Collected research
Concealing payloads in URL credentials
document.URL keeps the credentials part of a URL while location strips it, and Chrome and Firefox hide it from the address bar, so https://'-alert(1)-'@example.com carries an invisible payload. Any script that reads document.URL after removing the query and fragment reflects it, and Firefox does not percent-encode single quotes there, giving DOM XSS. Anchor elements also expose username and password properties inherited from the page URL, usable for clobbering.
Record
- Researcher
- Gareth Heyes
- Published by
- PortSwigger Research
- Date
- Topic
- Other
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Gareth Heyes, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .