1

Can an XSS be craft inside the following JS.

$(function () {
            $("#panel").find(".form").each(function (index) {
                var that = this;

                $(that).overload();
            });
            $("#panel").find(".form").find("[name=link]").each(function (index) {
                var that = this;

                $(that).on("click", function (event) {
                    $(that).select();
                });
            });
            $("#panel").find(".form").find("[href=#show]").each(function (index) {
                var that = this;

                $(that).on("click", function (event) {
                    prompt("HardcodedText", $(that).text());
                });
            });
        });
    </script>

The page url is something like so https://www.mylabtest.com#show I tried the following but neither worked

https://www.mylabtest.com#show]");+alert(1);//

https://www.mylabtest.com#show]");<script>alert(1);</script>

3

It would have helped if you would have provided with the HTML code as well. However, i think the reason why it does not work is because the value of the hash anchor is not being utilized in the JavaScript.

It would have been exploited as DOM based XSS if this value was being used in JavaScript somewhere. Here's is an example of code vulnerable to DOM based XSS:

URL: http://www.example.com/page.html?default=French

Select your language:
<select><script>    
document.write("<OPTION value=1>"+document.location.href.substring(document.location.href.indexOf("default=")+8)+"</OPTION>");    
document.write("<OPTION value=2>English</OPTION>");    
</script></select>
  • You are 100% right , i assume it was being used :( – user2650277 Apr 23 '15 at 10:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.