What are the ways in which XSS can be done in innerHTML

Ask Question

Asked 5 months ago

Modified 5 months ago

Viewed 73 times

Server has blacklisted <img> and <a> tags in input. Server does:

var myvar = url.searchParams.get('query'))
document.getElementById("id").innerHTML = myvar

<img> and <a> tags are not working. What are other tags/ ways on which I can do XSS on innerHTML?

asked Oct 12, 2022 at 22:25

CodeTalker

1111 bronze badge

Please provide additional information, such as more of your code, headers etc
– Rohit Gupta
Oct 13, 2022 at 1:27
The context of interpretation is important. how does this translate into your DOM? (and you still can use hundreds of other tags if only a and img are not allowed!)
– Soufiane Tahiri
Oct 13, 2022 at 7:50
You can use an <input> tag with events like onfocus. Unfortunately, autofocus doesn't work in innerHTML so user interaction is required. You may have some luck with a <video> tag
– paj28
Oct 13, 2022 at 8:39

Add a comment |

0 Your Answer

Name

Required, but never shown

Post as a guest

Name

Required, but never shown

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy