1 2 3 4 5 6 7 8 9 10 11 12
| __construct() __wakeup() __toString() __destruct() __invoke() __set() __get() __unset() __call() __callStatic() __clone()
|
内置类:
SoapClient::__call
可进行SSRF
range:PHP 5, PHP 7, PHP 8
SOAP(简单对象访问协议)是连接或Web服务或客户端和Web服务之间的接口。
其采用HTTP作为底层通讯协议,XML作为数据传送的格式,仅限于http/https协议
SOAP消息基本上是从发送端到接收端的单向传输,但它们常常结合起来执行类似于请求 / 应答的模式。
如果想要使用SoapClient类需要在php.ini配置文件里面开启extension=php_soap.dll选项
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66
| class SoapClient {
private ?string $uri = null; private ?int $style = null; private ?int $use = null; private ?string $location = null; private bool $trace = false; private ?int $compression = null; private ?resource $sdl = null; private ?resource $typemap = null; private ?resource $httpsocket = null; private ?resource $httpurl = null; private ?string $_login = null; private ?string $_password = null; private bool $_use_digest = false; private ?string $_digest = null; private ?string $_proxy_host = null; private ?int $_proxy_port = null; private ?string $_proxy_login = null; private ?string $_proxy_password = null; private bool $_exceptions = true; private ?string $_encoding = null; private ?array $_classmap = null; private ?int $_features = null; private int $_connection_timeout; private ?resource $_stream_context = null; private ?string $_user_agent = null; private bool $_keep_alive = true; private ?int $_ssl_method = null; private int $_soap_version; private ?int $_use_proxy = null; private array $_cookies = []; private ?array $__default_headers = null; private ?SoapFault $__soap_fault = null; private ?string $__last_request = null; private ?string $__last_response = null; private ?string $__last_request_headers = null; private ?string $__last_response_headers = null;
public __construct(?string $wsdl, array $options = []) public __call(string $name, array $args): mixed public __doRequest( string $request, string $location, string $action, int $version, bool $oneWay = false ): ?string public __getCookies(): array public __getFunctions(): ?array public __getLastRequest(): ?string public __getLastRequestHeaders(): ?string public __getLastResponse(): ?string public __getLastResponseHeaders(): ?string public __getTypes(): ?array public __setCookie(string $name, ?string $value = null): void public __setLocation(?string $location = null): ?string public __setSoapHeaders(SoapHeader|array|null $headers = null): bool public __soapCall( string $name, array $args, ?array $options = null, SoapHeader|array|null $inputHeaders = null, array &$outputHeaders = null ): mixed }
|
所以在脚本没有发现利用链时,我们可以利用内置类来利用漏洞。
补充一个知识点:对于PHP中的@符号,是用来屏蔽错误信息的。
(string)strlen()是强制类型转换
对象接口