There are a few payloads that don't work anymore in any browser about markdown-xss-payloads HOT 7 CLOSED

Can you please provide the specific payloads so I can check? Thanks.

from markdown-xss-payloads.

i edited the last comment with the proper payload that appears to not work in any browser. Those are a result of this payload

![a](javascript:prompt(document.cookie))\ and this ![a](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)\

But you should just check the above payloads directly in all browsers, it just doesn't work anymore.

from markdown-xss-payloads.

Well in proper context this payloads work:
https://localdomain.pw/xss/?ahref=javascript:alert(9)
https://localdomain.pw/xss/?ahref=javascript:prompt(document.cookie)

On the other hand the payload doesn't work:
https://localdomain.pw/xss/?ahref=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K

But the payload without base64 works:
https://localdomain.pw/xss/?ahref=data:text/html,%3Cscript%3Ealert(1)%3C/script%3E

I'm going to close this, if some payloads don't work on modern browsers, there is always an option to try some legacy browsers.

P.S. This payloads were collected from various BB reports so they all worked once in some libs.

from markdown-xss-payloads.

@cujanovic
hmmm the examples you gave me are from <a href="payload" and we all know that those work fine. the examples i gave you are from
<img src="payload"> that don't work anymore in any browser.

from markdown-xss-payloads.

I don't think that they ever worked in img src context, they were always in a href context in markdown not in img src.

from markdown-xss-payloads.

https://michelf.ca/blog/2010/markdown-and-xss/

from markdown-xss-payloads.

yea that might be true, then delete those payloads haha because they don't work.

from markdown-xss-payloads.