{"action":"created","issue":{"url":"https://api.github.com/repos/yahoo/webseclab/issues/6","labels_url":"https://api.github.com/repos/yahoo/webseclab/issues/6/labels{/name}","comments_url":"https://api.github.com/repos/yahoo/webseclab/issues/6/comments","events_url":"https://api.github.com/repos/yahoo/webseclab/issues/6/events","html_url":"https://github.com/yahoo/webseclab/issues/6","id":57346494,"number":6,"title":"XSS not being triggered in modern browsers","user":{"login":"Zapotek","id":375743,"avatar_url":"https://avatars.githubusercontent.com/u/375743?v=3","gravatar_id":"","url":"https://api.github.com/users/Zapotek","html_url":"https://github.com/Zapotek","followers_url":"https://api.github.com/users/Zapotek/followers","following_url":"https://api.github.com/users/Zapotek/following{/other_user}","gists_url":"https://api.github.com/users/Zapotek/gists{/gist_id}","starred_url":"https://api.github.com/users/Zapotek/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Zapotek/subscriptions","organizations_url":"https://api.github.com/users/Zapotek/orgs","repos_url":"https://api.github.com/users/Zapotek/repos","events_url":"https://api.github.com/users/Zapotek/events{/privacy}","received_events_url":"https://api.github.com/users/Zapotek/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-02-11T17:15:20Z","updated_at":"2015-02-11T18:09:52Z","closed_at":null,"body":"Browsers nowadays automatically escape URLs, leaving a lot of XSS cases unexploitable.\r\nFor example this:\r\n\r\n    http://localhost:8080/xss/dom/domwrite?in=abckk<xss>\r\n\r\n...will not be exploitable in Firefox 35.0.1, as it'll be automatically converted to:\r\n\r\n    http://localhost:8080/xss/dom/domwrite?in=abckk%3Cxss%3E\r\n\r\nSame goes for any client which properly follows the RFC specifications.\r\n\r\nMaybe URI-decode that sort of data prior to using it in XSS demo cases?"},"comment":{"url":"https://api.github.com/repos/yahoo/webseclab/issues/comments/73931957","html_url":"https://github.com/yahoo/webseclab/issues/6#issuecomment-73931957","issue_url":"https://api.github.com/repos/yahoo/webseclab/issues/6","id":73931957,"user":{"login":"yukinying","id":1326727,"avatar_url":"https://avatars.githubusercontent.com/u/1326727?v=3","gravatar_id":"","url":"https://api.github.com/users/yukinying","html_url":"https://github.com/yukinying","followers_url":"https://api.github.com/users/yukinying/followers","following_url":"https://api.github.com/users/yukinying/following{/other_user}","gists_url":"https://api.github.com/users/yukinying/gists{/gist_id}","starred_url":"https://api.github.com/users/yukinying/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yukinying/subscriptions","organizations_url":"https://api.github.com/users/yukinying/orgs","repos_url":"https://api.github.com/users/yukinying/repos","events_url":"https://api.github.com/users/yukinying/events{/privacy}","received_events_url":"https://api.github.com/users/yukinying/received_events","type":"User","site_admin":false},"created_at":"2015-02-11T18:09:52Z","updated_at":"2015-02-11T18:09:52Z","body":"+1 . I find that using document.location.hash could be a more convincing vector, e.g.  `http://localhost:8080/xss/dom/domwrite#in=abckk<xss>`\r\n"}}