Top 10 winner

Universal XSS in IE8

Eduardo Vela Nava and David Lindsay · wokb.cz

IE8's XSS filter neutralises a detected attack by rewriting one character of the response to a hash. The authors show an attacker can trigger that deliberately with a dummy GET parameter carrying a string already on the page, corrupting an equals sign just before a quoted attribute so injected text becomes a new attribute pair. That gave universal XSS on bing, wikipedia and twitter.

Record

Researcher

Eduardo Vela Nava and David Lindsay

Published by

wokb.cz

Topic

XSS

In the archive

• Ranked #6 in the 2010 Top 10 Web Hacking Techniques

Related sources

• Abusing Internet Explorer 8's XSS Filters Whitepaper

Tags

• xss
• filter-bypass
• sanitizer-bypass
• injection
• waf-bypass
• clickjacking
• detection
• owasp-a03-2021
• owasp-a04-2021
• owasp-a05-2021
• owasp-a09-2021

This page is the archive's own catalogue record. The research is the work of Eduardo Vela Nava and David Lindsay, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 September 2026.