0

I've noticed that the following Stored XSS does not execute, whereas in the JS console it works:

<img src=0 onerror=alert(document.domain+": "+Date.now())>

This doesn't prompt an alert box. Whereas the following do:

<img src=0 onerror=alert(Date.now())>
<img src=0 onerror=alert(document.domain)>

Casting any of the elements with String() doesn't help either.

The plain alert statement (alert(document.domain+": "+Date.now())) works in the Chrome JS console, in Firefox it works if I add the semicolon at the end.

I'm certainly no JS wizard, but I don't see why this doesn't work.

Why does the initial XSS via the image tag not work?

3

You have to remove space in ": " or add quotes for onerror attribute value:

<img src=0 onerror='alert(document.domain+": "+Date.now())'>
  • 1
    To encode the space, you can use ":\x20". – Anders Nov 16 '18 at 12:42
2

You put a quote in the original one. This messes up the HTML parser because " has special meaning inside the attribute space of a tag.

I'm wrong. It's the space.

  • So I assume this <img src=0 onerror=alert(document.domain+': '+Date.now())> should work? I just tested it and it doesn't work either. – GarlicCheese Nov 15 '18 at 11:38
  • 2
    I think that's actually not because of the quote but the space. Quotes inside an unquoted attribute AFAIK don't bother the parser. – Arminius Nov 15 '18 at 11:38
  • @Arminius Interesting! Without the space it works - why is that so? – GarlicCheese Nov 15 '18 at 11:40
  • @GarlicCheese Because if your attribute value is unquoted, the parser assumes that after a space a new attribute is starting. – Arminius Nov 15 '18 at 11:41
  • @Arminius I'm afraid I don't follow. What attribute is unquoted? How can I use spaces in this scenario? – GarlicCheese Nov 15 '18 at 12:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.