Skip to content

Instantly share code, notes, and snippets.

@cocuh

cocuh/background-image.html

Last active January 1, 2016 03:39
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save cocuh/8086611 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save cocuh/8086611 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
background-image.html
<html>
<head>
<meta charset="UTF-8"/>
<title>background-image</title>
<script>console.log(document.title)</script>
</head>
<body>
background-image
<div style="background-image:url(xss.svg);height:300px;width:300px"></div>
</body>
</html>
Raw
embed.html
<html>
<head>
<meta charset="UTF-8"/>
<title>embed</title>
<script>console.log(document.title)</script>
</head>
<body>
embed
<embed src="xss.svg" height="300" width="300"></embed>
</body>
</html>
Raw
iframe.html
<html>
<head>
<meta charset="UTF-8"/>
<title>iframe</title>
<script>console.log(document.title)</script>
</head>
<body>
iframe
<iframe src="xss.svg" width="300" height="300"></iframe>
</body>
</html>
Raw
img.html
<html>
<head>
<meta charset="UTF-8"/>
<title>img</title>
<script>console.log(document.title)</script>
</head>
<body>
img
<img src="xss.svg" height="300" width="300"/>
</body>
</html>
Raw
input.html
<html>
<head>
<meta charset="UTF-8"/>
<title>input</title>
<script>console.log(document.title)</script>
</head>
<body>
input
<input type="image" src="xss.svg" height="300" width="300"/>
</body>
</html>
Raw
object.html
<html>
<head>
<meta charset="UTF-8"/>
<title>object</title>
<script>console.log(document.title)</script>
</head>
<body>
object
<object data="xss.svg" height="300" width="300"></object>
</body>
</html>
Raw
svg.html
<html>
<head>
<meta charset="UTF-8"/>
<title>svg</title>
<script>console.log(document.title)</script>
<link rel="stylesheet" type="text/css" href="xss.css"/>
</head>
<body>
svg
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="300px" height="300px">
<text x="100" y="100" onclick="console.log('text onclick: '+document.domain)">onclick</text>
<text x="100" y="120" id="elem_ex">event handler(external)</text>
<text x="100" y="140" id="elem_in">event handler(internal)</text>
<circle cx="40" cy="40" r="20" style="stroke-width:expression(console.log('expression:'+document.domain));;fill:red;stroke:black;"></circle>
<circle cx="40" cy="80" r="20" class="xss"></circle>
<image x="0" y="100" height="100px" width="100px" xlink:href="cat.png"/>
<image x="0" y="200" height="100px" width="100px" xlink:href="javascript:console.log('image src:'+document.domain)"/>
<image x="0" y="300" height="100px" width="100px" xlink:href="consolelog.js"/>
<a xlink:href="javascript:console.log('a tag href:'+document.domain)"><text x="100" y="160">a tag href</text></a>
<script xlink:href="script.js"></script>
<script>
console.log('inline script: '+document.domain)
document.getElementById("elem_in").onclick=function(){
console.log('internal javascript onclick:'+document.domain)
};
</script>
</svg>
</body>
</html>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment