2

I am trying work on an XSS scenario. Would appreciate if anyone can help.

URL: www.example.com/mydata

"mydata" is landing in html as follows:

200 OK
...
Content-Type: text/html; charset=utf-8
...
...
<select>
<option value="mydata"> Anything</option>
</select>
......

Since the "mydata" is in URL I cannot use a payload with forward slashes. Thus, I am not able to use script tag to execute script since I am unable to close it without forward slash. Other payloads like <BODY ONLOAD=alert('XSS')> are not working with options tag.

Does anyone know a way to introduce xss in this scenario?

Improve this question
2
  • Have you looked at XSS syntax that does not use slashes?
    – schroeder ♦
    Jan 29 '15 at 19:30
  • I am not sure i have but i will check. Could you point me to some references for XSS syntax that does not use slashes?
    – Sanchit Sharma
    Apr 6 '15 at 10:34
2

You have at least basic XSS:

...
<select><option value="XSS"><input type="image" src="https:\\happyorhungry.files.wordpress.com\2011\10\cookie_monster_original.jpg">Anything</option></select>
...

Where your input is:

XSS"><input type="image" src="https:\\happyorhungry.files.wordpress.com\2011\10\cookie_monster_original.jpg
Improve this answer
3
  • 2
    I think I'm missing something; doesn't your input have forward slashes and therefore won't work in the URL?
    – Aron Foster
    Jan 29 '15 at 23:27
  • Good point. I converted them into backslashes.
    – Wrycu
    Jan 29 '15 at 23:54
  • 1
    @Wrycu Thanks alot!!! was looking for a tag that would work with option tag. Finally got it to work with this < input type="image" src="a" onerror=" alert(123)">
    – Sanchit Sharma
    Jan 30 '15 at 5:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.