Apprentice
← all rooms
XXE Expert

XML External Entity

Exploit XXE to read files. Entities resolve against a simulated filesystem only.

Mission briefing

SiteMapper ingests XML sitemaps from customers to crawl their sites. Uploads are parsed with external entities enabled for convenience. Find out whether crafted XML can reach files on the server filesystem.

0 / 2 tasks 0 / 35 pts

Objectives

  • Exfiltrate /etc/passwd via a reflected XXE
  • Confirm the blind parser still expands entities
Task 1 XXE Data Exfiltration Hard 15 pts

Scenario

SiteMapper accepts XML sitemap uploads and expands entities in loc elements. Parsed content is echoed back in a preview panel. Pull contents from a local file through a crafted entity reference.

Your approach

  1. Review the sample sitemap format on the upload page.
  2. Build XML with a SYSTEM entity pointing at a local file URI.
  3. Reference the entity inside a loc tag and upload the document.
  4. Read the echoed file contents or flag in the preview output.
  5. Submit the exfiltrated flag value.

Upload a sitemap that defines a SYSTEM entity pointing at a file.

Open lab →
Hint

<!ENTITY xxe SYSTEM "file:///etc/passwd"> inside a <loc>

Task 2 Blind XXE Expert 20 pts

Scenario

The blind parser still resolves external entities but shows no file contents. Success is silent—a processed status without data leakage. Confirm entity expansion works even when nothing is reflected.

Your approach

  1. Reuse the entity technique from the reflected parser lab.
  2. Upload valid malicious XML to the blind endpoint.
  3. Watch for a processed response without error messages.
  4. Note the lab flag issued for successful blind parsing.
  5. Submit that flag.

The parser expands entities but returns no content.

Open lab →
Hint

Same payload style as task 1 — success is 'processed' with no echo.