# XSS Payload Samples

Educational collection of cross-site scripting (XSS) payloads for security testing and validation

> Canonical page: https://elysiatools.com/en/samples/xss-payloads

- **Category:** Security

- **Keywords:** xss, cross-site scripting, security, web security, payloads, injection, penetration testing

## Overview

Educational collection of cross-site scripting (XSS) payloads for security testing and validation

## Examples

- **Script Tag XSS Injections**: Various script tag based cross-site scripting payloads - basic scripts, external sources, case variations, and obfuscation techniques
- **Event Handler XSS Injections**: Event handler based XSS payloads - onerror, onload, onclick, onmouseover, onfocus, and other DOM events
- **Protocol XSS Injections**: JavaScript protocol based XSS - javascript:, data:, vbscript:, and other protocol injections
- **Encoded XSS Payloads**: XSS payloads using various encoding techniques - URL encoding, HTML entities, Unicode, Base64, and mixed encoding
- **DOM-based XSS Payloads**: DOM-based XSS vectors that manipulate the DOM - innerHTML, outerHTML, eval, setTimeout, createElement, and location manipulation

## When to use

- Use this sample set when you want reference inputs for XSS Payload Samples.
- Use it to preview output formats and compare related sample variants.

## How it works

- Open a sample entry to inspect the prepared example payload or asset.
- Compare it with related tools to understand how the workflow connects.

## Use cases

- Script Tag XSS Injections
- Event Handler XSS Injections
- Protocol XSS Injections
- Encoded XSS Payloads
- DOM-based XSS Payloads

## Frequently asked questions

### What is included in XSS Payload Samples?

This page includes curated sample entries, related tools, and neighboring sample collections for XSS Payload Samples.

## Related tools

- [XSS Payload Detector](https://elysiatools.com/en/tools/xss-payload-detector): Detect XSS (Cross-Site Scripting) attack vectors in input strings
- [SQL Injection Detector](https://elysiatools.com/en/tools/sql-injection-detector): Detect common SQL injection attack patterns in input strings
- [AES Encryption Tool](https://elysiatools.com/en/tools/aes-encryption-tool): Encrypt or decrypt text and files with AES-256-GCM and export IV-based bundles
- [CSV/JSON Data Watermarker](https://elysiatools.com/en/tools/csv-json-data-watermarker): Inject visible or signature-style watermark fields into CSV or JSON exports so shared datasets can be traced later
- [PDF Prompt Injection Scanner](https://elysiatools.com/en/tools/pdf-prompt-injection-scanner): Compare safe and unsafe PDF extraction runs to detect hidden text, off-page content, tiny text, and hidden-layer prompt injection risks
- [Secure Random Generator](https://elysiatools.com/en/tools/secure-random-generator): Generate cryptographically secure random key material driven by entropy budget — request N bits of entropy, get hex/base64/base64url output. Also supports custom-alphabet strings via crypto.randomInt (rejection-sampled, no modulo bias). Use this instead of Math.random()-based tools for any secret/key/token.
- [Accessibility Checker](https://elysiatools.com/en/tools/accessibility-checker): Detect common WCAG 2.1 accessibility issues in HTML, fetched pages, or design images and return fix-ready guidance
- [AGEX Bundle Metadata Redactor](https://elysiatools.com/en/tools/agex-bundle-metadata-redactor): Rewrite exposed AGEX metadata like original filename or signer ID without touching ciphertext bytes

## Related content

- [SQL Injection Samples](https://elysiatools.com/en/samples/sql-injections): Educational collection of SQL injection payloads for security testing, vulnerability assessment, and defensive coding practices
- [JWT Samples](https://elysiatools.com/en/samples/jwt-samples): Comprehensive JWT examples from basic token structure to advanced security implementations
- [Git Branch Name Samples](https://elysiatools.com/en/samples/git-branch-names): Collection of Git branch names for validation testing, including valid patterns, invalid formats, and real-world examples
- [Log Files with Sensitive Data](https://elysiatools.com/en/samples/log-with-sensitive-data): Sample log files containing various types of PII (Personally Identifiable Information) for testing PII detection and log redaction tools
- [Hardhat Development Framework Samples](https://elysiatools.com/en/samples/hardhat-samples): Hardhat Ethereum development environment examples including smart contracts, testing, deployment, scripts, plugins, and development workflows
- [Jest Testing Framework](https://elysiatools.com/en/samples/jest-testing): Comprehensive Jest testing examples including unit tests, integration tests, mocking, async testing, and advanced patterns for JavaScript/TypeScript applications