1. Is it possible to do a DOM based xss attack with window.location.protocol?
  2. How can we use dom based xss with document.title?
  3. How can we bypass the escape javascript function if it is used?

thank you

closed as not a real question by rook, Luc, Rory Alsop Mar 30 '13 at 1:02

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    1: no 2: not possible 3: what escape function? – rook Mar 29 '13 at 0:53
  • Hi there. If you could clarify your questions, and separate them out, these may be more suitable, however I think you can see from the comment and answer what you will get. – Rory Alsop Mar 30 '13 at 1:04
  1. No

  2. I'm not sure what you mean? You can't "break out" of document.title=AttackerString where AttackerString is a javascript variable with data (the string value) controlled by you.

  3. Again, you can't exploit escape(AttackerString) but you can exploit something like <? echo 'escape("' .$_GET['AttackerString']. '");' ?> by simply bypass the javascript function: &AttackerString="); alert("xss in the case the html output would be: escape(""); alert("xss");

Not the answer you're looking for? Browse other questions tagged or ask your own question.