Cenzic 232 Patent
Paid Advertising
sla.ckers.org is
ha.ckers sla.cking
Sla.ckers.org
Q and A for any cross site scripting information. Feel free to ask away. 
Go to Topic: PreviousNext
Go to: Forum ListMessage ListNew TopicSearchLog In
XSS in "a" tag, need help
Posted by: mjmorrell
Date: September 15, 2010 07:19PM

Hey everyone, I am trying to find flaws in an HTML filter, and I have found a way to insert attributes (like alt, title, style) into the "a" hyperlink tags.

The problem is that all of the "on" events (like onClick, onMouseover, etc)have their names filtered. Any other ideas to get xss on it?

Options: ReplyQuote
Re: XSS in "a" tag, need help
Posted by: GaSmo
Date: September 16, 2010 03:59AM

http://ha.ckers.org/xss.html

here you find some XSS with style

Options: ReplyQuote
Re: XSS in "a" tag, need help
Posted by: mjmorrell
Date: September 18, 2010 12:54PM

forgot to mention all style xss is filtered

Options: ReplyQuote
Re: XSS in "a" tag, need help
Posted by: Kyo
Date: January 07, 2011 07:49AM

is it a whitelist or a blacklist? will something like title="onmouseover" work?

Options: ReplyQuote
Re: XSS in "a" tag, need help
Posted by: Albino
Date: January 07, 2011 09:10AM

What about href="javascript:alert(1)"

(from http://ha.ckers.org/xss.html )

Options: ReplyQuote
Re: XSS in "a" tag, need help
Posted by: mjmorrell
Date: January 15, 2011 08:35PM

This thread is is out of date and should be locked. (Interesting you ressurected this thread kyo, take a guess which filter)

Options: ReplyQuote
Re: XSS in "a" tag, need help
Posted by: Kyo
Date: January 15, 2011 09:55PM

Yeah, sorry. Thought it was fresh because it was relatively at the top (what with the servers going down I guess). That always seems to happen to me.

Options: ReplyQuote


Sorry, only registered users may post in this forum.