An XML External Entity (XXE) attack (sometimes called an XXE injection attack) is a type of attack that abuses a widely available but rarely used feature of XML parsers. Using XXE, an attacker is able to cause Denial of Service (DoS) as well as access local and remote content and services. XXE can be used to perform Server Side Request Forgery (SSRF) iducing the web application to make requests to other applications. In some cases, XXE may even enable port scanning and lead to remote code execution. There are two types of XXE attacks: in-band and out-of-band (OOB-XXE).    There are various types of XXE attacks:  XXE Attack Type  |  Description  ---|--- Exploiting XXE to Retrieve Files  |  Where an external entity is defined containing the contents of a file, and returned in the application's response.  Exploiting XXE to Perform SSRF Attacks  |  Where an external entity is defined based on a URL to a back-end system.  Exploiting Blind XXE Exfiltrate Data Out-of-Band  |  Where sensitive data is transmitted from…

A list of interesting payloads, tips and tricks for bug bounty hunters. - EdOverflow/bugbounty-cheatsheet