I'm trying to XSS a search field and my attack vector is getting reflected like this:

<input type="text" id="txtRpHiddenKeyword" style="display: none;" value="ATTACK VECTOR HERE" />

Only double-quotes are allowed and angle brackets are encoded therefore I can only use eventhandlers to execute my JavaScript. Problem is that display is set to none, therefore onMouseOver, onClick etc. won't work, so my question is, are there any other eventhandlers that apply to hidden elements?

  • 2
    You can try adding a second style attribute, that might override the 1-st one in some browsers (I haven't done any research/testing for this).
    – Vatev
    Dec 20, 2013 at 13:22
  • @Vatev I tried adding a second style attribute but it didnt work for Firefox Dec 20, 2013 at 13:27
  • If you control the URL, you can probably use Chrome's XSS protection "feature" to strip out some code (e.g. txtRpHiddenKeyword" style="display: none;) ;)
    – billc.cn
    Nov 16, 2015 at 16:56

3 Answers 3


This vulnerability is exploitable in Firefox via onaccesskey in combination with onclick:

accesskey="X" onclick="alert(1)">

Although this is HTML injection, this vulnerability is no longer XSS in the majority of browsers. This is because the element is invisible and there are no event handlers that will trigger on a hidden input element.

  • Opera uses to Webkit and V8 like chrome ! and it's not work on opera ! Dec 20, 2013 at 17:47
  • @Sajjad Pourali aah good call, I didn't test that exploit on the latest version of Opera.
    – rook
    Dec 21, 2013 at 0:22

Couldn't you still use the onerror() event handler?

From the 6th post in the link posted in Rook's answer above:

<input type="hidden" value="INPUT" name="test">

take for INPUT this:

whatever" type="image" src="dontcare.jpg" onerror="alert(123)

EDIT - Though later in that same thread a post mentions that none of the methods discussed there work anymore. So maybe not.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .