Server has blacklisted <img> and <a> tags in input. Server does:

var myvar = url.searchParams.get('query'))
document.getElementById("id").innerHTML = myvar

<img> and <a> tags are not working. What are other tags/ ways on which I can do XSS on innerHTML?

  • Please provide additional information, such as more of your code, headers etc Oct 13, 2022 at 1:27
  • The context of interpretation is important. how does this translate into your DOM? (and you still can use hundreds of other tags if only a and img are not allowed!) Oct 13, 2022 at 7:50
  • You can use an <input> tag with events like onfocus. Unfortunately, autofocus doesn't work in innerHTML so user interaction is required. You may have some luck with a <video> tag
    – paj28
    Oct 13, 2022 at 8:39


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.