I was reading about XSS Contexts on Portswigger and it has a section about the use of HTML-Encoding in bypassing input validation. What i understand is :

  • The browser html decodes the entities before passing them to the javascript engine.

The article showed it in context of an Attribute Injection, but does it work in non-attribute contexts as well.

Also, The payload shown there was '-alert(1)-'. It dont understand what - is doing in this payload!

The context was <input href="#" onclick=" ... var input='user controlled data';" />


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.