Another common vulnerability associated with XML parsing is called A Billion Laughs Attack. It uses an entity to resolve itself cyclically thereby consuming more CPU usage and causing a denial of service attack. An Example XML payload that can cause an XXE attack is as follows:
Step 1 : Capture the request into Burp
Step 2 : Send it to the repeater tab and then convert the body into XML whether it is accepting or not
Step 3 : To confirm, Check for the [ Accept ] Header change it into Application/json
Step 4 : Covert JSON into XML if their is no Possibility
Step 5 : Add the payload in between and change the content lol1 to lol9 depending on the dos variation in the xml field!