PortSwigger Updates XSS Cheat Sheet with New Exotic Event Vectors
PortSwigger Research has updated its widely used Cross-Site Scripting (XSS) cheat sheet, incorporating new exotic event handlers contributed by the web security community. This update highlights the collaborative nature of maintaining security resources, featuring valuable input from Mozilla to remove obsolete events related to the marquee tag in Firefox. Key additions include a Safari-specific vector using onwebkitplaybacktargetavailabilitychanged for audio and video tags, submitted by Amir Safari. Other notable contributions include the onpointercancel event, which requires significant user interaction, and the realization that the autofocus attribute is now compatible with nearly every HTML element, allowing for new focus-based attack vectors. Additionally, researcher Zhenwarx identified several WebKit-specific mouse force events, such as onwebkitmouseforceup and onwebkitmouseforcedown, which trigger via trackpad interactions. These updates ensure that security professionals have access to the latest exploitation techniques for testing and hardening web applications. The article emphasizes the importance of community-driven improvements in cybersecurity tools and invites further contributions through GitHub issues or pull requests, demonstrating the ongoing evolution of web security standards and browser-specific behaviors.
Wire timeline
PortSwigger Updates XSS Cheat Sheet with New Exotic Event Vectors
PortSwigger Research has updated its widely used Cross-Site Scripting (XSS) cheat sheet, incorporating new exotic event handlers contributed by the web security community. This update highlights the collaborative nature of maintaining security resources, featuring valuable input from Mozilla to remove obsolete events related to the marquee tag in Firefox. Key additions include a Safari-specific vector using onwebkitplaybacktargetavailabilitychanged for audio and video tags, submitted by Amir Safari. Other notable contributions include the onpointercancel event, which requires significant user interaction, and the realization that the autofocus attribute is now compatible with nearly every HTML element, allowing for new focus-based attack vectors. Additionally, researcher Zhenwarx identified several WebKit-specific mouse force events, such as onwebkitmouseforceup and onwebkitmouseforcedown, which trigger via trackpad interactions. These updates ensure that security professionals have access to the latest exploitation techniques for testing and hardening web applications. The article emphasizes the importance of community-driven improvements in cybersecurity tools and invites further contributions through GitHub issues or pull requests, demonstrating the ongoing evolution of web security standards and browser-specific behaviors.
PortSwigger Research