payloadbox / xss-payload-list Goto Github PK

Are these payloads expected to be encoded before sending? For example, the request will fail if you do not encode spaces in the query string. However encoding the query string will change the other values that may be required for the attack to work. Thoughts? Thank you.

Such as:

<A HREF="http://66.102.7.147/">XSS</A>
<A HREF="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">XSS</A>
<A HREF="http://1113982867/">XSS</A>
<A HREF="http://0x42.0x0000066.0x7.0x93/">XSS</A>
<A HREF="http://0102.0146.0007.00000223/">XSS</A>
<A HREF="htt	p://6	6.000146.0x7.147/">XSS</A>

Change marguee to marquee