If you change
a to save a few characters, you still need 13 characters just to set things up:
alert(document.cookie). You could get an extra character by using
oncut instead of
onload but you still have to few.
So trying to load an external script is a reasonable idea. Problem is, you have to few characters for that too. You can get around the blocking of
src by using things like
"scr"+"ipt", but you still run into the length limitation. If there is jQuery, you could almost make it with
$.loadScript, but only almost.
So what to do? I can see three options:
- See whats in the global namespace. Perhaps there is something you can use? If the site already put
document.cookie in a global variable named
x you are very lucky...
- Can you create multiple usernames with some sort of chained exploit? I.e. first one puts
document.cookie in a variable named
x, next one alerts it.