Xxe Generator
A new tool extracted from the codebase.
Last reviewed by the Radiatus Cloud team
XXE Payload Generator
Generate XML External Entity (XXE) payloads to test for file disclosure and denial of service.
Need this done properly for your business?
Radiatus delivers secure cloud, DevOps & compliance engineering.
Test your own application for XML external entity (XXE) injection
Testing whether your own application is vulnerable to XML external entity (XXE) injection is part of securing it, and doing so requires understanding the vulnerability class. This tool helps you generate test cases for XML external entity (XXE) injection so you can check your own application, under authorisation, and confirm that your defences hold. The test cases help you verify that your XML parser is configured to reject external entities rather than resolving them.
Why this vulnerability matters
XXE occurs when an XML parser processes external entity references in untrusted XML, which can be used to read local files or make server-side requests. It stems from insecure default XML parser configuration. It appears in the OWASP Top Ten precisely because it is common and serious, which is why testing for it against your own applications, and understanding how it works, is essential to defending against it.
The defence, and responsible use
The defence is to configure XML parsers to disable external entity resolution entirely, which the current guidance recommends by default. Testing confirms your parser configuration actually rejects external entities. This tool is for authorised security testing of systems you own or have explicit permission to test, for security research, and for education, testing without authorisation is illegal and unethical. It runs entirely in your browser, so nothing you enter is uploaded.
Related tools
- User Agent Parser — Parse a User-Agent string into browser, engine, operating system and device. Explains why UA strings are unreliable and what to use instead.
- QR Code Generator — Generate QR codes for URLs, text, Wi-Fi and contact details. Adjustable error correction and size, produced entirely in your browser.
- Credit Card Validator — Validate a card number with the Luhn algorithm and identify the issuing network from its prefix. Runs locally, nothing is transmitted.
- Text Case Converter — Convert text between camelCase, PascalCase, snake_case, kebab-case, CONSTANT_CASE, Title Case and sentence case. Runs entirely in your browser.
Frequently Asked Questions
How do I prevent XXE?
By configuring XML parsers to disable external entity and DTD processing entirely, which is the recommended secure default for handling untrusted XML.
What does the test verify?
That your XML parser rejects external entities rather than resolving them, confirming it is configured securely.
Is this for attacking other people’s systems?
No. It is for authorised testing of systems you own or have explicit permission to test, and for security education. Unauthorised testing is illegal.
Is my input uploaded?
No. It runs entirely in your browser.
Privacy & Security
Processed locally.
About This Tool
This tool runs entirely in your browser. No data is sent to any server, ensuring complete privacy. Simply use the interface above to get started — no registration or login required.
Disclaimer: This tool is provided "as is" without warranty of any kind. Results are for educational and utility purposes.
Related Tools
User Agent Parser
UtilityParse a User-Agent string into browser, engine, operating system and device. Explains why UA strings are unreliable and what to use instead.
QR Code Generator
UtilityGenerate QR codes for URLs, text, Wi-Fi and contact details. Adjustable error correction and size, produced entirely in your browser.
Credit Card Validator
UtilityValidate a card number with the Luhn algorithm and identify the issuing network from its prefix. Runs locally, nothing is transmitted.