解析XSLT服务器端注入攻击

Console.WriteLine("# This is a Vulnerable-by-Design application to test XSLT Injection #");

Console.WriteLine("# #");

Console.WriteLine("#####################################################################\n");

Console.WriteLine("The application expects (in the current working directory):");

Console.WriteLine(" - an XML file (data.xml) and\n - an XSLT style sheet (transform.xslt)\n");

Console.WriteLine("===================================================================");

String transformationXsltFileURI = "transform.xslt";

String dataXMLFileURI = "data.xml";

// Enable DTD processing to load external XML entities for both the XML and XSLT file

XmlReaderSettings vulnerableXmlReaderSettings = new XmlReaderSettings();

vulnerableXmlReaderSettings.DtdProcessing = DtdProcessing.Parse;

vulnerableXmlReaderSettings.XmlResolver = new XmlUrlResolver();

XmlReader vulnerableXsltReader = XmlReader.Create(transformationXsltFileURI, vulnerableXmlReaderSettings);

XmlReader vulnerableXmlReader = XmlReader.Create(dataXMLFileURI, vulnerableXmlReaderSettings);

XsltSettings vulnerableSettings = new XsltSettings();

// Embedded script blocks and the document() function are NOT enabled by default

vulnerableSettings.EnableDocumentFunction = true;

vulnerableSettings.EnableScript

　　推荐阅读

　　引入机器学习前需要先弄明白这三件事

很多公司声称本身的解决筹划中囊括了ML，但大年夜多半时刻，这项功能是被夸大年夜了的。钠揭捉?问供给商的问题，应落脚在他们体系的精确率、速度和效力上。分析的数据是大年夜哪儿来的?收集频率是多久一次?该解决筹>>>详细阅读

地址：http://www.17bianji.com/lsqh/39533.html