I am playing one pentesting game theres a task where i need to perform multi line xss to print cookies.

I was able to make xss that print "x" because one line is too short for entire command so this works "><script>alert("x")</script>( this is max length of field and we have three fields available)

But i need to use this "><script>alert(document.cookie)</script> and dont know how to modify it for three fields that i have for this task.

Thanks for any help

  • Hi. Welcome to Security.SE. Without additional information it's hard to answer this question. Can you clarify? – h4ckNinja Jun 30 at 20:57

The common way to do this is to span the payload across multiple parameters.For example imagine there are three parameter's param1,param2,param3.

param1=<script><then begin comment block>

param2=<end comment block>alert(document.cookie)<start comment block>

param3=<end comment block><script>

So the general idea is to comment out the middle that way you can stretch the payload, whenever there is a (number of character restriction).

Adjust the payload according to the number of allowed characters in the parameter's.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.