Lab: Reflected XSS with event handlers and href attributes blocked

This lab contains a reflected XSS vulnerability with some whitelisted tags, but all events and anchor href attributes are blocked.

To solve the lab, perform a cross-site scripting attack that injects a vector that, when clicked, calls the alert function.

https://portswigger.net

Note that you need to label your vector with the word “Click” in order to induce the simulated lab user to click your vector. For example:

<a href=””>Click me</a>