webProeasy
Lab 145 — RankPulse — XXE via Sitemap XML Parsing
hackadvisor
Task: Java/Spring Boot SEO platform that fetches and parses external XML sitemaps with entity resolution enabled. Solution: XXE injection via malicious sitemap hosted on Interaction Server — external entity reads /root/flag.txt, content appears as discovered URL in audit results.
$ ls tags/ techniques/
xxe_file_readexternal_entity_injectionsitemap_xml_abuseinteraction_server_payload_hosting
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 140 — Pressboard — XXE via RSS Feed Import— hackadvisor
- [web][Pro]Lab 84 — PulseView— hackadvisor
- [web][Pro]Lab 225 — MailPulse — SSTI in Campaign Template Preview— hackadvisor
- [web][Pro]MailPulse— hackadvisor
- [web][Pro]Lab 144 — InsightForge — Blind XXE via XML Data Import— hackadvisor