There are a few different types of XXE attack which can attempt Remote Code Execution (RCE) or – as we covered in the introduction – disclose information from targeted files. Here's an example of the second variety, from OWASP's entry for XXE:
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY >
<!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo>
Here, you can see the external entity and its attempt—through the location string's file prefix and the following system path—to access a sensitive file on the vulnerable server.
XXE can also be used to conduct DoS attacks through an XML variant of a popular logic bomb tactic called a Billion Laughs. A DoS attack that occurs via a logic bomb—a piece of...