Gist 6ed3f84640838d8320f6b209b1628e41

100%

Gist 6ed3f84640838d8320f6b209b1628e41

✓ Published0🌍 Public

Last edited Oct 5, 2018

Created on Oct 5, 2018

This example demonstrates a cross-site scripting (XSS) proof-of-concept that exfiltrates a visitor’s cookies. The code uses a raw JavaScript payload with `document.write` to inject an `<img>` tag, which fires a request to a user-supplied Ngrok URL, appending `document.cookie` as a query parameter. It shows a simple, direct attack vector for testing XSS vulnerabilities, relying on the browser’s automatic image request to send data to an external server. The visualization is the code itself, presented as a threat-modeling sample rather than a chart.

AI-generated description

Similar vizzes

Loading thumbnail…

Gist 6caf9fb33f0b7bf1fe0b594b403dc053

This example demonstrates a potential security exploit rather than a data visualization. The PHP code generates an HTML script tag that uses JavaScript to send the visitor’s cookies to a remote webhook URL via an img request. It relies on the `document.cookie` API to capture cookie data and the `document.write` method to inject the tracking pixel. The rendering approach is purely client-side, with no charting or visualization libraries involved. The piece highlights how insecure code can misuse basic web technologies for data exfiltration.

PPeleke

84% match

Loading thumbnail…

Gist 055a86617685691db7632fcb10fb8bc8

This example demonstrates a simulated cross-site scripting (XSS) attack via remote file inclusion, visually rendering a PHP script’s output as an alert dialog that exposes `document.cookie`. The visualization uses a plain HTML page to embed the PHP snippet, with the code directly echoing a `<script>` tag that triggers the alert. It relies on the browser’s native JavaScript execution rather than external libraries, showing the raw mechanism of injecting client-side code through a server-side include. The rendering approach is minimal, presenting the source code and its resulting runtime behavior side by side.

PPeleke

81% match

Loading thumbnail…

Gist 6b1a5d43e458a795e475b14a5d9dbeac

This example demonstrates a malicious PHP file embedded within a GitHub gist, where an `echo` statement outputs `<h3>HACKED</h3>` to the page. The code uses the PHP `echo` language construct to directly inject HTML into the response, simulating a simple cross-site scripting or content injection attack. The gist syntax-highlights the PHP code, showing how a plain text file can carry executable server-side logic. The example highlights the security risk of trusting raw gist content, as the code appears as a static file but would execute if processed by a PHP-enabled server.

PPeleke

68% match

Loading thumbnail…

Gist 16d0e6050f60256517db942d1fe29703

This example demonstrates a technique for remotely fetching and inspecting CSS stylesheets, particularly extracting image URLs from `srcset` attributes and resolving cross-origin stylesheet rules. The code uses the Fetch API with a CORS proxy to retrieve stylesheet contents, then parses `srcset` strings with a custom regular expression to collect image candidates. It also leverages `document.styleSheets`, `cssRules`, and a temporary `<style>` element to access rule data, while caching processed elements in a `WeakSet` to avoid duplication. The visualization output is logged to the console, showing the collected stylesheet rules and image URLs from the current page.

NN0taN3rd

59% match

Loading thumbnail…

Gist a0b52845de084cc3c135d878987abc87

This example demonstrates a Python script that logs into the Premier League fantasy football website and captures authentication cookies. It shows the redirect chain and cookie-handling process during login. The code uses the `requests` library to post login credentials and manually follows HTTP redirects while printing cookie names and values at each step. It relies on credentials imported from a `constants` module and includes a hardcoded `datadome` cookie from a prior session. The visualization is a code-based demonstration of session management, not a graphical output.

CConorAspell

56% match

Loading thumbnail…

Gist 46310a031af739a3b3941d63cd6cb33c

This visualization demonstrates the process of generating and displaying an SSH key, showing step-by-step terminal commands and their outputs. The code uses vanilla JavaScript and HTML/CSS to render a structured guide with command examples, including `ssh-keygen` variations and `cat` commands for viewing public keys. It presents the data as a static, text-based instructional card, with syntax highlighting applied to differentiate commands from comments and output. The interface relies on simple DOM manipulation and CSS styling rather than charting or mapping libraries.

MMistyBlunch

56% match

Loading thumbnail…

Gist 2d272134b57b02eb8cdd0c5904249591

This example tests the archival fidelity of a web page by loading a series of images and scripts that mimic dynamic behavior, including DOM manipulation, AJAX requests, and delayed updates. It uses JavaScript’s `XMLHttpRequest` to fetch remote images and replaces them via base64 data URLs, while `setTimeout` and scroll events trigger asynchronous content changes. The page is rendered within an iframe by the pywb web archiving tool, with a banner and rewrite layer applied. The visualization demonstrates how archived sites handle live interactions and resource loading over time.

NN0taN3rd

56% match

Loading thumbnail…

Gist ca8ce8dbd8dbba7b501860f3d569f019

This example demonstrates a lightweight Express server that acts as a CORS proxy for a joke API, enabling browser-based requests to bypass cross-origin restrictions. The code uses the `express` and `request` libraries to define a route, `/jokes/random`, which forwards requests to `https://joke-api-strict-cors.appspot.com/jokes/random` and relays the JSON response back to the client. A middleware sets the `Access-Control-Allow-Origin` header to `*`, allowing any frontend to access the proxied data. The server listens on a configurable port, defaulting to 3000, and handles errors by returning a JSON error object. This setup illustrates a simple server-side solution for enabling client-side data fetching from a restricted external source.

115Dkatz

55% match