← All Challenges
Challenge 36 of 66
Entity Expander
🟠 Hard
Injection
+100 XP
An XML parser accepts user input without disabling external entities. Inject an XXE payload to read /etc/flag from the server.
Define an external entity that references file:///etc/flag, then use it in the XML body.
🏆 Challenge Complete!
Know someone who would enjoy this? Challenge them.
Keep going
Make it count.
Join free to earn XP for what you read and solve, keep a streak, and track your progress.
Join free