I've tried to verify some vectors from OWASP XSS CheatSheet which exploits style attributes

STYLE tag using background-image

<STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A>
STYLE tag using background

<STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>
<STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>

<TABLE BACKGROUND="javascript:alert('XSS')">
Just like above, TD's are vulnerable to BACKGROUNDs containing JavaScript XSS vectors:
<TABLE><TD BACKGROUND="javascript:alert('XSS')">

But none of them seem to be working in the latest browsers - IE10, IE11, Chrome, Firefox, Safari.

Are they valid XSS vectors?


OWASP's XSS Filter Evasion Cheat Sheet clearly states that the cases you mention are for old browsers

Deprecated Tests (Works on IE 6 and older browsers)

These are the tests that have only been confirmed to work on IE 6 unless specified otherwise and do not work on any modern browsers as of March 12th, 2014.

Remember, though, not all of your users use up-to-date browsers.

One example is the <img src="javascript:alert('xss')" /> attack. I never thought I'd worry about it until one of our clients reported that whenever he tried to access one order's page on their inventory system, he'd get redirected to a pornographic website. I found the offending row in the database, but was never able to reproduce the redirect until I learned that he used IE6.

  • 1
    Ha! Yeah right, "the browser took me here boss". The perfect alibi.
    – deed02392
    Mar 25 '14 at 9:48
  • 1
    The OWASP XSS FIlter Evasion Cheat Sheet no longer states this
    – bodhizero
    Feb 5 '16 at 1:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.