0

I'm currently pentesting a website where I can set a URL on my profile. I'm trying to get an XSS to fire, but my javascript knowledge is a bit limited for this use case:

xss environment

Imagine this is your environment, and the only area you can edit is the highlighted area. Obviously this would fire when a user clicks it if the http:// was not before it, but when you try to add it to your profile, it automatically adds the http://. Is there a way to cancel out the HTTP?

(There is no escape the href parameter itself, I've already tried that.)

Improve this question
2
  • 2
    It does work, it'll just display a cookie once the href is clicked. I'm really just using it as a temporary POC until I actually get the payload to fire. Then I'll work on weaponizing it.
    – ex7lted
    Sep 2, 2022 at 4:37
  • Is the function that adds http server-side or client-side?
    – schroeder ♦
    Sep 2, 2022 at 14:29

1 Answer 1

Reset to default
0

In case the scheme is added on the client side, just go through the burpsuite and manipulate the request this is the one you can try. but I suggest that just go through the source code and the js files which around working for this function you will get the immediate idea. other than this, you can try client-side bypass via developer tools refer to this https://www.secjuice.com/client-side-encryption-bypass-using-devtools-part-2/

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .