{"action":"created","issue":{"url":"https://api.github.com/repos/yahoo/webseclab/issues/6","labels_url":"https://api.github.com/repos/yahoo/webseclab/issues/6/labels{/name}","comments_url":"https://api.github.com/repos/yahoo/webseclab/issues/6/comments","events_url":"https://api.github.com/repos/yahoo/webseclab/issues/6/events","html_url":"https://github.com/yahoo/webseclab/issues/6","id":57346494,"number":6,"title":"XSS not being triggered in modern browsers","user":{"login":"Zapotek","id":375743,"avatar_url":"https://avatars.githubusercontent.com/u/375743?v=3","gravatar_id":"","url":"https://api.github.com/users/Zapotek","html_url":"https://github.com/Zapotek","followers_url":"https://api.github.com/users/Zapotek/followers","following_url":"https://api.github.com/users/Zapotek/following{/other_user}","gists_url":"https://api.github.com/users/Zapotek/gists{/gist_id}","starred_url":"https://api.github.com/users/Zapotek/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Zapotek/subscriptions","organizations_url":"https://api.github.com/users/Zapotek/orgs","repos_url":"https://api.github.com/users/Zapotek/repos","events_url":"https://api.github.com/users/Zapotek/events{/privacy}","received_events_url":"https://api.github.com/users/Zapotek/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-02-11T17:15:20Z","updated_at":"2015-02-12T16:51:07Z","closed_at":null,"body":"Browsers nowadays automatically escape URLs, leaving a lot of XSS cases unexploitable.\r\nFor example this:\r\n\r\n    http://localhost:8080/xss/dom/domwrite?in=abckk<xss>\r\n\r\n...will not be exploitable in Firefox 35.0.1, as it'll be automatically converted to:\r\n\r\n    http://localhost:8080/xss/dom/domwrite?in=abckk%3Cxss%3E\r\n\r\nSame goes for any client which properly follows the RFC specifications.\r\n\r\nMaybe URI-decode that sort of data prior to using it in XSS demo cases?"},"comment":{"url":"https://api.github.com/repos/yahoo/webseclab/issues/comments/74106339","html_url":"https://github.com/yahoo/webseclab/issues/6#issuecomment-74106339","issue_url":"https://api.github.com/repos/yahoo/webseclab/issues/6","id":74106339,"user":{"login":"dmitris","id":31205,"avatar_url":"https://avatars.githubusercontent.com/u/31205?v=3","gravatar_id":"","url":"https://api.github.com/users/dmitris","html_url":"https://github.com/dmitris","followers_url":"https://api.github.com/users/dmitris/followers","following_url":"https://api.github.com/users/dmitris/following{/other_user}","gists_url":"https://api.github.com/users/dmitris/gists{/gist_id}","starred_url":"https://api.github.com/users/dmitris/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dmitris/subscriptions","organizations_url":"https://api.github.com/users/dmitris/orgs","repos_url":"https://api.github.com/users/dmitris/repos","events_url":"https://api.github.com/users/dmitris/events{/privacy}","received_events_url":"https://api.github.com/users/dmitris/received_events","type":"User","site_admin":false},"created_at":"2015-02-12T16:51:07Z","updated_at":"2015-02-12T16:51:07Z","body":"I agree the DOM XSS cases can be expanded and made more useful / educational.  We should add examples of PoEs (proof of exploits) for the DOM XSS cases.  Part of those cases were done to investigate and demonstrate differences between browsers in handling of different input elements (path  / query / hash) as described on domxsswiki - but of course description and examples would be helpful."}}