XSS via HTML5 Events All over again

XSS via HTML5 Events All over again

Back in 2018 I wrote a post about finding and exploiting XSS using the new(ish) event handlers in HTML 5. Those techniques paid out recently and I thought I'd write up the situation. Using the lists provided in the earlier post I discovered the application allowed an "SVG" tag. Within that tag it allowed the… Continue reading XSS via HTML5 Events All over again

XSS using HTML 5 Event Handlers

XSS using HTML 5 Event Handlers

I recently had some luck using HTML 5 event handlers to exploit XSS. This post includes some of the outcomes and a bit of how to replicate the steps using Burp Suite's Intruder using some wordlists stuck at the end of this post. The target had attempted to use blacklisting to prevent dangerous tags and… Continue reading XSS using HTML 5 Event Handlers