{"id":2128,"date":"2025-03-24T20:24:25","date_gmt":"2025-03-24T12:24:25","guid":{"rendered":"http:\/\/gzxingyu.cloud\/?p=2128"},"modified":"2025-03-24T20:24:26","modified_gmt":"2025-03-24T12:24:26","slug":"01-xml%e5%9f%ba%e7%a1%80","status":"publish","type":"post","link":"http:\/\/gzxingyu.cloud\/index.php\/2025\/03\/24\/01-xml%e5%9f%ba%e7%a1%80\/","title":{"rendered":"01.XML\u57fa\u7840"},"content":{"rendered":"

\u4e00\u3001XML\u7b80\u4ecb<\/h1>\n

XML\uff08\u53ef\u6269\u5c55\u6807\u8bb0\u8bed\u8a00\uff09\u662f\u4e00\u79cd\u7528\u4e8e\u5b58\u50a8\u548c\u4f20\u8f93\u6570\u636e\u7684\u6807\u8bb0\u8bed\u8a00\uff0c\u5176\u8bbe\u8ba1\u5b97\u65e8\u662f\u4f20\u8f93\u6570\u636e\uff0c\u800c\u975e\u663e\u793a\u6570\u636e\u3002<\/p>\n

\u4e8c\u3001XML\u7684\u7ec4\u6210\u90e8\u5206<\/h1>\n

XML\u7684\u6587\u6863\u7ed3\u6784\u5305\u542b\u4ee5\u4e0b\u51e0\u79cd
\n1\u3001XML\u58f0\u660e
\n\/\/\u793a\u4f8b: <?xml version="1.0" encoding="UTF-8"?><\/code>
\n2\u3001DTD\u6587\u6863\u7c7b\u578b\u5b9a\u4e49\uff08\u53ef\u9009\uff09\uff1aDTD\u6587\u6863\u7c7b\u578b\u5b9a\u4e49\u662f\u4e00\u5957\u4e3a\u4e86\u8fdb\u884c\u7a0b\u5e8f\u89c1\u7684\u6570\u636e\u4ea4\u6362\u800c\u5efa\u7acb\u7684\u5173\u4e8e\u6807\u8bb0\u7b26\u7684\u8bed\u6cd5
\n\u89c4\u5219
\n3\u3001\u6587\u6863\u5143\u7d20<\/p>\n

XML\u7684\u6784\u5efa\u6a21\u5757\u7ec4\u6210\u4e0eHTML\u7c7b\u4f3c\uff0c\u7531\u4e0b\u9762\u51e0\u79cd\u7ec4\u6210\uff1a<\/p>\n

\u5143\u7d20\uff1aXML\u6587\u6863\u7684\u4e3b\u8981\u6784\u5efa\u6a21\u5757\uff0c\u53ef\u5305\u542b\u6587\u672c\u5185\u5bb9\n\/ \/\u793a\u4f8b:<username>quan9i<\/username>\n\n\u5c5e\u6027\uff1a\u63d0\u4f9b\u5143\u7d20\u7684\u989d\u5916\u4fe1\u606f\n\/\/\u793a\u4f8b\uff1a<img src="1.jpg"\/> src\u5c31\u662f\u5c5e\u6027\n\n\u5b9e\u4f53\uff1a\u5b9e\u4f53\u662f\u7528\u6765\u5b9a\u4e49\u666e\u901a\u6587\u672c\u7684\u53d8\u91cf\u3002\u5b9e\u4f53\u5f15\u7528\u662f\u5bf9\u5b9e\u4f53\u7684\u5f15\u7528\u3002\nPCDATA(parsed character data\uff09:\u88ab\u89e3\u6790\u7684\u5b57\u7b26\u6570\u636e\nps:PCDATA \u662f\u4f1a\u88ab\u89e3\u6790\u5668\u89e3\u6790\u7684\u6587\u672c\u3002\u8fd9\u4e9b\u6587\u672c\u5c06\u88ab\u89e3\u6790\u5668\u68c0\u67e5\u5b9e\u4f53\u4ee5\u53ca\u6807\u8bb0\u3002\nCDATA(character data):\u5b57\u7b26\u6570\u636e\nps:CDATA \u662f\u4e0d\u4f1a\u88ab\u89e3\u6790\u5668\u89e3\u6790\u7684\u6587\u672c\u3002\n<\/code><\/pre>\n
\u4e09\u3001XML\u8bed\u6cd5\u89c4\u5219<\/h1>\n
1.\u6240\u6709XML\u5143\u7d20\u90fd\u987b\u6709\u5173\u95ed\u6807\u7b7e\u3002
\n2.XML\u6807\u7b7e\u5bf9\u5927\u5c0f\u5199\u654f\u611f\u3002
\n3.XML\u5fc5\u987b\u6b63\u786e\u5730\u5d4c\u5957\u3002
\n4.XML\u6587\u6863\u5fc5\u987b\u6709\u6839\u5143\u7d20\u3002
\n5.XML\u7684\u5c5e\u6027\u503c\u987b\u52a0\u5f15\u53f7\u3002
\n6.\u5b9e\u4f53\u5f15\u7528\uff1a\u5728\u6807\u7b7e\u5c5e\u6027\uff0c\u4ee5\u53ca\u5bf9\u5e94\u7684\u4f4d\u7f6e\u503c\u53ef\u80fd\u4f1a\u51fa\u73b0<\u3001>\u7b26\u53f7\uff0c\u4f46\u662f\u8fd9\u4e9b\u7b26\u53f7\u5728\u5bf9\u5e94\u7684XML\u4e2d
\n\u90fd\u662f\u6709\u7279\u6b8a\u542b\u4e49\u7684\uff0c\u8fd9\u65f6\u5019\u6211\u4eec\u5fc5\u987b\u4f7f\u7528\u5bf9\u5e94\u7684HTML\u5b9e\u4f53\u6765\u8868\u793a\uff0c\u6bd4\u5982\uff1a<\u7b26\u53f7\u5bf9\u5e94\u7684\u5b9e\u4f53\u5c31\u662f
\n<
\n7\u3001\u5728xML\u4e2d\uff0c\u7a7a\u683c\u4f1a\u88ab\u4fdd\u7559\uff0c\u6bd4\u5982\uff1a<p>aa\u7a7a\u683cbb<\/p><\/code> \uff0c\u8fd9\u4e2a\u7a7a\u683c\u4f1a\u88ab\u4fdd\u7559<\/p>\n
<?xml version="1.0" encoding="UTF-8"?> <!--xml\u6587\u4ef6\u7684\u58f0\u660e-->\n<tttang>                               <!--\u6839\u5143\u7d20-->\n<article category="CTF">               <!--tttang\u7684\u5b50\u5143\u7d20\uff0ccategory\u4e3a\u5c5e\u6027-->\n<title>XXE<\/title>                     <!--article\u7684\u5b50\u5143\u7d20-->\n<author>quan9i<\/author>                <!--article\u7684\u5b50\u5143\u7d20-->\n<year>2022<\/year>                      <!--article\u7684\u5b50\u5143\u7d20-->\n<data>8.20<\/data>                      <!--article\u7684\u5b50\u5143\u7d20-->\n<\/article>                             <!--article\u7684\u7ed3\u675f-->\n<\/tttang>                              <!--tttang\u7684\u7ed3\u675f-->\n<\/code><\/pre>\n
\"Pasted<\/p>\n
\u56db\u3001DTD<\/h1>\n
\u6587\u6863\u7c7b\u578b\u5b9a\u4e49\uff08DTD\uff09\uff0c\u7528\u4e8e\u5b9a\u4e49 XML \u6587\u6863\u7684\u7ed3\u6784\u3001\u5143\u7d20\u548c\u5c5e\u6027\u3002\u5b83\u4f7f\u7528\u4e00\u7cfb\u5217\u5408\u6cd5\u7684\u5143\u7d20\u6765\u5b9a\u4e49\u6587\u6863\u7684\u7ed3\u6784\uff0c\u7ea6\u675f\u4e86 xml\u6587\u6863\u7684\u7ed3\u6784\u3002DTD\u53ef\u88ab\u6210\u884c\u5730\u58f0\u660e\u4e8e XML \u6587\u6863\u4e2d\uff0c\u4e5f\u53ef\u4f5c\u4e3a\u4e00\u4e2a\u5916\u90e8\u5f15\u7528\u3002<\/p>\n
1.\u5185\u90e8\u5f15\u7528<\/h2>\n
\u683c\u5f0f\uff1a<\/p>\n
<!DOCTYPE \u6839\u5143\u7d20[\u5b9a\u4e49\u5185\u5bb9]>\n<\/code><\/pre>\n
\u793a\u4f8b\uff1a<\/p>\n
<?xml version="1.0"?> <!--XML\u58f0\u660e -->\n<!DOCTYPE note [ <!--\u5b9a\u4e49\u4e86note\u5143\u7d20-->\n  <!ELEMENT note (to,from,heading,body)> <!--\u5b9a\u4e49note\u5143\u7d20\u4e0b\u7684\u56db\u4e2a\u5143\u7d20-->\n  <!ELEMENT to      (#PCDATA)> <!--\u5b9a\u4e49\u4e86note\u7684\u5b50\u5143\u7d20to\uff0c\uff08#PCDATA)\u8868\u793a\u5143\u7d20to\u662f\u5b57\u7b26\u4e32\u5f62\u5f0f-->\n  <!ELEMENT from    (#PCDATA)> <!--\u5b9a\u4e49\u4e86note\u7684\u5b50\u5143\u7d20from\uff0c\uff08#PCDATA)\u8868\u793a\u5143\u7d20from\u662f\u5b57\u7b26\u4e32\u5f62\u5f0f-->\n  <!ELEMENT heading (#PCDATA)> <!--\u5b9a\u4e49\u4e86note\u7684\u5b50\u5143\u7d20heading\uff0c(#PCDATA)\u8868\u793a\u5143\u7d20heading\u662f\u5b57\u7b26\u4e32\u5f62\u5f0f-->\n  <!ELEMENT body    (#PCDATA)> <!--\u5b9a\u4e49\u4e86note\u7684\u5b50\u5143\u7d20body\uff0c\uff08#PCDATA)\u8868\u793a\u5143\u7d20body\u662f\u5b57\u7b26\u4e32\u5f62\u5f0f-->\n]>\n<!-- \u81f3\u6b64\uff0c\u4e0a\u65b9\u662fDTD\u6587\u6863\u5b9a\u4e49-->\n<note>\n<to>quan9i<\/to>\n<from>is<\/from>\n<heading>a<\/heading>\n<body>web xiao bai!<\/body>\n<\/note>\n<\/code><\/pre>\n
\"Pasted<\/p>\n
2.\u5916\u90e8\u5f15\u7528<\/h2>\n
\u683c\u5f0f\uff1a<\/p>\n
<!DOCTYPE \u6839\u5143\u7d20 SYSTEM "DTD\u6587\u4ef6\u8def\u5f84">\n<\/code><\/pre>\n
\u793a\u4f8b\uff1a<\/p>\n
<?xml version="1.0"?>\n<!DOCTYPE note SYSTEM "note.dtd">\n<note>\n<to>quan9i<\/to>\n<from>is<\/from>\n<heading>a<\/heading>\n<body>web xiao bai!<\/body>\n<\/note>\n<\/code><\/pre>\n
note.dtd\u6587\u4ef6\u7684\u5185\u5bb9\u5982\u4e0b\uff1a<\/p>\n
<!DOCTYPE note [\n<!ELEMENT note (to,from,heading,body)>\n<!ELEMENT to      (#PCDATA)>\n<!ELEMENT from    (#PCDATA)>\n<!ELEMENT heading (#PCDATA)>\n<!ELEMENT body    (#PCDATA)>\n]>\n<\/code><\/pre>\n
\"Pasted<\/p>\n
\u4e94\u3001DTD\u5b9e\u4f53<\/h1>\n
DTD\u5b9e\u4f53\u662f\u7528\u4e8e\u5b9a\u4e49\u5f15\u7528\u666e\u901a\u6587\u672c\u6216\u7279\u6b8a\u5b57\u7b26\u7684\u5feb\u6377\u65b9\u5f0f\u7684\u53d8\u91cf\uff0c\u53ef\u4ee5\u5185\u90e8\u58f0\u660e\u6216\u5916\u90e8\u5f15\u7528<\/p>\n
\u4e00\u822c\u5b9e\u4f53\uff1a\n\u5b9a\u4e49\uff1a<!ENTITY \u5b9e\u4f53\u540d\u79f0 "\u5b9e\u4f53\u5185\u5bb9">\n\u8c03\u7528\uff1a&\u5b9e\u4f53\u540d\u79f0;\n\n\u53c2\u6570\u5b9e\u4f53\uff1a\n\u5b9a\u4e49\uff1a<!ENTITY % \u5b9e\u4f53\u540d "\u5b9e\u4f53\u5185\u5bb9">\n\u8c03\u7528\uff1a%\u5b9e\u4f53\u540d\u79f0;\n<\/code><\/pre>\n
1.\u5185\u90e8\u5b9e\u4f53<\/h2>\n
\u683c\u5f0f\uff1a<\/p>\n
<!ENTITY \u5b9e\u4f53\u540d\u79f0 "\u5b9e\u4f53\u7684\u503c">\n<\/code><\/pre>\n
\u793a\u4f8b\uff1a<\/p>\n
<?xml version="1.0"?>\n<!DOCTYPE test [\n    <!ENTITY article "XXE">\n    <!ENTITY author "quan9i">\n]>\n<test><article>&article;<\/article><author>&author;<\/author><\/test>\n<\/code><\/pre>\n
\"Pasted<\/p>\n
2.\u5916\u90e8\u5b9e\u4f53<\/h2>\n
\u683c\u5f0f\uff1a<\/p>\n
<!ENTITY \u5b9e\u4f53\u540d\u79f0 SYSTEM "URI\/URL">\n\u6216\u8005\n<!ENTITY \u5b9e\u4f53\u540d\u79f0 PUBLIC "public_ID" "URI">\n<\/code><\/pre>\n
\u793a\u4f8b\uff1a<\/p>\n
<?xml version="1.0"?>\n<!DOCTYPE test [\n    <!ENTITY author SYSTEM "1.xm1">\n]>\n<test>&author;<\/test>\n<\/code><\/pre>\n
\u5916\u90e8\u5b9e\u4f53\u540c\u65f6\u8fd8\u652f\u6301\u5176\u4ed6\u534f\u8bae\uff1a
\nfile\u3001http\u3001https\u3001ftp<\/p>\n
\u5b9e\u9645\u4f8b\u5b50\uff1a<\/p>\n
<?xml version = "1.0"encoding = "utf-8"?>\n<!DOCTYPE test [\n    <!ENTITY file SYSTEM "file:\/\/\/etc\/passwd">\n]>\n<test>&file;<\/test>\n<\/code><\/pre>\n
\u53c2\u6570\u5b9e\u4f53\uff1a<\/p>\n
<?xml version="1.0"?>\n<!DOCTYPE test [\n<!ENTITY % file SYSTEM "file:\/\/\/etc\/passwd">\n%file;\n]>\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
\u4e00\u3001XML\u7b80\u4ecb XML\uff08\u53ef\u6269\u5c55\u6807\u8bb0\u8bed\u8a00\uff09\u662f\u4e00\u79cd\u7528\u4e8e\u5b58\u50a8\u548c\u4f20\u8f93\u6570\u636e\u7684\u6807\u8bb0\u8bed\u8a00\uff0c\u5176\u8bbe\u8ba1\u5b97\u65e8\u662f\u4f20\u8f93\u6570\u636e\uff0c\u800c\u975e\u663e\u793a\u6570\u636e […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,20],"tags":[],"class_list":["post-2128","post","type-post","status-publish","format-standard","hentry","category-web","category-xxe"],"_links":{"self":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/2128","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/comments?post=2128"}],"version-history":[{"count":1,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/2128\/revisions"}],"predecessor-version":[{"id":2129,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/2128\/revisions\/2129"}],"wp:attachment":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/media?parent=2128"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/categories?post=2128"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/tags?post=2128"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}