XSS Filters: Beating Length Limits Using DOM-based Techniques - Port Swigger
Summary: PortSwigger Research describes a technique for beating length-limit filters on reflected XSS by injecting a 45-byte script, <script>eval(location.hash.slice(1)</script>, into a vulnerable parameter, which turns the reflected flaw into a DOM-based one. The second script then runs from the URL fragment string, which sits outside the application's filters and can be arbitrarily long; the example uses OWASP's Broken Web Application Project and the IE browser, and other browsers may require URL decoding the message within the payload.
Bottom line: A 45-byte payload is small enough to slip past filters tuned to cap input length, and the actual attack code then rides in the URL fragment where the application's filters never see it.
Read the original at PortSwigger Research ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026