19

Say I have the a website with the following code on it:

<input type="text" id="search-text" name="query" value="?" />

Double quotes aren't escaped so I can break out of the value attribute, however, I can't break out of the HTML tag itself as '<' and > are being filtered out.

My goal here is to get a javascript popup to appear.

  • There's the onfocus attribute so I guess if someone clicked on the text input box a javascript popup could appear.
  • However is there a way to make a javascript popup appear when the page first loads?
  • 4
    did you try all the techniques on owasp.org/index.php/… ? – KDEx Aug 22 '15 at 18:40
  • I can't break out of the <input tag to start a <script tag, let alone not close a <script tag I'm already in. I'm not aware of any others that'll help either but if you are aware of one do feel free to post it as the answer.. – neubert Aug 22 '15 at 18:42
  • What reason would there be for not encoding double quotes? – Anonymous Aug 22 '15 at 20:22
  • @Anonymous - ignorance? I didn't write the website that I'm trying to exploit! – neubert Aug 22 '15 at 20:25
  • 2
    @neubert Oh, I read the phrase "Say I have the a website" and assumed you owned it. If not, this fits the close reason "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." in my opinion. – Anonymous Aug 22 '15 at 20:27
41

Try this:

" onfocus="alert(1)" autofocus="

It will expand to:

<input type="text" id="search-text" name="query" value="" onfocus="alert(1)" autofocus="" />

Which will cause an alert box, demonstrating XSS.

-3

You can checkout for this too

ONLOAD=alert('XSS')

Which will produce an alert box when the page loads.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.