Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to make XSS work on one site.It allows me to edit CSS which is then included inside web page source , but it won't allow me to use " , only ' . Source is like this:

body {
  margin: 0;
  padding: 0;
  background-color: #EFEFEF;
  overflow: hidden;
  font-family: Arial, Helvetica, sans-serif;

Can't XSS inside CSS be exploited if " is blocked.Thanks

share|improve this question
By embedded, you mean an inline stylesheet? Can you post the embedding related markup too? – CodesInChaos Sep 4 '12 at 20:42
And how do other characters, such as < get treated? And how is " treated? Forbidden? Entity-Encodes? `` escaped? – CodesInChaos Sep 4 '12 at 20:43
@CodesInChaos here is the full code and <> is hex encoded , just like ". – khaomax Sep 5 '12 at 16:36
up vote 8 down vote accepted

This policy might prevent breaking out of a double quoted style attribute as in

<div style="payload goes here">

or if this CSS is stored in a DB it might be a SQL Injection filter.

To answer your question though, yes, you can still attack the CSS itself with single quotes


which will work on IE7 and older or in some more recent IE quirks modes and it won't stop you from embedding double quotes visible to CSS as in

margin-left:expression('alert(\22 pwned\22)')
share|improve this answer
Here is what I'm dealing with : . Is there any way to get this xss working on mozzila.Thanks – khaomax Sep 5 '12 at 16:39
@user1203028, What part of that does an attacker control? – Mike Samuel Sep 5 '12 at 16:42
This : <style type="text/css"> body { margin: 0; padding: 0; background-color: #EFEFEF; overflow: hidden; font-family: Arial, Helvetica, sans-serif; } shortened cos of text limit..... ... ... </style> – khaomax Sep 5 '12 at 16:44
@user1203028, If they only filter ", then obviously </Style ><img onload=alert(1337)> will work. Otherwise, <style>body{-moz-binding:url(}</style> should do it. – Mike Samuel Sep 5 '12 at 17:00
No , well I tried with <> and they are filtered (hexed) , and the solution you gave didn't work , thanks anyway.It seems I cant do anything. Btw, if you want to give it a try , this is my email , jyst email me and I'll give you site location. – khaomax Sep 5 '12 at 17:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.