I have some cases of cross-site scripting (XSS) in hidden HTML input fields. There are some known XSS vectors that can be used for example using the HTML accesskey.

XSS in hidden inputs is frequently very difficult to exploit because typical JavaScript events like onmouseover and onfocus can't be triggered due to the element being invisible. Source: http://blog.portswigger.net/2015/11/xss-in-hidden-input-fields.html

But the use of an so called accesskey takes a high user interaction. Is there another way to inject code here and have it execute without keypresses or a milder form of user interaction?

In my current case the three characters ()> are filtered.

I need an XSS vector that can be injected in this position:

<input type="hidden" name="[INJECTION]" />

Another reference to the accesskey XSS trick can be found here: https://www.davidsopas.com/xss-on-a-input-hidden-field/

  • 2
    Please could you explain your question further? It is unclear what you're after. Thanks. – SilverlightFox Mar 4 '16 at 11:27
  • 2
    @SilverlightFox I think his question is "without user interaction, can XSS inject value in hidden input ?". – Walfrat Mar 4 '16 at 12:11
  • Is there a way to inject code in hidden inputs w/o user interaction or mild-user interaction? when (<) is allowed – Abdullah Hussam Mar 5 '16 at 11:25
  • 1
    I seriously have no idea how people would think that it is unclear what the OP is asking. unclear what you're asking is not I don't like this question, so it should be closed, or The question is badly phrased, lets close it. That's what downvoting and editing are for. That being said, this is a duplicate of Any eventhandlers that apply to hidden elements?. – tim Mar 5 '16 at 16:13
  • @tod97 Try \u003 instead of >. – Mark Buffalo Mar 5 '16 at 17:02

Unless you can inject to change the type (e.g. to text), then there is no known vector to trigger XSS within a hidden input field without further user interaction.

e.g. With

<input name="[INJECTION]" type="hidden" />

You could inject

" type="text" onfocus="alert&#x28;'xss'&#x29;" autofocus="1

to render

<input name="" type="text" onfocus="alert&#x28;'xss'&#x29;" autofocus="1" type="hidden" />

However, unless you can get in before the already set type="hidden" or close the tag and start a new one (which you can't in your case due to filtered >), you're snookered.

  • The payload would need to be '><script>[...]. But as the OP said, > is filtered, so that would not work. The OP also never said where the username comes from. It could be GET or come from the database, so delivering POST XSS doesn't seem relevant to the OPs question. – tim Mar 5 '16 at 17:11
  • I wasn't clear from the original post whether the payload was reflected into another hidden field or into HTML body context. I did actually begin to edit this today, but stopped when I realised it had been closed. – SilverlightFox Mar 5 '16 at 18:56

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.