XSS Tricky: Function Hoisting

Sun, 23 Jul 2017 00:00:00 +0000

Another day, another hunt for XSS. A simplified version of the target code:

<script>
func().val('<?php echo htmlspecialchars($input, ENT_COMPAT, 'UTF-8'); ?>');
</script>

A user-supplied $input is echoed into a JavaScript context after having HTML entities encoded. We can’t inject additional script tags due to the HTML encoding. So we’ll stick with JavaScript and try to inject a payload:

'); alert(1); //

We use '); to close out the val() call with an empty string. Next comes our payload. Finally, // comments out any remaining characters from the original code. We end up with:

XSS Tricky: innerText's HTML Decoding

Sun, 26 Mar 2017 00:00:00 +0000

XSS is in the air, everywhere I look around. A simplified version of the code:

<div id="foo">
<?php echo htmlspecialchars($input, ENT_QUOTES, 'UTF-8'); ?>
</div>

<script>
var bar = document.getElementById('foo');
var text = bar.innerText;
bar.innerHTML = '<b>' + text + '</b>';
</script>

So our user-supplied $input is echoed after having HTML entities encoded. Then its DOM element is read with innerText. This property returns only the text from a DOM element. Next, some decorative tags are added to the text and the whole thing is written back as markup, using innerHTML. Although there’s usually little reason to do this in JavaScript, our original input is encoded, so it doesn’t appear to be vulnerable to XSS.

Javascript on AppVuln

XSS Tricky: Function Hoisting

XSS Tricky: innerText's HTML Decoding