0

I am trying to exploit a reflected cross site scripting in a GET request where the reflection is in the first multi line script block.

It seems I can use every character but <, > and " and the best payload I could come up with is /?search='}]%3Balert(1)%3B%2F%2F

And it gets reflected like this:

<head><script> dataLayer = [{ 'pageType': 'Page', 'category': 'Search', 'searchTerm': ''}];alert(1);//', 'searchResults': '0', }]; </script>

Unfortunately this does not work. Neither does it with /* instead of // to comment out the rest of the script block. Is there any way to make it work without using "<" and ">"? Now it fails with "SyntaxError: unexpected token: ':'"

| improve this question | |
  • if needed, you can append the payload with code to re-open a new object in an array: [{ to balance it. – dandavis Nov 15 '18 at 6:20
2

You don't need to comment anything out.

Use:

/?search='-alert()-'

JS will attempt to create the search term string from the expression '' - alert() - '' which will trigger the alert function. I preferred - over + because it avoids potential issues with URL encoding and is rarely blacklisted, but you may also use any other binary operators to squeeze in your payload without causing a syntax error.

| improve this answer | |
  • That actually worked. And this would work in many more cases I assume... :-) I just wasn't aware that you can squeeze the code in the middle of some string using binary operators. Thank you Arminius – 6661620a Nov 16 '18 at 0:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.