1. Is it possible to do a DOM based xss attack with window.location.protocol?
  2. How can we use dom based xss with document.title?
  3. How can we bypass the escape javascript function if it is used?

thank you

  • 3
    1: no 2: not possible 3: what escape function?
    – rook
    Mar 29 '13 at 0:53
  • Hi there. If you could clarify your questions, and separate them out, these may be more suitable, however I think you can see from the comment and answer what you will get.
    – Rory Alsop
    Mar 30 '13 at 1:04
  1. No

  2. I'm not sure what you mean? You can't "break out" of document.title=AttackerString where AttackerString is a javascript variable with data (the string value) controlled by you.

  3. Again, you can't exploit escape(AttackerString) but you can exploit something like <? echo 'escape("' .$_GET['AttackerString']. '");' ?> by simply bypass the javascript function: &AttackerString="); alert("xss in the case the html output would be: escape(""); alert("xss");

Not the answer you're looking for? Browse other questions tagged or ask your own question.