Test files › Structured data › xxe-file-disclosure.xml
Sample XML file
XML declaring an external entity that reads a local file. Targets /etc/hostname - deliberately innocuous rather than /etc/passwd.
↓ Download xxe-file-disclosure.xml| Filename | xxe-file-disclosure.xml |
| Format | XML |
| Size | 141 bytes (141 bytes) |
| MIME type | application/xml |
| SHA-256 | 3b24847c3f0f1c1e34b3d8b2bee9d2229da9613a35b7163bb4842ffcaf4aae83 |
What this file catchesParsers with external entity resolution enabled by default (older libxml2, Java DocumentBuilder, .NET XmlTextReader). If the response echoes your hostname back, you have a file-disclosure hole.
Download & verify
curl -fsSL -o "xxe-file-disclosure.xml" "https://files.hexaqa.com/xml/xxe-file-disclosure.xml"
curl -fsSL "https://files.hexaqa.com/xml/xxe-file-disclosure.xml" | sha256sum
# expect: 3b24847c3f0f1c1e34b3d8b2bee9d2229da9613a35b7163bb4842ffcaf4aae83