This lab has a "Check stock" feature that embeds the user input inside a server-side XML document that is subsequently parsed.
Because you don't control the entire XML document you can't define a DTD to launch a classic attack.
To solve the lab, inject an XInclude statement to retrieve the contents of the /etc/passwd file.
Upon accessing the lab, I immediately targeted the POST /product/stock request to explore potential XXE vulnerabilities. However, I noticed that the Content-Type appeared to be different from the usual XML format:
To confirm if my input data was being embedded in an XML document, I attempted to reference an entity called ichyaboy:
Encountering the error message "Entities are not allowed for security reasons" confirmed that my input was being parsed as XML.
Given that I didn't control the entire XML document and couldn't define or modify a DOCTYPE element, I turned to XInclude, which allows including content from another XML document. In my case, I aimed to reference the /etc/passwd file. Here's the payload I crafted:
Upon sending this payload, I observed the content of the /etc/passwd file in the response, thereby successfully solving the lab.
In this payload, the line "xmlns:xi=""" defines a namespace prefix for XInclude. The subsequent part is an XInclude element (xi:include) that references an external file (file:///etc/passwd).