News for hackers. Stuff that matters.

A comment on XSS (Cross Site Scripting) Cheat Sheet. Parent comment

Re:XSS (Cross Site Scripting) Cheat Sheet by jerf on Monday February 13, 2012 @08:57PM (#3588277)
In what way are you saying it's out of date? The vast, vast bulk of those will work today just fine; very few of them are actually based on browser bugs. Most of them are really about getting valid HTML past dumb filters.
[ Parent | on HN ]
Re:XSS (Cross Site Scripting) Cheat Sheet by aj-code on Tuesday February 14, 2012 @05:25AM (#3589435)
One of the most useful features of that site used to be that you could tell at a glance which browsers the XSS payload would work on, and which it wouldn't. It hasn't been updated for modern browsers so now you have to test each browser yourself.

A lot of the payloads aren't based on browser "bugs" as such, more just the way browsers loosely interpret mangled HTML, CSS and JavaScript. Newer browsers tend to be stricter on what they'll interpret, especially when it comes to a potential XSS vector. The site doesn't seem to have been updated for anything after IE7 and Firefox 2, but I'm not aware of any better cheat sheets. Anyone got any?

[ Parent | on HN ]