I am trying to generate a POC for DOM XSS exploit. I could inject a code using the following link:

<a href="wepage.jsp" target='&quot;><script> alert(document.cookie)</script></div>'>domxss</a>

The injected code appears in a div element in the data-window parameter:

<div id="23212" class="contextMenu" data-window="&quot;><script> alert(document.cookie)</script></div>" style="display: none;"><a .....

I tried to pass &quote as a hex code, double encoded (%2522), with hackbar String.fromCharCode..., but still the double quote is rendered back to &quote;

Any hint for how to bypass the double quote or if there is another way to inject alert here?

  • 1
    Do you know anything about the process by which the payload ends up in the data-window attribute? – Anders Oct 4 '18 at 10:31
  • What if you just pass in the hex code for a double quote? since it seems to be translating your HTML entities perfectly fine. – xorist Oct 4 '18 at 14:37
  • does the injection appear in view-source? – dandavis Oct 4 '18 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.