Working on a pretty interesting XSS right now, I think I have my final payload but just for fun I'm wondering if anyone has any suggestions for shorter/less complicated ways to pop an alert here.

Current payload:

<img src=x onerror="constructor.constructor%0a(window['%5Cx53tring']['from%5Cx43har%5Cx43ode'](97,108,101,114,116,40,41))()">

We're injecting into a RESTful context so that comes with some interesting implications:

1. uppercase characters get normalized to lowercase so I used hex escapes to reference String.fromCharCode().
2. backslashes get normalized to forward slashes and the payload gets truncated at the first occurrence; hence the URL encoding for the hex escapes.

Where also injecting into an innerHTML sink so anything that gets executed synchronously like script tags to call resources from an origin we control are also out of the question. I found that using white space characters in between a function and its parameter declaration prevented the WAF from triggering (i.e. alert(1) wont work but alert%0a(1) will)

My knowledge of esoteric JS stops me here :(, so I was curious to see what others might come up with.

Edit:

We can pop an alert with the following payload:

<img src=x onerror=“alert%0a()”>

But I would like to keep using String.fromCharCode() or similar as that prevents us from having to tailor longer payloads to not trigger the WAF.

Hey r/xss

I want to share a simple yet effective script to scan a list of URLs for reflected XSS vulnerabilities. This tool uses custom payloads, supports HTTP/2, and rotates User-Agent strings to reduce detection.

Features:

• Concurrent scanning for faster results
• Custom payload support
• User-Agent rotation
• Detailed logging and results output

Additional Capabilities: You can also modify the payload to detect other vulnerabilities like SQL injection.

Check out the full details and get the script on GitHub

https://github.com/ManShum812/ReflectedXSS-Finder

I’d love to get your feedback, and if you find it helpful, please give it a star on GitHub!

The web page reflects back the value of the User-Agent header in a JavaScript string context. You can "exploit" it by intercepting a request in your proxy of choice and changing your User-Agent header to something like '-alert()-', but as far as I know, you can't force a victim's browser to change the User-Agent header on a page that it will render.

You can change the User-Agent header value in request made using XMLHttpRequest() and fetch() (as long as you aren't using Chrome/Chromium), but as far as I know, there's no way to make a victim's browser render them in the context of that domain.

A mock up of the potentially vulnerable page is here: https://kprthsuw6achwemqowqus2uwge0wbwoe.lambda-url.us-east-1.on.aws/

I'd love to know whether someone finds a way to exploit this

I put together a lab for a technique that used to work, but it appears it's not exploitable in modern browsers.

The idea is that an endpoint expects JSON data, so it should only be accessible either same-origin, or explicitly allowed by CORS. However, the endpoint doesn't verify the MIME type. So it's possible to craft a cross domain form, something like:

<input type="hidden" name="{&quot;foo&quot:&quotbar" value="&quot;}">

And this would create body content like this:

{"foo":"bar="}

Which could get through a JSON parser! However, it appears that Chrome now URL encodes some of these characters, so I think it is non-exploitable now.

(Just realised the title is a little confusing: form POSTs have always been URL encoded, but Chrome has extended the set of characters that get encoded)

This lab reflects the raw URL parameter. If you send a direct request using Zap or similar, it reflects < and >. However, if you try to exploit in Chrome, the browser URL-encodes the payload, making it non-exploitable. Is there a way to exploit this in a modern browser?

I've built a site to help people learn & collaborate on xss: XSSy

There are a number of labs there already ranging from easy to very hard.

It has a headless browser to verify payloads and successful submitters go on the hall of fame.

It also has a feature I've not seen elsewhere: you can create and share your own labs. I though this would be particularly useful if you encounter an unusual XSS scenario and wanted to crowd source solutions.

Please, give it a go, and tell your friends. And feel free to feed back to me any issues, feature requests, etc. Happy XSSing!

Hey There everyone!
I am new here! I would like to ask did you guys manage to solve the xss assessment? because I’ve been trying for a full day now with no real progress!

Thanks in advance 

https://preview.redd.it/iwf3l17tc8zc1.png?width=1585&format=png&auto=webp&s=97750938048fe2a1a79a01910f0203401fb69cc9

i found xss vulnerability from scannner but the thing is that i am not able to exploit it can guys anyone help me to do that i really appreciate that.

https://www.spaceship.com/domains"sTYLe='zzz:Expre%2F**%2FSSion(RFVu(9253))'bad="/cctld/io/ 4

https://preview.redd.it/pz65pdfvc8zc1.png?width=802&format=png&auto=webp&s=ba5812858098795873efdc92b8aac5cb094101a1

Folks I wanna escalate that svg payload to include location.href and redirect the victim ultimately..

Hey, imagine that we have these tags filtered. script|iframe|svg and also the word 'on' is filter (which means we cannot use <img/src/onerror=alert> or other vectors like this). Could you guys please tell me which HTML tag I can use to run the JS code? (All the filters are case-insensitive.)

https://xss.challenge.training.hacq.me/challenges/easy04.php
I am trying to solve the above challenge
Not able to exploit the vulnerability with symbols blocked.
If you guys have solved it what is the solution??

I've recently started looking at web hacking on burpsuite and have just began the XSS module. In the labs im currently doing : Lab: DOM XSS in document.write sink using source location.search. I've completed the lab but I don't understand how the XSS works in some places not others. On the test i search for 'abc' and notice it's reflected in two places. <h1>0 search results for 'abc'</h1> and <img src="/resources/images/tracker.gif?searchTerms=abc" e17walpp1="">. I figured out how to cause an XSS in the <img tag> with " onerror="alert(1)". I then wanted to try cause an xss in the <h1> tag and ended up with this <h1>0 search results for ''</h1><script>alert(1)</script>'<h1></h1> even though it's perfectly reflected in the source code, why does this not cause an alert? Sorry if this is a stupid question but I've just started and can't figure it out, thanks.

Hey, I’m testing my friends website. How would someone extract everyone’s cookies or session ID’s from an insecure website? Any templates or prompts?

Thanks

Hi,

There's a feature on burp which allows us to filter by parameter's, is such a feature available on zap? I was able to spider a website with zap, now I want to view the request which have parameter's in them, any idea how I can achieve this?

Thank you!

Am I allowed to test for reflected XSS on any website? Like, if the website dont have bug bounty program, can i still test on it?

I have a question, or rather two, first, in what environment do hackers work? Maybe Kali Linux?, and second, where do these hackers get their training, because really to what extent I have studied and my thoughts tell me that Black hats are always one step ahead of white hats or Ethical Hackers.

A lot of websites now have chatbots that are just wrappers around an API call to GPT3 or a comparable LLM.

Sometimes these chatbot interfaces aren't properly sanitised. The user inputs won't work, but if you can talk the GPT into writing the XSS payload for you, it actually executes because the devs didn't anticipate their own chatbot attacking the site.

I was trying on my own website to steal my cookies of another website but I don't really know how to...

Any help? I mean, once you get into my website a script appears and steal my cookies from a specific domain, is that possible?

​

Thank you in advance

A part of the page we add a bunch of hidden inputs into which we write string values, primarily for changing language strings. The values are loaded from a database table

In the javascript we might do something like

var welcome = $('#lang_welcome').val();
$('#head_title').innerHtml(welcome);

This is a bit of a contrived example but is a simplified version of what we are doing. As none of the values are user entered data or taken from queries or param I would have thought this is safe but the argument is that someone could change the value of the input to be something malicious which would then been written to the dom. I'd have thought that if someone has access to change the input value then they've got enough access to write to the dom anyway.

Can someone explain what the security issue is here as my understanding was you always escape untrusted data but it appears that I have to sanitise every change to the dom regardless of the source.

first char: ~ second char: . third char: _ fourth char: - and of course all alphabets are allowed

Although it seems very vulnerable, I can't seem to find an XSS that works on chrome ( haven't tried other browsers )

Here is a link to play around with:
https://xsstests.tiiny.site/

Tried googling but didn't find any way! I found a directory of domain where images are broken and page is messed up any ways i can inject xss ? I tried it on inspection it goes self attack

Hello hackers, I would like to know if my find is a valid XSS or just an auto XSS. Well, I was browsing through the platform of an online course that I'm taking, so I decided to intercept some requests in a questionnaire that I was answering. When sending one of the requests to Burp's repeater, the site returned me with an error page, saying that something was wrong, and with a "try again" button, when I clicked on the button I intercepted a somewhat interesting response. Soon I decided to add a payload as shown in the following figure:

https://preview.redd.it/qxkeok3m4zjb1.png?width=796&format=png&auto=webp&s=1b11e7ae38c61f6a72e42a7059c9d4827f8bee47

When sending the edited response to the server, nothing happened, but when I clicked the "submit all and finish" button, I received an alert in my browser, as shown in the following figures:

https://preview.redd.it/czamq3jq4zjb1.png?width=1086&format=png&auto=webp&s=2a79feda6766217354637d09db3929f18af48b05

https://preview.redd.it/kjya6e9r4zjb1.png?width=567&format=png&auto=webp&s=916d7c6079a7ab4c9a594bbe8a85dae79e9cfe17

https://preview.redd.it/lgo998wr4zjb1.png?width=782&format=png&auto=webp&s=cd8974e6629a33d14165f7ebdceadbee479d65e8

In short: I already logged out of the account, I closed and reopened the browser and the payload continues on the button. That is, it is a stored XSS. In addition, the payload is found in buttons on other forms that have the name "submit all and finish".

So I would like to know if this is just a self XSS, and if so is there any way to escalate this to something reportable?

I'm trying to solve an XSS CTF challenge on a website and have found the XSS entry point via <img src=x onerror=alert(1)>. However, the url parameter I'm injecting this payload in is limited to 40 characters, which is checked by a global JavaScript function via m.length. But I need the actual executed code (instead of alert(1)) to be a fetch command with an url etc... Which obviously exceeds 40 characters. Now I'm stuck at this point. Any clues on this?