4 ms·
There's an XSS on the page: Try to login or create an account. Enter this as your username (or password, as long as it's not valid: you need an error), hit sub
by Xk 15y ago
There's an XSS on the page:
Try to login or create an account. Enter this as your username (or password, as long as it's not valid: you need an error), hit submit. Error + XSS.
</script><script>alert(1);</script>
You escape quotes, which is good, so I can't break out of the JSON request. But you have to remember how the HTML parsing of a page works. </script> will break out from within a javascript string.
- Xuzz 15y agoI know this is off-topic, but you can use eval(String.fromCharCode(XX, XX, XX, etc)) to run arbitrary JavaScript, even if quotes are escaped.
- Xk 15y agoThat's not the reason why people escape quotes. Imagine the case where he had not escaped quotes, but had escaped < and >. In that case, I could put a doublequote/singlequote to break out of the JSON. Then I could just put whatever javascript I wanted and run it. But that is true, trying to filter specific character sequences for example, "eval" is never a good idea.