> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/portswigger-web-academy/xss/xss-contexts.md).

# XSS Contexts

<figure><img src="/files/HjopPpekuR8dptT15t5q" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/vmM2iGtdhMrPiGkWrJpc" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/1KUSfSbry1vFwDfeKhuq" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/CKvsYWtBak6uBm5WCJl8" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/1YoGiCPR6KuYBmeGawXc" alt=""><figcaption></figcaption></figure>

We know body works, but before moving on:&#x20;

**Tags** — HTML elements that can execute JavaScript, like `<script>`, `<img>`, `<svg>`, `<iframe>`, etc. Some tags execute code just by being parsed (`<script>`), others need an event handler or attribute to trigger execution.

**Events** — HTML attributes that fire JavaScript when a specific browser event happens, like `onerror`, `onload`, `onmouseover`, `onfocus`. These matter because filters often block `<script>` tags but forget to block event handler attributes on other elements (e.g. `<img src=x onerror=alert(1)>`).

**Payloads** — the full, ready-to-use exploit strings that combine a tag + event (or other technique) into something you paste directly into an input field to test for XSS, e.g.:

```
<img src=x onerror=alert(document.domain)>
```

So we found the tag, but now we need to find the event.&#x20;

`<body>` is the HTML tag that wraps all the visible content of a webpage — everything you actually see rendered in the browser (text, images, buttons, divs, etc.), as opposed to `<head>`, which holds metadata, `<title>`, `<script>` links, and stylesheets that aren't directly displayed.

{% hint style="info" %}
**Every HTML element can carry attributes** inside its opening tag, regardless of what the element does.
{% endhint %}

`<iframe src="https://YOUR-LAB-ID.web-security-academy.net/?search=%22%3E%3Cbody%20onresize=print()%3E" onload=this.style.width='100px'>`

1. Victim loads exploit page
2. Iframe starts loading the vulnerable lab page
3. Lab page finishes loading inside iframe → is now sitting in the iframe's DOM, waiting → onresize hasn't fired yet (no resize has happened)
4. Iframe's onload fires (on the exploit page) → Runs: this.style.width='100px'
5. Iframe width changes from default to 100px
6. Body inside iframe experiences a resize
7. onresize fires → print() runs → lab solved

{% hint style="info" %}
When you resize the iframe, the page inside it has to relayout to fit the new dimensions — and that relayout fires `onresize` on the body inside.
{% endhint %}
