How to alert cookie in 30 character XSS payload?

Question

The application allows user to enter a 30 character long username.

I tried the following XSS payload and it worked, but the triager is asking if I can alert cookie. But script tags and src keyword is blocked.

"><iframe/onload=alert()>

Any way to load javascript from a short URL, such as http://⑮.₨?

Answer 1

If you change iframe to a to save a few characters, you still need 13 characters just to set things up:

"><a onload=>

That leaves you 17 characters for the actual JavaScript payload. That is not enough for alert(document.cookie). You could get an extra character by using oncut instead of onload but you still have to few.

So trying to load an external script is a reasonable idea. Problem is, you have to few characters for that too. You can get around the blocking of script and src by using things like "scr"+"ipt", but you still run into the length limitation. If there is jQuery, you could almost make it with $.loadScript, but only almost.

So what to do? I can see three options:

• See whats in the global namespace. Perhaps there is something you can use? If the site already put document.cookie in a global variable named x you are very lucky...
• Can you create multiple usernames with some sort of chained exploit? I.e. first one puts document.cookie in a variable named x, next one alerts it.
• Maybe I missed some clever way to write super compact JavaScript that you can use!