XXE for local file disclosure
A stock-check feature parses an XML body with external entities enabled and reflects a value into the response. Read `/etc/passwd`.
Scenario
"Check stock" posts XML:
<?xml version="1.0"?>
<stockCheck><productId>2</productId><storeId>1</storeId></stockCheck>
The productId value is echoed back in the response (e.g. in an error), and the
parser resolves external entities.
Your objective
Read the contents of /etc/passwd through the stock-check endpoint. Solved when you submit the first line of the file.
Capture 1 flag(s) and record the exact technique for each step.
Getting started
- Confirm entity expansion with an internal entity:
<!DOCTYPE x [<!ENTITY e "2">]>and use&e;as the productId. - Define an external entity:
<!ENTITY xxe SYSTEM "file:///etc/passwd">. - Place
&xxe;in theproductIdelement so it is reflected. - Read the file contents out of the response.
- Submit the
root:...line as the flag.
Connecting
Press Launch Lab to build your own instance, then use the How to connect panel — it shows the browser link as soon as the app is running. Hit Stop when you are done, or Relaunch / Reset for a clean copy.
Credentials: No account required.
Hints
Tip
If the value is validated as an integer before reflection, put the entity in a different element that is echoed without validation.
How to connect
Connect to the lab VPN first
Lab machines sit on an isolated network with no public address. Connect to the VPN once — the same config works for every lab.
1 · Get your config
Download rooted-labs.ovpn2 · Connect
Linux / macOS — from a terminal:
Windows / mobile — import the file into OpenVPN Connect, Tunnelblick, or the OpenVPN GUI.
3 · Reach the machine
Once connected, the address shown below (SSH command / lab link / RDP command) is reachable. Only lab traffic is routed through the VPN — your normal internet is untouched.
Step 2 — reach the machine
Open the lab in your browser:
Open labCredentials: No account required.
The app can take a few more seconds to finish booting after the link appears.
Starting the container — your link will appear here automatically.
Launch the lab (sidebar) to get your link.
SSH into the machine:
Password for rabbit:
Log in as rabbit (has sudo). First login may take a few seconds while SSH finishes starting.
Provisioning — the SSH command will appear here when the machine is ready.
Launch the lab (sidebar) to get the SSH command.
Challenge questions
0 / 2 correct- Submit the initial flag you recovered while solving this lab.
- Which vulnerability class does this lab cover? (a few words)
On this page
Access
FREEAt a glance
- Operating system
- Web application
- Connection
- Browser / HTTP
- Questions
- 0 / 2 solved
- Launched by
- 0 hackers
- Maintained by
- Beaulah Marks
Your machine
Status
Booting your machine — this takes about a minute. Connection details appear in the brief below when it's ready.
Ready — see How to connect below.
Provisioning failed. Hit Relaunch to try again.