XXE

SiteMapper — Sitemap ingest

Scenario

SiteMapper accepts XML sitemap uploads and expands entities in loc elements. Parsed content is echoed back in a preview panel. Pull contents from a local file through a crafted entity reference.

Your approach

Review the sample sitemap format on the upload page.
Build XML with a SYSTEM entity pointing at a local file URI.
Reference the entity inside a loc tag and upload the document.
Read the echoed file contents or flag in the preview output.
Submit the exfiltrated flag value.

Upload sitemap

Each <loc> value is echoed after parsing. Experiment with XML features the parser may still support.