So, I am trying to understand how XSS works and I gathered some information online and crafted the code. Following is the snippet. When I enter some value in the text field and submit, the script should get exected.

<form action="http://randomsite/temp.php" onsubmit="" method="POST">
    <input type="text" name="test" value='"></input><script>function alrt(){alert();} document.forms[0].setAttribute("onsubmit", "alrt()");</script><br'>

While the above code works, I do not understand why. Specifically, I do not understand the single quotation in value='">. I also do not understand the ending break tag with a single quotation. I am not very proficient in JS so I would appreciate any pointers.

  • "While the above code works, ..." - it does not work for me, neither on Firefox nor Chrome. It just displays "></input><script>function alrt(){alert();} document.forms[0].setAttribute("onsubmit", "alrt()");</script><br inside the text field. It only works if it starts with value='' but not value='". – Steffen Ullrich Nov 10 '18 at 19:48
  • That's interesting. Because when I change it to value=' ', it doesn't work for me. I'm testing this on IceWeasel – Kar Nov 10 '18 at 20:29
  • IceWeasel was the former branding of Firefox by Debian but this is no longer done since 2016. This suggests for me that you are not using an up-to-date browser. What version number is displayed? – Steffen Ullrich Nov 10 '18 at 20:32
  • It is ESR 45.4.0 – Kar Nov 10 '18 at 20:35
  • Firefox/IceWeasel ESR 45 is no longer supported. Version 45.4.0 was more than two years ago. Maybe the behavior changed. – Steffen Ullrich Nov 10 '18 at 20:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.