---
id: 5489
title: "Redefining Impossible: XSS without arbitrary JavaScript"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/redefining-impossible-xss-without-arbitrary-javascript"
published_at: "2022-07-20T09:16:00Z"
tags: ["web-security", "xss", "side-channel", "exfiltration", "tagged-templates", "charset-restriction"]
phying_url: "https://phying.com/item/5489"
lang: en
---

# Redefining Impossible: XSS without arbitrary JavaScript

## Summary

Solving an 'impossible' XSS lab: with the payload confined to a single-quoted string and a tiny charset, Luan Herrera exfiltrates the cookie via side-channel techniques, not arbitrary JavaScript.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2022-07-20T09:16:00Z
- **Original:** https://portswigger.net/research/redefining-impossible-xss-without-arbitrary-javascript
- **Phying News:** https://phying.com/item/5489