-
My XSS attempt doesn’t seem to work on a simple HTML page I made
Hello everyone,
I wrote a small app with HTML and JS to try and replicate the effect, however the script is not being executed.
There’s no input sanitization whatsoever.Could somebody have a look at this codepen and let me know what I am doing wrong?
-
1 Reply
-
Hey @techblazes ! Answered in Discord but will also answer here for anyone else wondering.
Your sample code is vulnerable and does work with certain payloads.
.innerHTML doesn’t allow for scripts to be executed, so it actually prevents XSS payloads that use script tags (like <script>alert(1)</script>)
It does not prevent XSS payloads that make use of onload events, like: <img src=x onerror=alert();>
Log in to reply.