XML-XXE-Injection it is work like this ] > and we call by this &xxe; or ] > &xxe; Payload prompt(document.domain);