SensePost Challenge – Winners and Walkthrough

This walk-through documents a Black Hat challenge that demonstrates multiple serious web‑application flaws: XXE vulnerabilities used to read and exfiltrate local files (including use of external DTDs and php://filter base64 encoding) and injection of PHP into generated pages (via CDATA/encoded payloads) to achieve remote command execution. The report includes working payloads, HTTP request examples, and verification steps showing how each flag was obtained.