News for hackers. Stuff that matters.

A comment on The XSS Game by Google. Parent comment

Re:The XSS Game by Google by flanbiscuit on Wednesday November 23, 2016 @11:24AM (#13023660)
that didn't work for me. this did: <img onload="javascript:alert(0);" src="http://i.imgur.com/fXYSkbC.gif">

img tags support the onload attribute and is a typical element people use in posts

[ Parent | on HN ]
Re:The XSS Game by Google by cfontes on Wednesday November 23, 2016 @01:00PM (#13024375)
You used onload, the suggested was onerror,

Maybe it doesn't work because the page is already loaded so the onload is never run.

[ Parent | on HN ]
Re:The XSS Game by Google by 9point6 on Wednesday November 23, 2016 @12:07PM (#13023955)
weird, onerror worked fine for me

    <img src="404me" onerror="alert('test')" />
[ Parent | on HN ]