webPromedium
Lab 38 — PipelineForge — XXE in XML Pipeline Import
hackadvisor
Task: PipelineForge CI/CD dashboard with XML pipeline import feature on Settings page. Solution: XXE injection via external entity in uploaded XML file, flag at /root/flag.txt exfiltrated through validation error messages.
$ ls tags/ techniques/
xxe_file_readexternal_entity_injectioncsrf_token_extractionerror_based_exfiltrationanti_bot_honeypot_detection
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 388 — ModelForge— hackadvisor
- [web][Pro]Lab 352 — PipeForge — Content-Type Confusion to Admin JWT Forge to RCE— hackadvisor
- [web][Pro]Lab 320 — BuildForge — Path Traversal to RCE via CLI @File Expansion— hackadvisor
- [web][Pro]Lab 139 — HireFlow — XXE via XML Application Intake— hackadvisor
- [web][Pro]DecisionForge— hackadvisor