# # https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet # based on the RSnake original http://ha.ckers.org/xss.html # Retrieved on 2013-11-20 # Much of this wildly obsolete # # XSS Locator 2 '';!--"=&{()} # Grave Accent Obfuscation # Malformed A Tags # (not actually malformed) xxs link xxs link # Malformed IMG Tags "> # fromCharCode # Default SRC tag to get past filters that check SRC domain # Default SRC tag by leaving it empty # nickg; Unable to replicate in FF,Safari,Chrome 2014-01-10 # # Default SRC tag by leaving it out entirely # Decimal HTML character references # obsolete? # Decimal HTML character references without trailing semicolons # obsolete # Hexadecimal HTML character references without trailing semicolons # obsolete form # Embedded tab # obsolete form # # Embedded escaped tab # obsolete form # # Embedded newline to break up XSS # obsolete form # # Embedded CR # obsolete form # # Null # obsolete form # # Spaces and meta chars before the JavaScript in images for XSS # obsolete form # # Non-alpha-non-digit XS # this is bogus or obsolete # # Extraneous open brackets < # No closing script tags # INPUT image # BODY image # IMG Dynsrc # Wildly obsolete # IMG LOW src # Wildy obsolete # List-style-image # likely obsolete