WebGoat/webgoat/main/project/WebContent/lesson_plans/XMLInjection.html

<div align="Center"> 
<p><b>Lesson Plan Title:</b> How to Perform XML Injection Attacks. </p>
 </div>
 
<p><b>Concept / Topic To Teach:</b> </p>
 This lesson teaches how to perform XML Injection attacks.
 <br> 
<div align="Left"> 
<p>
<b>How the attacks works:</b>
</p>
AJAX applications use XML to exchange information with the server. This XML can be easily intercepted and altered by a malicious attacker.

</div>
<p><b>General Goal(s):</b> </p>
<!-- Start Instructions -->
WebGoat-Miles Reward Miles shows all the rewards available. Once you've entered your account ID, the lesson will show you your balance and the products you can afford. Your goal is to try to add more rewards to your allowed set of rewards. Your account ID is 836239.
<!-- Stop Instructions -->