Using a remote style sheet and including an expression you can embed JavaScript using a LINK that doesn’t use the JavaScript directive or the script tags. It’s a nice little evasion technique that I haven’t seen anywhere else.

This entry was posted on Thursday, January 1st, 1970 at 12:00 am and is filed under XSS, Webappsec. You can leave a response as well.