webProeasy
Lab 139 — HireFlow — XXE via XML Application Intake
hackadvisor
Task: HireFlow recruitment platform with XML-based ATS integration endpoint. Solution: XXE injection via external entity to read /root/flag.txt, flag reflected in JSON response.
$ ls tags/ techniques/
xxe_file_readexternal_entity_injection
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 291 — HireFlow — Broken Authorization in Premium Feature Endpoints— hackadvisor
- [web][Pro]Lab 140 — Pressboard — XXE via RSS Feed Import— hackadvisor
- [web][Pro]Lab 38 — PipelineForge — XXE in XML Pipeline Import— hackadvisor
- [web][Pro]Lab 156 — IntegraFlow — Path Traversal via Double URL Encoding— hackadvisor
- [web][Pro]Lab 102 — HireScreen — Indirect Prompt Injection via Resume Description— hackadvisor