XML External Entity (XXE)
XML External Entity (XXE) is a type of attack that exploits vulnerabilities in XML parsers. It occurs when an application processes XML input that includes a reference to an external entity. By exploiting this, attackers can access sensitive files, perform server-side request forgery (SSRF), or execute denial-of-service (DoS) attacks. XXE typically targets misconfigured or outdated parsers that allow external entity resolution, posing a significant threat to data confidentiality and system integrity.
Scenario:
Craw.in, a cutting-edge data analytics company, has recently launched a new service for processing XML data uploaded by clients. Their internal security team (that's you!) has identified a potential vulnerability in the XML parsing logic. You need to exploit it to prove the risk. The target server is running a simple web application. You can interact with it through the provided web interface.
Challenge Overview:
You'll be interacting with a web application that allows uploading XML files. Your goal is to exploit an XXE vulnerability to read sensitive information from the server's file system. Remember, all answers must be a single word.