# StockSync — XXE XML Import (lab)

> StockSync imports product listings from XML. The parser behind the import form resolves external entities, so a crafted DOCTYPE can pull a file's contents into any field of the parsed product —…

Canonical: https://codelivly.com/labs/xxe-xml-import

| | |
|---|---|
| Type | Web |
| Difficulty | Intermediate |
| Points | 300 |
| Session length | 30 min |
| Completions | 0 |

StockSync imports product listings from XML. The parser behind the import form resolves external entities, so a crafted DOCTYPE can pull a file's contents into any field of the parsed product — including fields the response echoes straight back to you.

## Objective

Learn XML External Entity (XXE) injection: when an XML parser is configured to resolve external entities declared in a DOCTYPE, an attacker-supplied document can declare an entity pointing at a file:// URL and have its contents substituted into the document the application then reads and displays.

## Tasks

1. Import a normal product
2. Add a DOCTYPE with an external entity
3. Reference the entity in a field
4. Read the response
5. Capture the flag

## Related

- [All labs](https://codelivly.com/practice?type=lab)