2

This is an XSS vulnerability I've found in a practice site. So, I need to create an alert() popup, but alert() is changed to prompt() by another script loaded before I give any input. (So I can't get rid of that script) So how can I make an alert() popup?

The code strips <, >, and + (I've only found these three) but changing my payload and injecting them doesn't seem to help.

I've tried window\["alert"](1) which is also detected. So are window["al"+"ert"] and window["al".concat("ert")].

I think I need to find another solution instead of alert(), but I have no clue where to proceed from here.

  • Normally being able to trigger a prompt would be sufficient to prove XSS - is this a specific challenge to trigger an alert, rather than a generic XSS challenge? – Matthew Jun 1 '18 at 8:06
  • @Matthew, apparently yes. No prompt or confirm helps. (XSS is allowed deliberately, so that is not the point of the challenge in this case) – user2505282 Jun 1 '18 at 8:44
2

Try with a fresh copy of window:

document
.body
.appendChild(document.createElement("iframe"))
.contentWindow
.alert("XSS");

you can cleanup/hide the iframe as needed, it doesn't have to navigate, it just has to exist to expose its global window methods. Think of it as a web worker with more built-ins. Note that even though chrome46+ block alerts from iframes, you're not calling it from the iframe technically, so it's allowed. This is also a decent way to avoid re-writes/fork to run a process that conflicts with pre-existing code which doesn't need the document's content to function, but needs DOM tools that Worker doesn't provide, like alert.

  • Thanks, this worked. I hadn't known about this though, need to read up a bit on it. – user2505282 Jun 1 '18 at 8:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.