HTML5 Security Cheatsheet

This is the home of the H5SC or HTML5 Security Cheatsheet. Here you will find three things:

• A collection of HTML5 related XSS attack vectors
• A set of useful files for XSS testing
• A set of formerly hidden features useful for XSS testing

Project status

The H5SC is an archive, kept online and readable on purpose. The 149 vectors were collected and verified between 2010 and 2016, with the last additions in 2022. They document how browsers behaved in that period, and that is the value of the collection: a large share of what sanitizers, filters and browsers do today exists because of what is catalogued here.

What this means in practice:

• The browsers field of each vector describes the engines of its day. "latest" means "latest as of when the vector was verified", not "current". Internet Explorer, Presto-era Opera, E4X, XBL, behavior: and VML entries describe engines that no longer ship, but still turn up in mail clients, embedded webviews and legacy sanitizer code.
• Vectors are not re-verified against current browsers and there are no plans to re-verify them. Entries are not removed either. A vector that stopped working is still a record of a parser behaviour that once existed and may exist again elsewhere.
• New vectors are accepted when they are of the same kind as the collection: a single markup snippet that executes script in a named engine, with a reporter credit.

For a living, engine-verified list of XSS payloads see PortSwigger's Cross-Site Scripting cheat sheet. For the reasoning behind attack classes rather than individual payloads, see the DOMPurify wiki page Attack Classes & Bypass History. For markup that causes requests rather than script execution, see HTTPLeaks.

The XSS Vectors

The collection of XSS vectors can be found here: https://html5sec.org/

The data lives in this repository as plain JavaScript modules and can be used without the site:

• items.js - the 149 vectors with name, payload, description, fix advice, browser matrix, tags and reporter, in seven languages (en, ja, ru, cs, de, tr, zh; not every entry has every translation).
• payloads.js - the %js_alert%-style placeholders the vectors are written against, so the same vector can be rendered with an alert, a confirm, or your own probe.
• categories.js - the category labels.
• vectors.txt - all vectors in one text file for easy copy and paste.

lib/index.js exposes all three as a CommonJS module.

Useful Files

We published a list of files useful for XSS testing in various situations. They are served from https://html5sec.org/ and stored in the /attachments sub-folder of this repository:

• https://html5sec.org/test.asf
• https://html5sec.org/test.avi
• https://html5sec.org/test.css
• https://html5sec.org/test.dtd
• https://html5sec.org/test.eml
• https://html5sec.org/test.evt
• https://html5sec.org/test.gif
• https://html5sec.org/test.hlp
• https://html5sec.org/test.hta
• https://html5sec.org/test.htc
• https://html5sec.org/test.html
• https://html5sec.org/test.jar
• https://html5sec.org/test.js
• https://html5sec.org/test.json
• https://html5sec.org/test.mpeg
• https://html5sec.org/test.pdf
• https://html5sec.org/test.sct
• https://html5sec.org/test.svg
• https://html5sec.org/test.swf
• https://html5sec.org/test.vbs
• https://html5sec.org/test.vml
• https://html5sec.org/test.wbxml
• https://html5sec.org/test.xbl
• https://html5sec.org/test.xdr
• https://html5sec.org/test.xml
• https://html5sec.org/test.xsl
• https://html5sec.org/test.xxe
• https://html5sec.org/test.zip
• https://html5sec.org/Test.class

Pull requests welcome.

Hidden Features

The H5SC has a few "hidden" features on https://html5sec.org/:

• An RSS mode to test feed readers: https://html5sec.org/rss
• /rss/+/ gives a unix timestamp 300 seconds in future (for ease use)
• /rss/+123/ gives a unix timestamp 123 seconds in future
• /rss/1234/ will serve a minimal rss feed until unix time is 1234.
• A JavaScript function to return all vectors as string, isolated and numbered: Go here and execute vectors()
• All H5SC vectors in one text file for easy copy & paste
• A useful search API via GET
• Want all vectors related to innerHTML? Open https://html5sec.org/?innerHTML
• Want to link a specific vector? Open https://html5sec.org/#123
• A redirect API resolving to a URL containing XSS payload
• Data URI, no special status: https://html5sec.org/r/data/
• Data URI, status code 307: https://html5sec.org/r/data/307
• JavaScript URI, status code 301: https://html5sec.org/r/javascript/301
• Supported status codes are: 301, 302, 303, 307, 308, 999
• Supported schemes are: data, javascript, jar, script (redirecting to https://html5sec.org/%3cscript>alert(1)%3c/script>/)

Contributing

If you have a vector that belongs here, open a pull request against items.js. Copy the shape of an existing entry, use the next free id, fill in at least the en strings, list the engines and versions you verified it in, and credit the reporter. Translations of existing entries are welcome too; the de strings in particular are mostly empty.

License

Mozilla Public License 2.0, see LICENSE.