25

Say I have the a website with the following code on it:

<input type="text" id="search-text" name="query" value="?" />

Double quotes aren't escaped so I can break out of the value attribute, however, I can't break out of the HTML tag itself as '<' and > are being filtered out.

My goal here is to get a javascript popup to appear.

  • There's the onfocus attribute so I guess if someone clicked on the text input box a javascript popup could appear.
  • However is there a way to make a javascript popup appear when the page first loads?
WhiteWinterWolf
  • 19,082
  • 4
  • 58
  • 104
neubert
  • 1,605
  • 3
  • 18
  • 36
  • 4
    did you try all the techniques on https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#No_closing_script_tags ? – KDEx Aug 22 '15 at 18:40
  • I can't break out of the ` – neubert Aug 22 '15 at 18:42
  • What reason would there be for *not* encoding double quotes? – Anonymous Aug 22 '15 at 20:22
  • 1
    @Anonymous - ignorance? I didn't write the website that I'm trying to exploit! – neubert Aug 22 '15 at 20:25
  • 3
    @neubert Oh, I read the phrase *"Say I have the a website"* and assumed you owned it. If not, this fits the close reason *"Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem."* in my opinion. – Anonymous Aug 22 '15 at 20:27
  • @Anyonous - well them let me create a PoC website that demo's the vulnerability. *Done*. Now... how do I exploit it? And I do believe I have demonstrated an understanding of the concepts. As I said in my OP I can break out of the attribute but not the tag. Or do you believe that familiarity with the `autofocus` attribute essential to understanding XSS? – neubert Aug 22 '15 at 20:29

2 Answers2

54

Try this:

" onfocus="alert(1)" autofocus="

It will expand to:

<input type="text" id="search-text" name="query" value="" onfocus="alert(1)" autofocus="" />

Which will cause an alert box, demonstrating XSS.

paj28
  • 32,736
  • 8
  • 92
  • 130
-3

You can checkout for this too

ONLOAD=alert('XSS')

Which will produce an alert box when the page loads.

Bhuvanesh
  • 87
  • 1
  • 5
  • 3
    Didn't work for me. Nor would I expect it to. onload isn't valid for `input type="text"` per http://www.w3schools.com/jsref/event_onload.asp – neubert Aug 24 '15 at 12:18