1

I've recently gotten into web security and javascript and I think this looks like apretty promising DOM XSS:

let hastagIntentos = 0
  , posAnterior = 0
  , reintentosHatagPos = 0;
function enlacesParciales() {
    if (window.location.hash.length > 0) {
        let c = $(window.location.hash);
        hastagIntentos++,
        0 == c.length ? hastagIntentos < 100 && setTimeout((function() {
            enlacesParciales()
        }
        ), 800) : (console.log("encuentro", c.offset().top),
        posAnterior != c.offset().top && (posAnterior = c.offset().top,
        $([document.documentElement, document.body]).animate({
            scrollTop: c.offset().top
        }, 800),
        reintentosHatagPos < 10 ? (reintentosHatagPos++,
        setTimeout((function() {
            enlacesParciales()
        }
        ), 1e3)) : reintentosHatagPos = 0))
    }
}

And especially this: let c = $(window.location.hash);

5
  • What exactly is your question? Are you looking for validation of your idea that that like is a DOM XSS? Can you explain why you think that is particularly vulnerable?
    – schroeder
    Oct 6, 2022 at 19:11
  • First of all, sorry for not being clear. I'm asking if this would be vulnerable and in case this is true how I could develop an attack. I thought this may be vulnerable becuase the data is just being read raw without any kind of validation. I'm sorry if this is all wrong, I'm very new to javascript. Edit: I've actually just noticed that half of my draft has been deleted. That was where I explained what I was looking for.
    – Henktorius
    Oct 6, 2022 at 19:38
  • What I removed did not explain what you were looking for either ... Can you edit your question to include the points in your comment?
    – schroeder
    Oct 6, 2022 at 19:41
  • So, if I crafted my own payload for window.location.hash, what could I do? All I'm seeing is it checking the length and the offset function. Why do you think that line exposes something uniquely problematic?
    – schroeder
    Oct 6, 2022 at 19:44
  • I guess you are right, I thought that maybe sending something like #[malicious code] would maybe trigger it. Thanks anyways!
    – Henktorius
    Oct 6, 2022 at 20:30

0

You must log in to answer this question.

Browse other questions tagged .