> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/cybersecurity-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-xxe-labs/lab-8.md). # lab-8 ## Exploiting XXE via Image File Upload **Difficulty:** Practitioner ### Lab Description This lab lets users attach avatars to comments and uses the Apache Batik library to process avatar image files. **Objective:** Upload an image that displays the contents of the `/etc/hostname` file after processing, then submit the resulting hostname value via the "Submit solution" button. ### Solution **Step 1 — Identify the vulnerable upload feature** Navigate to: ``` https://your-lab-id.web-security-academy.net/post?postId=3 ``` Post a comment with an avatar attached, and capture the request in Burp Suite. Inspecting the request shows the avatar field accepts image files — and because Apache Batik parses SVGs (which are XML-based), an SVG file can be uploaded in place of a normal image to smuggle in an XXE payload. **Step 2 — Craft a malicious SVG file** Create a file named `image.svg` with the following content: ```xml ]> &file; ``` This defines an external entity pointing at `/etc/hostname` and renders its value as text inside the SVG image. **Step 3 — Upload and trigger** Attach `image.svg` as the avatar and submit the comment. Open the rendered avatar image in a new tab — since Batik parses the SVG (including its DTD), the entity resolves and the hostname is rendered as visible text inside the image itself. **Step 4 — Submit the solution** Read the hostname value from the rendered image and submit it via the lab's "Submit solution" button to complete the lab. ### Conclusion The application accepted SVG files without proper validation, and because SVG is an XML-based format, this opened up a classic XXE injection vector through what looked like a simple image upload feature. > **Note:** If the application doesn't reflect the result directly (or the data is too large to render visibly), the same technique can be combined with an out-of-band exfiltration approach (as in the blind XXE labs) to retrieve the data via an external request instead. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-xxe-labs/lab-8.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.