the-web-application-hackers-handbook

458 Chapter 12 n Attacking Users: Cross-Site Scripting
HTML5 provides a wealth of new vectors using event handlers. These include
the use of the autofocus attribute to automatically trigger events that previously
required user interaction:
...
It allows event handlers in closing tags:
Finally, HTML5 introduces new tags with event handlers:
Script Pseudo-Protocols
Script pseudo-protocols can be used in various locations to execute inline script
within an attribute that expects a URL. Here are some examples:
Although the javascript pseudo-protocol is most commonly given as an
example of this technique, you can also use the vbs protocol on Internet Explorer
browsers, as described later in this chapter.
As with event handlers, HTML5 provides some new ways of using script
pseudo-protocols in XSS attacks:
The new event-source tag is of particular interest when targeting input filters.
Unlike any pre-HTML5 tags, its name includes a hyphen, so using this tag may
bypass legacy regex-based filters that assume tag names can contain only letters.