XSS attack demo with innerHTML

attack.md

Tested with Chrome, Firefox and Safari.

The following code will not trigger an alert. target.innerHTML = "<script> alert('XSS Attack'); </script>";

The following code will trigger an alert. target.innerHTML = "<img src=x onerror=\"alert('XSS Attack')\" >";

Good note!

good note, but i wanna to know why

HTML5 specifies that a <script> tag inserted with innerHTML should not execute.
https://developer.mozilla.org/en-US/docs/Web/API/Element/innerHTML

Well, the latter didn't work on GitHub.

the second code won't work, because the src value inside the code target.innerHTML = "<img src=x onerror="alert('XSS Attack')" >"; should be inside quotes ('')