Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was looking at this website and trying to understand how this XSS is possible, but I just can't figure it out. Here's the URL:

<script src="../js/jquery-1.9.1.js"></script>
function setMessage(){
    var t=location.hash.slice(1);
    $("div[id="+t+"]").html("Message from the name ";
    <a href="#message" > Show Here</a>
    <div id="message">Showing Message1</div>
    <a href="#message1" > Show Here</a>
    <div id="message1">Showing Message2</div>
share|improve this question
up vote 10 down vote accepted

This page is taking input from an untrusted source, and directly outputs it in the browser as HTML.

In this case, the untrusted source is To the inexperienced programmer, this may seem harmless, but in reality, it can be set to any arbitrary value, because it's derived from the name of the frame:


In the code you've given, there's another glaring hole: The selector is also taken from an untrusted source (the URL), which allows attackers to output the HTML in whatever place they desire. This doesn't need to be a frame, just visit the following URL:],body,[whatever

t is set to "whatever],body,[whatever" (from location.hash), and is used to construct a jQuery selector ("div[id="+t+"]"). Together, it results in a selector that selects (e.g.) the <body> element:


Though not as harmful as, it might be worth fixing.

share|improve this answer
Thank you very much! – Michael Blake Dec 26 '13 at 20:15
Also, is this possible without using an iFrame? – Michael Blake Dec 26 '13 at 20:42
@MichaelBlake can also be set via the second argument of Since frames can be hidden, it's unlikely that, name) will be used for such an attack. Furthermore, Chrome seems to clear with – Rob W Dec 26 '13 at 22:58

In addition to attack vectors described in the first answer, and attacker could set"<script>alert(1)</script>";

On their malicious webpage and redirect the victim to your webpage. Because persists across page load, this would also be an xss attack vector.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.