I found a lot of instances where XSS scripts like the following work:

<iMg SrC=x OnErRoR=window.location=123>

Given that JavaScript is a case sensitive language, how is the browser able to identify it as JavaScript code and execute it?

<iMg SrC=x OnErRoR=window.location=123>

The mixed case parts in your example are not the Javascript but the HTML. And HTML is case insensitive

<iMg     HTML img tag (i.e. image), case insensitive
SrC      src attribute for HTML img tag, case insensitive
OnErRoR  onerror attribute for HTML img tag, case insensitive

window.location=123  - Javascript, case sensitive

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.