Solving Portswigger Academy: Exploiting XXE via image file upload

This lab lets users attach avatars to comments and uses the Apache Batik library to process avatar image files.

To solve the lab, upload an image that displays the contents of the /etc/hostname file after processing. Then use the "Submit solution" button to submit the value of the server hostname.

When you access the lab, there are various blog posts. Visit any post and in comment section you will see an upload functionality.

Upload function in comment section

I first created SVG image file with below contents.

SVG image file

Now go to the comments section and select Choose file button to upload above image.Also fill up comments and other details.

Now visit the comments section and you will see the image is processed by server and in image it is showing hostname.

hostname