Sample XML file: free download
What is an XML file?
An XML file is text marked up with nested, named elements and attributes, following the W3C XML 1.0 specification. It can declare entities in a document type definition, which is also its main risk: entity expansion (billion laughs) and external entities (XXE) attack the parser itself.
XML for parsers and importers, including the two attacks every XML parser must be hardened against: the billion-laughs entity expansion bomb and XXE external-entity file disclosure.
Need a specific size?
Opens the generator with the size filled in. Click Generate and the file is built in your browser: nothing is uploaded, and no sign-up.
4 ready-made XML test files
| File | Size | What it catches | Download |
|---|---|---|---|
| unclosed-tag.xml | 51 bytes | Error reporting quality - the message should include a line and column. | download |
| xxe-file-disclosure.xml | 141 bytes | Parsers with external entity resolution enabled by default (older libxml2, Java DocumentBuilder, .NET XmlTextReader). If the response echoes your hostname back, you have a file-disclosure hole. | download |
| valid.xml | 395 bytes | Baseline for the XML parser cases below. | download |
| billion-laughs.xml | 794 bytes | Parsers without an entity-expansion limit. A hardened parser rejects this in milliseconds; a vulnerable one consumes all available memory. | download |
Every file is generated from source (no third-party copyright) and each has its own page with a published SHA-256 you can verify after download.
Questions
What is the billion laughs attack?
Nested XML entities that expand exponentially: a few kilobytes of input becomes gigabytes in memory, taking the process down. The file below contains a bounded version of the classic payload.
What is XXE?
XML External Entity: a document that declares an entity pointing at a local file or URL, tricking the parser into disclosing it. Test that your parser has external entities disabled.