# Billion Laugh Attack * Another common vulnerability associated with XML parsing is called A Billion Laughs Attack. It uses an entity to resolve itself cyclically thereby consuming more CPU usage and causing a denial of service attack. An Example XML payload that can cause an XXE attack is as follows: ``` Step 1 : Capture the request into Burp Step 2 : Send it to the repeater tab and then convert the body into XML whether it is accepting or not Step 3 : To confirm, Check for the [ Accept ] Header change it into Application/json Step 4 : Covert JSON into XML if their is no Possibility Step 5 : Add the payload in between and change the content lol1 to lol9 depending on the dos variation in the xml field! ``` * Billion Laugh Payload : ``` ]> &lol9; ``` ## Contributor: * [N3T\_hunt3r](https://twitter.com/N3T_hunt3r) --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://kathan19.gitbook.io/howtohunt/xxe/billion_laugh_attack.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.