Timeline for XSS payload shorter than 20 character
Current License: CC BY-SA 4.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Dec 10, 2018 at 2:10 | history | edited | 1lastBr3ath | CC BY-SA 4.0 |
added 319 characters in body
|
| Dec 9, 2018 at 21:43 | comment | added | 1lastBr3ath | @tim Yep! That's why I added 'might not work in all cases and all browsers'. I needed it to add for the sake of completeness like <base href> one. | |
| Dec 9, 2018 at 21:40 | comment | added | tim | @1lastBr3ath Thanks for editing in the explanation (answers should really be self-contained in case a link stops working). I didn't know that you can just omit the "window." part; that's a neat trick. Regarding not closing script tags: I don't think that it works in any modern browser. But it will work if you have any other script tags after the insertion point (because the first opening script tag will be used). | |
| Dec 9, 2018 at 21:33 | history | edited | 1lastBr3ath | CC BY-SA 4.0 |
added 239 characters in body
|
| Dec 9, 2018 at 21:30 | comment | added | 1lastBr3ath | @tim That's where I asked to refer to my blog post for explotation part. | |
| Dec 9, 2018 at 21:29 | comment | added | tim |
Where does name come from here? You can't really have it somewhere in the HTML code, because getting it via JavaScript (getElementById etc) would be a lot of characters. And if you can define it in a previous block of JS, couldn't you just execute whatever you want to execute there?
|
|
| Dec 9, 2018 at 21:27 | comment | added | Xavier59 | Cool trick with the domain name ! | |
| Dec 9, 2018 at 21:22 | history | answered | 1lastBr3ath | CC BY-SA 4.0 |