← Back to Dashboard

XSS Payload Cheat Sheet

Your collected payloads from the XSS Training Lab

0
Levels Solved
30
Remaining
0
Payloads Collected
LevelChallengeContextDefenseStatusYour Payloads
Level 1Hello, Reflected XSSHTML BodyNoneUnsolved—
Level 2Stored XSS GuestbookHTML Body (Stored)NoneUnsolved—
Level 3Script Tag BlockedHTML Body<script> strippedUnsolved—
Level 4Attribute InjectionHTML AttributeNoneUnsolved—
Level 5JavaScript ContextJS String< > encodedUnsolved—
Level 6Event Handler BlocklistHTML Body12 event handlers blockedUnsolved—
Level 7Case & Keyword FilterHTML BodySingle-pass keyword stripUnsolved—
Level 8DOM-Based XSSDOM (location.hash → innerHTML)No server-side reflectionUnsolved—
Level 9href Injectionhref Attributejavascript: blockedUnsolved—
Level 10CSP BypassHTML Body + CSPscript-src 'nonce' 'self'Unsolved—
Level 11Double EncodingHTML BodyWAF decode + tag/handler/javascript: filterUnsolved—
Level 12Template InjectionClient-side templateAll HTML tags strippedUnsolved—
Level 13postMessage XSSDOM (postMessage → innerHTML)No reflection, no formUnsolved—
Level 14SVG Upload XSSInline SVG<script> strippedUnsolved—
Level 15Mutation XSSDOMParser sanitizer + template renderScripts + event handlers stripped (querySelectorAll)Unsolved—
Level 16Recursive FilterHTML BodyRecursive keyword loopUnsolved—
Level 17The PolyglotHTML + Attribute + JS<script> stripped, " encodedUnsolved—
Level 18DOM ClobberingHTML Body → window globals<script>/handlers/javascript: strippedUnsolved—
Level 19Prototype Pollution → XSSJSON merge → innerHTMLNo direct HTML injectionUnsolved—
Level 20Base Tag InjectionHTML Body (before scripts)CSP nonce + self, <script>/handlers strippedUnsolved—
Level 21Dangling MarkupHTML AttributeAll execution vectors blockedUnsolved—
Level 22JSON InjectionJSON in <script> blockCSP nonce, < > Unicode-escapedUnsolved—
Level 23URL Scheme Bypassa href attribute<script>/handlers stripped, javascript: blockedUnsolved—
Level 24Blind XSSAdmin Panel (Stored)No direct feedbackUnsolved—
Level 25Unicode NormalizationHTML BodyTags/handlers stripped, NFKC normalizationUnsolved—
Level 26CSS Injection<style> blockTags/handlers strippedUnsolved—
Level 27window.name XSSDOM (window.name → innerHTML)No URL reflectionUnsolved—
Level 28Header InjectionHTML Body (from request header)No URL reflectionUnsolved—
Level 29WebSocket XSSWebSocket message → innerHTMLNo HTTP inputUnsolved—
Level 30Service Worker Hijacknavigator.serviceWorker.registerRequires JSONP chainUnsolved—