Hacker News new | past | comments | ask | show | jobs | submit login

What is lvl2's answer? I'm trying:

<img src='invalid_link.png' onerror="this.src='alert(1);'">




My solution was:

     <img src="foo" onMouseOver="alert(33);"
Interesting to see so many people used onError instead.


One of the hints says you can use onError()

I'm sure that's where most people are getting it from.


img src='garbage' onerror='script' is gauranteed to auto execute, where mouseover requires the user to mouse over the element.


onerror= is usually the one used in CTF and XSS examples!


I used just onclick


just onerror="alert(1)" :)


I did <a onclick="alert('hakz');">click</a>


Me too, except I used a button tag. Feels like cheating though.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: