HTML tags that can clobber the credentials part of the URL

2

This vector shows which which html tags can clobber the credentials part of the URL, based on: https://portswigger.net/research/concealing-payloads-in-url-credentials

Created on: Monday, November 4, 2024 at 8:01:37 AM

Updated on: Wednesday, April 23, 2025 at 3:37:04 PM

Vector type: XSS

Vector charset: UTF-8

Vector data 1: html

Vector data 2: attributes

<$[data1] id="xx" $[data2]="https://x:x@x.com">

if(xx.username==="x"){log('$[data1]:$[data2]')}