Geek asks and answers

Cross site

I am testing a web application. I want to write a XSSscript that displays a warning "Hello".

The first script I wrote was:

<script >alert("Hello");</script >

But the warning did not appear "Hello". I found that the XSSscript is working

<SCRIPT >alert(String.fromCharCode(72,101,108,108,111,33))</SCRIPT >

I would like to know why the first script did not work.

+6
source share
1 answer

Most likely, this site replaces double quotes with HTML objects or tries to avoid them in some other way, which makes them unsuitable for JavaScript. When using, String.fromCharCode(...)you do not need to use quotation marks to make it work. It gets a list of ASCII codes for string characters and creates a string from them at runtime. Therefore, there is no need for quoting.

XSS - < &lt; - , script .

, >, " & HTML , HTML! XSS <, , HTML ( , " )

+8

More articles:


All Articles