Arseniy Sharoglazov Exploiting XXE with local DTD files This little technique can force your blind XXE to output anything you want!
Imagine you have an XXE. External entities are supported, but the server’s response is always empty. In this case you have two options: error-based and out-of-band exploitation.
Let’s consider this error-based example: