While testing a website that has a responsible disclosure policy I found out that I can insert code and close the attribute and insert some text of my own:
<input type="text" value=""xsstext>
Now sure I can send them an email showing them I can insert
<!-- and comment out the rest of the page, but I do not think they will take that too serious. From what I tested it will throw a 403 error when using:
It is possible to insert for example:
<b>batman</b> <img> <div>
I'm quite new to XSS. Is there any way I can actually run some script or do something more useful here?