XXE Lab: Read Server Files Through an XML Upload

DocParse accepts XML documents and shows you what it parsed. XML has an old feature called entities, a way to define a shortcut that expands into other text. Some entities can point at a file, and the parser will fetch it. Define one that points at a system file, use it in your document, and the parser pastes that file into its output for you. Lab at a glance: Intermediate · 100 XP · about 15 minutes · runs in…

Read full article →