Merge pull request minimaxir#84 from clickthisnick/master

2 More XSS based on user interactions
netvisao · Nov 3, 2015 · 883a491 · 883a491
2 parents f58f92b + 5e5e1a7
commit 883a491
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/blns.json b/blns.json
@@ -405,6 +405,8 @@
   "<IMG SRC=\"javascript:alert('XSS')\"", 
   "<iframe src=http://ha.ckers.org/scriptlet.html <", 
   "\\\";alert('XSS');//", 
+  "<u oncopy=alert()> Copy me</u>",
+  "<i onwheel=alert(1)> Scroll over me </i>",
   "<plaintext>", 
   "http://a/%%30%30", 
   "1;DROP TABLE users", 
@@ -480,4 +482,4 @@
   "But now...\u001b[20Cfor my greatest trick...\u001b[8m", 
   "The quic\b\b\b\b\b\bk brown fo\u0007\u0007\u0007\u0007\u0007\u0007\u0007\u0007\u0007\u0007\u0007x... [Beeeep]", 
   "Powerلُلُصّبُلُلصّبُررً ॣ ॣh ॣ ॣ冗"
-]
+]
diff --git a/blns.txt b/blns.txt
@@ -493,6 +493,8 @@ perl -e 'print "<IMG SRC=java\0script:alert(\"XSS\")>";' > out
 <IMG SRC="javascript:alert('XSS')"
 <iframe src=http://ha.ckers.org/scriptlet.html <
 \";alert('XSS');//
+<u oncopy=alert()> Copy me</u>
+<i onwheel=alert(1)> Scroll over me </i>
 <plaintext>
 http://a/%%30%30