Entities that convert to greater than in a iframe srcdoc

This shows which entities convert to the greater than character inside a iframe srcdoc. Inspired by: x.com/therceman/status/1803666353892585642

Shazzer Master

Created Aug 1, 2024

Updated May 27, 2025

Unable to render tweet button

Detecting browser...

CategoryEntity Parsing

VisibilityPublic

TypeXSS

CharsetUTF-8

$[data1] placeholderhtml_entities

Template used:

<iframe srcdoc="$[data1]" id=x></iframe>

Code used after fuzz:

if(x.srcdoc.includes(">"))log('$[data1]')

Sample payloads

<iframe srcdoc="&gt;" id=x></iframe>

<iframe srcdoc="&GT;" id=x></iframe>

<iframe srcdoc="&nvgt;" id=x></iframe>