There is a security challenge where you have to execute code on the server to retrieve a flag, and this code has to be executed using an XSL document.
So I found a way to make the server interpret my own XSL file, And I used the
php:function functionality to execute a php function on the server. Here is an example of the code I'm giving to the server:
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl"> <xsl:template match="/"> <xsl:value-of select="php:function('file_get_contents','index.php')"/> </xsl:template> </xsl:stylesheet>
This code will output the source code of the page
The next step is to execute
scandir on the server to list the current directory (to find the flag). The problem that I'm having is that the response from the server is only
Array, that's all what the server outputs.
After searching for almost 8 hours, I'm stuck, and I can't find any XSL functionality that will output the array returned by
- The functions that allow code execution (
system) are disabled by the server.
- I'm really a beginner (complete noob) in the XSL and XML languages.