I have the following code,

<li data-type="test" title="?"> test </li>

Following values were Not allowed


My goal here is to get a javascript popup to appear. is there a way to make an alert popup?


 <li data-type="test" title="" onmouseover="alert(1)//" ""> test </li>
  • 1
    It is working for me. What issue are you having? – Aaron Garton Sep 12 '19 at 17:46
  • I need to inject some vector and execute XSS. so I tried the following the vector '"onmouseover="alert(1)//" " '. But they never allowed single/double-quotes. Due to this, I can't inject my vector in the title attribute. so that I need an alternate vector to break down the HTML Attributes and execute the alert using an event(onload, onmouseover,etc.. ) – saranraj S Sep 13 '19 at 1:12
  • Is this an exercise of some kind, where the expectation is that there is an attack vector, and it's your job to find something more subtle than directly dropping "onmouseover="alert(1)//" in? Or is it an essentially random site that might be fully-hardened against such attacks? – TripeHound Sep 13 '19 at 8:57
  • I am starting learning XSS from last week. Most of the places every one using " to break down the HTML Attribute. But i checking the alternate way to break it down. I am also trying to find an alternative solution. But I am a newbie for this field. so that I asked for an help for others. – saranraj S Sep 14 '19 at 9:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.