webmedium

Fragment XML

spbctf

Task: Payment web application where user input in comment field is inserted into XML without escaping. Solution: XML fragment injection to close the current payment element and inject a new one with arbitrary sender, bypassing sender validation.

$ ls tags/ techniques/
xmlinjectionpayment_bypassfragment_injection
xml_fragment_injectionpayment_forgery
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]