I am trying to insert a XSS payload into a hidden HTML input field. I know it works with a script tag like below, but I am looking for other alternatives.
<input type="hidden" name="date" value=""/> <script>alert('0');</script>" />
I found this article, that says it can be done with the
Eventually I learned about XSS through access keys from above article and wondered if the onclick event would be called on the hidden input when it activated via an access key. From articles I learnt, we can execute an XSS payload inside a hidden attribute, provided you can persuade the victim into pressing the key combination. On Firefox Windows/Linux the key combination is ALT+SHIFT+X and on OS X it is CTRL+ALT+X..
As of now I know it works with some type attribute value, e.g:
<input type="text" accesskey="X" onclick="alert(1)">
I was trying with a hidden field:
<input type="hidden" accesskey="X" onclick="alert(1)">
But this is not working for me in several browsers, assuming it might have been handled for recent browsers, so then also tried with some lower versions like firefox 4, but din work out. Can anyone help with this?