XSS attack demo with innerHTML

attack.md

Tested with Chrome, Firefox and Safari.

The following code will not trigger an alert. target.innerHTML = "<script> alert('XSS Attack'); </script>";

The following code will trigger an alert. target.innerHTML = "<img src=x onerror=\"alert('XSS Attack')\" >";

You really saved me! I am trying to demo an xss attack but it did not work with the first way for chrome, the second way works perfectly.