2

An XSS bug was found in United Airlines by Strukt and Burelogic (full article here). Apparently they were using this to protect from XSS:

Basically, the code overrides the native alert(), confirm(), prompt(), unescape(), and document.write()functions and nullifies them, so calling them does absolutely nothing. This was implemented as an "XSS protection".

I was wondering if using a base tag to point to a js file with a simple XSS payload would be blocked by the same function that blocked the XSS in the first place.

Improve this question
  • You can't import JS with base, you would need script. Or are you suggesting that you should set base href to a domain that you control, and then host the code without the XSS protections there? – Anders Nov 19 '17 at 11:27
1

The CSP will block your JS from a third party website. However, in the event that you manage to find a CSP bypass, XSSObject.proxy will override those functions anyway, because a javascript src runs on the page it is called.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.