1

I have a XSS payload that successfully ran the javascript when I pasted the URL in browser and hit enter. This is the URL:

localhost/path/to/file.jsp?aMessage=%3Cscript%3Ealert(%27XSSed%27)%3C/script%3E

Where aMessage gets displayed in a table like so:

<table>
  <tr>
     <td>
         <%= myObject.getString("aMessage") %>
     </td>
  </tr>
</table>

The markup looks like so:

localhost/path/to/file.jsp?aMessage=<script>alert('XSSed')</script>

The result: an alert dialog pops up and says 'XSSed'. I then tried to perform a XSS attack using the title/subtitle of the web page, but it didn't work. This was the new URL:

localhost/path/to/file.jsp?aTitle=%3Cscript%3Ealert(%27XSSed%27)%3C/script%3E&aSubTitle=%3Cscript%3Ealert(%27XSSed%27)%3C/script%3E

where aTitle gets assigned to title and aSubTitle gets assigned to subTitle in the jsp like so:

<popup
    title = '<%= myObject.getString("aTitle") %>'
    subTitle = '<%= myObject.getString("aSubTitle") %>'>
</popup>

Where popup is a custom tag in an xml file.

So I have a couple questions:

1) Is it possible to perform a XSS attack using the title/subtitle of a webpage? I am wondering if it is necessary to escape the characters in these fields as well, or if it is fine to accept whatever text. (I know it's generally not a good idea it's just for the sake of curiousity).

2) If it IS possible, why doesn't this work?

4
  • 1
    Can you give us a bit more context? Specifically, where are the "aTitle" and "aSubTitle" variable getting written to the page. Can you include the markup, similar to what you've done for the "aMessage" variable? Commented Jul 6, 2017 at 16:23
  • I added a little more description to it. Let me know if there's anything else you need!
    – Michael
    Commented Jul 6, 2017 at 16:28
  • Can you show us what the rendered markup looks like when you navigate to 'localhost/path/to/file.jsp?aTitle=%3Cscript%3Ealert(%27XSSed%27)%3C/script%3E&aSubTitle=%3Cscript%3Ealert(%27XSSed%27)%3C/script%3E ' Commented Jul 6, 2017 at 16:35
  • traditional xss can work anywhere on the page. dom-based needs special contexts.
    – dandavis
    Commented Jul 6, 2017 at 18:44

1 Answer 1

1
  1. Yes, it is possible. It all depends on where the content is reflected in the markup, and if the content is escaped properly for the given context.

  2. Your xss doesn't work in the title fields because it's not formatted correctly for the given context. The markup for "aMessage" is in an element context. Your XSS Payload is formatted for that context. "aTitle" and "aSubtitle" are in an attribute context. Your payload is not formatted for that context.

You have a couple of different options to get it to work:

  1. See if you can get to an element context. Try entering aSubTitle with a value like

"> < /popup> < script> alert('xss'); < /script> < popup>

The resulting markup should look something like

"< popup title="What ever you entered for title" subTitle="">< /popup> < script> alert('xss'); < /script> < popup> < /popup>

  1. If the output is being encoded for an attribute context, try exploiting a javascript event to execute your payload. For example:

" onmouseover="alert('xss');" could potential cause your payload to execute when the user mouses over your content.

4
  • Hey I tried both and neither seemed to work. What is the need for the double quote before the payload?
    – Michael
    Commented Jul 6, 2017 at 20:08
  • The double quote closes the "subTitle" attribute. Look at the markup that is getting rendered, see if what is being rendered, and modify your input accordingly. Keep playing with it, and I'm confident it will work. Commented Jul 7, 2017 at 20:12
  • I will try that on monday, thanks for the help so far
    – Michael
    Commented Jul 7, 2017 at 20:53
  • In the example attributes are enclosed in single quotes, so '><script> alert('xss');... Commented Sep 4, 2017 at 22:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .