A PHP fan blog about a football player with a contact form. The form sends XML to contact.php, which parses it with external entity loading enabled and echoes the sender's name.
Pas commencéDockercommit 52dc94ex86_64 · aarch64Secret
Use the contact form's XML parser to read /etc/passwd from the server.
Le brief de ce lab se trouve dans son dépôt.