I have some cases of cross-site scripting (XSS) in hidden HTML input fields. There are some known XSS vectors that can be used for example using the HTML accesskey.

XSS in hidden inputs is frequently very difficult to exploit because typical JavaScript events like onmouseover and onfocus can't be triggered due to the element being invisible. Source: http://blog.portswigger.net/2015/11/xss-in-hidden-input-fields.html

But the use of an so called accesskey takes a high user interaction. Is there another way to inject code here and have it execute without keypresses or a milder form of user interaction?

In my current case the three characters ()> are filtered.

I need an XSS vector that can be injected in this position:

<input type="hidden" name="[INJECTION]" />

Another reference to the accesskey XSS trick can be found here: https://www.davidsopas.com/xss-on-a-input-hidden-field/

  • 2
    Please could you explain your question further? It is unclear what you're after. Thanks. Mar 4, 2016 at 11:27
  • 2
    @SilverlightFox I think his question is "without user interaction, can XSS inject value in hidden input ?".
    – Walfrat
    Mar 4, 2016 at 12:11
  • Is there a way to inject code in hidden inputs w/o user interaction or mild-user interaction? when (<) is allowed Mar 5, 2016 at 11:25
  • 1
    I seriously have no idea how people would think that it is unclear what the OP is asking. unclear what you're asking is not I don't like this question, so it should be closed, or The question is badly phrased, lets close it. That's what downvoting and editing are for. That being said, this is a duplicate of Any eventhandlers that apply to hidden elements?.
    – tim
    Mar 5, 2016 at 16:13
  • @tod97 Try \u003 instead of >. Mar 5, 2016 at 17:02

1 Answer 1


Unless you can inject to change the type (e.g. to text), then there is no known vector to trigger XSS within a hidden input field without further user interaction.

e.g. With

<input name="[INJECTION]" type="hidden" />

You could inject

" type="text" onfocus="alert&#x28;'xss'&#x29;" autofocus="1

to render

<input name="" type="text" onfocus="alert&#x28;'xss'&#x29;" autofocus="1" type="hidden" />

However, unless you can get in before the already set type="hidden" or close the tag and start a new one (which you can't in your case due to filtered >), you're snookered.

  • The payload would need to be '><script>[...]. But as the OP said, > is filtered, so that would not work. The OP also never said where the username comes from. It could be GET or come from the database, so delivering POST XSS doesn't seem relevant to the OPs question.
    – tim
    Mar 5, 2016 at 17:11
  • I wasn't clear from the original post whether the payload was reflected into another hidden field or into HTML body context. I did actually begin to edit this today, but stopped when I realised it had been closed. Mar 5, 2016 at 18:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .