aMessage gets displayed in a table like so:
<table> <tr> <td> <%= myObject.getString("aMessage") %> </td> </tr> </table>
The markup looks like so:
The result: an alert dialog pops up and says 'XSSed'. I then tried to perform a XSS attack using the title/subtitle of the web page, but it didn't work. This was the new URL:
where aTitle gets assigned to title and aSubTitle gets assigned to subTitle in the jsp like so:
<popup title = '<%= myObject.getString("aTitle") %>' subTitle = '<%= myObject.getString("aSubTitle") %>'> </popup>
Where popup is a custom tag in an xml file.
So I have a couple questions:
1) Is it possible to perform a XSS attack using the title/subtitle of a webpage? I am wondering if it is necessary to escape the characters in these fields as well, or if it is fine to accept whatever text. (I know it's generally not a good idea it's just for the sake of curiousity).
2) If it IS possible, why doesn't this work?