Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

onwebkitplaybacktargetavailabilitychanged?! New exotic events in the XSS cheat sheet

portswigger.net | research | #web-security | #xss | #cheat-sheet | #safari | #event-handlers

Summary

The XSS cheat sheet adds exotic event vectors: Safari-only onwebkitplaybacktargetavailabilitychanged for audio/video, heavy-interaction onpointercancel and the widely usable autofocus attribute.
Published
Collected

original ↗

Related coverage

  1. What's in a tag name? JavaScript, apparently (portswigger.net)
  2. An Interesting XSS-Bypassing WAF (labs.cognisys.group)
  3. The $12,000 Intersection between Clickjacking, XSS, and Denial of Service (samcurry.net)
  4. Eradicating image authentication injection from the entire internet (samcurry.net)
  5. CRLF-Powered Desync Attacks: Beheading HTTP Streams (portswigger.net)
  6. XSS without HTML: Client-Side Template Injection with AngularJS (portswigger.net)

back