I'm testing burp against a vulnerable application as part of work for my client. There was one successful xss payload related to DNS lookup which worked on form data at point of file-upload. Here is the part of payload

javascript:/*</script><img/onerror='-/"/-/ onmouseover=1/-/[`*/[]/[(new(Image)).src=(/;/+/7mu0war5msdjnc8auyu75qw2ntttht9h18p0cs0hX;.burpcollaborator.net/).replace(/.;/g,[])]//'src=>
Content-Disposition: form-data; name="description"

The response is as as attached

I want help in deciphering of payload because it seems quite convoluted. <img/onerror='-/"/-/ This is believe causing img tag to fail causing event-handler onerror to trigger but I don't understand the use of '-/"/-/


Similary, as error popups the victim moves his move over and this in return kicks of another event/action which is including src tag and loading external content which is replace with a regex like whatever is in src tag is replace with output of DNS resolution

I appreciate if someone can decode piece by piece how this payload is actually crafted thanks.


You must log in to answer this question.

Browse other questions tagged .