My XSS attempt doesn't seem to work on a simple HTML page I made

1. T

   techblazes

   Jan 15, 2022

   Hello everyone,

   I wrote a small app with HTML and JS to try and replicate the effect, however the script is not being executed.
   There's no input sanitization whatsoever.

   Could somebody have a look at this codepen and let me know what I am doing wrong?

   https://codepen.io/techblazes/pen/oNeBPNz

2. C

   Christophe

   Jan 16, 2022

   Hey @techblazes ! Answered in Discord but will also answer here for anyone else wondering.

   Your sample code is vulnerable and does work with certain payloads.

   .innerHTML doesn't allow for scripts to be executed, so it actually prevents XSS payloads that use script tags (like <script>alert(1)</script>)

   It does not prevent XSS payloads that make use of onload events, like: <img src=x onerror=alert();>

< Back to Cybersecurity