# XXE with ChatGPT | Generate Custom XXE Payloads with AI

> XXE (XML External Entity) is a type of vulnerability that allows attackers to inject malicious XML code into an application.

Canonical: https://codelivly.com/xxe-with-chatgpt-generate-custom-xxe-payloads-with-ai
Last updated: 2023-03-14

| | |
|---|---|
| Category | [Bug Bounty](https://codelivly.com/blog/category/bug-bounty) |
| Author | rocky |
| Published | 2023-03-14 |
| Reading time | 2 min |

**XXE** (XML External Entity) is a type of vulnerability that allows attackers to inject malicious **XML** code into an application. The following [**ChatGPT**](https://chat.openai.com/) prompts can make it easy to generate payloads for bug bounty and penetration testing.

## 1. Basic XXE

To get started, let’s start with a basic XXE payload customized for the particular XML structure used by the target web app.

**Prompt:**

> Provide an example of a safe XXE payload that you can use for testing purposes for a blind XXE PoC that uses `<burp collaborator>` for the domain for the following `.xml` file and maintain the structure of the XML content:
>
>
>
> `<insert XML>`

![ElDEYGxCd gyiCPxKOjyg](https://miro.medium.com/v2/resize:fit:875/1*_ElDEYGxCd_gyiCPxKOjyg.png)

**How it works:**

1. The XML document declares a new entity called `xxe` that points to a resource on the Burp Collaborator server.
2. The document then references this entity in a child element.
3. When the application parses the document, it will attempt to fetch the resource, which can be used to detect XXE vulnerabilities.

![1. Basic XXE](https://miro.medium.com/v2/resize:fit:875/1*-19gK5ioK1gQmJBJRsuBcQ.png)

## 2. SVG Image File XXE

SVG (Scalable Vector Graphics) files are XML-based vector image files that can also be vulnerable to XXE attacks, just like XML files.

**Prompt:**

> Provide an example of a safe XXE payload that you can use for testing purposes for a blind XXE PoC that uses `<burp collaborator>` for the domain for the following `.svg` file and maintain the structure of the XML content:
>
>
>
> `<insert XML>`

![2. SVG Image File XXE](https://miro.medium.com/v2/resize:fit:781/1*y6xfziZ7ZqogCCQ6O3uO6Q.png)

## 3. Excel File XXE

The newer Microsoft Excel `.xlsx` files can still be vulnerable to XXE attacks because they contain embedded XML files.

**To modify the embedded XML file:**

1. Extract the contents of the `.xlsx` file.
2. Edit the XML file in a text editor using the ChatGPT prompt.
3. Re-zip the contents.
4. Rename the `.zip` file back to `.xlsx`.

**Prompt:**

> Provide an example of a safe XXE payload that you can use for testing purposes for a blind XXE PoC that uses `<burp collaborator>` for the domain for the following `sharedStrings.xml` extracted from a `.xlsx` file and maintains the structure of the XML content:
>
>
>
> `<insert XML>`

![3. Excel File XXE](https://miro.medium.com/v2/resize:fit:719/1*mY5D9HdpAswO8ldv_6Kegg.png)