0

I've noticed that the following Stored XSS does not execute, whereas in the JS console it works:

<img src=0 onerror=alert(document.domain+": "+Date.now())>

This doesn't prompt an alert box. Whereas the following do:

<img src=0 onerror=alert(Date.now())>
<img src=0 onerror=alert(document.domain)>

Casting any of the elements with String() doesn't help either.

The plain alert statement (alert(document.domain+": "+Date.now())) works in the Chrome JS console, in Firefox it works if I add the semicolon at the end.

I'm certainly no JS wizard, but I don't see why this doesn't work.

Why does the initial XSS via the image tag not work?

2 Answers 2

3

You have to remove space in ": " or add quotes for onerror attribute value:

<img src=0 onerror='alert(document.domain+": "+Date.now())'>
1
  • 1
    To encode the space, you can use ":\x20".
    – Anders
    Nov 16, 2018 at 12:42
2

You put a quote in the original one. This messes up the HTML parser because " has special meaning inside the attribute space of a tag.

I'm wrong. It's the space.

8
  • So I assume this <img src=0 onerror=alert(document.domain+': '+Date.now())> should work? I just tested it and it doesn't work either. Nov 15, 2018 at 11:38
  • 2
    I think that's actually not because of the quote but the space. Quotes inside an unquoted attribute AFAIK don't bother the parser.
    – Arminius
    Nov 15, 2018 at 11:38
  • @Arminius Interesting! Without the space it works - why is that so? Nov 15, 2018 at 11:40
  • @GarlicCheese Because if your attribute value is unquoted, the parser assumes that after a space a new attribute is starting.
    – Arminius
    Nov 15, 2018 at 11:41
  • @Arminius I'm afraid I don't follow. What attribute is unquoted? How can I use spaces in this scenario? Nov 15, 2018 at 12:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .