alert("This page is XSS vulnerable."); //
console.log("This page is XSS vulnerable."); /*

XSS test page

This page can be embedded to test XSS atacks with little space available. The common shortest XSS vector is <img src=# onerror=alert()> = 27 characters, but it allows for no custom alert message to be shown.
Use <script src=//><script> = 30 characters. The vector just fits into 32-byte limited fields (like WPA SSIDs). If the page is XSS-vulnerable an alert window will display "This page is XSS vulnerable".

If you want your own code to be hosted under (which still fits into 32 bytes), you can use my xsshost service. In case you have questions, drop me a note on Twitter.

A project by