mission · xxe-capstone-pii
Capstone: PII Heist Through SSRF
The full chain. DropZone's converter has file access and its internal network has an administration service: a 'members API' at http://10.0.0.12/export that dumps customer records (PII) for the internal staff dashboard. The converter will happily make HTTP requests on your behalf — an external entity pointing at an http:// URL is just a request the server makes for you (SSRF). Combine file reading and SSRF to pull the member list out through the converter.
objective
Use the converter's XML parser to reach the internal members API (SSRF) and exfiltrate the PII it returns.
Document Converter
DropZone converts .docx, .xml and .csv files between formats. The conversion engine parses every document server-side.
Drop your file
.docx (XML inside), .xml, .csv — convert to PDF or plain text.
The converter echoes the parsed document as plain text.
Simulated target for training. This page is the vulnerable website — payloads you craft execute here in your browser. Practice only on systems you own or are authorized to test.