XXE Payload Library

XML External Entity (XXE) injection payload collection. File disclosure, SSRF via XXE, blind XXE with out-of-band, XXE via SVG/docx, and error-based techniques. This free web security tool runs entirely in your browser — no data leaves your device, no account required, and it keeps working offline once the page has loaded.