XXE
Intentionally vulnerable web services exploitable via XML External Entity (XXE) attacks. Zipped Ubuntu VM set up as a Capture the Flag; successful exploiters can place their name on a leaderboard. Part of the OWASP Vicnum project; used in OWASP AppSec 'Breaking Bad' events.
Notes
XXE can lead to disclosure of confidential data, DoS, or port scanning from the parser host. Download VM from SourceForge. See xxe.sourceforge.io.