What's in a tag name? JavaScript, apparently

Login

_ _

_ _ _ _ _

Products

Solutions

Research Academy

Support

Company

Customers About Blog Careers Legal Contact Resellers

My account Customers About Blog Careers Legal Contact Resellers

Burp AT Agentic AI that extends human-led pentesting.

Burp Suite DAST The enterprise-enabled dynamic web vulnerability scanner.

Burp Suite Professional The world's #1 web penetration testing toolkit.

Burp Suite Community Edition The best manual tools to start web security testing.

View all product editions

Burp Scanner

Burp Suite's web vulnerability scanner

Attack surface visibility Improve security posture, prioritize manual testing, free up time. CI-driven scanning More proactive security - find and fix vulnerabilities earlier. Application security testing See how our software enables the world to secure the web. DevSecOps Catch critical bugs; ship more secure software, more quickly.

Penetration testing Accelerate penetration testing - find more bugs, more quickly. Automated scanning Scale dynamic scanning. Reduce risk. Save time/money.

Bug bounty hunting Level up your hacking and earn more bug bounties. Compliance Enhance security monitoring to comply with confidence.

View all solutions

Product comparison

What's the difference between Pro and DAST?

Support Center Get help and advice from our experts on all things Burp. Documentation Tutorials and guides for Burp Suite. Get Started - Professional Get started with Burp Suite Professional. Get Started - DAST Get started with Burp Suite DAST. Downloads Download the latest version of Burp Suite.

Visit the Support Center

Downloads

Download the latest version of Burp Suite.

_

Articles

Overview

_

Core Topics

Black Hat XSS Request Smuggling Template Injection Top 10 Hacking Techniques

Articles

_

Meet the Researchers

James Kettle Gareth Heyes Zakhar Fedotkin Tom Stacey

Talks

RSS

_

What's in a tag name? JavaScript, apparently

_

Gareth Heyes

Researcher

@garethheyes

**Published: **Tuesday, 25 August 2026 at 14:24 UTC

**Updated: **Tuesday, 25 August 2026 at 14:24 UTC

I was on my laptop, as I often am when there's rubbish on telly, and found myself wondering what characters are allowed in a tag. I knew they had to begin with "a-zA-Z", but what about after that? I tried placing alert(1) in the tag name and remembered that the browser converts everything to uppercase. Then I wondered whether another property existed that didn't do that. I gave my tag an id attribute and inspected it in DevTools using console.dir(x) . Carefully inspecting each property, I saw that " localName " contained a lowercase version of the tag name. This was perfect.

After that, it was a simple case of putting the puzzle pieces together. I already knew that you could make any tag focusable using tabindex and that you can chain the onfocus event with itself. You can write a string to the event handler using attributes[0].value, which gets converted into a function and can then be called as a constructor using "new":

I'm sure you'll agree that it's pretty shocking, and it works in every browser. It's also a pretty nice way to bypass a WAF. Let's continue the journey. If localName returns a lowercase version of the tag, maybe that means you can use uppercase JavaScript, and yes, you can:

Then I fuzzed every transformation of the tag name. This showed that alphabetic characters, forward slashes, whitespace, and newlines get transformed. Interestingly, line and paragraph separator characters don't. These are treated like newlines in JavaScript, so you can create bizarre-looking vectors:

If attributes[0].value gets blocked, there are some interesting alternatives:

`` After that, I started messing around with the HTML. An opening angle bracket can actually be part of the tag name. You can then combine it with the first attribute to produce an XSS vector:

" onfocus=innerHTML=localName+attributes[0].value tabindex=1 autofocus> I messed around with other attributes, like "part", which actually converts space-separated values into an array. You can then extract the onfocus(event) portion of the event, overwrite the event variable with the payload, and replace the onfocus variable with the Function constructor. This results in the lowercase tag name being passed to eval and executed as JavaScript:

I gave this to Sol 5.6 to see whether it could come up with any interesting variants. It was pretty damn good. It discovered that you could use contenteditable instead of tabindex to make an element focusable:

I didn't know about the getAttributeNode function either:

It also reminded me about the setHTMLUnsafe function, which I'd forgotten about:

" onfocus=setHTMLUnsafe(localName+title) tabindex=1 autofocus> Finally, it found a nice variant of the part attribute vector that uses classList instead:

I started this post as a simple question about what are valid tag name characters and it turned into a reminder that browsers are far more lenient than you would expect. A tag name can become an JS payload, a URL, or even fresh markup.

The lesson is that unusual HTML and seemingly harmless properties such as localName, part, and classList can become unexpected sources of hiding payloads and transformations that can bypass blocklists and WAF signatures.

XSS JavaScript HTML

Back to all articles

Related Research

Cookie Chaos: How to bypass __Host and __Secure cookie prefixes

03 September 2025

Cookie Chaos: How to bypass __Host and __Secure cookie prefixes

Stealing HttpOnly cookies with the cookie sandwich technique

22 January 2025

Stealing HttpOnly cookies with the cookie sandwich technique

Bypassing WAFs with the phantom $Version cookie

04 December 2024

Bypassing WAFs with the phantom $Version cookie

Concealing payloads in URL credentials

23 October 2024

Concealing payloads in URL credentials

Burp Suite

Web vulnerability scanner Burp Suite Editions Release Notes

Vulnerabilities

Cross-site scripting (XSS) SQL injection Cross-site request forgery XML external entity injection Directory traversal Server-side request forgery

Customers

Organizations Testers Developers

Company

About Careers Contact Legal Privacy Notice Modern Slavery Statement

Insights

Web Security Academy Blog Research Engineering

Follow us © 2026 PortSwigger Ltd.