I have some cases of cross-site scripting (XSS) in hidden HTML input fields. There are some known XSS vectors that can be used for example using the HTML accesskey.
onfocuscan't be triggered due to the element being invisible. Source: http://blog.portswigger.net/2015/11/xss-in-hidden-input-fields.html
But the use of an so called
accesskey takes a high user interaction. Is there another way to inject code here and have it execute without keypresses or a milder form of user interaction?
In my current case the three characters
()> are filtered.
I need an XSS vector that can be injected in this position:
<input type="hidden" name="[INJECTION]" />
Another reference to the accesskey XSS trick can be found here: https://www.davidsopas.com/xss-on-a-input-hidden-field/