Capture the FlagMedium
The Parsing Doc Viewer
Lab for XML External Entities (XXE): Reading the Server's Files
Scenario
The site runs a document viewer at /xml-viewer that parses the XML you submit and echoes the parsed result back. If the parser processes external entities, an entity pointing at a file on the server will expand into that file's contents — right in the response.
Objective
Make the XML viewer resolve an external entity that reads /etc/passwd, then extract the flag from the echoed file.
lab ~ the parsing doc viewernothing real runs
booting lab sandbox…
This sandbox is fully emulated in your browser, nothing real runs and nothing leaves your machine. Type help to see the tools available.