Comment Comment by jannes For me it actually worked to use a script tag, but I'm confused about why, as the hint says it shouldn't.This is the URL I used: https://xss-game.appspot.com/level3/frame#'><script>alert('bla')</script> But the hint is hinting at something more like this, I think: https://xss-game.appspot.com/level3/frame#' onerror="alert('bla')"> Can somebody explain why the first one worked? Are they wrong when they say that the browser won't execute scripts added after the page has loaded? parent jannes 12 years ago
This is the URL I used:
But the hint is hinting at something more like this, I think: Can somebody explain why the first one worked? Are they wrong when they say that the browser won't execute scripts added after the page has loaded?