View source01 <! DOCTYPE html>
02
03 <title> Oh no! </Title>
04 <script type = "text/javascript">
05 var xss = "</script> <script> alert ('xsss'); </script> ";
06 </script>
07
08 <body>
09 <p> And you thought parsers were smart. </p>
10 </body>
11
Result:
</Script> the priority is parsed, as if the priority is relatively high.
Reference http://erlend.oftedal.no/blog/ below? Blogid = 91 content:
"That does not mean, however, that blocking <and> when ouputting user data in javascript isn' t necessary", David said.
I was confused. How cocould those characters change the interpretation of a string?
"But for a javascript string, aren't quotes and backslash the only meta characters that can change the way it's interpreted ?", I replied.
"Good question", David replied. "And while that is true for an isolated javascript, it is not true, when javascript and HTML are mixed in an HTML page. Consider the following ..."
David grabbed the keyboard, and wrote the following HTML page:
View source1
2 <body>
3 <script>
4 var a = "</script> <script> alert ('xsss'); </script> ";
5 </script>
6 </body>
7
"What do you think will happen here ?", David asked.
So the attacker was able to insert a script tag in a javascript variable. That's it. That shouldn't matter, right? I opened the HTML in my browser. I was wrong...
"Ehm ..", I replied intelligently.
"Now why do you think that happened ?"
"I have no clue... How are we breaking out of the variable ?", I asked.
"As mentioned, this happens because we are running javascript as a part of an HTML page. The HTML parser runs first, so what the browser ends up with, is something like this ...", He replied, and opened the HTML in Firefox with the firebug add-in.
Xss-firebug
"HTML is in blue, javascript in black. the browser interprets the contents as some HTML, then an unclosed javascript variable 'A', then some script that creates a popup, then a quote and a semicolon as HTML-it's now outside the script tags, right-and last it sees an attempt to close a script tag that has never been opened. so as you see, we need to escape the <and> characters anyways. but we need to escape them for javascript instead of HTML. so we coshould do something like this."
View source1
2 <body>
3 <script>
4 var a = "\ x3C/script \ x3E \ x3Cscript \ x3Ealert ('xss'); \ x3C/script \ x3E ";
5 </script>
6 </body>
7
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
