== Blind XXE assignment

In the previous page we showed you how you can ping a server with a XXE attack, in this assignment try to make a DTD which will upload the contents of a file `secret.txt` from the WebGoat server to our WebWolf server. You can use WebWolf to serve your DTD. The `secret.txt` is located on the WebGoat server in this location, so you do not need to scan all directories and files:


|===
|OS |Location

|`operatingSystem:os[]`
|`webGoatTempDir:temppath[]/XXE/username:user[]/secret.txt`

|===

Try to upload this file using WebWolf landing page for example: `webWolfRootLink:landing?text=contents_file[noLink,target=landing]`
(NOTE: this endpoint is under your full control)
Once you obtained the contents of the file post it as a new comment on the page, and you will solve the lesson.
