To test XSS for a certain website, username in the account settings to <script type="text/javascript">alert("XSS");</script>
. In the html the code it is visible and but it's not running. When change the username the page didn't refresh so the username change must happen with JS. Why is the script not running?
3 Answers
This happens because the developer tools of your browser misrepresent the value of the tag. Likely the content is correctly escaped, but your browser is trying to be helpful by showing in unescaped. Note how the tag in your example is completely grey and not syntax highlighted like the rest of the HTML.
-
2Note that some JS features like
textContent
andcreateTextNode
allow adding unescaped text to the page in a way that prevents it from being interpreted as HTML. That's likely what's happening here.– Ajedi32Commented Aug 30, 2018 at 14:42 -
1@Ajedi32: no, those setters automatically escape the text for you, and that's what keeps it from being interpreted. you can prove this by setting the textContent and getting the innerHTML...– dandavisCommented Aug 30, 2018 at 18:49
There's any number of reasons ranging from "This website is not vulnerable to XSS" down to "You need to massage your XSS string some more".
Getting XSS popups to work is a bit of an art. The Inspect Element view is not the best way to look at it because that is showing how your browser has parsed the HTML, but the whole point of XSS is to fool the HTML parser.
Instead do View Page Source and ctrl+f for your string alert("XSS")
. First, as @Sjoerd suggests, see if your string is being escaped (ie do you see <script>
or <script>
?). If being escaped properly, then you won't be able to do XSS. If it's not being escaped, then there probably is XSS. To get it working, you'll need to look at where your text is being placed within the source and close any strings and tags so that your <script>
tag is not buried inside something else. That's why you often see XSS payloads start with a quote and a close-tag, like "</a><script>...
. This part takes some trial and error. Good luck!
A simple and fast way you can check whether the XSS payload is being encoded correctly is to right click on the payload in the Web Inspector and select "Edit as HTML".
If the payload appears like "<script type="text/javascript">alert("XSS");</script>"
, which is the case for when you try it on StackExchange sites, you can see that the double quotes are properly HTML encoded as "
hence no XSS will occur.
<script>
tags, so it's obviously not working.