{"height":"190","title":"\u7b2c25\u56de XML\u5916\u90e8\u30a8\u30f3\u30c6\u30a3\u30c6\u30a3\uff08XXE\uff09\uff1a\u5b9f\u969b\u306e\u78ba\u8a8d\u65b9\u6cd5","categories":["Bug Bounty Bootcamp"],"version":"1.0","author_url":"https://blog.hatena.ne.jp/ThisIsOne/","description":"Hello there, ('\u03c9')\u30ce XML\u3068\u306f\uff1f \u30c7\u30fc\u30bf\u306e\u3084\u308a\u3068\u308a\u306b\u4f7f\u308f\u308c\u308b\u5f62\u5f0f JSON\u3068\u4e26\u3093\u3067\u696d\u52d9\u30b7\u30b9\u30c6\u30e0\u3067\u3088\u304f\u4f7f\u308f\u308c\u307e\u3059 \u4f8b\uff1a <?xml version=\"1.0\"?> <user> <name>\u5c71\u7530</name> </user> \u3053\u306e\u3088\u3046\u306a\u5f62\u306e\u30c7\u30fc\u30bf\u3067\u3059\u3002 XXE\u304c\u767a\u751f\u3059\u308b\u30d1\u30bf\u30fc\u30f3\u3068\u306f\uff1f XML\u30d5\u30a1\u30a4\u30eb\u3092\u53d7\u3051\u53d6\u3063\u3066\u89e3\u6790\u3059\u308b\u30b7\u30b9\u30c6\u30e0 \u30d5\u30a1\u30a4\u30eb\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u6a5f\u80fd API\u9023\u643a\u306a\u3069 \u7279\u306b\u6b21\u306e\u3088\u3046\u306a\u5834\u5408\u306b\u6ce8\u610f\uff1a \u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\uff1a\u8acb\u6c42\u66f8XML\u3084\u7533\u8acb\u66f8XML API\uff1aXML\u5f62\u5f0f\u3067\u30c7\u30fc\u30bf\u3092POST \u306a\u305c\u5371\u967a\u306a\u306e\u304b\uff1f \u653b\u6483\u8005\u306f\u6b21\u306e\u3088\u3046\u306a\u7d30\u5de5\u3092\u3057\u307e\u3059\uff1a <?xml version=\"1.0\"?> <!D\u2026","provider_url":"https://hatena.blog","author_name":"ThisIsOne","width":"100%","url":"https://cysec148.hatenablog.com/entry/2025/07/20/155559","html":"<iframe src=\"https://hatenablog-parts.com/embed?url=https%3A%2F%2Fcysec148.hatenablog.com%2Fentry%2F2025%2F07%2F20%2F155559\" title=\"\u7b2c25\u56de XML\u5916\u90e8\u30a8\u30f3\u30c6\u30a3\u30c6\u30a3\uff08XXE\uff09\uff1a\u5b9f\u969b\u306e\u78ba\u8a8d\u65b9\u6cd5 - Shikata Ga Nai\" class=\"embed-card embed-blogcard\" scrolling=\"no\" frameborder=\"0\" style=\"display: block; width: 100%; height: 190px; max-width: 500px; margin: 10px 0px;\"></iframe>","image_url":null,"published":"2025-07-20 15:55:59","provider_name":"Hatena Blog","blog_url":"https://cysec148.hatenablog.com/","blog_title":"Shikata Ga Nai","type":"rich"}