How to launch XSS code into an HTML input field?

Question

im working on trying to find vulnerabilities on a fake website for class and I was wondering how to launch XSS code into this input field?

This is the code from the website:

<form name="friendForm" method="POST" action="/Tunestore/addfriend.do">
  Friend name: <input type="text" name="friend" value="&quot
    <script>alert(1)</script>"><br>
  <input type="submit" value="Submit">
</form>

I have tried this but it didn't work:

"> <script>alert(1)</script>

" onfocus="alert(1)"

" onclick="alert(1)

That's because your browser escapes the value you type in there. Typically XSS is achieved when the text you write into an input box is later treated as HTML an published somewhere, maybe check out Computerphile's video on XSS. — Luca Kiebel
– Luca Kiebel, Commented Sep 11, 2018 at 16:37
What is the way to achieve XSS with an input field like that? — Gary Toms
– Gary Toms, Commented Sep 11, 2018 at 16:43
As I wrote above, the text in that input field has to be treaded like HTML in a process that publishes it, let's say, you're making a blog and the comment section has a textbox. When a user hits submit you just add that comment as a <p> to the site, if the user then enters some html, including script tags, that JS will be executed by all clients visiting the page, not just by your own browser, which isn't really a good attack vector — Luca Kiebel
– Luca Kiebel, Commented Sep 11, 2018 at 16:46

Lakshay baheti · Accepted Answer · 2019-11-21 14:14:15Z

2

Try this:

" onfocus="alert(1)" autofocus="

It will expand to:

<'input type="text" name="friend" value=" " onfocus="alert(1)" autofocus=" " />

Which will cause an alert box, demonstrating XSS.

edited Nov 21, 2019 at 14:14

answered Sep 11, 2018 at 16:40

Lakshay baheti

214 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Lakshay baheti Over a year ago

did you try methods on owasp.org/index.php/… ?

Luca Kiebel Over a year ago

A browser will most certainly not treat the input as HTML, it will escape the characters

Capricorn Over a year ago

Please properly format your answer, e.g. by using code blocks: stackoverflow.com/help/formatting

Collectives™ on Stack Overflow

How to launch XSS code into an HTML input field?

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related