A website is presented, where you can choose from a list of options. When changing the options, a request is sent to the backend server which will give you a reply. One of the options is XXE, which will tell you that you cannot do XXE on JSON.
Inspecting the source of the website, it is shown that it encodes using JSON to communicate with the backend, which includes setting Content-Type: application/json
, with a format of {"message": "Cola"}
.
Instead it can be set to Content-Type: application/xml
, <message>Cola</message>
.