Malicious RSS Tests

Background Info: Hacking Feeds: Malware Javascript in RSS and Atom and Hacking RSS: The Threat is Real

Last update: August 10, 2006

Each feed tests for a javascript insertion weaknesses in various RSS 2.0 elements.

Plain script insertion: malicious_1.rss
Entity encoded insertion: malicious_2.rss
Double Entity encoded insertion: malicious_2.1.rss
Hex code insertion: malicious_3.rss
Hex/entity mixed insertion:malicious_3.1.rss
Decimal code insertion: malicious_4.rss
Decimal/entity mixed insertion: malicious_4.1.rss
Miscellaneous (CSS, Image onload, Entity declaration) insertions: malicious_5.rss

OPML of all scripts.

WARNING! These scripts could seriously screw things up. Use at your own risk.
If you would like to suggest new variations or report your findings, feel free to do so here.