Other nomination
Location based XSS attacks
DOM XSS delivered through location.hash, which the browser never sends to the server, so server-side filters and WAFs see only half the payload. The server half calls eval(location.hash.slice(1)); a stronger variant needs no parentheses at all by opening a comment server-side and closing it in the hash, assigning location a javascript: URL built from both halves.
Record
- Researcher
- Gareth Heyes
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Gareth Heyes, first published at the original source. Preserved copies are kept so the citation survives its host.