XML External Entity – Beyond /etc/passwd (For Fun & Profit)

This blog post provides a hands-on tutorial for exploiting XML External Entity (XXE) vulnerabilities: it shows a vulnerable PHP XML parser, example payloads to exfiltrate files and issue HTTP requests from the server, techniques to base64-encode responses, an internal web scanning script, and a complete pivoting chain culminating in a reverse shell against an internal host.