Timeline for 15 Characters or Shorter XSS Payloads

8 events

when toggle format	what		by	license	comment
Dec 22, 2016 at 4:06	comment	added	dandavis		fwiw, i couldn't think of much to do even with 15 chars of JS. 3-8 chars is likely harmless since quotes or parens would use up 2 of those, leaving 1-6 chars. i'd look into it more if the questioned weren't closed...
Dec 22, 2016 at 3:50	vote	accept	Jack
Dec 22, 2016 at 3:50	comment	added	dandavis		ah, well with including script tags, then i would think 15 chars is too little as `<script></script>` is 17 chars, and `<b onclick=>` leaves only 3 chars of attack; not enough.
Dec 22, 2016 at 3:47	comment	added	Jack		@dandavis thanks, but alert(666) alone doesn't run, and I can't fit <script> or javascript
Dec 22, 2016 at 3:47	answer	added	thel3l		timeline score: 2
Dec 22, 2016 at 3:34	comment	added	dandavis		i use `alert(666)` a lot. something like `open("//ab.cd")` can be made bad. if you have an upload vuln, `location=/bad/` can be used to run more code.
Dec 22, 2016 at 3:31	review	First posts
Dec 22, 2016 at 3:44
Dec 22, 2016 at 3:27	history	asked	Jack	CC BY-SA 3.0