0

I am looking to figure out how to create an iFrame tag without any spaces. I have found an input on a Bug Bounty program that reflects my input back into the page, and allows me to escape double quotes and an angle bracket. The page has XSS protection so my next thought would be iFrame injection. With that said, sadly, because of where my RXSS is located in the document, I can't include a space anywhere in my payload.

<iframe src="\\12341234">

It also doesn't allow periods or forward slashes but I found a way around that. All I need to figure out, is how to replace that space (in between iframe and src). Any ideas are appreciated.

Improve this question
2
  • What about CR or LF?
    – Marcel
    Aug 23, 2022 at 12:40
  • Other white-spaces like %09(TAB) are often a possible replacement for spaces too, apart from CR/LF like @Marcel said
    – Christiaan
    Aug 23, 2022 at 13:51

1 Answer 1

Reset to default
1

I might be wrong, but this should work <iframe/src=//14.rs>. If anything still not allows so, try some encoding or else find out the js files from the page source and please share the relevant code so it will help to analyze what exactly happening.

Improve this answer
2
  • +1 that's a good solution if OPs way of bypassing the / filter allows for it. Otherwise, this may also work.
    – tim
    Sep 17, 2022 at 18:15
  • As per my understanding, he is in HTML now, so I think mostly HTML tags will work, <script\src=*> from your reference might not work as he mentioned that javascript would not be injected cause of some protection. also, this payload will need // ( forward slashed to give any malicious script link ). It would be better and easy to understand if we got to see the source and what is happening behind the page. other than this, bypassing encoding is the better option.
    – N008x
    Sep 20, 2022 at 3:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.