Click the title

XSS Payload Test Suite for Hive Frontends ``` ⚠️ FOR AUTHORIZED TESTING ONLY Do not use against systems without explicit written permission. Report ID: AUDIT-20260322 Auditor: louis88 ``` > **Purpose:** Post each payload as a Hive blockchain post body to test sanitization > across condenser and other Hive frontends. All payloads use `alert(1)` or > `alert(document.domain)` as a benign proof-of-concept indicator. > > **How to use:** Each section contains payloads wrapped in markdown code fences > for reference, followed by the raw payload to copy. Test each payload as: > 1. A standalone post body > 2. Wrapped in `...` tags (triggers the raw HTML path in MarkdownViewer) > 3. Inside a markdown paragraph mixed with normal text > 4. As a comment on an existing post --- ## Table of Contents 1. [Standard Vectors](#1-standard-vectors) 2. [HTML Tag Event Handlers — Exhaustive](#2-html-tag-event-handlers--exhaustive) 3. [SVG Vectors](#3-svg-vectors) 4. [MathML Vectors](#4-mathml-vectors) 5. [HTML5 Semantic & Obscure Tags](#5-html5-semantic--obscure-tags) 6. [Encoding Bypass Vectors](#6-encoding-bypass-vectors) 7. [Unicode & Character Tricks](#7-unicode--character-tricks) 8. [CSS-Based Vectors](#8-css-based-vectors) 9. [Markdown-Specific Vectors](#9-markdown-specific-vectors) 10. [Mutation XSS (mXSS)](#10-mutation-xss-mxss) 11. [DOM Clobbering Chains](#11-dom-clobbering-chains) 12. [Template & Framework-Specific](#12-template--framework-specific) 13. [Protocol Handler Abuse](#13-protocol-handler-abuse) 14. [Meta & Base Tag Injection](#14-meta--base-tag-injection) 15. [Form & Input Hijacking](#15-form--input-hijacking) 16. [Object, Embed & Applet](#16-object-embed--applet) 17. [Media Elements](#17-media-elements) 18. [Focus & Autofocus Chains](#18-focus--autofocus-chains) 19. [Animation & Transition Events](#19-animation--transition-events) 20. [Content-Editable & Designmode](#20-content-editable--designmode) 21. [Polyglot Payloads](#21-polyglot-payloads) 22. [DOMPurify Specific Bypasses](#22-dompurify-specific-bypasses) 23. [Condenser html-Wrapper Path](#23-condenser-html-wrapper-path) 24. [Dangling Markup Injection](#24-dangling-markup-injection) 25. [Tab-Nabbing & Window Reference](#25-tab-nabbing--window-reference) 26. [Exotic Attribute Vectors](#26-exotic-attribute-vectors) 27. [Regex Sanitizer Bypass Techniques](#27-regex-sanitizer-bypass-techniques) 28. [Obfuscation & Evasion Techniques](#28-obfuscation--evasion-techniques) 29. [Payload Chaining & Multi-Stage](#29-payload-chaining--multi-stage) --- ## 1. Standard Vectors Classic payloads that every sanitizer should catch. If any of these fire, the sanitizer is fundamentally broken. ``` XSS-STD-001 ``` ``` XSS-STD-002 ``` ``` XSS-STD-003 ``` ``` XSS-STD-004 ``` ``` XSS-STD-005 ``` ``` XSS-STD-006 — Script with CDATA (XHTML context) ``` ``` XSS-STD-007 — Closing existing tag context ``` ``` XSS-STD-008 — Closing textarea context ``` ``` XSS-STD-009 — Closing noscript context ``` ``` XSS-STD-010 — Line breaks in tag ``` alert(1) --- ## 2. HTML Tag Event Handlers — Exhaustive Comprehensive list of every HTML event handler attribute. Many sanitizers only block `onerror` and `onload` but miss obscure handlers. ### 2.1 Mouse Events ``` XSS-EVT-001 ```

``` XSS-EVT-002 ```

HOVER ME

``` XSS-EVT-003 ```

HOVER ME

``` XSS-EVT-004 ```

HOVER THEN LEAVE

``` XSS-EVT-005 ```

CLICK ME

``` XSS-EVT-006 ```

CLICK ME

``` XSS-EVT-007 ```

MOVE OVER ME

``` XSS-EVT-008 ```

LEAVE ME

``` XSS-EVT-009 ```

CLICK ME

``` XSS-EVT-010 ```

DOUBLE CLICK

``` XSS-EVT-011 ```

RIGHT CLICK ME

``` XSS-EVT-012 ```

SCROLL ON ME

### 2.2 Keyboard Events ``` XSS-EVT-013 ``` ``` XSS-EVT-014 ``` ``` XSS-EVT-015 ``` ### 2.3 Load / Lifecycle Events ``` XSS-EVT-016 ``` ``` XSS-EVT-017 ```

``` XSS-EVT-018 ``` ``` XSS-EVT-019 ``` ``` XSS-EVT-020 ``` ``` XSS-EVT-021 ``` ``` XSS-EVT-022 ``` ``` XSS-EVT-023 ```

``` XSS-EVT-024 ```

``` XSS-EVT-025 ```