Skip to content
XSS without parentheses and semi-colons
portswigger.net | research | #xss | #portswigger | #javascript | #waf-bypass | #payload | #limited-charset | #onerror
Summary
Gareth Heyes adapts his classic onerror/throw trick to call functions without parentheses, semicolons or newlines, enabling XSS in heavily filtered contexts.
- Published
- Collected