0

Burp suggests that there is a reflection.. It changes a value of a cookie named as x as x=<script src=abc.js> and in response this value gets injected to a javascript function..

<script type="text/javascript">
fnUseX('arg1','<script src=abc.js>');
</script>

I tried a few scripts and looks like characters such as / and ; are blocked. Does this confirm the presence of cross site scripting? How we could actually exploit it? Are there any HTML5 XSS vectors which could be tried here?

1

This looks like it could be exploited using a cookie value like this

</script><script>alert(1)</script>

Try setting it manually and see if it fires the alert.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.