🚩
THM Walkthroughs
  • THM Walkthroughs
    • 🧑‍🏫Tutorial
  • 🟦Difficulty: Info
    • 🔌What is Networking?
    • 🔌Intro to LAN
    • 🐧Linux Fundamentals
      • 🐧Linux Fundamentals Part 1
        • Task 2 - A Bit of Background on Linux
        • Task 4 - Running Your First few Commands
        • Task 5 - Interacting With the Filesystem!
        • Task 6 - Searching for Files
        • Task 7 - An Introduction to Shell Operators
      • 🐧Linux Fundamentals Part 2
        • Task 3 - Introduction to Flags and Switches
        • Task 4 - Filesystem Interaction Continued
        • Task 5 - Permissions 101
        • Task 6 - Common Directories
      • 🐧Linux Fundamentals Part 3
        • Task 3 - Terminal Text Editors
        • Task 4 - General/Useful Utilities
        • Task 5 - Processes 101
        • Task 6 - Maintaining Your System: Automation
        • Task 8 - Maintaining Your System: Logs
    • 🪟Windows Fundamentals
      • 🪟Windows Fundamentals 1
      • 🪟Windows Fundamentals 2
      • 🪟Windows Fundamentals 3
    • 🔓Principles of Security
    • 🐍Python Basics
    • 🔍History of Malware
    • 🦹Common Attacks
    • 🖥️Security Awareness
    • ⚔️Intro to Offensive Security
    • 🦹Pentesting Fundamentals
    • 🔓CVE Walkthroughs
      • 🖥️Sudo Security Bypass: CVE-2019-14287
      • 🖥️Sudo Buffer Overflow: CVE-2019-18634
      • 🖥️Baron Samedit: CVE-2021-3156
      • 🖥️OverlayFS: CVE-2021-3493
      • 🖥️Polkit: CVE-2021-3560
      • 🖥️Pwnkit: CVE-2021-4034
      • 🪶Apache HTTP Server Path Traversal: CVE-2021-41773/42013
      • 🧻Dirty Pipe: CVE-2022-0847
      • 🟢Spring4Shell: CVE-2022-22965
    • 🟧Burp Suite
      • 🟧Burp Suite: The Basics
      • 🟧Burp Suite: Repeater
    • 🏁Challenges
      • ⤴️Bypass Disable Functions
    • 🎟️THM PROMOs
      • 🎟️Learn and win prizes [PROMO ENDED]
      • 🎟️Learn and win prizes #2 [PROMO ENDED]
  • 🟩Difficulty: Easy
    • 🚀Learning Cyber Security
    • 🔁The Hacker Methodology
    • 🔍Google Dorking
      • Task 2 - Let's Learn About Crawlers
      • Task 4 - Beepboop - Robots.txt
      • Task 5 - Sitemaps
      • Task 6 - What is Google Dorking?
    • 🐝OWASP Top 10
      • Task 5 - Command Injection Practical
      • Task 7 - Broken Authentication Practical
      • Task 11 - Sensitive Data Exposure (Challenge)
      • Task 13 - XML External Entity - eXtensible Markup Language
      • Task 14 - XML External Entity - DTD
      • Task 16 - XML External Entity - Exploiting
      • Task 18 - Broken Access Control (IDOR Challenge)
      • Task 19 - Security Misconfiguration
      • Task 20 - Cross-site Scripting
      • Task 21 - Insecure Deserialization
      • Task 24 - Insecure Deserialization - Cookies
      • Task 25 - Insecure Deserialization - Cookies Practical
      • Task 30 - Insufficient Logging and Monitoring
    • 📡Nmap
      • Task 2 - Introduction
      • Task 3 - Nmap Switches
      • Task 5 - TCP Connect Scans
      • Task 6 - Scan Types SYN Scans
      • Task 7 - UDP Scans
      • Task 8 - NULL, FIN and Xmas
      • Task 9 - ICMP Network Scanning
      • Task 10 - NSE Scripts Overview
      • Task 11 - Working with the NSE
      • Task 12 - Searching for Scripts
      • Task 13 - Firewall Evasion
      • Task 14 - Practical
    • 📡RustScan
      • Task 2 - Installing RustScan
      • Task 5 - Extensible
      • Task 7 - Scanning Time!
      • Task 8 - RustScan Quiz
    • 🐙Crack the hash
    • 🌍OhSINT
    • 🧑‍🚀Vulnversity
    • 🧊Ice
    • 🪟Blue
    • 🎄Advent of Cyber 4 (2022)
  • 🟨Difficulty: Medium
    • 🪟Attacktive Directory
      • Task 3 - Welcome to Attacktive Directory
      • Task 4 - Enumerating Users via Kerberos
      • Task 5 - Abusing Kerberos
      • Task 6 - Back to the Basics
      • Task 7 - Elevating Privileges within the Domain
      • Task 8 - Flag Submission Panel
    • 💀Mr Robot CTF
    • 🛗Linux PrivEsc
    • 🛗Linux PrivEsc Arena [WIP]
    • 🛗Windows PrivEsc Arena
  • 🟧Difficulty: Hard
    • 🐘Hacking Hadoop [WIP]
  • 🟥Difficulty: Insane
    • ⛺You're in a cave [WIP]
  • Blank Room (Duplicate Me)
Powered by GitBook
On this page
  1. Difficulty: Easy
  2. OWASP Top 10

Task 13 - XML External Entity - eXtensible Markup Language

PreviousTask 11 - Sensitive Data Exposure (Challenge)NextTask 14 - XML External Entity - DTD

Last updated 2 years ago

Task 13 [Severity 4] XML External Entity - eXtensible Markup Language

Full form of XML

Reveal Flag

Extensible Markup Language

Is it compulsory to have XML prolog in XML documents?

Reveal Flag

no

Can we validate XML documents against a schema?

Reveal Flag

yes

How can we specify XML version and encoding in XML document?

Reveal Flag

XML prolog

🚩
🚩
🚩
🚩
🚩
🚩
🚩
🚩
🟩
🐝
  • Task 13 [Severity 4] XML External Entity - eXtensible Markup Language
  • Full form of XML
  • Is it compulsory to have XML prolog in XML documents?
  • Can we validate XML documents against a schema?
  • How can we specify XML version and encoding in XML document?