-2

I'm having this super hard XSS challnge. I'm in the JavaScript tag already so all I need to do is just pop up an alert box. The problem is that I just can't use a lot of alert options:

  • alert turns to Alert
  • confirm turns to Confirm
  • prompt turns to Prompt
  • window turns to WINDOW
  • eval turns to EVAL

I tried to URL encode it but it dosn't work. What else can I do? Are there more options like alert that are not in the list?

closed as off-topic by John Deters, techraf, S.L. Barth - Reinstate Monica, Steve Dodier-Lazaro, Xander Aug 22 '16 at 15:50

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – John Deters, techraf, S.L. Barth - Reinstate Monica, Steve Dodier-Lazaro
If this question can be reworded to fit the rules in the help center, please edit the question.

  • I don't know if it must be an alert from javascript but maybe something from jquery would also work. jqueryui.com/dialog/#modal – Lexu Aug 19 '16 at 13:13
  • constructor.constructor(atob("YWxlcnQoNjY2KQ=="))(); or ({}).constructor.constructor(atob("YWxlcnQoNjY2KQ=="))(); – dandavis Sep 1 '16 at 10:55
5

Does this still work? If so, you can try:

<script>this["al" + "ert"]("Test")</script>
  • 2
    @ShaiAlfasi If this answer helped you and solved your problem, you can mark it as accepted by clicking the check box under the score to the left of the post. – Anders Aug 19 '16 at 14:27
  • note that if "use strict" was globally applied before the above code it will throw. – dandavis Sep 1 '16 at 10:54
3

If for your challenge VBScript is allowed, your XSS should work in Internet Explorer:

<script language=VBScript>MsgBox "XSS"</script>

VBScript isn't case sensitive, so even if the above is changed to Msgbox or MSGBOX then the attack should still work.

2

There is tons of javascript code obfuscation generator.
Some infamous generator are Hieroglyphy and jsfuck

If all this code is injected before the script, and call it afterwards, it will defeat all javascript function replacement. This will escape most of the javascript function replacement tricks. E.g. if some program saw the "this" and replace it, then there is a no go.

Nevertheless, if a plugin replace the function with other stuff, it will cripples most XSS. E.g.

# if the plugin sit on the background and run this before the tab/page XSS
alert=document.write()

Not the answer you're looking for? Browse other questions tagged or ask your own question.