4

So I was experimenting with XSS using new line (%0A) character. So I got to the usual vector: '%0Aalert(/xss/)// and one thing came to my mind. What if you can't insert a quote?

A new line will break the string so you can insert code. However, the syntax error (Unterminated string) will prevent the script from executing. Is there any way around it?

Thank you!

  • 1
    You have not provided sufficient information to answer this question. You only provided the injection string, an lack context. Does does it look like var j='junk'\nalert(/xss/)// ? – rook Mar 7 '13 at 4:08
4

You could end your script element and start a new one:

%0A</script><script>alert(/xss/)//

There will still be a syntax error in the original script (none of it up to this point will run), but the added one will still execute (including anything that comes after it). Demo. As you can see, disallowing quotes is not a valid defense against XSS, escaping is the way to go.

(And in case you're wondering, the attack is possible even if the call were wrapped in a function or eval.)

| improve this answer | |
  • Yeh I thought of that way too, but I generally don't like to use the <script> tags because a lot of detection systems look for them. Is there any other possible way without ending the script tags? (assuming quotes and angle brackets are escaped both HTML and js way). Thanks :) – Chris Illusion Mar 6 '13 at 21:58
  • @1llusion none that I know of. I thought about the '\' character, but couldn't conceive any way to exploit it. What exactly are you trying to achieve? – mgibsonbr Mar 6 '13 at 22:18
  • 2
    @ mgibsonbr I have noticed, that a lot of developers don't do anything about the newline character. However XSS is known and a lot of developers know a little about preventing it. So I was trying to find out, if there is a way to successfully run an attack with only the newline character. So far it looks, that it can be treated only as a warning as long as there are no other weaknesses. Thank you for your help! (I can't upvote yet, but I'll once I can) – Chris Illusion Mar 6 '13 at 23:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.