Serves a marker payload, or one you supply, with a chosen Content-Type.
| URL | Response | Content-Type |
|---|---|---|
| /html | <script>window.xsstest=12345</script> | text/html |
| /js | window.xsstest=12345 | text/javascript |
| /html?code=xxx | xxx | text/html |
| /js?code=xxx | xxx | text/javascript |
| /html?b64=xxx | base64_decode(xxx) | text/html |
| /js?b64=xxx | base64_decode(xxx) | text/javascript |
The marker payload sets window.xsstest=12345, so a successful
injection is detectable by reading that property back.
code wins if both parameters are given. Values are
percent-decoded byte-for-byte, including sequences that are not valid UTF-8;
+ is kept literal rather than read as a space, so base64 padding
and 1+1 both survive. Use %20 for a space.
b64 accepts the standard and URL-safe alphabets, padded or not.