XSS (Cross Site Scripting) Cheat Sheet

XSS (Cross Site Scripting) Cheat Sheet
Esp: for filter evasion

By RSnake

Note from the author: XSS is Cross Site Scripting. If you don't know how XSS (Cross Site Scripting) works, this page probably won't help you. This page is for people who already understand the basics of XSS attacks but want a deep understanding of the nuances regarding filter evasion. This page will also not show you how to mitigate XSS vectors or how to write the actual cookie/credential stealing/replay/session riding portion of the attack. It will simply show the underlying methodology and you can infer the rest. Also, please note my XSS page has been replicated by the OWASP 2.0 Guide  in the Appendix section with my permission. However, because this is a living document I suggest you continue to use this site to stay up to date. 

Also, please note that most of these cross site scripting vectors have been tested in the browsers listed at the bottom of the page, however, if you have specific concerns about outdated or obscure versions please download them from Evolt . Please see the XML format of the XSS Cheat Sheet  if you intend to use CAL9000  or other automated tools. If you have an RSS reader feel free to subscribe to the Web Application Security RSS feed below, or join the forum :

Browser support reference table:

IE7.0		Vector works in Internet Explorer 7.0. Most recently tested with Internet Explorer 7.0.5700.6 RC1, Windows XP Professional SP2.
IE6.0		Vector works in Internet Explorer. Most recently tested with Internet Explorer 6.0.28.1.1106CO, SP2 on Windows 2000.
NS8.1-IE		Vector works in Netscape 8.1+ in IE rendering engine mode. Most recently tested with Netscape 8.1 on Windows XP Professional. This used to be called trusted mode, but Netscape has changed it's security model away from the trusted/untrusted model and has opted towards Gecko as a default and IE as an option.
NS8.1-G		Vector works in Netscape 8.1+ in the Gecko rendering engine mode. Most recently tested with Netscape 8.1 on Windows XP Professional
FF2.0		Vector works in Mozilla's Gecko rendering engine, used by Firefox. Most recently tested with Firefox 2.0.0.2 on Windows XP Professional.
O9.02		Vector works in Opera. Most recently tested with Opera 9.02, Build 8586 on Windows XP Professional
NS4		Vector works in older versions of Netscape 4.0 - untested.

Note: if a vector is not marked it either does not work or it is untested.

http://ha.ckers.org/xss.html