3

I am pentesting a super strange website and was trying to get Stored XSS on their main website. After some hours of testing i found that it is possible to inject sucesfully without any encoding:

<img src="any" alt="any">

Cool right? the thing is i have tried +50 event handlers (some of them not even working for images) and 80% of them were blocked by the waf and the rest that were accepted (code 200 instead of 500) but were stripped from the response, even invalid ones. So

<img src="any" asdasd=asdasd alt="any"> Turns into --> <img src="any" alt="any">

So i was wondering, is there any possible way to exploit this without event handlers?

i know that isn't allowed for most browsers and will not trigger anything (correct me if I'm wrong here).

2
  • My answer here may be helpful, but you are probably hosed. Sounds like they are properly parsing and processing HTML. Skip to the part about a robust parser: security.stackexchange.com/questions/220447/… Nov 13, 2019 at 1:30
  • forgot to say but because jkksjdbf=ksjdfsd gets filtered they probably use a whitelist instead of a blacklist to filter handlers. Nov 13, 2019 at 1:42

1 Answer 1

1

Did you try other payloads for XSS?

Here's the cheat-sheet: https://portswigger.net/web-security/cross-site-scripting/cheat-sheet

You can check the Event, Compatibility, tag as well as code there.

If 80% percent were blocked by WAF, you need to bypass it, some bug bounty hunters already bypass some WAF and here's the link:

https://github.com/EdOverflow/bugbounty-cheatsheet/blob/master/cheatsheets/xss.md

For the browser, just test in all browsers.

3
  • they use a whitelist, i know that because i tried to add sjkldnf=ksjnfsdf as event hanlder and was stripped from the response. Nov 13, 2019 at 3:18
  • you are working in the image only? or try something like <iframe src=javascript:alert(1)> For no event handlers, check here: brutelogic.com.br/blog/xss-without-event-handlers
    – Al Francis
    Nov 13, 2019 at 3:36
  • thanks, that was useful! but didn't work unfortunately. Nov 16, 2019 at 17:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .