9

I'm trying to XSS a search field and my attack vector is getting reflected like this:

<input type="text" id="txtRpHiddenKeyword" style="display: none;" value="ATTACK VECTOR HERE" />

Only double-quotes are allowed and angle brackets are encoded therefore I can only use eventhandlers to execute my JavaScript. Problem is that display is set to none, therefore onMouseOver, onClick etc. won't work, so my question is, are there any other eventhandlers that apply to hidden elements?

  • 2
    You can try adding a second style attribute, that might override the 1-st one in some browsers (I haven't done any research/testing for this). – Vatev Dec 20 '13 at 13:22
  • @Vatev I tried adding a second style attribute but it didnt work for Firefox – thenoobcoder Dec 20 '13 at 13:27
  • If you control the URL, you can probably use Chrome's XSS protection "feature" to strip out some code (e.g. txtRpHiddenKeyword" style="display: none;) ;) – billc.cn Nov 16 '15 at 16:56
2

This vulnerability is exploitable in Firefox via onaccesskey in combination with onclick:

accesskey="X" onclick="alert(1)">
1

Although this is HTML injection, this vulnerability is no longer XSS in the majority of browsers. This is because the element is invisible and there are no event handlers that will trigger on a hidden input element.

  • Opera uses to Webkit and V8 like chrome ! and it's not work on opera ! – Sajjad Pourali Dec 20 '13 at 17:47
  • @Sajjad Pourali aah good call, I didn't test that exploit on the latest version of Opera. – rook Dec 21 '13 at 0:22
0

Couldn't you still use the onerror() event handler?

From the 6th post in the link posted in Rook's answer above:

<input type="hidden" value="INPUT" name="test">

take for INPUT this:

whatever" type="image" src="dontcare.jpg" onerror="alert(123)

EDIT - Though later in that same thread a post mentions that none of the methods discussed there work anymore. So maybe not.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.