From fb19c953cb15a429e1afb3cda1cd4b89f996407a Mon Sep 17 00:00:00 2001 From: Somdev Sangwan Date: Thu, 8 Nov 2018 19:43:25 +0530 Subject: [PATCH] + Awesome XSS mind map, + Awesome Encoding --- README.md | 39 ++++++++++++++++++++++++++++++++++++++- 1 file changed, 38 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index dd21d31..5c35b41 100644 --- a/README.md +++ b/README.md @@ -27,6 +27,9 @@ Put this repo on watch. I will be updating it regularly. - [BeEF](https://github.com/beefproject/beef) - [JShell](https://github.com/UltimateHackers/JShell) +### Awesome XSS Mind Maps +A beutiful XSS mind map by Jack Masa, [here](https://github.com/s0md3v/AwesomeXSS/blob/master/Database/jackmasa-mind-map.png) + ### Awesome Payloads ``` z @@ -57,6 +60,8 @@ Here's an XSS polyglot that I made which can break out of 20+ contexts: %0ajavascript:`/*\"/*--><svg onload='/*` ``` +Explanation of how it works, [here](https://github.com/s0md3v/AwesomeXSS/blob/master/Database/polyglot.png) + ### Awesome Tags & Event Handlers - [105 Event Handlers with description](https://github.com/UltimateHackers/AwesomeXSS/blob/master/Database/event-handlers.md) - [200 Event Handlers without description](http://pastebin.com/raw/WwcBmz5J) @@ -260,7 +265,39 @@ If the your dummy tags lands in the source code as it is, go for any of these pa ``` ### Awesome Encoding -Come back later + +|HTML|Char|Numeric|Description|Hex|CSS (ISO)|JS (Octal)| +|----|----|-------|-----------|----|--------|----------| +|`"`|"|`"`|quotation mark|u+0022|\0022|\42| +|`#`|#|`#`|number sign|u+0023|\0023|\43| +|`$`|$|`$`|dollar sign|u+0024|\0024|\44| +|`%`|%|`%`|percent sign|u+0025|\0025|\45| +|`&`|`&|`&`|ampersand|u+0026|\0026|\46| +|`'`|'|`'`|apostrophe|u+0027|\0027|\47| +|`(`|(|`(`|left parenthesis|u+0028|\0028|\50| +|`)`|)|`)`|right parenthesis|u+0029|\0029|\51| +|`*`|*|`*`|asterisk|u+002A|\002a|\52| +|`+`|+|`+`|plus sign|u+002B|\002b|\53| +|`,`|,|`,`|comma|u+002C|\002c|\54| +|`−`|-|`-`|hyphen-minus|u+002D|\002d|\55| +|`.`|.|`.`|full stop; period|u+002E|\002e|\56| +|`/`|/|`/`|solidus; slash|u+002F|\002f|\57| +|`:`|:|`:`|colon|u+003A|\003a|\72| +|`;`|;`|`;`|semicolon|u+003B|\003b|\73| +|`<`|<|`<`|less-than|u+003C|\003c|\74| +|`=`|=|`=`|equals|u+003D|\003d|\75| +|`>`|>|`>`|greater-than sign|u+003E|\003e|\76| +|`?`|?|`?`|question mark|u+003F|\003f|\77| +|`@`|@|`@`|at sign; commercial at|u+0040|\0040|\100| +|`[`|\[|`[`|left square bracket|u+005B|\005b|\133| +|`\`|/\|`\`|backslash|u+005C|\005c|\134| +|`]`|]|`]`|right square bracket|u+005D|\005d|\135| +|`^`|^|`^`|circumflex accent|u+005E|\005e|\136 +|`_`|_|`_`|low line|u+005F|\005f|\137| +|```|\`|```|grave accent|u+0060|\0060|\u0060| +|`{`|{|`{`|left curly bracket|u+007b|\007b|\173| +|`|`|\||`|`|vertical bar|u+007c|\007c|\174| +|`}`|}|`}`|right curly bracket|u+007d|\007d|\175| ### Awesome Tips & Tricks - `http(s)://` can be shortened to `//` or `/\\` or `\\`.