0

Assume the content of the name variable below is controlled by an attacker. Is this line of code vulnerable to XSS?

console.log(name)

When I send an injection in name variable I see its value printed by console.log as a URL encoded string, and it does not get interpreted as a script tag format. Is there a way to exploit this to XSS attack ?

  • 2
    in which language have you crafted these lines ? – user45139 Dec 27 '14 at 22:08
  • javascript, it's inside a javascript function – kassr Dec 27 '14 at 23:11
  • i tried to inject the following payload: fname=alert(1); but it didnt work – kassr Dec 27 '14 at 23:12
  • Script injection doesn’t apply to console.log output… – Ry- Dec 28 '14 at 1:21
2

No the exact code you have posted is not vulnerable to XSS.

Now if you are writing first_name to the page anywhere it could be a reflected XSS vulnerability or maybe a DOM based XSS vulnerability. But the tiny piece code you have posted is not a vulnerability

-5

It is useless to try to find an XSS vulnerability within pure JavaScript code.

XSS vulernabilities are useful when the website offers to you the opportunity to interact with PHP/MySQL inputs/URLs. We can not talk about XSS in your case.

  • 4
    Dnakki your answer is completely wrong and quite harmful. OF COURSE there can be XSS in javascript-only code. Obviously XSS is not just about PHP (even though it is very common there), and it has absolutely nothing to do with MySQL (or any other database for that matter). I suggest you read up a bit on so-called "DOM-Based XSS" or "client-side XSS". – AviD Dec 28 '14 at 14:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.