mission · xxe-svg-avatar
The Avatar That Reads Your Files
DropZone lets members upload a profile picture. They accept PNG, JPG… and SVG, because 'it's just an image'. The upload handler parses every SVG on the server to check it's valid (dimensions, size) — and that parser processes external entities. An SVG is XML, so a picture can carry a DOCTYPE.
objective
Upload an SVG avatar that reads a file on the server (try /etc/passwd, or an app config) and shows it back in the response.
Profilesigned in as you@dropzone.app
Your profile picture is shown on the team page. We accept PNG, JPG and SVG.
Upload avatar
Drag your image here, or paste the file contents below.
Simulated target for training. This page is the vulnerable website — payloads you craft execute here in your browser. Practice only on systems you own or are authorized to test.