A4 iframe srcdoc

Preview below renders in a sandboxless iframe.

You are inside <iframe srcdoc="...">: the value is HTML parsed in the iframe. HTML-encode your quote to stay in the attribute, or break out: &lt;svg onload=alert(document.domain)&gt; inside srcdoc, or close it with "><svg onload=alert(document.domain)>.


RatXSS Dojo · HackXpert Coaching · The XSS Rat · authorized lab use only