Well i need to know is it possible to enter xss script through console of developer's tools(e.g. : firebug of firefox)? Is this a proper way ?
As an example, here's me popping up an alert box on this very page:
This is only dangerous if your end-user is stupid enough to run code in dev-tools that they don't understand.
Alternatively if there's an exploit available in the plugin your calling that may also be leveraged to exploit XSS attacks
I feel like you might not understand what XSS is. Lets take a look at the definition that OWASP has:
Cross-site scripting (XSS) attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user.
I would emphasize the last part of this definition: "...to a different end user."
In my mind, to qualify as a XSS attack you would need to submit a request to a website and have that site respond with the malicious content. The ways this can happen is typically broken down into two different methods:
Reflected XSS: Part of your URL is rendered on the page and the attack payload is part of your URL. You need to trick users into clicking your link to execute the attack.
Stored XSS: The XSS is stored on the server itself due to insecure programming. Then when a user visits the page with the XSS payload, the attack is called up from the server. The user just needs to visit the page, no link clicking required.
You can change the maxlength attribute of an input by doing this.
first you look for the id of the input and you type this in the console
var inp = document.getElementById("id_name");
Then you change the maxlength attribute by typing this in the console
After doing that, you are able to type up to 2000 characters in the selected input.
This isn't an XSS attack by itself, but it if the victim depends on the maxlength attribute (without any server-side form validation) to protect there website then this will give the attacker the freedom to send as much code as they want to the server.