Web - Server

I don’t know how to approach it.

I mean.. is it right to put the value in the ’xsl’ column?

If i put the value in, get an only error without validate every time..

Of course i know how to handle xslt

Please tell me how.

Thank you

Refer this
1.)https://www.acunetix.com/blog/articles/the-hidden-dangers-of-xsltprocessor-remote-xsl-injection/
2.)https://www.blackhat.com/docs/us-15/materials/us-15-Arnaboldi-Abusing-XSLT-For-Practical-Attacks-wp.pdf

Something that help me get started in most challenges is using sites that provides a well structured list of cheat-sheets of checklists such as https://book.hacktricks.xyz/welcome....

Root-me challenges are smart enough not to use the same POC as the ones you would find on those website so the only thing that this is really good for is the put you in the right mindset to tackle the challenge. I strongly recommend Google searching the name of the challenges. Those too will help you to get in the right mindset.

I really like that challenge. It is worth not giving up. :)