Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
All challenges
In progress
Web-18. XXE Attack via a Contact Form
Mission
This contact form serializes its input as XML and sends it to the server, which parses it and echoes the result. Depending on how the XML parser is configured, unexpected files might become readable.
Hints
Hint 1 Show
Check the Network tab to confirm the form submits XML data
Hint 2 Show
Try sending custom XML with curl or Burp Suite
Hint 3 Show
Try defining an external entity in a DOCTYPE declaration