0

I've noticed that the following Stored XSS does not execute, whereas in the JS console it works:

<img src=0 onerror=alert(document.domain+": "+Date.now())>

This doesn't prompt an alert box. Whereas the following do:

<img src=0 onerror=alert(Date.now())>
<img src=0 onerror=alert(document.domain)>

Casting any of the elements with String() doesn't help either.

The plain alert statement (alert(document.domain+": "+Date.now())) works in the Chrome JS console, in Firefox it works if I add the semicolon at the end.

I'm certainly no JS wizard, but I don't see why this doesn't work.

Why does the initial XSS via the image tag not work?

2 Answers 2

3

You have to remove space in ": " or add quotes for onerror attribute value:

<img src=0 onerror='alert(document.domain+": "+Date.now())'>
1
  • 1
    To encode the space, you can use ":\x20".
    – Anders
    Nov 16, 2018 at 12:42
2

You put a quote in the original one. This messes up the HTML parser because " has special meaning inside the attribute space of a tag.

I'm wrong. It's the space.

8
  • So I assume this <img src=0 onerror=alert(document.domain+': '+Date.now())> should work? I just tested it and it doesn't work either. Nov 15, 2018 at 11:38
  • 2
    I think that's actually not because of the quote but the space. Quotes inside an unquoted attribute AFAIK don't bother the parser.
    – Arminius
    Nov 15, 2018 at 11:38
  • @Arminius Interesting! Without the space it works - why is that so? Nov 15, 2018 at 11:40
  • @GarlicCheese Because if your attribute value is unquoted, the parser assumes that after a space a new attribute is starting.
    – Arminius
    Nov 15, 2018 at 11:41
  • @Arminius I'm afraid I don't follow. What attribute is unquoted? How can I use spaces in this scenario? Nov 15, 2018 at 12:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.