{"id":479726,"date":"2023-08-09T10:43:58","date_gmt":"2023-08-09T10:43:58","guid":{"rendered":""},"modified":"2023-09-05T11:19:26","modified_gmt":"2023-09-05T11:19:26","slug":"xml-bomb","status":"publish","type":"wiki","link":"https:\/\/oneproxy.pro\/cn\/wiki\/xml-bomb\/","title":{"rendered":"XML\u70b8\u5f39"},"content":{"rendered":"<h2>\u4ecb\u7ecd<\/h2>\n<p>\u5728\u7f51\u7edc\u5b89\u5168\u9886\u57df\uff0c\u4e86\u89e3\u548c\u9632\u8303\u6f5c\u5728\u5a01\u80c1\u81f3\u5173\u91cd\u8981\u3002\u5728\u591a\u5e74\u6765\u51fa\u73b0\u7684\u4f17\u591a\u5a01\u80c1\u4e2d\uff0c\u201cXML \u70b8\u5f39\u201d\u4e00\u8bcd\u5df2\u58f0\u540d\u72fc\u85c9\uff0c\u6210\u4e3a\u4e00\u79cd\u5f3a\u5927\u4e14\u5177\u6709\u6f5c\u5728\u7834\u574f\u529b\u7684\u653b\u51fb\u5a92\u4ecb\u3002\u672c\u6587\u6df1\u5165\u63a2\u8ba8\u4e86 XML \u70b8\u5f39\u7684\u5386\u53f2\u3001\u673a\u5236\u3001\u7c7b\u578b\u3001\u5f71\u54cd\u548c\u672a\u6765\u524d\u666f\uff0c\u63ed\u793a\u4e86\u8fd9\u4e00\u795e\u79d8\u7684\u7f51\u7edc\u5a01\u80c1\u3002<\/p>\n<h2>\u8d77\u6e90\u548c\u65e9\u671f\u63d0\u53ca<\/h2>\n<p>XML \u70b8\u5f39\u7684\u6982\u5ff5\u6700\u65e9\u51fa\u73b0\u5728 2000 \u5e74\u4ee3\u521d\uff0c\u6e90\u4e8e XML\uff08\u53ef\u6269\u5c55\u6807\u8bb0\u8bed\u8a00\uff09\u56fa\u6709\u7684\u6f0f\u6d1e\u3002XML \u662f\u4e00\u79cd\u5e7f\u6cdb\u4f7f\u7528\u7684\u6784\u9020\u548c\u5b58\u50a8\u6570\u636e\u7684\u8bed\u8a00\uff0c\u5176\u8bbe\u8ba1\u65e2\u65b9\u4fbf\u4eba\u7c7b\u9605\u8bfb\uff0c\u4e5f\u65b9\u4fbf\u673a\u5668\u9605\u8bfb\u3002\u7136\u800c\uff0c\u8fd9\u4e00\u7279\u6027\u5374\u53ef\u80fd\u88ab\u5229\u7528\u6765\u521b\u5efa\u6076\u610f XML \u6587\u6863\uff0c\u5373\u6240\u8c13\u7684 XML \u70b8\u5f39\u3002<\/p>\n<h2>\u63ed\u5f00 XML \u70b8\u5f39\u7684\u9762\u7eb1<\/h2>\n<h3>\u7ed3\u6784\u548c\u529f\u80fd<\/h3>\n<p>XML \u70b8\u5f39\u5229\u7528 XML \u89e3\u6790\u7684\u9012\u5f52\u7279\u6027\u6765\u8fd0\u4f5c\u3002\u5b83\u7ecf\u8fc7\u7cbe\u5fc3\u8bbe\u8ba1\uff0c\u53ef\u5728 XML \u89e3\u6790\u5668\u4e2d\u5f15\u53d1\u62d2\u7edd\u670d\u52a1 (DoS) \u6216\u8d44\u6e90\u8017\u5c3d\u653b\u51fb\uff0c\u4ece\u800c\u5bfc\u81f4\u5176\u6d88\u8017\u8fc7\u591a\u7684\u8ba1\u7b97\u8d44\u6e90\u3002\u70b8\u5f39\u7684\u6076\u610f\u8d1f\u8f7d\u9690\u85cf\u5728\u5d4c\u5957\u7684 XML \u5b9e\u4f53\u5c42\u4e2d\uff0c\u5bfc\u81f4\u89e3\u6790\u5668\u9012\u5f52\u6269\u5c55\u8fd9\u4e9b\u5b9e\u4f53\uff0c\u76f4\u5230\u7cfb\u7edf\u8d44\u6e90\u5b8c\u5168\u8017\u5c3d\u3002<\/p>\n<h3>\u4e3b\u8981\u7279\u70b9\u4e0e\u5206\u6790<\/h3>\n<p>\u51e0\u4e2a\u5173\u952e\u7279\u5f81\u5b9a\u4e49\u4e86 XML \u70b8\u5f39\u7684\u884c\u4e3a\uff1a<\/p>\n<ol>\n<li>\n<p><strong>\u6307\u6570\u589e\u957f<\/strong>\uff1aXML\u70b8\u5f39\u968f\u7740\u6bcf\u5c42\u5d4c\u5957\u7684\u6269\u5927\u800c\u5448\u6307\u6570\u589e\u957f\uff0c\u6700\u7ec8\u8017\u5c3d\u76ee\u6807\u7cfb\u7edf\u7684\u5185\u5b58\u548cCPU\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u65e0\u9650\u5faa\u73af<\/strong>\uff1a\u9012\u5f52\u6269\u5c55\u4f1a\u5bfc\u81f4\u65e0\u9650\u5faa\u73af\u7684\u60c5\u51b5\uff0c\u4ece\u800c\u963b\u6b62\u89e3\u6790\u5668\u5904\u7406\u8fdb\u4e00\u6b65\u8f93\u5165\u7684\u80fd\u529b\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u7d27\u51d1\u8868\u793a<\/strong>\uff1aXML \u70b8\u5f39\u901a\u5e38\u4f53\u79ef\u8f83\u5c0f\uff0c\u56e0\u6b64\u5f88\u96be\u901a\u8fc7\u7b80\u5355\u7684\u57fa\u4e8e\u5c3a\u5bf8\u7684\u8fc7\u6ee4\u5668\u8fdb\u884c\u68c0\u6d4b\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u8d44\u6e90\u67af\u7aed<\/strong>\uff1aXML\u70b8\u5f39\u7684\u6700\u7ec8\u76ee\u7684\u662f\u8017\u5c3d\u7cfb\u7edf\u8d44\u6e90\uff0c\u5bfc\u81f4\u7cfb\u7edf\u8fd0\u884c\u7f13\u6162\u751a\u81f3\u5d29\u6e83\u3002<\/p>\n<\/li>\n<\/ol>\n<h2>XML\u70b8\u5f39\u7684\u79cd\u7c7b<\/h2>\n<p>XML \u70b8\u5f39\u6709\u591a\u79cd\u7c7b\u578b\uff0c\u6bcf\u79cd\u7c7b\u578b\u90fd\u6709\u81ea\u5df1\u7684\u7279\u70b9\u548c\u6f5c\u5728\u7834\u574f\u7a0b\u5ea6\u3002\u4e0b\u8868\u6982\u8ff0\u4e86\u5e38\u89c1\u7684 XML \u70b8\u5f39\u7c7b\u578b\uff1a<\/p>\n<table>\n<thead>\n<tr>\n<th>XML \u70b8\u5f39\u7c7b\u578b<\/th>\n<th>\u63cf\u8ff0<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\u5341\u4ebf\u7b11\u58f0<\/td>\n<td>\u5229\u7528\u5d4c\u5957\u5b9e\u4f53\u5f15\u7528\u6765\u521b\u5efa\u6307\u6570\u5b9e\u4f53\u589e\u957f\u3002<\/td>\n<\/tr>\n<tr>\n<td>\u4e8c\u6b21\u7206\u7834<\/td>\n<td>\u901a\u8fc7\u4f7f\u7528\u5d4c\u5957\u5143\u7d20\u548c\u5185\u90e8\u5b50\u96c6\u6765\u6269\u5927\u5b9e\u4f53\u6269\u5c55\u3002<\/td>\n<\/tr>\n<tr>\n<td>\u591a\u9879\u5f0f\u7206\u7834<\/td>\n<td>\u6784\u9020\u6df1\u5ea6\u5d4c\u5957\u7684\u5143\u7d20\u6765\u5b9e\u73b0\u591a\u9879\u5f0f\u5b9e\u4f53\u589e\u957f\u3002<\/td>\n<\/tr>\n<tr>\n<td>\u81ea\u5b9a\u4e49\u6709\u6548\u8f7d\u8377<\/td>\n<td>\u4f7f\u7528\u7279\u5b9a\u5b9e\u4f53\u7cbe\u5fc3\u5236\u4f5c\u7684\u6709\u6548\u8f7d\u8377\u6765\u9488\u5bf9\u67d0\u4e9b\u6f0f\u6d1e\u3002<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>\u90e8\u7f72\u3001\u95ee\u9898\u548c\u89e3\u51b3\u65b9\u6848<\/h2>\n<p>XML \u70b8\u5f39\u7684\u4f7f\u7528\u5f15\u53d1\u4e86\u9053\u5fb7\u548c\u6cd5\u5f8b\u95ee\u9898\uff0c\u56e0\u4e3a\u5b83\u4eec\u53ef\u80fd\u88ab\u6076\u610f\u5229\u7528\u6765\u7834\u574f\u670d\u52a1\u5e76\u4fb5\u72af\u9690\u79c1\u3002\u5bf9\u7b56\u5305\u62ec\u8f93\u5165\u9a8c\u8bc1\u3001\u5b9e\u4f53\u6269\u5c55\u9650\u5236\u4ee5\u53ca\u53ef\u8bc6\u522b\u548c\u9632\u5fa1 XML \u70b8\u5f39\u7684\u66f4\u65b0\u89e3\u6790\u5668\u3002<\/p>\n<h2>XML \u70b8\u5f39\u4e0e\u76f8\u5173\u672f\u8bed<\/h2>\n<p>\u4e3a\u4e86\u66f4\u6e05\u695a\u5730\u8bf4\u660e XML \u70b8\u5f39\u4e0e\u76f8\u5173\u6982\u5ff5\u4e4b\u95f4\u7684\u533a\u522b\uff0c\u8bf7\u8003\u8651\u4ee5\u4e0b\u6bd4\u8f83\uff1a<\/p>\n<table>\n<thead>\n<tr>\n<th>\u5b66\u671f<\/th>\n<th>\u63cf\u8ff0<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>XML\u70b8\u5f39<\/td>\n<td>\u4e3a\u8017\u5c3d\u8d44\u6e90\u800c\u8bbe\u8ba1\u7684\u5229\u7528\u6027 XML \u6587\u6863\u3002<\/td>\n<\/tr>\n<tr>\n<td>\u62d2\u7edd\u670d\u52a1\u653b\u51fb<\/td>\n<td>\u6545\u610f\u901a\u8fc7\u65bd\u52a0\u538b\u529b\u6765\u7834\u574f\u670d\u52a1\u3002<\/td>\n<\/tr>\n<tr>\n<td>\u6076\u610f\u8f6f\u4ef6<\/td>\n<td>\u65e8\u5728\u9020\u6210\u635f\u5bb3\u3001\u5229\u7528\u6216\u83b7\u5f97\u672a\u7ecf\u6388\u6743\u7684\u8bbf\u95ee\u7684\u8f6f\u4ef6\u3002<\/td>\n<\/tr>\n<tr>\n<td>XSS \u653b\u51fb<\/td>\n<td>\u6ce8\u5165\u6076\u610f\u811a\u672c\u7684\u8de8\u7ad9\u70b9\u811a\u672c\u653b\u51fb\u3002<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>\u672a\u6765\u5c55\u671b\u548c XML \u70b8\u5f39\u76f8\u5173\u6280\u672f<\/h2>\n<p>XML \u70b8\u5f39\u9632\u5fa1\u7684\u672a\u6765\u6d89\u53ca\u589e\u5f3a\u7684\u89e3\u6790\u7b97\u6cd5\u3001\u5f02\u5e38\u68c0\u6d4b\u548c\u66f4\u667a\u80fd\u7684\u8d44\u6e90\u5206\u914d\u3002\u968f\u7740\u4eba\u5de5\u667a\u80fd\u548c\u673a\u5668\u5b66\u4e60\u7684\u53d1\u5c55\uff0c\u5148\u8fdb\u7684\u7cfb\u7edf\u53ef\u4ee5\u5b9e\u65f6\u8bc6\u522b\u548c\u6d88\u9664 XML \u70b8\u5f39\u3002<\/p>\n<h2>\u4ee3\u7406\u670d\u52a1\u5668\u548c XML \u70b8\u5f39\u7f13\u89e3<\/h2>\n<p>\u4ee3\u7406\u670d\u52a1\u5668\uff08\u5982 OneProxy \u63d0\u4f9b\u7684\u4ee3\u7406\u670d\u52a1\u5668\uff09\u5728\u7f13\u89e3 XML \u70b8\u5f39\u653b\u51fb\u65b9\u9762\u53d1\u6325\u7740\u91cd\u8981\u4f5c\u7528\u3002\u901a\u8fc7\u5145\u5f53\u5ba2\u6237\u7aef\u548c\u76ee\u6807\u670d\u52a1\u5668\u4e4b\u95f4\u7684\u4e2d\u4ecb\uff0c\u4ee3\u7406\u670d\u52a1\u5668\u53ef\u4ee5\u68c0\u67e5\u548c\u8fc7\u6ee4\u4f20\u5165\u7684 XML \u6d41\u91cf\uff0c\u4ee5\u67e5\u627e\u4efb\u4f55\u6076\u610f\u8d1f\u8f7d\u3002\u9ad8\u7ea7\u4ee3\u7406\u89e3\u51b3\u65b9\u6848\u7ed3\u5408\u4e86\u5a01\u80c1\u68c0\u6d4b\u673a\u5236\uff0c\u53ef\u8bc6\u522b\u548c\u963b\u6b62 XML \u70b8\u5f39\u653b\u51fb\uff0c\u786e\u4fdd\u5728\u7ebf\u670d\u52a1\u7684\u5b89\u5168\u6027\u548c\u8fde\u7eed\u6027\u3002<\/p>\n<h2>\u76f8\u5173\u94fe\u63a5<\/h2>\n<p>\u8981\u8fdb\u4e00\u6b65\u4e86\u89e3 XML \u70b8\u5f39\u53ca\u5176\u542b\u4e49\uff0c\u8bf7\u6d4f\u89c8\u4ee5\u4e0b\u8d44\u6e90\uff1a<\/p>\n<ul>\n<li><a href=\"https:\/\/www.w3.org\/XML\/\" target=\"_new\" rel=\"noopener nofollow\">W3C XML \u6807\u51c6<\/a><\/li>\n<li><a href=\"https:\/\/owasp.org\/www-project-web-security-testing-guide\/latest\/4-Web_Application_Security_Testing\/05-Input_Validation_Testing\/07-Testing_for_XML_External_Entity_(XXE)_Processing\" target=\"_new\" rel=\"noopener nofollow\">OWASP XML \u5916\u90e8\u5b9e\u4f53 (XXE) \u5904\u7406<\/a><\/li>\n<li><a href=\"https:\/\/csrc.nist.gov\/publications\/detail\/sp\/800-95\/final\" target=\"_new\" rel=\"noopener nofollow\">NIST XML \u5b89\u5168\u6307\u5357<\/a><\/li>\n<\/ul>\n<h2>\u7ed3\u8bba<\/h2>\n<p>\u7f51\u7edc\u5b89\u5168\u9886\u57df\u4e00\u76f4\u5728\u4e0e\u65b0\u5174\u5a01\u80c1\u4f5c\u6597\u4e89\uff0cXML \u70b8\u5f39\u5c31\u662f\u6076\u610f\u884c\u4e3a\u8005\u72e1\u733e\u624b\u6bb5\u7684\u660e\u8bc1\u3002\u4e86\u89e3\u8fd9\u79cd\u5a01\u80c1\u7684\u590d\u6742\u6027\u5bf9\u4e8e\u5236\u5b9a\u6709\u6548\u7684\u9632\u5fa1\u63aa\u65bd\u81f3\u5173\u91cd\u8981\u3002\u901a\u8fc7\u52a0\u5f3a\u89e3\u6790\u5668\u6280\u672f\u3001\u4fc3\u8fdb\u8d1f\u8d23\u4efb\u7684\u7f16\u7a0b\u4ee5\u53ca\u91c7\u7528\u4ee3\u7406\u670d\u52a1\u5668\u7b49\u9ad8\u7ea7\u5b89\u5168\u63aa\u65bd\uff0c\u6570\u5b57\u9886\u57df\u53ef\u4ee5\u51cf\u8f7b XML \u70b8\u5f39\u7684\u5f71\u54cd\u5e76\u52a0\u5f3a\u5176\u7f51\u7edc\u9632\u5fa1\u3002<\/p>","protected":false},"featured_media":479727,"menu_order":0,"template":"","meta":{"_acf_changed":false,"content-type":"","inline_featured_image":false,"footnotes":""},"class_list":["post-479726","wiki","type-wiki","status-publish","has-post-thumbnail","hentry"],"acf":{"faq_title":"Frequently Asked Questions about <mark>XML Bomb: Unraveling the Intricacies of a Cyber Threat<\/mark>","faq_items":[{"question":"What is an XML bomb?","answer":"<p>An XML bomb is a maliciously crafted XML document designed to exploit the recursive nature of XML parsing. It aims to overwhelm an XML parser, consuming excessive resources and causing a denial of service (DoS) or resource exhaustion attack.<\/p>"},{"question":"How does an XML bomb work?","answer":"<p>An XML bomb hides its payload within layers of nested XML entities. When the XML parser processes these entities, it recursively expands them, leading to exponential growth and resource consumption. This ultimately results in system slowdowns or crashes.<\/p>"},{"question":"What are the key features of an XML bomb?","answer":"<p>Key features of an XML bomb include its exponential growth, ability to create infinite loops, compact size, and resource exhaustion tactics. These characteristics collectively make it a potent and challenging cyber threat.<\/p>"},{"question":"What are the types of XML bombs?","answer":"<p>There are several types of XML bombs, including:<\/p><ul><li><strong>Billion Laughs:<\/strong> Uses nested entity references for exponential growth.<\/li><li><strong>Quadratic Blowup:<\/strong> Inflates expansion using nested elements and internal subsets.<\/li><li><strong>Polynomial Blowup:<\/strong> Constructs deeply nested elements for polynomial growth.<\/li><li><strong>Custom Payloads:<\/strong> Crafted payloads to exploit specific vulnerabilities.<\/li><\/ul>"},{"question":"How can XML bombs be mitigated?","answer":"<p>XML bomb mitigation involves:<\/p><ul><li>Implementing input validation to filter out malicious payloads.<\/li><li>Setting entity expansion limits to prevent exponential growth.<\/li><li>Employing updated parsers that recognize and defend against XML bombs.<\/li><\/ul>"},{"question":"What is the future outlook for XML bombs?","answer":"<p>The future involves enhanced parsing algorithms, AI-driven detection, and real-time neutralization of XML bombs. Advances in technology aim to strengthen defenses against this cyber threat.<\/p>"},{"question":"How do proxy servers relate to XML bomb defense?","answer":"<p>Proxy servers, like OneProxy, play a crucial role in XML bomb defense. They act as intermediaries, inspecting and filtering incoming XML traffic for malicious payloads. Proxy solutions incorporate threat detection mechanisms to block XML bomb attempts, ensuring online service security.<\/p>"},{"question":"Where can I learn more about XML bombs?","answer":"<p>For further information, you can explore these resources:<\/p><ul><li><a href=\"https:\/\/www.w3.org\/XML\/\" target=\"_new\">W3C XML Standard<\/a><\/li><li><a href=\"https:\/\/owasp.org\/www-project-web-security-testing-guide\/latest\/4-Web_Application_Security_Testing\/05-Input_Validation_Testing\/07-Testing_for_XML_External_Entity_(XXE)_Processing\" target=\"_new\">OWASP XML External Entity (XXE) Processing<\/a><\/li><li><a href=\"https:\/\/csrc.nist.gov\/publications\/detail\/sp\/800-95\/final\" target=\"_new\">NIST Guidelines on XML Security<\/a><\/li><\/ul>"}]},"_links":{"self":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/wiki\/479726","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/wiki"}],"about":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/types\/wiki"}],"version-history":[{"count":0,"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/wiki\/479726\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/media\/479727"}],"wp:attachment":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/media?parent=479726"}],"curies":[{"name":"\u53ef\u6e7f\u6027\u7c89\u5242","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}