4

Is it possible to inject a payload inside <a> tag such that the script runs without user interaction?

The injection is inside the href attribute. I can inject onmouseover or onclick attributes, but user interaction is required.

The onfocus and autofocus trick does not work in <a> tag (correct me if I'm wrong).

In my case, the page cannot be loaded in iframe, so I can't do tricks with iframes.

Do you know some other tricks?

10

You can force the user interaction with CSS, by making the a element an fixed positioned block element with a large size and z-index.

<a style="display: block; position: fixed; top: 0; left: 0; z-index: 99999; width: 9999px; height: 9999px;" onmouseover="alert('xss')">

  • mousemove would be better in that mouseover might not fire on a full-window elm because the pointer is already "over" the elm. (both events should require movement) – dandavis Sep 6 '17 at 18:41
  • 2
    Wouldn't absolute positioning (even if combined with left: 0; top: 0;) place the element relative to its offset parent? I think position: fixed would do the trick, as it allows for positioning relative to the viewport and not just the closest positioned parent. Perhaps one could even add right: 0; bottom: 0;, which would effectively cover the entire page. – rhino Sep 6 '17 at 23:07
  • @rhino Yes, sorry, will fix. – Polynomial Sep 7 '17 at 13:07
2

Yes, that's possible.

The onfocus and autofocus trick does not work in tag (correct me if I'm wrong).

Correct, the autofocus attribute doesn't exist for <a> tags. But instead, you can take advantage of anchor names to still achieve the autofocus effect.

E.g., create a document with this link:

<a href="#" onfocus="alert('Gimme bounty!')" name="foo">Click me</a>

Now open the document as https://example.com/anchor.html#foo. The anchor #foo will make the browser autofocus the link element with the name foo and trigger the JS payload.

(This works for me in Google Chrome but not Firefox.)

  • might try a meta redirect to change the hash after page-load, to see if focus() fires in FF – dandavis Sep 6 '17 at 18:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.