Portswigger Lab: DOM XSS in document.write sink using source location.search

[@brandedmunda6281]

why svg tag use used not any other like span etc

[@WomanInWhiteHat]

First let me explain you what is The tag is basically for creating scalable vector graphics and a svg file can be considered an image format file. Although it's bit different from jpeg or png files... So svg tag will support events like onload, onclick, etc., (you can refer the video and see in the payload I have used the onload event) and this will inturn trigger the JavaScript code execution. In the payload onload=alert(1), the onload event of the SVG element is used to execute the alert(1) JavaScript code when the SVG loads. The tag, on the other hand, doesn't support events like onload. I hope this helps!! Let me know if you need further clarification.

[@brandedmunda6281]

@@WomanInWhiteHat best explanation big fan mam

[@electrowizard2658]

Hwy u got discord or something im into cyber sec self studied for years would love to connect u btw great video

[@WomanInWhiteHat]

Hey, glad to know. But unfortunately I don't.