# BillFlow — XXE Invoice Importer (CTF challenge)

> BillFlow imports invoices as XML and echoes back the parsed customer name. Its XML parser resolves external entities — so a crafted document can make the server read a local file and hand it back to…

Canonical: https://codelivly.com/ctf/challenges/billflow-xxe

| | |
|---|---|
| Category | Web Exploitation |
| Difficulty | Hard |
| Points | 700 |
| Estimated time | 30 min |
| Type | Live instance |
| Solves | 14 |
| Author | Codelivly |

BillFlow imports invoices as XML and echoes back the parsed customer name. Its XML parser resolves external entities — so a crafted document can make the server read a local file and hand it back to you. Read /tmp/billflow/flag.txt via XXE.

## Related

- [All CTF challenges](https://codelivly.com/practice?type=ctf)