<div class="card">Unquoted attribute demo.</div><p class="goal">The value has no quotes: <code><input value=rat></code>. A space lets you add a handler with no quote-breakout: <code>x onmouseover=alert(document.domain)</code></p><input value=rat>
RatXSS Dojo · HackXpert Coaching · The XSS Rat · authorized lab use only