definitely the coolest bug i've found so far :) blind xxe on a host behind a strict firewall, i.e. no external reqs aside from dns allowed by abusing internal dtd's w/ help from @honoki, enumeration and limited exfiltration of local files was possible @yeswehack #yeswerhackers