1

I'm testing Android app which is vulnerable to HTML injection, but I'm having problem escalating it to a stored XSS vulnerability.

I have tried these, and many more:

<script>alert(1)</script>
<iframe src="javascript:confirm(1)">
<a href="javascript:alert(1)">foo | linking to https://foo.com does not work also

None of these work - they don't render or links/tags are not clickable. I have also tried using Android event handlers like ontouchstart and so on, but none of them seem to work either.

However I have noticed that I can load any image like this:

<img src="https://host.com/image.jpg">

I tried adding event handlers there too, but it did not work.

I'm out of ideas. I have tried googling for this but I can't seem to find answer why it does not work. I was thinking can it be because I'm running on Android 5.1.1, which does have some built-in XSS protection?

Improve this question
2
  • Maybe the server it's fetching the page from has some csp set that prevent scripts from executing ?
    – Xavier59
    Commented Aug 29, 2019 at 14:02
  • the render text was actually done via textview html.fromHtml which cannot execute JS as far as i know.
    – SecurityQuy
    Commented Aug 30, 2019 at 0:11

1 Answer 1

Reset to default
1

After decompiling the app and going through the source code I found out that it cannot be escalated to XSS because it's using Html.fromHtml TextView

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .