I am practicing HTML injection on my friends website(he knows that I am practicing). So I found one vulnerability if I type <!----> in search box username or password website ignores it. and I practiced some tags in search box like <script>, <styles>, <link> and website ignores(or I don't know what it does with them).

So I typed this in search box <script src=[myip]/tmp.js></script> and when I did this as query it gave result Error: Please enter a query to search. and in that tmp.js file was a simple alert('hey'); but website didn't pop hey.

So I tried some other injections from different websites and got these as output(all in search box)

INPUT:    <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
OUTPUT:   Results for "<input type="image" src="denied:javascript:alert('XSS');">"


INPUT:   "<xml ID=I><X><C><![CDATA[<IMG SRC=""javas]]><![CDATA[cript:alert('XSS');"">]]>"
OUTPUT:  Results for """"


OUTPUT:   Results for ""<span></span>""

Question: so is the website vulnerable can I inject somehow javascript, or can I enter backend somehow? or should I inject something else?(website uses PHP as backend)

  • In form fields I would try SQL injection. – André Borie Feb 21 '17 at 8:05
  • I'd recommend to first understand what you are doing before trying to go further. Doing some actual programming could help you – niilzon Feb 21 '17 at 8:20
  • Your question is unclear. What exactly did you put in what did you get out - in each separate case? Why are you alternatively talking about a search box and a query? What (else) do you know about that website? Please edit your question. – user13695 Feb 21 '17 at 9:36
  • Are the results the HTML source code or the rendered page? You should be looking at the source code to see what is actually happening with your input. – tim Feb 21 '17 at 19:40
  • @tim rendered output. – user5954246 Feb 21 '17 at 19:47

Results for ""<span></span>""

If you see this in the rendered page, the page is not vulnerable to XSS, because the < and > characters are correctly escaped. The source would look like this:

Results for ""&lt;span&gt;&lt;/span&gt;""

As you can see your HTML tags don't end up as HTML tags in the source, so it is not possible to inject tags into the HTML.

Now, it seems that your site also does some sanitation on the input. It removes some tags and alters the javascript: URL. This is not a sufficient method to protect against XSS. It is pretty hard to write an XSS filter correctly, and most of the time such filters can be bypassed by using some combination of tags and attributes.

The correct way to protect against XSS is to HTML encode on output.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.