PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Documenting the impossible: Unexploitable XSS labs

portswigger.net | research | #web-security | #xss | #payloads | #challenges | #cheat-sheet | #impossible-labs
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

The XSS cheat sheet gains an 'impossible labs' section: eight scenarios its researchers couldn't exploit, from 15-character length limits to blocked events, with a challenge to solve the impossible.
Published
Collected

Related coverage

research · portswigger.net
Our favourite community contributions to the XSS cheat sheet
A rundown of the seven best community submissions to PortSwigger's XSS cheat sheet: shorter Vue and AngularJS vectors, the obscure onbeforeinput event, and a WAF-evading base64-encoded payload.
research · portswigger.net
New crazy payloads in the URL Validation Bypass Cheat Sheet
URL Validation Bypass Cheat Sheet adds IP formats — partial decimal, mixed encodings, IPv6 — and a userinfo payload that makes Spring misparse hosts, enabling SSRF and open redirect.
research · portswigger.net
Introducing the URL validation bypass cheat sheet
PortSwigger launches the URL Validation Bypass Cheat Sheet, consolidating payloads for SSRF, CORS misconfiguration and open redirect testing, with three contexts and Intruder-friendly wordlists.
research · portswigger.net
onwebkitplaybacktargetavailabilitychanged?! New exotic events in the XSS cheat sheet
The XSS cheat sheet adds exotic event vectors: Safari-only onwebkitplaybacktargetavailabilitychanged for audio/video, heavy-interaction onpointercancel and the widely usable autofocus attribute.
research · portswigger.net
Framing without iframes
Chrome allows framing sites via param tags inside object and embed's code attribute; Firefox now matches Chrome's tabindex onfocus behaviour. Vectors documented in the XSS cheat sheet.
research · portswigger.net
New XSS vectors
New XSS vectors: transition events firing from default outline styles on focusable tags — no style block — plus SVG 'use' payloads executing JavaScript from data URLs.
Back