Characters allowed before event in attribute name using setAttribute

This vector shows which characters are allowed before an event name when using setAttribute.

Created by: hackvertor

Created on: Wednesday, August 21, 2024 at 11:46:45 AM

Updated on: Thursday, November 21, 2024 at 7:58:18 AM

Vector type: JS

Vector charset: UTF-8

Template used:

let img = document.createElement('img');
img.src = 'data:';
img.setAttribute('$[chr]onerror','log($[i])')
document.body.append(img);

Your browser was detected as:

Detecting... Detecting... Detecting... Detecting...

Sample payloads

let img = document.createElement('img');
img.src = 'data:';
img.setAttribute('\onerror','alert(92)')
document.body.append(img);