Loading page
Review the challenge brief, files, and requirements.
An API endpoint accepts XML for data import. The XML parser has not been hardened.
POST /api/import
Content-Type: application/xml
<user>
<name>Test</name>
</user>
Exploit the XML parser to read a sensitive file from the server. The flag is stored somewhere on disk.
Sign in to attempt this challenge.
Use Proving Grounds to continue your challenge practice.
Open Proving Grounds