It bans one keyword | Hunt the Flag

Labs need a computer

Open this page on a computer, or make the browser window larger.

Loading the lab.

Scenario

After the last lesson the Hacker added protection that rejects any document containing the keyword SYSTEM. But XML has a second way to define an external entity with the same effect.

What you are looking at

The same feed import, but the developer blocks the keyword SYSTEM in the document. External-entity definitions have another form, PUBLIC, that does the same thing and is not blocked.

Goal

Read /etc/passwd again, bypassing the SYSTEM ban.

What counts as solved

You bypassed the SYSTEM ban with PUBLIC and read /etc/passwd.

Method checklist

Tick each step as you work through it. The steps are the method, not the answer.

Try a SYSTEM-form entity and note it is rejected.
Recall the entity definition also has a PUBLIC form.
Define the entity in PUBLIC form for the same file.
Read the system file despite the filter.

Hints

You have not revealed a hint yet. Ask the falcon when you need one.

Why the solution worked

The protection banned one keyword, and XML offers PUBLIC as a second way to the same effect, so banning SYSTEM is not enough — a keyword blacklist is incomplete. The fix is the same: disable DTDs and external entities in the parser; do not chase keywords.

The root cause

The blacklist blocks one keyword while XML grammar offers the equivalent PUBLIC form; the root is leaving external entities enabled.

How the code is fixed

Banning keywords is a blacklist; the fix is disabling the feature in the parser, not scanning the text.

Vulnerable code

if (/SYSTEM/.test(xml)) return bad();       // one keyword; PUBLIC still works
const doc = new DOMParser().parseFromString(xml, 'text/xml');

Safe code

const parser = new XMLParser({ resolveExternalEntities: false, processEntities: false });
parser.parse(xml); // no entity resolves, whatever keyword is used

Impact in the real world

Blocking a keyword does not stop XXE; file reading stays possible through the alternate form.

How defenders detect it

Defenders disable entity processing entirely instead of blocking keywords, and alert on DOCTYPE and ENTITY in either form.

Next level Back to the lesson