1

I'm attempting to make a site with an example of what XSS would look like, so in this I take user input and set a paragraph element's innerHTML to the user input but the script isn't running. However the script tag is present within the span. Anyone know why?

input in text box: <script>alert()</script>

code:

<!doctype html>
<html lang="en">
<head>
    <title>XSS example</title>
</head>
<body> 
    <input type="text" id="inputBox"/>
    <button id="displayButton">submit</button>
    <span id="inputDisplay"></span>
        
    <script>
        const textInput = document.getElementById("inputBox");
        const inputDisplay = document.getElementById("inputDisplay");
        const displayButton = document.getElementById("displayButton");

        displayButton.onclick = event => {
            inputDisplay.innerHTML = textInput.value;
            textInput.value = "";
        }
    </script> 
</body>
</html>
Improve this question
2
  • However, if you input: <img src="xx" onerror="alert('xss attack')" /> ....
    – browsermator
    Commented May 10, 2022 at 21:15
  • Not exactly sure why, but if you do "document.write(textInput.value)" your script injection of (<script>alert()</script>) works. Maybe because it's blasting the whole page it causes execution.
    – browsermator
    Commented May 10, 2022 at 23:24

1 Answer 1

Reset to default
0

Your code is working fine. Whatever you put inside is what makes the trick

<script><img title="</script><img src onerror=alert(1)>"></script>

P.S! It relays on your Webrowser. Use this as a refrence

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .