Lab: Reflected XSS with event handlers and href attributes blocked
Summary: This PortSwigger lab presents a reflected cross-site scripting vulnerability where some tags are whitelisted but all event handlers and anchor href attributes are blocked. To solve it, participants must inject a vector that calls the alert function when clicked and label it with the word "Click" so the simulated lab user will click it.
Key Takeaway: The lab demonstrates that filtering event handlers and href attributes alone does not close reflected XSS - a payload still executes on click, which is the same gap an attacker needs to run script in a victim's browser session.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026