I am trying work on an XSS scenario. Would appreciate if anyone can help.

URL: www.example.com/mydata

"mydata" is landing in html as follows:

200 OK
Content-Type: text/html; charset=utf-8
<option value="mydata"> Anything</option>

Since the "mydata" is in URL I cannot use a payload with forward slashes. Thus, I am not able to use script tag to execute script since I am unable to close it without forward slash. Other payloads like <BODY ONLOAD=alert('XSS')> are not working with options tag.

Does anyone know a way to introduce xss in this scenario?

  • Have you looked at XSS syntax that does not use slashes?
    – schroeder
    Jan 29, 2015 at 19:30
  • I am not sure i have but i will check. Could you point me to some references for XSS syntax that does not use slashes? Apr 6, 2015 at 10:34

1 Answer 1


You have at least basic XSS:

<select><option value="XSS"><input type="image" src="https:\\happyorhungry.files.wordpress.com\2011\10\cookie_monster_original.jpg">Anything</option></select>

Where your input is:

XSS"><input type="image" src="https:\\happyorhungry.files.wordpress.com\2011\10\cookie_monster_original.jpg
  • 2
    I think I'm missing something; doesn't your input have forward slashes and therefore won't work in the URL? Jan 29, 2015 at 23:27
  • Good point. I converted them into backslashes.
    – Wrycu
    Jan 29, 2015 at 23:54
  • 1
    @Wrycu Thanks alot!!! was looking for a tag that would work with option tag. Finally got it to work with this < input type="image" src="a" onerror=" alert(123)"> Jan 30, 2015 at 5:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.