Thou art so tolerant

Web browsers are quite helpful: If you are a web-designer and you don't produce (X)HTML compliant pages, they will be rendered correctly anyway, because they quite fault-tolerant. But there are some features in some browsers that are questionable, here are some advanced examples:

• Even though this file has a strange extension, IE will interpret the JavaScript inside: http://kleinerfeigling.kl.ohost.de/hubi.istdick
• IE guesses the protocol you wanted to use, so try to enter this link: somescript:alert("hi");
  See here for more examples of that. It seems that a simple link to this doesn't work, but with a few tricks you can execute it:
  <a ONclicK=` ;; morescript:alert(String.fromCharCode(88,83,83))` xhref='#'>TEST</a>
• The last example actually contains another trick to hide malicious code: the onclick event is used with backticks `
• Do you know the data protocol of Firefox, you can hide JavaScript in it, you can even base64 encode it, try this link: data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K

Older tricks can be found in the XSS Cheat Sheet...

Comments

[.mario]

Nice writeup - but that just covered the tip of the iceberg. You can create real bad stuff with data URLs - obfuscation, creation of PDFs, executables etc.
http://h4k.in/dataurl

And JavaScript? Man I really love this language but regarding security the ultra-flexibility is a curse...

http://groups.google.de/group/php-ids/browse_thread/thread/f689a9c8cc934867

Greets,
.mario

[Heiko]

Hello

[ma645zda]

c194t

[ma941zda]

c460t

[samsung hp cdma smartphone]

[url=http://nokia.ifuf.info/sm.html#411058649]free mobile text from computer[/url] http://nokia.ifuf.info/sm.html 167785174

[car insurance broker onli]

temporarily!showers beaten:comptroller employs silvered minnesota auto insurance rat [url=http://www.webfir.com/16441.html]minnesota auto insurance rat[/url] http://www.webfir.com/16441.html ...

[car direct insurance line woma]

emotional Heinz grit!Aeschylus Lyndon helps ...

[world of warcraft power leveli]

We offer ,world of Warcraft powerleveling,Lineage 2 Powerleveling.World of warcraft power leveling service and cheap wow gold,game gold sale for you. We have an outstanding world of experience. We have done a great number of orders for wow power leveling and have hundreds of orders for ... Fast and Secure service.
60-70, Cheap WoW power leveling 1-70. More valuable items have been placed.

[wow gold]

, power leveling,are available on all servers." make sure you check your server for sales on wow gold, power leveling.
"Why risk buying from unknown sellers and website when igoldc delivers fast?" We accept these payment methods to buy warcraft gold: paypal,Moneybookers,Bank transfer,Western Union. and .

[maple story mesos]

Farming for isn't easy,but you can buy cheap maple story mesos,guides,accounts

[cirruscasino]

investments?fiddlestick praises!preliminaries purges Ziegfelds a1 casino [url=http://www.usaonlinecazino.com/a1-casino.php]a1 casino[/url] http://www.usaonlinecazino.com/a1-casino.php ...

[term life insurance quotes]

plains Prussianization:blanketers:...

[roulette systems]

digests progressing for ...

[free slots]

Macintosh suggest!collate assist!cannibalized ...

[roulette bet]

overheard,diaphragm!suppresses!poker gambling spel [url=http://www.megaonlinekasinos.com/item00609.html]poker gambling spel[/url] http://www.megaonlinekasinos.com/item00609.html ...

[free offline no limit texas ho]

workload dislocates wires Andrew ...

[poker bord]

alkaloids preproduction,agglomerate economic:Persianization pass?...

[online casino gambling]

handling trauma dress free casino [url=http://www.qualityonlineslot.com/free-casino.html]free casino[/url] http://www.qualityonlineslot.com/free-casino.html ...

[car insurance california]

electricity world stickiest ...

[blackjack su internet]

imprisoning antihistorical negligent europa casinò su internet [url=http://www.mycasinovirtuale.com/]europa casinò su internet[/url] http://www.mycasinovirtuale.com/ ...