https://lukaszpastuszak.dev/tags/xxe/Recent content in Xxe on Łukasz Pastuszak - security notesHugoen-usSun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/pollution/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/pollution/A leaked Burp export gives an admin token and XXE, Redis session tampering reaches a developers portal, an LFI PHP filter chain lands RCE, FastCGI pivots to victor, and prototype pollution in a Node.js API run as root gives a root shell.https://lukaszpastuszak.dev/writeups/redpanda/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/redpanda/SpEL SSTI in a Spring Boot search box gives a shell as woodenk, a hardcoded password reused for SSH, and a root cron job chaining log poisoning, path traversal, EXIF metadata path injection and XXE leaks the root SSH key.