3

As a pentester I came across this scenario:

<script type="text/javascript">

 URL = 'http://example.com?x=input';

I am able to insert a new line with %A0, spaces and almost anything except '. The problem is that I need that ' before making a new line so the JS doesn't break.

I am able to leave it like this:

<script type="text/javascript">

 URL = 'http://example.com?x=input;
 prompt`9`
 anything';

After the input and before the ; I need to insert a ' or it won't work... Is there any workaround/bypass on this? I am able to inset / too.

2
  • Have you tried using web encoded characters like %27 for ' or sending as binary?
    – TinCan
    Nov 2, 2019 at 7:36
  • yes i have tried using %27 and double encoding, however i didn't try binary... i never thought that encoding would work in this scenario Nov 4, 2019 at 4:38

1 Answer 1

4

That's not XSSable.

(I'm assuming in your scenario angle brackets are blacklisted too. Otherwise, you could obviously close the script tag with </script> and inject a separate script that doesn't use single quotes.)

In JS/ES syntax, a string literal that starts with a single quote needs to be ended with a single quote. Since you can't inject one yourself, you may at most cause a syntax error by introducing unescaped line breaks or escaping the closing single quote with a \. An attacker could use that to prevent execution of the current script which may eventually be chained with other bugs to something more severe. But it's not XSS-exploitable by itself.

3
  • 1
    Yes they are! thanks for letting me know. learning where the dead ends are is useful for future websites i test. thank you. Nov 1, 2019 at 15:39
  • However, it is still exploitable (not as XSS) because you literally break JS code by making a new line. In the case previously explained i just broke an entire functionality of the website. Nov 4, 2019 at 4:41
  • @Mr.ToxicMan Sure, "you may at most cause a syntax error". This may be helpful in some attack scenarios, but it's certainly not XSS-exploitable.
    – Arminius
    Nov 4, 2019 at 8:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .