> **This is a starter template — replace every bracketed note below with your > actual writeup.** The frontmatter above (title, date, category, tags) is > already filled in based on what you've told me about this challenge; the > body is a standard XXE writeup skeleton for you to fill with your real > payloads, screenshots, and findings. ## Challenge overview [One or two sentences: what the challenge gave you — a web app, an API endpoint, a file upload form — and what the objective was.] - **Category:** Web / Injection - **Points:** [xxx] - **Files/links provided:** [xxx] ## Recon [What did the target look like? Any endpoints that accepted XML? How did you find the injection point — burp history, a content-type header, a file upload that silently parsed XML under the hood?] ``` [ request / response snippet ] ``` ## Identifying the vulnerability [Which field in the response reflected parsed XML values back to you? This is usually the tell for XXE — you send an entity, and something in the app's output changes to match what that entity resolved to.] ```xml ]> &xxe; ``` ## Exploitation [Walk through the payloads you iterated on, and why each one moved you closer to reading a file. Show the failed attempts too — they're often the most useful part of a writeup for readers hitting the same walls.] ```xml ]> &xxe; ``` ## Getting the flag [What did the final response look like? Where was the flag hiding — filesystem, environment variable, internal service reachable via SSRF-style XXE?] ## Lessons learned [What would you tell someone defending against this? E.g. disable external entity resolution in the XML parser, use an allowlist parser configuration, avoid parsing untrusted XML entirely where possible.]

Every case, filed.

Path Traversal in a File Viewer Endpoint