Tencent (TSRC) — DOM-XSS PoC host

Live verification host for the Tencent XSS engagement. Requests to this host are logged (JSON) with timestamp, path, query and headers, so any report can cite a live, reproducible test.

Phase 2 deliverable

Phase 2 report (HTML) — controlled verification (read-only).

Phase 2 result: both approved candidates dead-ended. A — jiazhang location.search redirect: no reflection (identical bytes/ETag, no query parser). B — exmail /qy_mng_logic/wwhelp: real .html() sink but the endpoint takes no parameters and ignores the query (8 benign params → byte-identical body); hot_log_html is server-authored. No reportable finding.

Phase 1 deliverable

Phase 1 report (HTML) — full static & DOM analysis.

Candidate summary (Phase 1, static)

#	Host	Sink	Reachability	Confidence
1	*.exmail.qq.com	`$(".index_hot_wrap").html(n.data.hot_log_html)`	needs server data control (`/qy_mng_logic/wwhelp`)	Low–Med
2	app.mail.qq.com	`andriod_app_download.href` from `from`/`kvclick`	fixed HTTPS prefix, property assignment	None
3	jiazhang.qq.com	`document.write` (domain trampoline)	internal/defensive	None
4	jiazhang.qq.com	swiper `hashNavigation`	hash compared to `data-hash` only	None
5	jiazhang.qq.com	redirect with `location.search`	static target, no DOM sink	None
6	*.exmail.qq.com	`getUrlParam` (unescape)	AJAX param only, no DOM sink	None

Honest verdict: no confirmed DOM-based XSS in Phase 1 (static only). One genuine executing HTML sink exists (candidate #1, exmail), pending a server-side question for a controlled Phase 2 round.

Live PoC pages

POST /collect — request/canary collector (POST-only; validated, writes to the collector log via 127.0.0.1:8780). Not a GET page.
Additional PoC pages will be added under /poc/* in Phase 2 after operator approval.

Logging

All requests → /var/log/caddy/tencent-poc-access.log (JSON: time, remote_ip, method, host, uri, headers, status).