mission · xxe-local-file-read
Read the Server's Secrets
DropZone added a 'preview rendered' tab: paste XML, and the page renders any text element as visible content. The XML parser they use still processes external entities. A classic XXE trick reads a file by pointing an external entity at it and letting the app echo the file's contents back — try the platform's own filesystem first.
objective
Read a file from the server (e.g. /etc/passwd) via an external entity and see its contents in the rendered preview.
XML Viewer
Paste an XML document and DropZone pretty-prints it for you. Documents are parsed server-side — that's what lets us show you the resolved structure.
Paste your XML document
XML, XHTML, SVG… anything the parser can read.
Simulated target for training. This page is the vulnerable website — payloads you craft execute here in your browser. Practice only on systems you own or are authorized to test.