I have some cases of cross-site scripting (XSS) in hidden HTML input fields. There are some known XSS vectors that can be used for example using the HTML accesskey.

XSS in hidden inputs is frequently very difficult to exploit because typical JavaScript events like onmouseover and onfocus can't be triggered due to the element being invisible. Source: http://blog.portswigger.net/2015/11/xss-in-hidden-input-fields.html

But the use of an so called accesskey takes a high user interaction. Is there another way to inject code here and have it execute without keypresses or a milder form of user interaction?

In my current case the three characters ()> are filtered.

I need an XSS vector that can be injected in this position:

<input type="hidden" name="[INJECTION]" />

Another reference to the accesskey XSS trick can be found here: https://www.davidsopas.com/xss-on-a-input-hidden-field/

  • 2
    Please could you explain your question further? It is unclear what you're after. Thanks. Mar 4 '16 at 11:27
  • 2
    @SilverlightFox I think his question is "without user interaction, can XSS inject value in hidden input ?".
    – Walfrat
    Mar 4 '16 at 12:11
  • Is there a way to inject code in hidden inputs w/o user interaction or mild-user interaction? when (<) is allowed Mar 5 '16 at 11:25
  • 1
    I seriously have no idea how people would think that it is unclear what the OP is asking. unclear what you're asking is not I don't like this question, so it should be closed, or The question is badly phrased, lets close it. That's what downvoting and editing are for. That being said, this is a duplicate of Any eventhandlers that apply to hidden elements?.
    – tim
    Mar 5 '16 at 16:13
  • @tod97 Try \u003 instead of >. Mar 5 '16 at 17:02

Unless you can inject to change the type (e.g. to text), then there is no known vector to trigger XSS within a hidden input field without further user interaction.

e.g. With

<input name="[INJECTION]" type="hidden" />

You could inject

" type="text" onfocus="alert&#x28;'xss'&#x29;" autofocus="1

to render

<input name="" type="text" onfocus="alert&#x28;'xss'&#x29;" autofocus="1" type="hidden" />

However, unless you can get in before the already set type="hidden" or close the tag and start a new one (which you can't in your case due to filtered >), you're snookered.

  • The payload would need to be '><script>[...]. But as the OP said, > is filtered, so that would not work. The OP also never said where the username comes from. It could be GET or come from the database, so delivering POST XSS doesn't seem relevant to the OPs question.
    – tim
    Mar 5 '16 at 17:11
  • I wasn't clear from the original post whether the payload was reflected into another hidden field or into HTML body context. I did actually begin to edit this today, but stopped when I realised it had been closed. Mar 5 '16 at 18:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.