Images

• Harmless images:
  • BMP
  • JPEG
  • PNG
  • SVG
• XSS SVGs:
  • just log with console.error
  • alert
  • prompt
  • confirm
  • alert of document.cookie
  • alert of location.href
  • eval of location.hash (Usage: add code to evaluate as hash to the URL of the page like xss-console-eval_hash.svg#alert(location.href))
• Denial of Service:
  • lottapixel.jpg (JPEG with maximum dimensions)

• You can customize xss-template.svg and run create-xss-svg-variants.sh to generate custom images.
• You can also customize the harmless images by modifying harmless.svg and running create-harmless-images.sh.