I found a way to use a locally hosted XML with embedded JavaScript that is generated using an XML data island. This is a pretty nice little vector if you can include an file on the server in question.

This entry was posted on Thursday, January 1st, 1970 at 12:00 am and is filed under XSS, Webappsec. You can leave a response as well.