├── .gitignore ├── LICENSE ├── README.md ├── attachments ├── Test.class ├── test.asf ├── test.avi ├── test.css ├── test.dtd ├── test.eml ├── test.evt ├── test.gif ├── test.hlp ├── test.hta ├── test.htc ├── test.html ├── test.jar ├── test.js ├── test.json ├── test.mpeg ├── test.pdf ├── test.sct ├── test.svg ├── test.swf ├── test.vbs ├── test.vml ├── test.wbxml ├── test.xbl ├── test.xdr ├── test.xml ├── test.xsl ├── test.xxe └── test.zip ├── bower.json ├── categories.js ├── html ├── images │ ├── chrome.png │ ├── cn.png │ ├── cs.png │ ├── en.png │ ├── firefox.png │ ├── ie.png │ ├── ja.png │ ├── opera.png │ ├── ru.png │ ├── safari.png │ ├── search.png │ └── tr.png ├── index.html ├── scripts │ ├── import.js │ └── jquery.js └── styles │ └── basic.css ├── items.js ├── lib └── index.js ├── package.json ├── payloads.js ├── r ├── .htaccess └── index.php ├── rss ├── .htaccess ├── index.php └── rss.txt └── vectors.txt /.gitignore: -------------------------------------------------------------------------------- 1 | .project 2 | node_modules 3 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Mozilla Public License, version 2.0 2 | 3 | 1. Definitions 4 | 5 | 1.1. "Contributor" 6 | 7 | means each individual or legal entity that creates, contributes to the 8 | creation of, or owns Covered Software. 9 | 10 | 1.2. "Contributor Version" 11 | 12 | means the combination of the Contributions of others (if any) used by a 13 | Contributor and that particular Contributor's Contribution. 14 | 15 | 1.3. "Contribution" 16 | 17 | means Covered Software of a particular Contributor. 18 | 19 | 1.4. "Covered Software" 20 | 21 | means Source Code Form to which the initial Contributor has attached the 22 | notice in Exhibit A, the Executable Form of such Source Code Form, and 23 | Modifications of such Source Code Form, in each case including portions 24 | thereof. 25 | 26 | 1.5. "Incompatible With Secondary Licenses" 27 | means 28 | 29 | a. that the initial Contributor has attached the notice described in 30 | Exhibit B to the Covered Software; or 31 | 32 | b. that the Covered Software was made available under the terms of 33 | version 1.1 or earlier of the License, but not also under the terms of 34 | a Secondary License. 35 | 36 | 1.6. "Executable Form" 37 | 38 | means any form of the work other than Source Code Form. 39 | 40 | 1.7. "Larger Work" 41 | 42 | means a work that combines Covered Software with other material, in a 43 | separate file or files, that is not Covered Software. 44 | 45 | 1.8. "License" 46 | 47 | means this document. 48 | 49 | 1.9. "Licensable" 50 | 51 | means having the right to grant, to the maximum extent possible, whether 52 | at the time of the initial grant or subsequently, any and all of the 53 | rights conveyed by this License. 54 | 55 | 1.10. "Modifications" 56 | 57 | means any of the following: 58 | 59 | a. any file in Source Code Form that results from an addition to, 60 | deletion from, or modification of the contents of Covered Software; or 61 | 62 | b. any new file in Source Code Form that contains any Covered Software. 63 | 64 | 1.11. "Patent Claims" of a Contributor 65 | 66 | means any patent claim(s), including without limitation, method, 67 | process, and apparatus claims, in any patent Licensable by such 68 | Contributor that would be infringed, but for the grant of the License, 69 | by the making, using, selling, offering for sale, having made, import, 70 | or transfer of either its Contributions or its Contributor Version. 71 | 72 | 1.12. "Secondary License" 73 | 74 | means either the GNU General Public License, Version 2.0, the GNU Lesser 75 | General Public License, Version 2.1, the GNU Affero General Public 76 | License, Version 3.0, or any later versions of those licenses. 77 | 78 | 1.13. "Source Code Form" 79 | 80 | means the form of the work preferred for making modifications. 81 | 82 | 1.14. "You" (or "Your") 83 | 84 | means an individual or a legal entity exercising rights under this 85 | License. For legal entities, "You" includes any entity that controls, is 86 | controlled by, or is under common control with You. For purposes of this 87 | definition, "control" means (a) the power, direct or indirect, to cause 88 | the direction or management of such entity, whether by contract or 89 | otherwise, or (b) ownership of more than fifty percent (50%) of the 90 | outstanding shares or beneficial ownership of such entity. 91 | 92 | 93 | 2. License Grants and Conditions 94 | 95 | 2.1. Grants 96 | 97 | Each Contributor hereby grants You a world-wide, royalty-free, 98 | non-exclusive license: 99 | 100 | a. under intellectual property rights (other than patent or trademark) 101 | Licensable by such Contributor to use, reproduce, make available, 102 | modify, display, perform, distribute, and otherwise exploit its 103 | Contributions, either on an unmodified basis, with Modifications, or 104 | as part of a Larger Work; and 105 | 106 | b. under Patent Claims of such Contributor to make, use, sell, offer for 107 | sale, have made, import, and otherwise transfer either its 108 | Contributions or its Contributor Version. 109 | 110 | 2.2. Effective Date 111 | 112 | The licenses granted in Section 2.1 with respect to any Contribution 113 | become effective for each Contribution on the date the Contributor first 114 | distributes such Contribution. 115 | 116 | 2.3. Limitations on Grant Scope 117 | 118 | The licenses granted in this Section 2 are the only rights granted under 119 | this License. No additional rights or licenses will be implied from the 120 | distribution or licensing of Covered Software under this License. 121 | Notwithstanding Section 2.1(b) above, no patent license is granted by a 122 | Contributor: 123 | 124 | a. for any code that a Contributor has removed from Covered Software; or 125 | 126 | b. for infringements caused by: (i) Your and any other third party's 127 | modifications of Covered Software, or (ii) the combination of its 128 | Contributions with other software (except as part of its Contributor 129 | Version); or 130 | 131 | c. under Patent Claims infringed by Covered Software in the absence of 132 | its Contributions. 133 | 134 | This License does not grant any rights in the trademarks, service marks, 135 | or logos of any Contributor (except as may be necessary to comply with 136 | the notice requirements in Section 3.4). 137 | 138 | 2.4. Subsequent Licenses 139 | 140 | No Contributor makes additional grants as a result of Your choice to 141 | distribute the Covered Software under a subsequent version of this 142 | License (see Section 10.2) or under the terms of a Secondary License (if 143 | permitted under the terms of Section 3.3). 144 | 145 | 2.5. Representation 146 | 147 | Each Contributor represents that the Contributor believes its 148 | Contributions are its original creation(s) or it has sufficient rights to 149 | grant the rights to its Contributions conveyed by this License. 150 | 151 | 2.6. Fair Use 152 | 153 | This License is not intended to limit any rights You have under 154 | applicable copyright doctrines of fair use, fair dealing, or other 155 | equivalents. 156 | 157 | 2.7. Conditions 158 | 159 | Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in 160 | Section 2.1. 161 | 162 | 163 | 3. Responsibilities 164 | 165 | 3.1. Distribution of Source Form 166 | 167 | All distribution of Covered Software in Source Code Form, including any 168 | Modifications that You create or to which You contribute, must be under 169 | the terms of this License. You must inform recipients that the Source 170 | Code Form of the Covered Software is governed by the terms of this 171 | License, and how they can obtain a copy of this License. You may not 172 | attempt to alter or restrict the recipients' rights in the Source Code 173 | Form. 174 | 175 | 3.2. Distribution of Executable Form 176 | 177 | If You distribute Covered Software in Executable Form then: 178 | 179 | a. such Covered Software must also be made available in Source Code Form, 180 | as described in Section 3.1, and You must inform recipients of the 181 | Executable Form how they can obtain a copy of such Source Code Form by 182 | reasonable means in a timely manner, at a charge no more than the cost 183 | of distribution to the recipient; and 184 | 185 | b. You may distribute such Executable Form under the terms of this 186 | License, or sublicense it under different terms, provided that the 187 | license for the Executable Form does not attempt to limit or alter the 188 | recipients' rights in the Source Code Form under this License. 189 | 190 | 3.3. Distribution of a Larger Work 191 | 192 | You may create and distribute a Larger Work under terms of Your choice, 193 | provided that You also comply with the requirements of this License for 194 | the Covered Software. If the Larger Work is a combination of Covered 195 | Software with a work governed by one or more Secondary Licenses, and the 196 | Covered Software is not Incompatible With Secondary Licenses, this 197 | License permits You to additionally distribute such Covered Software 198 | under the terms of such Secondary License(s), so that the recipient of 199 | the Larger Work may, at their option, further distribute the Covered 200 | Software under the terms of either this License or such Secondary 201 | License(s). 202 | 203 | 3.4. Notices 204 | 205 | You may not remove or alter the substance of any license notices 206 | (including copyright notices, patent notices, disclaimers of warranty, or 207 | limitations of liability) contained within the Source Code Form of the 208 | Covered Software, except that You may alter any license notices to the 209 | extent required to remedy known factual inaccuracies. 210 | 211 | 3.5. Application of Additional Terms 212 | 213 | You may choose to offer, and to charge a fee for, warranty, support, 214 | indemnity or liability obligations to one or more recipients of Covered 215 | Software. However, You may do so only on Your own behalf, and not on 216 | behalf of any Contributor. You must make it absolutely clear that any 217 | such warranty, support, indemnity, or liability obligation is offered by 218 | You alone, and You hereby agree to indemnify every Contributor for any 219 | liability incurred by such Contributor as a result of warranty, support, 220 | indemnity or liability terms You offer. You may include additional 221 | disclaimers of warranty and limitations of liability specific to any 222 | jurisdiction. 223 | 224 | 4. Inability to Comply Due to Statute or Regulation 225 | 226 | If it is impossible for You to comply with any of the terms of this License 227 | with respect to some or all of the Covered Software due to statute, 228 | judicial order, or regulation then You must: (a) comply with the terms of 229 | this License to the maximum extent possible; and (b) describe the 230 | limitations and the code they affect. Such description must be placed in a 231 | text file included with all distributions of the Covered Software under 232 | this License. Except to the extent prohibited by statute or regulation, 233 | such description must be sufficiently detailed for a recipient of ordinary 234 | skill to be able to understand it. 235 | 236 | 5. Termination 237 | 238 | 5.1. The rights granted under this License will terminate automatically if You 239 | fail to comply with any of its terms. However, if You become compliant, 240 | then the rights granted under this License from a particular Contributor 241 | are reinstated (a) provisionally, unless and until such Contributor 242 | explicitly and finally terminates Your grants, and (b) on an ongoing 243 | basis, if such Contributor fails to notify You of the non-compliance by 244 | some reasonable means prior to 60 days after You have come back into 245 | compliance. Moreover, Your grants from a particular Contributor are 246 | reinstated on an ongoing basis if such Contributor notifies You of the 247 | non-compliance by some reasonable means, this is the first time You have 248 | received notice of non-compliance with this License from such 249 | Contributor, and You become compliant prior to 30 days after Your receipt 250 | of the notice. 251 | 252 | 5.2. If You initiate litigation against any entity by asserting a patent 253 | infringement claim (excluding declaratory judgment actions, 254 | counter-claims, and cross-claims) alleging that a Contributor Version 255 | directly or indirectly infringes any patent, then the rights granted to 256 | You by any and all Contributors for the Covered Software under Section 257 | 2.1 of this License shall terminate. 258 | 259 | 5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user 260 | license agreements (excluding distributors and resellers) which have been 261 | validly granted by You or Your distributors under this License prior to 262 | termination shall survive termination. 263 | 264 | 6. Disclaimer of Warranty 265 | 266 | Covered Software is provided under this License on an "as is" basis, 267 | without warranty of any kind, either expressed, implied, or statutory, 268 | including, without limitation, warranties that the Covered Software is free 269 | of defects, merchantable, fit for a particular purpose or non-infringing. 270 | The entire risk as to the quality and performance of the Covered Software 271 | is with You. Should any Covered Software prove defective in any respect, 272 | You (not any Contributor) assume the cost of any necessary servicing, 273 | repair, or correction. This disclaimer of warranty constitutes an essential 274 | part of this License. No use of any Covered Software is authorized under 275 | this License except under this disclaimer. 276 | 277 | 7. Limitation of Liability 278 | 279 | Under no circumstances and under no legal theory, whether tort (including 280 | negligence), contract, or otherwise, shall any Contributor, or anyone who 281 | distributes Covered Software as permitted above, be liable to You for any 282 | direct, indirect, special, incidental, or consequential damages of any 283 | character including, without limitation, damages for lost profits, loss of 284 | goodwill, work stoppage, computer failure or malfunction, or any and all 285 | other commercial damages or losses, even if such party shall have been 286 | informed of the possibility of such damages. This limitation of liability 287 | shall not apply to liability for death or personal injury resulting from 288 | such party's negligence to the extent applicable law prohibits such 289 | limitation. Some jurisdictions do not allow the exclusion or limitation of 290 | incidental or consequential damages, so this exclusion and limitation may 291 | not apply to You. 292 | 293 | 8. Litigation 294 | 295 | Any litigation relating to this License may be brought only in the courts 296 | of a jurisdiction where the defendant maintains its principal place of 297 | business and such litigation shall be governed by laws of that 298 | jurisdiction, without reference to its conflict-of-law provisions. Nothing 299 | in this Section shall prevent a party's ability to bring cross-claims or 300 | counter-claims. 301 | 302 | 9. Miscellaneous 303 | 304 | This License represents the complete agreement concerning the subject 305 | matter hereof. If any provision of this License is held to be 306 | unenforceable, such provision shall be reformed only to the extent 307 | necessary to make it enforceable. Any law or regulation which provides that 308 | the language of a contract shall be construed against the drafter shall not 309 | be used to construe this License against a Contributor. 310 | 311 | 312 | 10. Versions of the License 313 | 314 | 10.1. New Versions 315 | 316 | Mozilla Foundation is the license steward. Except as provided in Section 317 | 10.3, no one other than the license steward has the right to modify or 318 | publish new versions of this License. Each version will be given a 319 | distinguishing version number. 320 | 321 | 10.2. Effect of New Versions 322 | 323 | You may distribute the Covered Software under the terms of the version 324 | of the License under which You originally received the Covered Software, 325 | or under the terms of any subsequent version published by the license 326 | steward. 327 | 328 | 10.3. Modified Versions 329 | 330 | If you create software not governed by this License, and you want to 331 | create a new license for such software, you may create and use a 332 | modified version of this License if you rename the license and remove 333 | any references to the name of the license steward (except to note that 334 | such modified license differs from this License). 335 | 336 | 10.4. Distributing Source Code Form that is Incompatible With Secondary 337 | Licenses If You choose to distribute Source Code Form that is 338 | Incompatible With Secondary Licenses under the terms of this version of 339 | the License, the notice described in Exhibit B of this License must be 340 | attached. 341 | 342 | Exhibit A - Source Code Form License Notice 343 | 344 | This Source Code Form is subject to the 345 | terms of the Mozilla Public License, v. 346 | 2.0. If a copy of the MPL was not 347 | distributed with this file, You can 348 | obtain one at 349 | http://mozilla.org/MPL/2.0/. 350 | 351 | If it is not possible or desirable to put the notice in a particular file, 352 | then You may include the notice in a location (such as a LICENSE file in a 353 | relevant directory) where a recipient would be likely to look for such a 354 | notice. 355 | 356 | You may add additional accurate notices of copyright ownership. 357 | 358 | Exhibit B - "Incompatible With Secondary Licenses" Notice 359 | 360 | This Source Code Form is "Incompatible 361 | With Secondary Licenses", as defined by 362 | the Mozilla Public License, v. 2.0. -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | HTML5 Security Cheatsheet 2 | ==== 3 | 4 | This is the new home of the H5SC or HTML5 Security Cheatsheet. Here you will find three things: 5 | 6 | * A collection of HTML5 related XSS attack vectors 7 | * A set of useful files for XSS testing 8 | * A set of formerly hidden features useful for XSS testing 9 | 10 | ## The XSS Vectors 11 | 12 | The collection of XSS vectors can be found here: https://html5sec.org/ 13 | 14 | ## Useful Files 15 | 16 | We published a list of files useful for XSS testing in various situations. Currently the following files are available: 17 | 18 | * https://html5sec.org/test.asf 19 | * https://html5sec.org/test.avi 20 | * https://html5sec.org/test.css 21 | * https://html5sec.org/test.dtd 22 | * https://html5sec.org/test.eml 23 | * https://html5sec.org/test.evt 24 | * https://html5sec.org/test.gif 25 | * https://html5sec.org/test.hlp 26 | * https://html5sec.org/test.hta 27 | * https://html5sec.org/test.htc 28 | * https://html5sec.org/test.html 29 | * https://html5sec.org/test.jar 30 | * https://html5sec.org/test.js 31 | * https://html5sec.org/test.json 32 | * https://html5sec.org/test.mpeg 33 | * https://html5sec.org/test.pdf 34 | * https://html5sec.org/test.sct 35 | * https://html5sec.org/test.svg 36 | * https://html5sec.org/test.swf 37 | * https://html5sec.org/test.vbs 38 | * https://html5sec.org/test.vml 39 | * https://html5sec.org/test.wbxml 40 | * https://html5sec.org/test.xbl 41 | * https://html5sec.org/test.xdr 42 | * https://html5sec.org/test.xml 43 | * https://html5sec.org/test.xsl 44 | * https://html5sec.org/test.xxe 45 | * https://html5sec.org/test.zip 46 | * https://html5sec.org/Test.class 47 | 48 | Pull requests welcome, we store the files in the `/attachments` sub-folder. 49 | 50 | ## Hidden Features 51 | 52 | The H5SC currently has three "hidden" features 53 | 54 | * An RSS mode to test feed readers: https://html5sec.org/rss 55 | * `/rss/+/` gives a unix timestamp 300 seconds in future (for ease use) 56 | * `/rss/+123/` gives a unix timestamp 123 seconds in future 57 | * `/rss/1234/` will serve a minimal rss feed until unix time is 1234. 58 | * A JavaScript function to return all vectors as string, isolated and numbered: Go [here](https://html5sec.org/) and execute `vectors()` 59 | * All H5SC vectors in [one text file](https://raw.githubusercontent.com/cure53/H5SC/master/vectors.txt) for easy copy & paste 60 | * A useful search API via GET 61 | * Want all vectors related to `innerHTML`? Open https://html5sec.org/?innerHTML 62 | * Want to link a specific vector? Open https://html5sec.org/#123 63 | * A redirect API resolving to a URL containing XSS payload 64 | * Data URI, no special status: https://html5sec.org/r/data/ 65 | * Data URI, status code `307`: https://html5sec.org/r/data/307 66 | * JavaScript URI, status code `301`: https://html5sec.org/r/javascript/301 67 | * Supported status codes are: `301`, `302`, `303`, `307`, `308`, `999` 68 | * Supported schemes are: `data`, `javascript`, `jar`, `script` (redirecting to https://html5sec.org/%3cscript>alert(1)%3c/script>/) 69 | * More to come soon! 70 | 71 | -------------------------------------------------------------------------------- /attachments/Test.class: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/cure53/H5SC/1a91bbc085426579ebcdefb1bc5450760db3dad5/attachments/Test.class -------------------------------------------------------------------------------- /attachments/test.asf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/cure53/H5SC/1a91bbc085426579ebcdefb1bc5450760db3dad5/attachments/test.asf -------------------------------------------------------------------------------- /attachments/test.avi: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/cure53/H5SC/1a91bbc085426579ebcdefb1bc5450760db3dad5/attachments/test.avi -------------------------------------------------------------------------------- /attachments/test.css: -------------------------------------------------------------------------------- 1 | * { 2 | color: red; 3 | -o-link: 'javascript:alert(1)'; 4 | -o-link-source: current; 5 | x: expression(write(1)); 6 | } 7 | -------------------------------------------------------------------------------- /attachments/test.dtd: -------------------------------------------------------------------------------- 1 | 2 | -------------------------------------------------------------------------------- /attachments/test.eml: -------------------------------------------------------------------------------- 1 | ABCDEFGHIJK 2 | GARBAGE HERE 3 | ABCDEFGHIJK 4 | JUST NO TWO NEWLINES 5 | Content-Type: text/html 6 | Content-Transfer-Encoding: quoted-printable 7 | 8 | =3cs= 9 | cr= 10 | ipt=3e 11 | =61le= 12 | rt=28docu= 13 | ment=2e= 14 | dom=61= 15 | in=29 16 | =3c=2f= 17 | script=3e 18 | 19 | -------------------------------------------------------------------------------- /attachments/test.evt: -------------------------------------------------------------------------------- 1 | 2 | -------------------------------------------------------------------------------- /attachments/test.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/cure53/H5SC/1a91bbc085426579ebcdefb1bc5450760db3dad5/attachments/test.gif -------------------------------------------------------------------------------- /attachments/test.hlp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/cure53/H5SC/1a91bbc085426579ebcdefb1bc5450760db3dad5/attachments/test.hlp -------------------------------------------------------------------------------- /attachments/test.hta: -------------------------------------------------------------------------------- 1 | 2 |
3 | 4 | -------------------------------------------------------------------------------- /attachments/test.htc: -------------------------------------------------------------------------------- 1 | ]]> 2 | -------------------------------------------------------------------------------- /attachments/test.html: -------------------------------------------------------------------------------- 1 | some content without two new line \n\n Content-Type: multipart/related; boundary="******"some content without two new line --****** Content-Location: xss.html Content-Transfer-Encoding: base64 PGlmcmFtZSBuYW1lPWxvIHN0eWxlPWRpc3BsYXk6bm9uZT48L2lmcmFtZT4NCjxzY3JpcHQ+DQp1 cmw9bG9jYXRpb24uaHJlZjtkb2N1bWVudC5nZXRFbGVtZW50c0J5TmFtZSgnbG8nKVswXS5zcmM9 dXJsLnN1YnN0cmluZyg2LHVybC5pbmRleE9mKCcvJywxNSkpO3NldFRpbWVvdXQoImFsZXJ0KGZy YW1lc1snbG8nXS5kb2N1bWVudC5jb29raWUpIiwyMDAwKTsNCjwvc2NyaXB0PiAgICAg -- 2 | -------------------------------------------------------------------------------- /attachments/test.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/cure53/H5SC/1a91bbc085426579ebcdefb1bc5450760db3dad5/attachments/test.jar -------------------------------------------------------------------------------- /attachments/test.js: -------------------------------------------------------------------------------- 1 | alert(1) 2 | -------------------------------------------------------------------------------- /attachments/test.json: -------------------------------------------------------------------------------- 1 | {"xss":alert(1), "url": "javascript:alert(1)"} 2 | -------------------------------------------------------------------------------- /attachments/test.mpeg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/cure53/H5SC/1a91bbc085426579ebcdefb1bc5450760db3dad5/attachments/test.mpeg -------------------------------------------------------------------------------- /attachments/test.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/cure53/H5SC/1a91bbc085426579ebcdefb1bc5450760db3dad5/attachments/test.pdf -------------------------------------------------------------------------------- /attachments/test.sct: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | -------------------------------------------------------------------------------- /attachments/test.svg: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | -------------------------------------------------------------------------------- /attachments/test.swf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/cure53/H5SC/1a91bbc085426579ebcdefb1bc5450760db3dad5/attachments/test.swf -------------------------------------------------------------------------------- /attachments/test.vbs: -------------------------------------------------------------------------------- 1 | msgbox 1 2 | -------------------------------------------------------------------------------- /attachments/test.vml: -------------------------------------------------------------------------------- 1 | 2 | -------------------------------------------------------------------------------- /attachments/test.wbxml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/cure53/H5SC/1a91bbc085426579ebcdefb1bc5450760db3dad5/attachments/test.wbxml -------------------------------------------------------------------------------- /attachments/test.xbl: -------------------------------------------------------------------------------- 1 | 2 | -------------------------------------------------------------------------------- /attachments/test.xdr: -------------------------------------------------------------------------------- 1 | 2 | -------------------------------------------------------------------------------- /attachments/test.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | alert(1) 5 | 6 | 7 | -------------------------------------------------------------------------------- /attachments/test.xsl: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | -------------------------------------------------------------------------------- /attachments/test.xxe: -------------------------------------------------------------------------------- 1 | 2 | -------------------------------------------------------------------------------- /attachments/test.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/cure53/H5SC/1a91bbc085426579ebcdefb1bc5450760db3dad5/attachments/test.zip -------------------------------------------------------------------------------- /bower.json: -------------------------------------------------------------------------------- 1 | { 2 | "name": "h5sc", 3 | "version": "0.0.0", 4 | "main": [ 5 | "items.js", 6 | "payloads.js", 7 | "categories.js" 8 | ] 9 | } 10 | -------------------------------------------------------------------------------- /categories.js: -------------------------------------------------------------------------------- 1 | /* Categories - the available categories */ 2 | (function (root, factory) { 3 | if (typeof define === 'function' && define.amd) { 4 | // AMD. Register as an anonymous module. 5 | define([], factory); 6 | } else if (typeof exports === 'object') { 7 | // Node. Does not work with strict CommonJS, but 8 | // only CommonJS-like environments that support module.exports, 9 | // like Node. 10 | module.exports = factory(); 11 | } else { 12 | // Browser globals (root is window) 13 | root.categories = factory(); 14 | } 15 | }(this, function () { 16 | return { 17 | 'html5' : { 18 | 'en' : 'Vectors making use of HTML5 features', 19 | 'ja' : 'HTML5\u306e\u6a5f\u80fd\u3092\u4f7f\u3063\u305f\u624b\u6cd5', 20 | 'ru' : 'HTML5', 21 | 'cs' : 'Útoky využívající možností HTML5', 22 | 'de' : '', 23 | 'tr' : 'HTML5 özelliklerinden yararlanan vektörler', 24 | 'zh' : 'HTML5特性向量' 25 | }, 26 | 'html' : { 27 | 'en' : 'Vectors working on HTML4 and older versions', 28 | 'ja' : 'HTML4\u4ee5\u524d\u3067\u6a5f\u80fd\u3059\u308b\u624b\u6cd5', 29 | 'ru' : 'HTML4↓', 30 | 'cs' : 'Útoky fungující v HTML4 a starších', 31 | 'de' : '', 32 | 'tr' : 'HTML4 ve eski versiyonlarında çalışan vektörler', 33 | 'zh' : 'HTML4和一些老的向量' 34 | }, 35 | 'css' : { 36 | 'en' : 'Cascading stylesheet injection based vectors', 37 | 'ja' : '\u30b9\u30bf\u30a4\u30eb\u30b7\u30fc\u30c8\u306e\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306b\u3088\u308b\u624b\u6cd5', 38 | 'ru' : 'CSS', 39 | 'cs' : 'Útoky založené na injektáži CSS', 40 | 'de' : '', 41 | 'tr' : 'CSS enjeksiyonu tabanlı vektörler', 42 | 'zh' : '基于CSS注入的向量' 43 | }, 44 | 'javascript' : { 45 | 'en' : 'Plain JavaScript vectors', 46 | 'ja' : '\u30d7\u30ec\u30fc\u30f3\u306aJavaScript\u306b\u3088\u308b\u624b\u6cd5', 47 | 'ru' : 'JavaScript', 48 | 'cs' : 'Útoky obyčejným JavaScriptem', 49 | 'de' : '', 50 | 'tr' : 'Düz JavaScript Vektörleri', 51 | 'zh' : '纯javascript的向量' 52 | }, 53 | 'e4x' : { 54 | 'en' : 'E4X vectors working on gecko based browsers', 55 | 'ja' : 'Gecko\u30d9\u30fc\u30b9\u306e\u30d6\u30e9\u30a6\u30b6\u306b\u5bfe\u3059\u308bE4X\u306b\u3088\u308b\u624b\u6cd5', 56 | 'ru' : 'E4X', 57 | 'cs' : 'Útoky založené na E4X v prohlížečích s jádrem Gecko', 58 | 'de' : '', 59 | 'tr' : 'Gecko tabanlı tarayıcılarda çalışan E4X vektörleri', 60 | 'zh' : 'E4X向量' 61 | }, 62 | 'dom' : { 63 | 'en' : 'Vectors attacking DOM properties and methods', 64 | 'ja' : 'DOM\u30d7\u30ed\u30d1\u30c6\u30a3\u3001\u30e1\u30bd\u30c3\u30c9\u3092\u5229\u7528\u3057\u305f\u624b\u6cd5', 65 | 'ru' : 'DOM', 66 | 'cs' : 'Útoky na vlastnosti a metody DOM', 67 | 'de' : '', 68 | 'tr' : 'DOM özelliklerine ve metotlarına saldıran vektörler', 69 | 'zh' : 'DOM属性与方法的攻击向量' 70 | }, 71 | 'json' : { 72 | 'en' : 'JSON based vectors', 73 | 'ja' : 'JSON\u30d9\u30fc\u30b9\u306e\u624b\u6cd5', 74 | 'ru' : 'JSON', 75 | 'cs' : 'Útoky založené na JSON', 76 | 'de' : '', 77 | 'tr' : 'JSON tabanlı vektörler', 78 | 'zh' : '基于JSON的向量' 79 | }, 80 | 'svg' : { 81 | 'en' : 'Vectors embedded in SVG files', 82 | 'ja' : 'SVG\u30d5\u30a1\u30a4\u30eb\u3078\u306e\u57cb\u3081\u8fbc\u307f\u306b\u3088\u308b\u624b\u6cd5', 83 | 'ru' : 'SVG', 84 | 'cs' : 'Útoky ukryté v SVG', 85 | 'de' : '', 86 | 'tr' : 'SVG dosyalarına gömülü vektörler', 87 | 'zh' : 'SVG内的向量' 88 | }, 89 | 'xml' : { 90 | 'en' : 'Vectors related to X(HT)ML', 91 | 'ja' : 'X\u0028HT\u0029ML\u306b\u95a2\u9023\u3059\u308b\u624b\u6cd5', 92 | 'ru' : 'X(HT)ML', 93 | 'cs' : 'Útoky svázané s X(HT)ML', 94 | 'de' : '', 95 | 'tr' : 'X(HT)ML ile ilgili vektörler', 96 | 'zh' : 'X(HT)ML相关向量' 97 | }, 98 | 'charset' : { 99 | 'en' : 'UTF7 and other exotic charset based vectors', 100 | 'ja' : 'UTF-7\u306a\u3069\u306e\u7279\u6b8a\u306a\u6587\u5b57\u30a8\u30f3\u30b3\u30fc\u30c7\u30a3\u30f3\u30b0\u306b\u3088\u308b\u624b\u6cd5', 101 | 'ru' : 'UTF-7 и др. экзот. код-ки', 102 | 'cs' : 'Útoky založené na UTF-7 a dalších exotických znakových sadách', 103 | 'de' : '', 104 | 'tr' : 'UTF-7 ve diğer egzotik karakter kodlamaları tabanlı vektörler', 105 | 'zh' : 'UTF-7和其它诡异的编码集的向量' 106 | }, 107 | 'dos' : { 108 | 'en' : 'Client side denial of service vectors', 109 | 'ja' : '\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30b5\u30a4\u30c9\u3067\u306e\u30b5\u30fc\u30d3\u30b9\u4e0d\u80fd(DoS)', 110 | 'ru' : 'DoS', 111 | 'cs' : 'Útoky DoS zaměřené na klienta', 112 | 'de' : '', 113 | 'tr' : 'İstemci taraflı servis durdurdma (DoS) vektörleri', 114 | 'zh' : '客户端DOS向量' 115 | }, 116 | 'behavior' : { 117 | 'en' : 'HTML behavior and binding vectors', 118 | 'ja' : 'HTML behavior \u306b\u3088\u308b\u624b\u6cd5', 119 | 'ru' : 'Поведения и связывание данных', 120 | 'cs' : 'Útoky využívající HTML behavior a binding', 121 | 'de' : '', 122 | 'tr' : 'HTML behavior ve binding vektörleri', 123 | 'zh' : 'HTML behavior和binding相关向量' 124 | }, 125 | 'clickjacking' : { 126 | 'en' : 'Clickjacking and UI Redressing vectors', 127 | 'ja' : '', 128 | 'ru' : 'Перехват нажатий и подмена интерфейса', 129 | 'cs' : '', 130 | 'de' : '', 131 | 'tr' : 'Clickjacking ve Kullanıcı Arabirimi değiştirme vektörleri', 132 | 'zh' : 'Clickjacking和UI Redressing的向量' 133 | } 134 | } 135 | })); 136 | -------------------------------------------------------------------------------- /html/images/chrome.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/cure53/H5SC/1a91bbc085426579ebcdefb1bc5450760db3dad5/html/images/chrome.png -------------------------------------------------------------------------------- /html/images/cn.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/cure53/H5SC/1a91bbc085426579ebcdefb1bc5450760db3dad5/html/images/cn.png -------------------------------------------------------------------------------- /html/images/cs.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/cure53/H5SC/1a91bbc085426579ebcdefb1bc5450760db3dad5/html/images/cs.png -------------------------------------------------------------------------------- /html/images/en.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/cure53/H5SC/1a91bbc085426579ebcdefb1bc5450760db3dad5/html/images/en.png -------------------------------------------------------------------------------- /html/images/firefox.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/cure53/H5SC/1a91bbc085426579ebcdefb1bc5450760db3dad5/html/images/firefox.png -------------------------------------------------------------------------------- /html/images/ie.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/cure53/H5SC/1a91bbc085426579ebcdefb1bc5450760db3dad5/html/images/ie.png -------------------------------------------------------------------------------- /html/images/ja.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/cure53/H5SC/1a91bbc085426579ebcdefb1bc5450760db3dad5/html/images/ja.png -------------------------------------------------------------------------------- /html/images/opera.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/cure53/H5SC/1a91bbc085426579ebcdefb1bc5450760db3dad5/html/images/opera.png -------------------------------------------------------------------------------- /html/images/ru.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/cure53/H5SC/1a91bbc085426579ebcdefb1bc5450760db3dad5/html/images/ru.png -------------------------------------------------------------------------------- /html/images/safari.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/cure53/H5SC/1a91bbc085426579ebcdefb1bc5450760db3dad5/html/images/safari.png -------------------------------------------------------------------------------- /html/images/search.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/cure53/H5SC/1a91bbc085426579ebcdefb1bc5450760db3dad5/html/images/search.png -------------------------------------------------------------------------------- /html/images/tr.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/cure53/H5SC/1a91bbc085426579ebcdefb1bc5450760db3dad5/html/images/tr.png -------------------------------------------------------------------------------- /html/index.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | HTML5 Security Cheatsheet 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 |

HTML5 Security CheatsheetWhat your browser does when you look away...

16 | Fork me on GitHub 17 |
18 | 31 | 45 | 46 | 47 | 48 |
49 | Impressum 50 | Datenschutz 51 |
52 | 53 | -------------------------------------------------------------------------------- /html/scripts/import.js: -------------------------------------------------------------------------------- 1 | /** 2 | * Import script for the HTML5 Security Cheatsheet HTML version 3 | */ 4 | (function(){ 5 | window.onload = function() { 6 | // sanitize 7 | var sanitize = function(input){ 8 | output = input.replace(/&/gm, '&') 9 | .replace(//gm, '>'); 10 | return output; 11 | }; 12 | // rudimentary off-line support 13 | (function(){ 14 | var offline = function(){ 15 | var store = JSON.parse(localStorage[location.hostname]); 16 | items = store.items; 17 | categories = store.categories; 18 | payloads = store.payloads; 19 | $('#offline').show(); 20 | }; 21 | if(navigator.onLine || typeof navigator.onLine === 'undefined') { 22 | try { 23 | localStorage[location.hostname]=JSON.stringify( 24 | {'items':items,'payloads':payloads,'categories':categories} 25 | ); 26 | $(window).bind('offline', offline); 27 | $(window).bind('online', function(){$('#offline').hide()}) 28 | $('#offline').hide(); 29 | } catch(e){} 30 | } else { 31 | offline(); 32 | } 33 | })(); 34 | // categories 35 | (function() { 36 | // enumerate categories and build initial lists 37 | for(var category in categories) { 38 | // determine cookie or navigator language or set default 39 | if (/lang=\w{2}/.test(document.cookie)) { 40 | var lang = document.cookie.match(/lang=(\w{2})/)[1]; 41 | } 42 | else { 43 | var userLang = navigator.language||navigator.browserLanguage; 44 | var lang = userLang ? userLang.match(/(\w{2})/)[1] : 'en'; 45 | } 46 | if(typeof categories[category][lang] === 'undefined' 47 | || !categories[category][lang]) { 48 | lang = 'en'; 49 | } 50 | // check if translated items exist 51 | if (typeof categories[category][lang] === 'string') { 52 | $('#content').append('

  • ' 53 | + categories[category][lang] + '

    • '); 54 | $('#sidebar').append('
  • ' 55 | + categories[category][lang] + '
    • '); 56 | } 57 | } 58 | $('#content li').wrap('