0

I've seen

<base href=/\evil> 

and

 <base href=//0>

as a vector to use XSS. Could someone make an example using these vectors and explain me if "/\" is the same as http:// or has some special meaning?

Thanks.

0

/\ interprets the same as //. // tells the browser to pick https:// if available or http:// if not.

Neither of these are major exploits persay, they just make code more error proof against not knowing if a system has an active SSL.

/\evil is probably just using "evil" as a placeholder for a malicious address

//0 will in some instances interpret as //0.0.0.0 which means "no particular address", so probably also a placeholder, but in some cases, going to IP 0.0.0.0 may initiate a default behavior which is exploitable such as https://nvd.nist.gov/vuln/detail/CVE-2018-1281. Using //0 instead of //0.0.0.0 may be intended as a way to bypass validation.

See: https://en.wikipedia.org/wiki/0.0.0.0 for more details on 0.0.0.0 behaviors.

1

// is just the start of a protocol-relative URL. From this site, //google.com would take you to https://google.com. From a plain old http site, //google.com would take you to http://google.com (which would likely bounce you to the https site, but that's not tangential).

The tag itself will set your relative URL interpretation to another domain. so with that above base tag in effect, <a href=/login>Login</a> on your site would not take you to your login page, it would take you to http://google.com/login. While google is benign, you can see the potential problem.

In terms of your exact question, I'm not sure what the point of either example you provide is, as-shown, other than just to break your site's links. A malicious use would have to list another destination in the base tag. to be of use.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.