XXE is one of those things you never expect to be present but it somehow makes it way to a web chall.
GenCys CTF 2025 Finals
CTF Conducted by UST.
Participated under team_xz
Placed position 7, solved a few web and misc challenges.
The lack of PWN/REV challenges is so annoying :cry:
Solves
Inference Override 1
Log in to website using info leak in an internal route, and use query-parameter-injection to pollute locals.
BTW Always look at robots.txt :thumbs:.