PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

XSS in hidden input fields

portswigger.net | research | #firefox | #web-security | #xss | #hidden-input | #access-keys
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Gareth Heyes shows how to execute XSS inside hidden input fields: Firefox fires onclick when an access key activates the element. Includes the PoC vector and key combinations.
Published
Collected

Related coverage

research · portswigger.net
Concealing payloads in URL credentials
Payloads concealed in URL credentials stay invisible in Chrome and Firefox address bars, persisting through same-origin navigation; document.URL exposes them, enabling DOM XSS and clobbering.
research · portswigger.net
Framing without iframes
Chrome allows framing sites via param tags inside object and embed's code attribute; Firefox now matches Chrome's tabindex onfocus behaviour. Vectors documented in the XSS cheat sheet.
research · portswigger.net
Bypassing Firefox's HTML Sanitizer API
Gareth Heyes bypassed Firefox's HTML Sanitizer API: SVG 'use' elements importing same-origin absolute URLs still executed JavaScript, even for uploads protected with Content-Disposition: attachment.
research · portswigger.net
Bypassing DOMPurify again with mutation XSS
A fresh mutation XSS bypass of DOMPurify's patch: crafted comments and encoded tags mutate sanitized markup into executable XSS in Chrome, plus a CDATA variant for Firefox; fixed in DOMPurify 2.1.
research · portswigger.net
Provoking browser quirks with behavioural fuzzing
Gareth Heyes applies behavioural fuzzing to Firefox's HTML and JavaScript parsers, uncovering quirks like alternative HTML comment terminations that can aid XSS filter bypasses.
research · yokai.hakaisecurity.io
Client-Side Path Traversal na Prática: De Stored XSS à Exclusão de Conta
# Client-Side Path Traversal na Prática: De Stored XSS à Exclusão de Conta RESEARCHER **Pedro Cruz "gankd"** READ TIME**12 MINUTES** PUBLISHED**15 Oct 2026** INDEX ▸ Sumário ▸ Introdução ▸...
Back