I recently participated in a CTF and solution of that CTF is based on this weird behavior of browser.
In First case when I am including script tag inside an HTML comment and without closing that comment then the browser(Firefox) assumes whole content after that as comment including body part. And no alert is popped.
<script> alert(1); <!--<script alert(2); </script> <body>Hello</body>
In Second all code is same except I removed script tag from comment now browser ending comment at that position and all other code executed smoothly. Both alert popped 1,2
<script> alert(1); <!-- alert(2); </script> <body>Hello</body>
So I have two questions.
- In first case when browser is assuming code in next lines as comment why even alert(1) is not popped?
- Second why browser having different boundaries of HTML comment based on script Tag?
Please answer them or point to any resources. And feel free to modify question, I am new to this field and might have added some rubbish.