If a field is not santized(except <,>) and all it does is add http in payload and reflects the output, is it possible to execute script in the client side?

This is what output looks like for input ../javascript:alert(1)

<a href  = "http://../javascript:alert(1)" target ="_blank">

Another Sample input : Input : "><>:

Output :

<a href = "http://"&gt;&lt;:" target="_blank">

Edit: It would be nice if someone can think of payload with javascript: ,atrribute like a way to prompt using javascript:prompt(1).

  • All the http code is doing is completing the link source. You would have to trigger the link. – schroeder Oct 11 '15 at 18:41
  • Any example you can come up with ? – ramailo sathi Oct 11 '15 at 18:57

Because < and > are encoded, ending the anchor tag and adding a new tag won't work. However, if " quotation marks aren't encoded or filtered out, you can definitely still get XSS. For example, example.com/"+onclick="alert('XSS!') as a URL input will generate the output <a href="http://example.com/" onclick="alert('XSS!')" target="_blank">.

The onclick alert is the easiest way (EDIT: as @pineappleman points out), but you could also add other events (such as onmouseover) and could display your own content in front of the page using CSS, which could allow an attacker to influence victims into doing things that they would not want to do (think clickjacking, but on the vulnerable page directly instead of via an iframe of that page).

| improve this answer | |
  • 1
    The quote is not encoded. However the entire thing is still considered a URL. For eg. for <a href="example.com/"onclick="alert('XSS!')"> and If I click, I get redirected to this URl => example.com/"onclick="alert('XSS!'). – ramailo sathi Oct 11 '15 at 19:41
  • Did you miss the + (you could also do it with %20 in the URL) to create a space between the href and the onclick event handler? Of the href attribute value is quoted, as it ought to be, then that attack should work. – CBHacking Oct 11 '15 at 19:46

If the data is not sanitized, but only "http" is added, than the app it's vulnerable to XSS. For example, if the data is inserted in a href attribute like this:

<a href="http://userdata">

then an attacker could instead of userdata enter "><img src=x onerror=alert() what would result in:

<a href="http://"><img src=x onerror=alert()">

Edit: In the second example you added, the < and > signs are encoded. You could try to insert " onclick="alert() what could execute a script when somebody clicks on the link.

| improve this answer | |
  • Yes, Sorry for the confusion. Please read the question again. :) – ramailo sathi Oct 11 '15 at 19:13
  • I added some info :) – stanko Oct 11 '15 at 19:19
  • The edit says that quote is not filtered. Only > and < is filtered. – ramailo sathi Oct 11 '15 at 19:20
  • Thanks again, the output is : <a href='http://"onclick = alert(1)' . Quote is not encoded, but the entire thing is considered a URL. – ramailo sathi Oct 11 '15 at 19:29
  • try inserting a single quote (') instead of double qoute – stanko Oct 11 '15 at 19:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.