0

Is it possible to get XSS in the value field of Input tag when the application filters out double quote?

<input type="hidden" name="something" id="somenthing" value="my_input_goes_here">

input from request goes inside the value field , so i tried to close it with " and give a payload like " accesskey="X" onclick="alert(1)" but " is filtered out.

So any XSS vector possible in this scenario?

Improve this question
2
  • Have you tried encoding / double encoding it?
    – Jeroen
    Mar 6 '19 at 6:25
  • @Jeroen-ITNerdbox Yes, both single and double encoding but still it's getting filtered.
    – pentesterxvi
    Mar 6 '19 at 11:52
1

No, per the HTML specification, only the matching quote (in this case, double quotes), can get you out of the attribute value context.

You might be able to get a " past the filter with some filter evasion tricks, but as long as the browser's HTML parser doesn't see a literal double quote, it won't exit the attribute context for you to inject a payload.

Improve this answer
2
  • agreed. So is there any event handlers or payload that can be given directly inside the attribute value context itself ? . So that i don't have to use double quote
    – pentesterxvi
    Mar 6 '19 at 11:57
  • No event handlers cannot be specified inside that paramater you will have to break out of the parameter first
    – yeah_well
    Mar 6 '19 at 12:57
0

No,Only a double quote will be able to get out of that situation. But sometimes developers don't quote a parameter .Then they can be broken out of with various ways including [space] % * + , - / ; < = > ^ and |.Lookup OWASP xss filter evasion cheat sheet to learn more.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.