2

<img class="avatar" src="MY INPUT SPACE">

I am trying to bypass an XSS filter but it is not working since given <, > are filtered. I feel like it I could break it since only these two characters are filtered but I just couldn't find a way to do it, any suggestion on this?

Alex
  • 33
  • 1
  • 1
  • 4
  • 1
    If just those are filtered, write out the html tag as you normally would, and apply the injection half afterwards. Example: <img class="avatar" src="imghere.jpg" onload="javascript:alert('lol');"/>. So, input imghere.jpg" onload="javascript:alert('lol');? – Mark Buffalo Apr 15 '18 at 02:37
  • It looks like I am getting there, however the there is no alert showing. I am getting:<img class="image" src="http://www.image.com/1" onload="javascript:alert('lol')><div class=" content"=""> – Alex Apr 15 '18 at 02:51
  • @Mark Buffalo After a few attempts, I am able to make the site to store a image of: but the script is never excuted – Alex Apr 15 '18 at 03:31
  • Why are you adding a semi-colon after the src attribute? – Mark Buffalo Apr 15 '18 at 06:40
  • What about loading an external javascript file using https://www.myevilsite.org/injections.js or something similar. This assuming you have "real" control over src= – Jeroen Apr 15 '18 at 09:48

1 Answers1

3

The general advice (to inject an event handler in the image tag) from @MarkBuffalo in the comment is correct, but onload isn't a great choice of event handler for images. The better option is usually onerror, which is very easy to reliably trigger; just set the source to be something you know won't exist (or at least won't be an image), like src="qq" onerror="alert('XSS!')".

The specific exception I like is SVG tags, where <svg onload="…" /> is a nice short string (as short as <script>…</script>, and usable in places that try stupid tricks like filtering <script>).

CBHacking
  • 48,401
  • 3
  • 90
  • 130
  • 2
    Just wondering, but why isn't onload a good choice for images? It works for me pretty much every time. However, stuff like buttons, or other elements, sure. – Mark Buffalo Apr 15 '18 at 06:40
  • You could also add some more to the tag, so it isn't that obvious, that the image is hijacked: add style="display:none" to hide it or set another background-image so it looks normal afterwards – rubo77 Jun 03 '20 at 21:04