Sample XML file — free download
XML for parsers and importers, including the two attacks every XML parser must be hardened against: the billion-laughs entity expansion bomb and XXE external-entity file disclosure.
Need a specific size?
Streamed on demand — nothing stored, no signup, any size up to 2 GB.
4 ready-made XML test files
| File | Size | What it catches | |
|---|---|---|---|
| unclosed-tag.xml | 51 bytes | Error reporting quality - the message should include a line and column. | download |
| xxe-file-disclosure.xml | 141 bytes | Parsers with external entity resolution enabled by default (older libxml2, Java DocumentBuilder, .NET XmlTextReader). If the response echoes your hostname back, you have a file-disclosure hole. | download |
| valid.xml | 395 bytes | Baseline for the XML parser cases below. | download |
| billion-laughs.xml | 794 bytes | Parsers without an entity-expansion limit. A hardened parser rejects this in milliseconds; a vulnerable one consumes all available memory. | download |
Every file is generated from source — no third-party copyright — and each has its own page with a published SHA-256 you can verify after download.
Questions
What is the billion laughs attack?
Nested XML entities that expand exponentially — a few kilobytes of input becomes gigabytes in memory, taking the process down. The file below contains a bounded version of the classic payload.
What is XXE?
XML External Entity: a document that declares an entity pointing at a local file or URL, tricking the parser into disclosing it. Test that your parser has external entities disabled.