Blind XXE exfiltration with external parameter entities

When inline DTDs are blocked and there is no output, an external DTD with parameter entities exfiltrates files over your own channel.