4 ms·
<div onclick="alert(0)">whoops</div> If you want to dive down the rabbit hole, here's a good place to start: https://www.owasp.org/index.php/XSS_Filter_Evasion
by johnsoft 8y ago
<div onclick="alert(0)">whoops</div>
If you want to dive down the rabbit hole, here's a good place to start: https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_She...
- _bxg1 8y agoAh right, duh. Still, I feel like there would be an enumerable set of properties that can execute JS.
- marcosdumay 8y agoThere is an enumerable set of HTML and CSS properties, so yeah. That document is scary! There are 70 different ways to encode an opening angle bracket, what is just a tiny side note...