PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

onwebkitplaybacktargetavailabilitychanged?! New exotic events in the XSS cheat sheet

portswigger.net | research | #web-security | #xss | #cheat-sheet | #safari | #event-handlers
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

The XSS cheat sheet adds exotic event vectors: Safari-only onwebkitplaybacktargetavailabilitychanged for audio/video, heavy-interaction onpointercancel and the widely usable autofocus attribute.
Published
Collected

Related coverage

research · portswigger.net
New crazy payloads in the URL Validation Bypass Cheat Sheet
URL Validation Bypass Cheat Sheet adds IP formats — partial decimal, mixed encodings, IPv6 — and a userinfo payload that makes Spring misparse hosts, enabling SSRF and open redirect.
research · portswigger.net
Introducing the URL validation bypass cheat sheet
PortSwigger launches the URL Validation Bypass Cheat Sheet, consolidating payloads for SSRF, CORS misconfiguration and open redirect testing, with three contexts and Intruder-friendly wordlists.
research · portswigger.net
Safari is hot-linking images to semi-random websites
Safari's over-enthusiastic OCR parses text inside images into clickable links — the Amazon logo's arrow produced 'Zon.com'; the research probes which URL formats and payloads Safari will accept.
research · portswigger.net
Our favourite community contributions to the XSS cheat sheet
A rundown of the seven best community submissions to PortSwigger's XSS cheat sheet: shorter Vue and AngularJS vectors, the obscure onbeforeinput event, and a WAF-evading base64-encoded payload.
research · portswigger.net
Framing without iframes
Chrome allows framing sites via param tags inside object and embed's code attribute; Firefox now matches Chrome's tabindex onfocus behaviour. Vectors documented in the XSS cheat sheet.
research · portswigger.net
New XSS vectors
New XSS vectors: transition events firing from default outline styles on focusable tags — no style block — plus SVG 'use' payloads executing JavaScript from data URLs.
Back