2

Is it possible to set a javascript variable through the URL?

Here's an example of the code I'm trying to modify:

<script type="text/javascript">

var x = 0;

</script>

Is there a way to modify that variable through a browser, for instance, www.somewebsite.com + (something that changes 'x' variable)?

Related on Stack Exchange:https://stackoverflow.com/questions/39023761/modify-javascript-variable-with-url

4

No, this is not possible without an XSS vulnerability. If such a thing were generally possible, XSS would run rampant and you could execute any arbitrary code on any page, which would be bad.

Now if the code had a reflected XSS attack vector, or an DOM-based XSS attack vector, the the URL could be used to deliver a JavaScript payload. Of course, this would only be possible if the server-side or JavaScript code had such a security vulnerability (if your code makes that possible, then you should fix it).

1

Similar attacks are possible, without XSS.

Say the code was

<script type="text/javascript">

var x = 0;

// Some processing

x=395;

</script>

If the attacker wants the value of x not to be affected by the x=395 they could use the browser's anti-XSS filter in order to filter out the code.

e.g. By creating a crafted link to send to their victim:

example.com/page.html?param=x%3d395%3b

The XSS filter will detect that the parameter value is reflected in the output (x=395;), and block execution of it.

Therefore, the original value of x will remain.

In order to mitigate this, set the user's browser's XSS filter to block rather than to filter using security headers:

X-XSS-Protection: 1; mode=block

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.