Other nomination

Non-Alpha-Non-Digit 3

Yair Amit's IE parser quirk: a tag and its attribute can be separated by a slash, so <SCRIPT/SRC="..."> needs no whitespace at all. Unlike the earlier non-alpha-non-digit vectors it requires no space, defeating XSS filters that use whitespace to find where a tag ends. IE6-7 and Netscape 8 in IE mode.

In the archive

• Nominated for the 2007 Top 10 Web Hacking Techniques

Tags

• xss
• filter-bypass
• parser-differential
• sanitizer-bypass
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of its author, first published at the original source. Preserved copies are kept so the citation survives its host.