1

I have a XSS payload that successfully ran the javascript when I pasted the URL in browser and hit enter. This is the URL:

localhost/path/to/file.jsp?aMessage=%3Cscript%3Ealert(%27XSSed%27)%3C/script%3E

Where aMessage gets displayed in a table like so:

<table>
  <tr>
     <td>
         <%= myObject.getString("aMessage") %>
     </td>
  </tr>
</table>

The markup looks like so:

localhost/path/to/file.jsp?aMessage=<script>alert('XSSed')</script>

The result: an alert dialog pops up and says 'XSSed'. I then tried to perform a XSS attack using the title/subtitle of the web page, but it didn't work. This was the new URL:

localhost/path/to/file.jsp?aTitle=%3Cscript%3Ealert(%27XSSed%27)%3C/script%3E&aSubTitle=%3Cscript%3Ealert(%27XSSed%27)%3C/script%3E

where aTitle gets assigned to title and aSubTitle gets assigned to subTitle in the jsp like so:

<popup
    title = '<%= myObject.getString("aTitle") %>'
    subTitle = '<%= myObject.getString("aSubTitle") %>'>
</popup>

Where popup is a custom tag in an xml file.

So I have a couple questions:

1) Is it possible to perform a XSS attack using the title/subtitle of a webpage? I am wondering if it is necessary to escape the characters in these fields as well, or if it is fine to accept whatever text. (I know it's generally not a good idea it's just for the sake of curiousity).

2) If it IS possible, why doesn't this work?

  • 1
    Can you give us a bit more context? Specifically, where are the "aTitle" and "aSubTitle" variable getting written to the page. Can you include the markup, similar to what you've done for the "aMessage" variable? – user52472 Jul 6 '17 at 16:23
  • I added a little more description to it. Let me know if there's anything else you need! – Michael Jul 6 '17 at 16:28
  • Can you show us what the rendered markup looks like when you navigate to 'localhost/path/to/file.jsp?aTitle=%3Cscript%3Ealert(%27XSSed%27)%3C/script%3E&aSubTitle=%3Cscript%3Ealert(%27XSSed%27)%3C/script%3E ' – user52472 Jul 6 '17 at 16:35
  • traditional xss can work anywhere on the page. dom-based needs special contexts. – dandavis Jul 6 '17 at 18:44
1
  1. Yes, it is possible. It all depends on where the content is reflected in the markup, and if the content is escaped properly for the given context.

  2. Your xss doesn't work in the title fields because it's not formatted correctly for the given context. The markup for "aMessage" is in an element context. Your XSS Payload is formatted for that context. "aTitle" and "aSubtitle" are in an attribute context. Your payload is not formatted for that context.

You have a couple of different options to get it to work:

  1. See if you can get to an element context. Try entering aSubTitle with a value like

"> < /popup> < script> alert('xss'); < /script> < popup>

The resulting markup should look something like

"< popup title="What ever you entered for title" subTitle="">< /popup> < script> alert('xss'); < /script> < popup> < /popup>

  1. If the output is being encoded for an attribute context, try exploiting a javascript event to execute your payload. For example:

" onmouseover="alert('xss');" could potential cause your payload to execute when the user mouses over your content.

  • Hey I tried both and neither seemed to work. What is the need for the double quote before the payload? – Michael Jul 6 '17 at 20:08
  • The double quote closes the "subTitle" attribute. Look at the markup that is getting rendered, see if what is being rendered, and modify your input accordingly. Keep playing with it, and I'm confident it will work. – user52472 Jul 7 '17 at 20:12
  • I will try that on monday, thanks for the help so far – Michael Jul 7 '17 at 20:53
  • In the example attributes are enclosed in single quotes, so '><script> alert('xss');... – SleepProgger Sep 4 '17 at 22:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.