xss-payload-list

Introduction

⭐ Star us on GitHub — it motivates a lot! ⭐

If you have any XSS payload, just create a PullRequest.

jaVasCript:/*--></title></style></textarea></script></xmp><svg/onload='+/"/+/onmouseover=1/+/[*/[]/+alert(1)//'>
"'alert(1)

XSS-polyglot.txt A JavaScript Polyglot is a Cross Site Scripting (XSS) vector that is executable within various injection contexts in its raw form, or a piece of code that can be executed in multiple contexts in the application.

Rules To Find XSS

1: injecting haramless HTML ,

2: injecting HTML Entities

<b> \u003b\u00

3 :injecting Script Tag

4: Testing For Recursive Filters

5: injecting Anchor Tag

6: Testing For Event Handlers

7: Input Less Common Event Handlers

8: Testing With SRC Attrubute

9: Testing With Action Attrubute

10: Injecting HTML 5 Based Payload

Needless to mention, please use this tool very very carefully. The authors won't be responsible for any consequences.

Name		Name	Last commit message	Last commit date
Latest commit History 110 Commits
.github		.github
swagger		swagger
README.md		README.md
xss-all-list.txt		xss-all-list.txt
xss-by-keyword-filtering.txt		xss-by-keyword-filtering.txt
xss-encoding-payload.txt		xss-encoding-payload.txt
xss-for-hidden-input.txt		xss-for-hidden-input.txt
xss-for-input.txt		xss-for-input.txt
xss-for-markdowns.txt		xss-for-markdowns.txt
xss-for-onfocus.txt		xss-for-onfocus.txt
xss-for-title.txt		xss-for-title.txt
xss-for-username-field.txt		xss-for-username-field.txt
xss-for-vuejs.txt		xss-for-vuejs.txt
xss-href.txt		xss-href.txt
xss-payload-for-input-search.txt		xss-payload-for-input-search.txt
xss-polyglot.txt		xss-polyglot.txt
xss-top500-list.txt		xss-top500-list.txt
xss-without-alert-confirm-prompt		xss-without-alert-confirm-prompt
xss-without-alert.txt		xss-without-alert.txt