0

To test XSS for a certain website, username in the account settings to <script type="text/javascript">alert("XSS");</script>. In the html the code it is visible and but it's not running. When change the username the page didn't refresh so the username change must happen with JS. Why is the script not running?

<div class="jss733 jss30 jss31"> "<script type="text/javascript">alert("XSS"); </script>" <b class="jss45 jss46 jss48"></b> </div>

  • you're not supposed to be able to see <script> tags, so it's obviously not working. – dandavis Aug 30 '18 at 18:49
2

This happens because the developer tools of your browser misrepresent the value of the tag. Likely the content is correctly escaped, but your browser is trying to be helpful by showing in unescaped. Note how the tag in your example is completely grey and not syntax highlighted like the rest of the HTML.

  • 2
    Note that some JS features like textContent and createTextNode allow adding unescaped text to the page in a way that prevents it from being interpreted as HTML. That's likely what's happening here. – Ajedi32 Aug 30 '18 at 14:42
  • 1
    @Ajedi32: no, those setters automatically escape the text for you, and that's what keeps it from being interpreted. you can prove this by setting the textContent and getting the innerHTML... – dandavis Aug 30 '18 at 18:49
1

There's any number of reasons ranging from "This website is not vulnerable to XSS" down to "You need to massage your XSS string some more".

Getting XSS popups to work is a bit of an art. The Inspect Element view is not the best way to look at it because that is showing how your browser has parsed the HTML, but the whole point of XSS is to fool the HTML parser.

Instead do View Page Source and ctrl+f for your string alert("XSS"). First, as @Sjoerd suggests, see if your string is being escaped (ie do you see <script> or &lt;script&gt;?). If being escaped properly, then you won't be able to do XSS. If it's not being escaped, then there probably is XSS. To get it working, you'll need to look at where your text is being placed within the source and close any strings and tags so that your <script> tag is not buried inside something else. That's why you often see XSS payloads start with a quote and a close-tag, like "</a><script>.... This part takes some trial and error. Good luck!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.