4

I have input box with maxlength=12, and that input box is vulnerable to xss.

But because of maxlength 12 it is not possible to construct any really valid xss vector. The user input is stored in the attribute value="user input". When the user intercepts the post request with burpproxy, he can change post parameters and cause xss.

Now my question is it is possible to make a post request from other site which bypasses the maxlength element. On my exploit attempts, it takes me to the page where input box is located, and it cuts off everything past the 12th character.

Can that post request be forged and maxlength bypassed to exploit the xss issue?

This is form search on page with maxlength :

This is my try to exploit it from my page:

When I click exploit page button it just sends me back to the main page and input is cut off at the 12th character.

Improve this question
2
  • 1
    I'm not 100% sure if I'm grasping what you are trying to ask, but all one needs to do is fire up chrome with it's built-in dev tools or firefox with the firebug addon and the end user can remove the maxlength attribute from their copy of the page just like it never even existed. Is this what you are getting at?
    – Aeo
    Commented Jun 18, 2012 at 16:15
  • Not really please take a look at updated post.Thanks for answering.
    – Daniel
    Commented Jun 18, 2012 at 16:53

2 Answers 2

Reset to default
6

Yes. It is possible. Maxlenght is a html attribute in client browser's DOM object.

Maxlenght is significant only in the client browser, it is not significant on server side unless you code the server side to validate input length.

If you are using a intercept proxy which doesn't create DOM object can easily bypass the Maxlength or any other parameter and javascripts too.

Bypass can be done via a different domain/web page with different html attribute that does not put any restrictions on input length to cause XSS.

Sounds like the type of XSS you are attempting is a server side Non-Persistent XSS flaw - User input consists of malicious code that get returned in server's response to the request, it doesn't get stored in the web app so it is specific to that request.

I think you need to improve the javascript you are using to exploit XSS. onmouseover="alert(0)" cannot exploit XSS, it is just a DOM based local action to client browser, onmouseover will not send the input to the server to get returned back to the client. Your javascript must be sent to http://www.site.rs/usersearch.php and returned back by the server.

Improve this answer
5
  • Please take a look at updated post.Thanks for answering.
    – Daniel
    Commented Jun 18, 2012 at 16:54
  • Yes it is , I can break out with "> and create xss alert with <img onerror=alert(0) src=x> , I used temper data , but whats the point of vulnerabilty if you can't recreate it without tool. Maxlength is killing me.
    – Daniel
    Commented Jun 18, 2012 at 17:07
  • How are you running this exploit? Are you sure the server is vulnerable to XSS? I think you need to improve the javascript you are using to exploit XSS. onmouseover="alert(0) cannot exploit XSS, it is just a DOM based local action to client browser, onmouseover will not send the input to the server to get returned back to the client. Your javascript must be sent to http://www.site.rs/usersearch.php and returned back by the server.
    – Majoris
    Commented Jun 18, 2012 at 17:09
  • Kapish thanks a lot , i got it working now , so stupid of me not to think of that. I got it working now , can't thank you enough.Thanks again :)
    – Daniel
    Commented Jun 18, 2012 at 17:16
  • 1
    @user1203028: "whats the point of vulnerabilty if you can't recreate it without tool" - I'm pretty sure you aren't whistling the ZMODEM protocol at 300 baud into an acoustic coupler ;) You're already using an extremely complex stack of tools (from the silicon through the OS through TCP/IP to the browser itself). Adding one more layer into the mix isn't making it significantly more complex.
    – Piskvor left the building
    Commented Jun 18, 2012 at 19:46
4

maxlength isn't a protection, is rather for usability purpose (than security). There are a lot of ways to bypass this kind of protection. The easiest one is creating another website with form, which submits to your location.

Every sanitization/limitation shoudn't be use on the client-side. Every JavaScript or xHTML (like maxlength) are bad for security purpose. The best solution is to have server-side validation.

Improve this answer
1
  • Please take a look at updated post.Thanks for answering.
    – Daniel
    Commented Jun 18, 2012 at 16:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .