Documenting the impossible: Unexploitable XSS labs
DRANK
Have you ever found some risky behavior, but couldn't quite prove it was exploitable? Our XSS cheat sheet contains virtually every exploit technique we know of, but what should you do if you can't fin
2 comments
It looks like the <selectedcontent> vector can solve this impossible lab listed in portswigger.net/research/docum…:
"innerHTML assignment where you can't use ="
PoC:
portswigger-labs.net/impossible-lab…
This should work because of how Chrome's cloneNode behaves:
document.body.innerHTML =
<div id="source"> <svg><script>alert()</script></svg> </div> <div id="target"></div>;clone=source.cloneNode(true);
target.append(clone);//works on Chrome/Safari