Export to GitHub

html5security - issue #1

JSON format proposal for a single vector item


Posted on Apr 26, 2010 by Massive Lion

We need a JSON based format ton store the single vectors including category, tags, default payload and other meta information.

Here's a first proposal:

{id:'',type:'',name:'',browsers:{'':[],'':[]},payload:{'':'','':''},tags:[]}

Example usage:

{id:1, type:2, name:'XSS via onscroll', browsers:{'FF':['3.5','3.6'],'GC':['4','5']},payload:{'position_a_and_c':'alert(1)'},tags:['xss', 'html5', 'ff', 'gc']}

This enables users to use own files specifying payload assigned to a vector by its id - while we provide a default version. People can so create scanners based on the JSON file and fill it with own custom stuff and overwrite anything they need.

Suggestions welcome!

Comment #1

Posted on Apr 26, 2010 by Massive Lion

Example form the project homepage:

{{{ X

{ id:1, type:2, name:'XSS via onscroll', data: 'X', description: 'A small vector displaying the HTML5 form and formac ... the supported browsers.', browsers:{'Opera':['10.5']}, payload:{'pos_1':'javascript:alert(1)'}, tags:['xss', 'html5', 'ff', 'gc'] } }}}

Comment #2

Posted on May 1, 2010 by Massive Lion

(No comment was entered for this change.)

Comment #3

Posted on May 1, 2010 by Massive Lion

(No comment was entered for this change.)

Status: Fixed

Labels:
Type-Defect Priority-High