3

I have found out that in most browsers the following code won't execute:

<a href="javascript:alert(1)" target=_blank>click</a>

But the same code without blank will. My question is, is it possible to exploit an XSS in the first scenario and run javascript with _blank target?

Improve this question
2
  • What does it do instead? Naively, I'd expect it to pop a new window and then execute the JS URI there, achieving nothing of great value due to being a null origin but you could still use window.parent to have some affect on the original page.
    – CBHacking
    Commented Apr 13, 2023 at 0:31
  • 2
    @CBHacking, instead it just shows about:blank#blocked with no execution at all
    – The Modern Gamer
    Commented Apr 13, 2023 at 4:44

2 Answers 2

Reset to default
1

While there may be cases where you're limited to the exact scenario you describe, in which case I would look for a different xss bug as in my experience when there is one xss bug, there are many.

If you were limited to the one bug here are a few things you could try:

  • Inject code that terminates the href, ie: javascript:alert(1)">
  • Try to confuse the parser, ie: javascript:alert(1)" target="_self
  • Avoid the terminating " to make the target attribute part of the javascript, ie: javascript:alert(1);a=\
  • Any of the techniques from the Post XSS world article: https://lcamtuf.coredump.cx/postxss/

I would also question your assumptions. Are you sure the Javascript is not executing or the alert box is simply suppressed? Have you tried a different payload?

Improve this answer
1
  • 1
    Any JS execution in new tab is blocked
    – The Modern Gamer
    Commented Apr 15, 2023 at 10:29
1

If you open the URL via Mouse trick :)

  1. Clicking the middle button of your mouse. (XSS executes on the same domain)
  2. Right click, open link in new tab, the XSS will execute. (XSS executes on the new domain)
Improve this answer
1
  • Works on Chromium. ON Firefox middle click opens a new tab with the payload as URL but won't execute it. Open in a new tab is not available for javascript:.
    – noraj
    Commented Dec 6, 2023 at 13:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .