Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

So I was experimenting with XSS using new line (%0A) character. So I got to the usual vector: '%0Aalert(/xss/)// and one thing came to my mind. What if you can't insert a quote?

A new line will break the string so you can insert code. However, the syntax error (Unterminated string) will prevent the script from executing. Is there any way around it?

Thank you!

share|improve this question
1  
You have not provided sufficient information to answer this question. You only provided the injection string, an lack context. Does does it look like var j='junk'\nalert(/xss/)// ? –  Rook Mar 7 '13 at 4:08

1 Answer 1

up vote 1 down vote accepted

You could end your script element and start a new one:

%0A</script><script>alert(/xss/)//

There will still be a syntax error in the original script (none of it up to this point will run), but the added one will still execute (including anything that comes after it). Demo. As you can see, disallowing quotes is not a valid defense against XSS, escaping is the way to go.

(And in case you're wondering, the attack is possible even if the call were wrapped in a function or eval.)

share|improve this answer
    
Yeh I thought of that way too, but I generally don't like to use the <script> tags because a lot of detection systems look for them. Is there any other possible way without ending the script tags? (assuming quotes and angle brackets are escaped both HTML and js way). Thanks :) –  Chris Illusion Mar 6 '13 at 21:58
    
@1llusion none that I know of. I thought about the '\' character, but couldn't conceive any way to exploit it. What exactly are you trying to achieve? –  mgibsonbr Mar 6 '13 at 22:18
2  
@ mgibsonbr I have noticed, that a lot of developers don't do anything about the newline character. However XSS is known and a lot of developers know a little about preventing it. So I was trying to find out, if there is a way to successfully run an attack with only the newline character. So far it looks, that it can be treated only as a warning as long as there are no other weaknesses. Thank you for your help! (I can't upvote yet, but I'll once I can) –  Chris Illusion Mar 6 '13 at 23:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.