If you change iframe
to a
to save a few characters, you still need 13 characters just to set things up:
"><a onload=>
That leaves you 17 characters for the actual JavaScript payload. That is not enough for alert(document.cookie)
. You could get an extra character by using oncut
instead of onload
but you still have to few.
So trying to load an external script is a reasonable idea. Problem is, you have to few characters for that too. You can get around the blocking of script
and src
by using things like "scr"+"ipt"
, but you still run into the length limitation. If there is jQuery, you could almost make it with $.loadScript
, but only almost.
So what to do? I can see three options:
- See whats in the global namespace. Perhaps there is something you can use? If the site already put
document.cookie
in a global variable named x
you are very lucky...
- Can you create multiple usernames with some sort of chained exploit? I.e. first one puts
document.cookie
in a variable named x
, next one alerts it.
- Maybe I missed some clever way to write super compact JavaScript that you can use!