While testing a website that has a responsible disclosure policy I found out that I can insert code and close the attribute and insert some text of my own:
<input type="text" value=""xsstext>
Now sure I can send them an email showing them I can insert <!--
and comment out the rest of the page, but I do not think they will take that too serious. From what I tested it will throw a 403 error when using:
"javascript:
"onload= (and onmouseover, onfocus etc.)
"onload:
"<script >
"<svg >
"<iframe>
"expression(
It is possible to insert for example:
<b>batman</b>
<img>
<div>
I'm quite new to XSS. Is there any way I can actually run some script or do something more useful here?
<iframe>
,<img>
, event handlers on, say,<div>
? Try to find out under what rules the website refuses to reflect your payload.