XXE
5/
Adding the DOCTYPE , a new ENTITY pointing to the filesystem root:

7/
Modify request with Burpsuite, you can see the data is in json type.
The response is: "You are posting JSON which does not work with a XXE"

First, you must change Content-Type from application/json to application/xml. Next, do similarly with past challenge:

11/ Blind XXE assignment
File to upload to webgoft:
<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY secret SYSTEM 'file:///home/webgoat/.webgoat-8.2.2//XXE/secret.txt'>
Modify Post request (post command with burpsuite) and edit to:

Reload page and submit value you receive:
Last updated