c0ny1 / xxe-lab Goto Github PK

View Code? Open in Web Editor NEW

763.0 12.0 177.0 1.47 MB

一个包含php,java,python,C#等各种语言版本的XXE漏洞Demo

License: GNU General Public License v3.0

Python 98.25% ASP.NET 0.03% HTML 1.72%

php-xxe-demo python-xxe-demo java-xxe-demo csharp-xxe-demo

xxe-lab's People

Contributors

Stargazers

Watchers

Forkers

dr0ple7 popmedd h3ll0w0lrd bit4woo b1gw00d j4ckzh0u rh2002 fromcl pa55w0rd atmaxhub fate93930 flagiamfree greatspider135 c3stbon nazicc zhonghaoling rudrasingh99 arongmh heiye007 diaodiaofly nahtnahs mo-xiaoxi hackpanda jywah yaxuan404 xsr7yer junefreemore n8v79a lordsky godminer qsdj darknight-666 dongwgnod f8syw5v piggypage imsebao spr1ngbr0ther snrt7 ai0tsec chirec hugefatsheep cream-sec conanjun freeide z3r023 djiangliu yunjiaxiaojiu dawnadvent helinze cs4745 godepic crackercat imulmul richard6666 yizhimanpadewoniu jarzn ylcangel dingafter niro001 dyanday he1lif3 attackgithub yut0u tkitn f19t w1one alan920 h1iba1 numanturle unitary-orz duxin2020286 chenjiewei123 ghostaatrox leo-jo huyanshuhan silver-birch-wawa jungle22 xblancnfj dnslog95 shubhamgupta0x0 guojiale-del 5l1v3r1 qiaobd jinlongdesigner shuitianyise m3g4byt3 javalangclass bunk3r lwzsoviet happygongzhuo monopole-zh polosec skyroot xiaoliangli1128 mxm-tools liuchuanpei123 seiriosalpha lddp anttutu okm404

xxe-lab's Issues

Maybe i do sth wrong... How to run the lab?

When i try to run it with java8 and tomcat 8, i'm sill getting this error:

[2021-02-15 11:34:41,269] Artifact xxe-1.0-SNAPSHOT.jar: Error during artifact deployment. See server log for details.
		at com.sun.jmx.interceptor.DefaultMBeanServerInterceptor.invoke(DefaultMBeanServerInterceptor.java:819)
		at com.sun.jmx.mbeanserver.JmxMBeanServer.invoke(JmxMBeanServer.java:801)
		at org.apache.catalina.mbeans.MBeanFactory.createStandardContext(MBeanFactory.java:482)
		at org.apache.catalina.mbeans.MBeanFactory.createStandardContext(MBeanFactory.java:431)
		at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
		at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
		at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
		at java.lang.reflect.Method.invoke(Method.java:498)
		at org.apache.tomcat.util.modeler.BaseModelMBean.invoke(BaseModelMBean.java:286)
		at com.sun.jmx.interceptor.DefaultMBeanServerInterceptor.invoke(DefaultMBeanServerInterceptor.java:819)
		at com.sun.jmx.mbeanserver.JmxMBeanServer.invoke(JmxMBeanServer.java:801)
		at com.sun.jmx.remote.security.MBeanServerAccessController.invoke(MBeanServerAccessController.java:468)
		at javax.management.remote.rmi.RMIConnectionImpl.doOperation(RMIConnectionImpl.java:1468)
		at javax.management.remote.rmi.RMIConnectionImpl.access$300(RMIConnectionImpl.java:76)
		at javax.management.remote.rmi.RMIConnectionImpl$PrivilegedOperation.run(RMIConnectionImpl.java:1309)
		at java.security.AccessController.doPrivileged(Native Method)
		at javax.management.remote.rmi.RMIConnectionImpl.doPrivilegedOperation(RMIConnectionImpl.java:1408)
		at javax.management.remote.rmi.RMIConnectionImpl.invoke(RMIConnectionImpl.java:829)
		at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
		at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
		at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
		at java.lang.reflect.Method.invoke(Method.java:498)
		at sun.rmi.server.UnicastServerRef.dispatch(UnicastServerRef.java:357)
		at sun.rmi.transport.Transport$1.run(Transport.java:200)
		at sun.rmi.transport.Transport$1.run(Transport.java:197)
		at java.security.AccessController.doPrivileged(Native Method)
		at sun.rmi.transport.Transport.serviceCall(Transport.java:196)
		at sun.rmi.transport.tcp.TCPTransport.handleMessages(TCPTransport.java:573)
		at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run0(TCPTransport.java:834)
		at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.lambda$run$0(TCPTransport.java:688)
		at java.security.AccessController.doPrivileged(Native Method)
		at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run(TCPTransport.java:687)
		at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
		at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
		at java.lang.Thread.run(Thread.java:748)
	Caused by: java.lang.IllegalStateException: ContainerBase.addChild: start: org.apache.catalina.LifecycleException: Failed to start component [org.apache.catalina.webresources.StandardRoot@5d21833b]
		at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:747)
		at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:719)
		at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:705)
		at org.apache.catalina.startup.HostConfig.manageApp(HostConfig.java:1663)
		at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
		at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
		at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
		at java.lang.reflect.Method.invoke(Method.java:498)
		at org.apache.tomcat.util.modeler.BaseModelMBean.invoke(BaseModelMBean.java:286)
		... 35 more

What is a normal way to run this examples?

C#版本注入获取文件信息失败

String xmlData ="<!DOCTYPE a[<!ENTITY xxe SYSTEM \"file:///D:/log.txt\">]>" + "<user><username>&xxe;</username><password>admin</password></user>";

直接在代码中写这个执行LoadXml 无法返回xxe
使用doc获取到对应的节点内容是空的，也就是没有把文件内容读取出来存到对应的节点中
这是什么原因呢？.net修复了？

DOMDocument::loadXML(): StartTag: invalid element name in Entity, line: 1 尝试用file://伪协议读取的时候遇到了这个报错，是php版本的问题吗？

python的xxe环境在使用的时候报错

我在使用file协议读取任意文件的时候，返回的报文会提示“list index out of range”，请问这个是我python版本的问题吗？还是在使用环境的时候还有什么设置需要去做

Error: Invalid XML:

Fatal error: Uncaught Error: Class 'DOMDocument' not found in /var/www/html/doLogin.php:15
Stack trace:
#0 {main}
thrown in /var/www/html/doLogin.php on line 15

:parsererror

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.