All recipes35
New recipeCheck example
<@encode(setVariable,'json')>{"a":"b"}</@encode><@check(isJson)><@encode(getVariable,'json') /></@check> && <@encode(base64)><@encode(getVariable,'json') /></@encode>0
Unicode effects
<@encode(unicodeEffect,'underline')>foo</@encode> <@encode(unicodeEffect,'doubleUnderline')>foo</@encode> <@encode(unicodeEffect,'overline')>foo</@encode> <@encode(unicodeEffect,'doubleOverline')>foo</@encode> <@encode(unicodeEffect,'strike')>foo</@encode> <@encode(unicodeEffect,'shortStrike')>foo</
0
unicode
<@encode(unicode)>unicode escapes</@encode> <@encode(unicodeEs6)>es6 unicode escapes</@encode> <@encode(unicodeOverflow,0x100)>unicode overflows</@encode> <@encode(unicodeOverflowVariations,0xfff)>unicode variations</@encode>
0
Nested base64->hex->invisible unicode
JiN4ZGI0MDsmI3hkYzAxOyYjeGRiNDA7JiN4ZGM0ODsmI3hkYjQwOyYjeGRjNjU7JiN4ZGI0MDsmI3hkYzZjOyYjeGRiNDA7JiN4ZGM2YzsmI3hkYjQwOyYjeGRjNmY7JiN4ZGI0MDsmI3hkYzIwOyYjeGRiNDA7JiN4ZGM3NzsmI3hkYjQwOyYjeGRjNmY7JiN4ZGI0MDsmI3hkYzcyOyYjeGRiNDA7JiN4ZGM2YzsmI3hkYjQwOyYjeGRjNjQ7JiN4ZGI0MDsmI3hkYzIxOyYjeGRiNDA7JiN4ZGMyMDsm
0
GZip compression
‹������³ÉÌMW(.JVÈÏK-*Ê/²MÌI-*Ñ0Ô´�'ýhX���
2
Overlong UTF-8
<@encode(overlongUTF8,6,false)><img src onerror=alert(1)></@encode>
2
SMTP parameters attack
<@encode(smtpParameters,'collab','oastify.com')>user@example.com</@encode>
7
toString obfuscator
eval(<@encode(toStringObfuscator,2,36)>alert</@encode>+"(1)")
1
Persist extension data
var interestingAttributes = List.of(
AttributeType.STATUS_CODE,
AttributeType.WORD_COUNT,
AttributeType.LINE_COUNT,
AttributeType.CONTENT_LENGTH,
AttributeType.CONTENT_TYPE
);
var currentValues = new LinkedHashMap<String, String>();
for (AttributeType interesting : interestingA0
Malformed url encoding
<@encode(malformedUrl)><img src onerror=alert(1)></@encode> <@decode(malformedUrl)>%3,%6)%6-%6'%2 %7#%7"%6#%2 %6/%6.%6%%7"%7"%6/%7"%3-%6!%6,%6%%7"%7$%2(%3!%2)%3.</@decode>
16
Unicode truncation example
<@encode(unicodeTruncation,20000,30000)>AAAAA</@encode> How it works: <@encode(hexSpace)><@encode(unicodeTruncation,20000,30000)>AAAAA</@encode></@encode>
28
UTF-7 example
<@encode(encodedWordMeta,'utf-7',q)><@encode(utf7,&)>foobar</@encode></@encode>@example.com
4
Unicode Normalizations for Semicolon Character
<@encode(unicodeNormalization)>;</@encode>
15