diff --git a/sectraining.md b/sectraining.md
index 82854ca..430807e 100644
--- a/sectraining.md
+++ b/sectraining.md
@@ -188,3 +188,47 @@ private static String fetchRemoteObject(String location) throws Exception {
return body;
}
```
+
+### XML Entity Expansion
+
+#### billion laughs attack
+```xml
+
+
+
+
+
+
+]>
+
+ Join &t3;
+
+```
+
+#### forgery
+```xml
+
+
+
+]>
+
+ &xxe;
+
+```
+
+or
+
+```xml
+
+
+
+]>
+
+ &xxe;
+
+```