Lab: Reflected XSS with some SVG markup allowed
This lab has a simple reflected XSS vulnerability. The site is blocking common tags but misses some SVG tags and events. To solve the lab, perform a cross-site scripting attack that calls the
alert()
function.
--> So i tried all svg related payloads from This cheatsheet and one payload worked which was this:
<svg><animatetransform+onbegin%3dalert(1)+attributeName%3dtransform>
So final payload will look like this:
And after forwarding the request i solved the lab!