From d56f36488af2969b1e94f1d9bd04c3950d75a0d2 Mon Sep 17 00:00:00 2001 From: ShadowByte <155693555+ShadowByte1@users.noreply.github.com> Date: Wed, 7 Aug 2024 11:20:13 +1000 Subject: [PATCH] Update README.md --- README.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/README.md b/README.md index 8879c1e..a4821e3 100644 --- a/README.md +++ b/README.md @@ -585,6 +585,13 @@ If script tags and event handler attributes are blogged you can try to leverage Exploiting SQL errors if you see SQL errors, they are often not sanitized. This means they are worth checking for reflected xss. This doesn't only apply to SQL specifically but its the context I've seen this most +Exif Data Injection to XSS +Inject XSS Payloads into Exif data if the form is not sanitized properly +Use a tool like ExifTool to embed a JavaScript payload in the EXIF metadata of an image. +``` +exiftool -Title='' image.jpg +``` + Exploiting WebAssembly WebAssembly (Wasm) code that includes user input can be manipulated to execute malicious scripts. ```