1

Is there a possible way to write a payload which can bypass filtering of ', ", < and >? As far as I know, it's javascript:alert() as this uses none of the above. So should it work if I use that in an input field where all the above mentioned chars are filtered?

I have a field like this:

<input type="text" name="name" value=''></input>

Now I have to close the quote at value and put my string (e.g. ' onload=javascript:alert()), but that single quote doesn't show up in the source of my resource.

Improve this question
2
  • If single quotes are filtered and your injection point is inside the value attribute you have no way of injecting JS.
    – Arminius
    Commented Apr 6, 2017 at 21:52
  • It may be bypassed if encodings are messed up. Saying input is UTF-8 and encoding is UTF-8, then it won't escape multibyte characters containing 0x27 byte (the ' but I don't know if such byte can appear in UTF-8 multibyte characters). If the client interprets the HTML as ASCII/latin1 then it may end up reading the multibyte as multiple characters, one being the closing '
    – Xenos
    Commented Apr 7, 2017 at 12:19

2 Answers 2

Reset to default
4

No, XSS cannot work here without a single quote.

In javascript:alert(), the first part is the javascript protocol. You need to be in a URL context for it to work (eg inside an href attribute). It will also work - but not be necessary - in an Event Attribute (eg onload).

To perform XSS in your context, you need to be able to exit the string context of the value attribute. To do this, you need single quotes. If they are properly filtered, there is no XSS here.

(There is a slight change that the filter is not working properly; filtering may for example be done first, after which the input is handled further - eg decoded from some format - which might allow you to bypass the filter; but if you cannot bypass the filter and inject a single quote, you cannot perform XSS).

Improve this answer
0

The previous answer to this question, as far as I'm aware is wrong. You can bypass single quotes by using functions that do not result in void return values.

For example

<img src=javascript:eval(alert(new Data.now()))>

This would trigger an XSS alert with no quotes required.

Improve this answer
3
  • would your example work in the value field in the OP's scenario?
    – schroeder ♦
    Commented May 18, 2018 at 14:01
  • the value field is irrelevant without more information on what is happening to the form after submission. For xss, it is usually how this form is then displayed on the following screen that allows for the actual alert to show up
    – Dimi Tree
    Commented May 22, 2018 at 4:19
  • for example <input name='foo' value=''> on the next screen this is rendered as <span>(then foos value is placed here)</span> What can turn this input into an XSS is whether the input field was either not sanitised, not filtered or there was no handelling of JS escape characters
    – Dimi Tree
    Commented May 22, 2018 at 4:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .