Shazzer logo

    List of HTML elements that convert to arbitrary string

    When an element is used as a string it is converted using toString. Most elements convert to something like [object HTMLDivElement] but some dont

    Created by: joaxcar

    Created on: Wednesday, April 10, 2024 at 12:48:20 PM

    Updated on: Thursday, July 25, 2024 at 1:27:30 AM

    Vector type: XSS

    Template used:
    <$[data1] id="x"></$[data1]>
    Code used after fuzz:
    x.toString().startsWith('[') || log('$[data1]')
    Your browser was detected as:
    Detecting... Detecting... Detecting... Detecting...

    Sample payloads

    <a id="x"></a>
    <area id="x"></area>

    Fuzz results

    Chrome logo
    Chrome 123.0.0.0 Unknown Unknown
    Found 2 results
    Data
    a
    Data
    area
    Safari logo
    Safari 16.4 Unknown Unknown
    Found 2 results
    Data
    a
    Data
    area
    Firefox logo
    Firefox 124.0 Unknown Unknown
    Found 2 results
    Data
    a
    Data
    area