2

Sometimes you stumble upon input fields that don't escape input properly, but who still appear to be to short to actually be used for anything malicious, at least to someone with my limited imagination.

This made me wonder what is the shortest possible input field that can be used to perform a malicious XSS?

Improve this question
3

1 Answer 1

Reset to default
1

Depends on the context.

A very short one:

Context:

    <script src="%XSS%"></script>

Let's say you are the owner/maintainer/administrator of http://.to (Tonga gTLD).

    <script src="//to"></script>

XSS with 4 chars. Probably one of the shortest possible.

There are dozens of other contexts.

Edit:

Tested on Chrome 38.0.2125.122 (Mac OS X 10.8.5)

Improve this answer
4
  • Why do you think to would be completed to to.com?
    – Gumbo
    Dec 2, 2014 at 1:15
  • 1
    @Gumbo My mistake, I edited the answer. to is a gTLD.
    – Lucas NN
    Dec 2, 2014 at 1:40
  • I don't understand the answer, what exactly did you inject? Just the string //to? Why not have the context be <script src="//t%XSS%"></script> and then inject the letter o? Wouldn't that be only 1 character then?
    – jake192
    Dec 2, 2014 at 5:44
  • @jake192 Did you already see your example? Because I already found a bug in Google that proves my point, but in this case I had unlimited chars to exploit the bug, so this is just an example of a short XSS.
    – Lucas NN
    Dec 3, 2014 at 5:18

Not the answer you're looking for? Browse other questions tagged .