$ cat writeup.md…
$ cat writeup.md…
hackadvisor
Task: Applicant tracking system accepts .docx resume uploads and parses XML content with external entity resolution enabled. Solution: Craft malicious DOCX with XXE payload in word/document.xml referencing file:///root/flag.txt; server resolves entity and displays file contents in confirmation page resume preview.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar