<script> Tag Payload - Basic XSS payload.
Copy Payload to Clipboard

---

javascript: URI Payload - For use where URI's are taken as input.
Copy Payload to Clipboard

---

<input> Tag Payload - For bypassing poorly designed blacklist systems with the HTML5 autofocus attribute.
Copy Payload to Clipboard

---

<img> Tag Payload - Another basic payload for when <script> tags are explicitly filtered.
Copy Payload to Clipboard

---

<video><source> Tag Payload - HTML5 payload, only works in Firefox, Chrome and Opera
Copy Payload to Clipboard

---

<iframe srcdoc= Tag Payload - HTML5 payload, only works in Firefox, Chrome and Opera
Copy Payload to Clipboard

---

XMLHTTPRequest Payload - For exploitation of web applications with Content Security Policies containing script-src but have unsafe-inline enabled.
Copy Payload to Clipboard

---

$.getScript() Payload - Example payload for sites that include JQuery
Copy Payload to Clipboard

Full Name
Password
Email
Custom xss.ht Subdomain Additional JavaScript Payload URI Injection Correlation Key Copy Key to Clipboard
Note: Must be used with an XSS Hunter compatible client tool, click here for an example. If you want to build your own please see our documentation. Note that injection requests are only stored for 30 days and are purged afterwards. You will still receive XSS alerts after 30 days but they won't be correlated.

Email upon XSS payload fire?


PGP Key

Collect Page List

Subdomain Redirect URL Static JavaScript XSS Payload

Update Settings