Little code snippet a colleague of mine stumbled across..
Go to any site, then in the address line of your browser for that site, replace the entire URL with the code below.
Watch as you can now edit any content on the page. This serves as an example of why server side request validation and/or anti-XSS techniques and libraries are crucial in all coding practices.
As additional security measures, check HTTP headers and authenticate all POST and GET headers as well to prevent these kind of attacks.
javascript: document.body.contentEditable = 'true'; document.designMode = 'on'; void 0
Leave a comment