<img class="avatar" src="MY INPUT SPACE">

I am trying to bypass an XSS filter but it is not working since given <, > are filtered. I feel like it I could break it since only these two characters are filtered but I just couldn't find a way to do it, any suggestion on this?

  • 1
    If just those are filtered, write out the html tag as you normally would, and apply the injection half afterwards. Example: <img class="avatar" src="imghere.jpg" onload="javascript:alert('lol');"/>. So, input imghere.jpg" onload="javascript:alert('lol');? – Mark Buffalo Apr 15 '18 at 2:37
  • It looks like I am getting there, however the there is no alert showing. I am getting:<img class="image" src="image.com/1" onload="javascript:alert('lol')></p></figure><div class=" content"=""> – Alex Apr 15 '18 at 2:51
  • @Mark Buffalo After a few attempts, I am able to make the site to store a image of: <img class="avatar-image" src="petco.scene7.com/is/image/PETCO/…>"> but the script is never excuted – Alex Apr 15 '18 at 3:31
  • Why are you adding a semi-colon after the src attribute? – Mark Buffalo Apr 15 '18 at 6:40
  • What about loading an external javascript file using myevilsite.org/injections.js or something similar. This assuming you have "real" control over src= – Jeroen Apr 15 '18 at 9:48

The general advice (to inject an event handler in the image tag) from @MarkBuffalo in the comment is correct, but onload isn't a great choice of event handler for images. The better option is usually onerror, which is very easy to reliably trigger; just set the source to be something you know won't exist (or at least won't be an image), like src="qq" onerror="alert('XSS!')".

The specific exception I like is SVG tags, where <svg onload="…" /> is a nice short string (as short as <script>…</script>, and usable in places that try stupid tricks like filtering <script>).

  • 2
    Just wondering, but why isn't onload a good choice for images? It works for me pretty much every time. However, stuff like buttons, or other elements, sure. – Mark Buffalo Apr 15 '18 at 6:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.