Cross-Site Scripting (XSS) Cheat Sheet
PortSwigger's XSS cheat sheet lists filter-bypass patterns for script injection across major browsers, without a new CVE.
PortSwigger's Cross-Site Scripting cheat sheet is a reference of payload patterns intended to bypass XSS filters in major browsers. The entries describe families of tricks such as exception handling, template strings, location and window-name redirects, ES6 language features, uppercase script tags, and dense JavaScript encodings. It is a long-standing Web Security Academy resource rather than disclosure of a new vulnerability or an active campaign. The listing names no CVE, affected product incident, or confirmed in-the-wild exploitation.
- Reference catalog of XSS filter-bypass patterns, not a new vulnerability.
- Covers parenthesis-free, quote-free, and encoding-based vectors.
- Patterns are noted as varying across Chrome, Edge, Firefox, and Safari.
- No CVE or confirmed exploitation campaign is described.
- Vendors
- PortSwigger
- Products
- Web Security Academy
- Organizations
- PortSwigger
From the original article
7 min read at portswigger.net
No parentheses using exception handling no semi colons using expressions No parentheses using exception handling and string eval on Chrome / Edge No parentheses using exception handling and string eval on Safari
By portswigger.net via pushcx · portswigger.net
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.