The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Google firing range vs portswigger labs

Dan | Last updated: Apr 02, 2021 03:00AM UTC

Hi all, I'm new here so I hope I'm asking in the right place. I'll keep it short and simple! On this lab, we can use the payload in the URL: <img src=1 onerror=alert(document.domain)> https://portswigger.net/web-security/cross-site-scripting/dom-based/lab-document-write-sink-inside-select-element But, on Google's firing range, the same payload gets encoded to: %3Cimg%20src=1%20onerror=alert(document.domain)%3E What's the difference? (I thought modern browsers encoded all tags. Is this a server setting?) Thanks, - Dan

Uthman, PortSwigger Agent | Last updated: Apr 06, 2021 09:38AM UTC