mission · xxe-filtered-svg
The Upload Filter (Blind XXE)
DropZone patched the avatar upload after the last report — the validator now rejects SVGs whose DOCTYPE mentions SYSTEM or any file path. But it still accepts SVG files, and the parser still expands external entities. You can't read a file back in the response anymore… so make the server send it somewhere you're listening.
objective
Exfiltrate the contents of /etc/hostname using blind XXE — your SVG can't read files back in the response, so exfiltrate out-of-band to your listener.
Profilesigned in as you@dropzone.app
Your profile picture is shown on the team page. We accept PNG, JPG and SVG.
Upload avatar
Drag your image here, or paste the file contents below.
attacker.hp-lab.local — listening
Exfiltration log
No requests captured yet. Plant a payload that calls fetch()…
Simulated target for training. This page is the vulnerable website — payloads you craft execute here in your browser. Practice only on systems you own or are authorized to test.