1

The application allows user to enter a 30 character long username.

I tried the following XSS payload and it worked, but the triager is asking if I can alert cookie. But script tags and src keyword is blocked.

"><iframe/onload=alert()>

Any way to load javascript from a short URL, such as http://⑮.₨?

2
  • Hi and welcome to the site! Is there a reason you are linking to that strange looking URL? Are you looking for ways to load scripts from a URL in general?
    – Anders
    Commented Feb 24, 2023 at 7:40
  • 1
    yes :D. Its the shortest url that I can use to show impact. The character count of ⑮.₨ is just 2 that saves 2 character since its uni-code character. When interpreted by browser it actually become 15.rs.
    – alisa
    Commented Feb 24, 2023 at 15:45

1 Answer 1

2

If you change iframe to a to save a few characters, you still need 13 characters just to set things up:

"><a onload=>

That leaves you 17 characters for the actual JavaScript payload. That is not enough for alert(document.cookie). You could get an extra character by using oncut instead of onload but you still have to few.

So trying to load an external script is a reasonable idea. Problem is, you have to few characters for that too. You can get around the blocking of script and src by using things like "scr"+"ipt", but you still run into the length limitation. If there is jQuery, you could almost make it with $.loadScript, but only almost.

So what to do? I can see three options:

  • See whats in the global namespace. Perhaps there is something you can use? If the site already put document.cookie in a global variable named x you are very lucky...
  • Can you create multiple usernames with some sort of chained exploit? I.e. first one puts document.cookie in a variable named x, next one alerts it.
  • Maybe I missed some clever way to write super compact JavaScript that you can use!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .