<script
</script
<iframe
<embed
<object
<svg
<math
<video
<audio
<marquee
<details
<dialog
<base
<body
<form
<isindex
<frameset
<frame
<link
<meta
<noframes
<noscript
<plaintext
<title
<xss
expression(
javascript:
vbscript:
data:
livescript:
mocha:
eval(
alert(
prompt
confirm
window.location
document.cookie
document.domain
document.write
innerHTML
setTimeout(
setInterval(
Function(
srcdoc=
src=
xlink:href
onabort=
onauxclick=
onbeforeunload=
onblur=
oncancel=
oncanplay=
oncanplaythrough=
onchange=
onclick=
onclose=
oncontextmenu=
oncuechange=
ondblclick=
ondrag=
ondragend=
ondragenter=
ondragexit=
ondragleave=
ondragover=
ondragstart=
ondrop=
ondurationchange=
onemptied=
onended=
onerror=
onfocus=
onformdata=
onhashchange=
oninput=
oninvalid=
onkeydown=
onkeypress=
onkeyup=
onlanguagechange=
onload=
onloadeddata=
onloadedmetadata=
onloadstart=
onmessage=
onmousedown=
onmouseenter=
onmouseleave=
onmousemove=
onmouseout=
onmouseover=
onmouseup=
onoffline=
ononline=
onpagehide=
onpageshow=
onpause=
onplay=
onplaying=
onpopstate=
onprogress=
onratechange=
onrejectionhandled=
onreset=
onresize=
onscroll=
onsearch=
onsecuritypolicyviolation=
onseeked=
onseeking=
onselect=
onshow=
onslotchange=
onstalled=
onsubmit=
onsuspend=
ontimeupdate=
ontoggle=
onunhandledrejection=
onunload=
onvolumechange=
onwaiting=
onwheel=
oncut=
oncopy=
onpaste=
onreadystatechange=
./
../
%3Cscript
%3Ciframe
%3Cimg
%3Csvg
?cmd=
&cmd=
cmd=
exec=