Test files › Security and validation › html-xss-payloads.html

Sample HTML file

Name: Sample HTML file: html-xss-payloads.html
Creator: HEXAQA
License: https://creativecommons.org/publicdomain/zero/1.0/

A catalogue of common XSS vectors - inline script, event handlers, javascript: URLs, SVG and iframe payloads. Every payload calls console.log only.

↓ Download html-xss-payloads.html

Filename	`html-xss-payloads.html`
Format	HTML
Size	855 bytes (855 bytes)
MIME type	`text/html; charset=utf-8`
SHA-256	`6be860331959cf4a89a293a213f56912a5378c1db21a79cdd885a8e7daf87ef2`

What this file catchesHTML sanitisers, rich-text editors and preview renderers. Feed this through your sanitiser and diff the output: anything executable that survives is a finding.

Download & verify

curl -fsSL -o "html-xss-payloads.html" "https://files.hexaqa.com/security/html-xss-payloads.html"

curl -fsSL "https://files.hexaqa.com/security/html-xss-payloads.html" | sha256sum # expect: 6be860331959cf4a89a293a213f56912a5378c1db21a79cdd885a8e7daf87ef2

More security and validation test files

eicar.com.txt gtube-spam.txt path-traversal-payloads.txt polyglot-gif-html.gif shell-script.sh sql-injection-payloads.txt windows-batch.bat

← All Security and validation files