XXE XML Entity Injection

1. Popular Science

Entity entities
To use a piece of data frequently in one or more XML documents, we can pre-define an "alias" of the data, an entity, and then call it where it is needed in those documents.
XML defines two types of entity, one used in an XML document, and the other as a parameter in a DTD file.
Definition syntax for entity:

    <! DOCTYPE  file name [
    <! Entity  entity Name "entities Content" >
    ]>

2. Harm

XML entity can read external files, in fact, the entity function is equivalent to defining global variables and referencing external files

<! DOCTYPE NetSPI [<! ENTITY XXe SYSTEM "file:///xxxx" >]> referencing external files
<! DOCTYPE NetSPI [<! ENTITY XXe "Hello" >]> global variables

In general, asynchronous Web sites will have asynchronous data to interact with the server, generally transmitting data as JSON, but if the transferred data format is changed to XML. There is a great possibility that the server will parse your asynchronous uploaded XML script to do what you want to do 3. A CTF topic

Api

The purpose is to obtain/home/ctf/flag.txt's content clearly
The following analysis source

<script> function XHR () {var XHR;
        try {xhr = new XMLHttpRequest ();}
            catch (e) {var iexhrvers =["Msxml3.xmlhttp", "Msxml2.xmlhttp", "Microsoft.XMLHTTP"];
                for (var i=0,len=iexhrvers.length;i< len;i++) {try {xhr = new ActiveXObject (Iexhrvers[i]);}
            catch (e) {continue;}
    }} return XHR;
 } function Send () {evil_input = document.getElementById ("Evil-input"). Value;
     var xhr = XHR ();
     Xhr.open ("Post", "/api/v1.0/try", true); Xhr.onreadystatechange = function () {if (xhr.readystate==4 && xhr.status==201) {data = JS
             On.parse (Xhr.responsetext);
             Tip_area = document.getElementById ("Tip-area");
         Tip_area.value = Data.task.search+data.task.value;
     }
     };
     Xhr.setrequestheader ("Content-type", "Application/json");
Xhr.send (' {"" Search ":" ' +evil_input+ ' "," value ":" Own "} '); } </script> is obviously Ajax asynchronously transmitting data

Grab the bag with Burpsuit

Obviously, we need to modify Content-type first.
Then add the XML script to