xss-payload-list

Introduction

:star: Star us on GitHub — it motivates a lot! :star:

If you have any XSS payload, just create a PullRequest.

Write-Ups / Tutorials

https://portswigger.net/web-security/cross-site-scripting/cheat-sheet https://medium.com/p/92ac1180e0d0 https://book.hacktricks.xyz/pentesting-web/xss-cross-site-scripting

My love polyglot

jaVasCript:/*--></title></style></textarea></script></xmp><svg/onload='+/"/+/onmouseover=1/+/[*/[]/+alert(1)//'>
"'alert(1)

Todos

• [ ] XSS payloads for url fields
• [x] XSS payloads for onfocus
• [x] XSS payloads for title
• [x] XSS payloads without alert
• [ ] XSS payloads for base64
• [ ] XSS payloads without script tag
• [ ] XSS payloads for javascript fields
• [ ] XSS payloads for number fields
• [ ] XSS payloads for a href
• [x] XSS payloads for markdown
• [ ] XSS for anker
• [ ] XSS for open-redirect
• [ ] cloudflare bypass

File Descriptions

• XSS-polyglot.txt A JavaScript Polyglot is a Cross Site Scripting (XSS) vector that is executable within various injection contexts in its raw form, or a piece of code that can be executed in multiple contexts in the application.

Rules

Rules To Find XSS

1: injecting haramless HTML ,