hard20 pts · first answer countssecurity-testing

XSS that survives HTML encoding

A profile lets users add a website URL, shown as <a href="...">. The app HTML-encodes < > " and &. Which input is still most likely to cause XSS?

A.<script>alert(1)</script>B.https://example.comC." onmouseover="alert(1)D.javascript:alert(document.domain)

Discussion 0

Join free to post in the discussion.