ProfileMe drops your name into the value attribute of an input field, and it escapes angle brackets, so the usual tag-based payloads do nothing. But inside an attribute the dangerous character is the quote that closes the value — and that one is not escaped. Lab at a glance: Intermediate · 70 XP · about 15 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below. [se_lab_cta id="xss-attribute-1"]…
No comments:
Post a Comment