Creating HTML with intentional HTML Injection

Question

I am a cybersecurity student trying to understand some basic HTML injections. I have been working on this code for a few days and can't understand what I am doing wrong. The code that I have currently does allow for injection, for example if I put <h1>test</h1> into the textbox, it will display test as a header. But if I try <script>alert(1)</script> it won't actually run the script. I have tried setting the value of the text box to "" or with the thought that I could close out that line by inputting the following into the textbox: "><script>alert(1)</script>

I've also tried to cancel out the remainder of the code by adding a comment to the end like this: <script>alert(1)</script><!--

I've tried a number of combinations of each with no luck. Now I actually need to be able to inject a script since I'm playing around with CSP and how that affects injection of scripts into the webpage. I currently DO NOT have a csp specified that would restrict the JavaScript from running. Some other things I've tried include using different browsers, changing browser security, and ensuring that JavaScript is enabled in the browser. Any help would be greatly appreciated!!

<html>
    <script language='JavaScript'>
    function getwords(){
        textbox = document.getElementById('words');
        label = document.getElementById('label');
        label.innerHTML = textbox.value;
    }
    </script>

    <body>
        <input type="text" id="words">
        <input type="button" onclick="getwords()" id="Button" value="Enter" />
        <label id="label">
        </label>
    </body>
</html>

Possible duplicate of Can scripts be inserted with innerHTML? — Jorge Fuentes González
– Jorge Fuentes González, Commented Sep 30, 2019 at 14:43

FZs · Accepted Answer · 2019-09-30 14:57:05Z

3

That's because <script>s run at page load, and, when the label's content change, the scripts have ran already.

However, if you inject <script> tags to a different page (through the backend (XSS means Cross-Site Scripting)), it does work.

Alternatively, to make it work in a scenario, where the content injected after page load (like your case), you can use JS events (like onclick) to run your code:

<div onclick="alert(1)">Click me!</div>

Or, to execute it without user interaction, you could use an <iframe>'s onload event:

<iframe onload="alert(1)" style="display:none"></iframe>

edited Sep 30, 2019 at 14:57

answered Sep 30, 2019 at 14:41

FZs

18.8k13 gold badges47 silver badges56 bronze badges

Sign up to request clarification or add additional context in comments.

8 Comments

xswarms Over a year ago

Thank you for the response, that definitely helped. I have another question though, is there anyway to specify the source in which the javascript would be ran from? The current csp that I'm using restricts the src to self and *.google.com

FZs Over a year ago

Like script src? Basically no; but you can try an AJAX request, if supports CORS, and then eval it

xswarms Over a year ago

Alright so going back to the xss portion, if in my code I added a window to popup that maybe set something to the input of that textbox, the script would run since the new page loaded on click of the button?

FZs Over a year ago

@xswarms 'if in my code I added a window to popup that maybe set something to the input of that textbox, the script would run since the new page loaded on click of the button?' - Sorry, I don't understand what do you ask...

xswarms Over a year ago

Essentially, I am wanting it to actually run when I put in <script>alert(1)</script>. In reference to the portion that you said "if you inject <script> tags to a different page (through the backend (XSS means Cross-Site Scripting)), it does work." I am wondering if I set the button to open a new window, and in that window have it print the textbox value if it will actually run a script if inserted.

|

Rumplin · Accepted Answer · 2019-09-30 14:40:48Z

2

to execute javascript from your form, you can try:

<iframe src=javascript:alert(1)>

or

<img src=x onerror=alert(1)>

Also worth noting:

script elements inserted using innerHTML do not execute when they are inserted.

answered Sep 30, 2019 at 14:40

Rumplin

2,78822 silver badges46 bronze badges

2 Comments

padarom Over a year ago

Could you add a source for that last quote?

Rumplin Over a year ago

developer.mozilla.org/en-US/docs/Web/API/Element/innerHTML

Triple0t · Accepted Answer · 2019-09-30 15:09:09Z

To manually execute JavaScript, you may do the following

without editing your HTML file, add this to the Input field on your Browser.

<iframe onload="alert(1)" style="display:none"></iframe>

More information on why this works here

More on how you can perform actions like this here: developer.mozilla.org

<html>
    <script language='JavaScript'>
    function getwords(){
        textbox = document.getElementById('words');
        label = document.getElementById('label');
        label.innerHTML = textbox.value;
    }
    </script>

    <body>
        <input type="text" id="words">
        <input type="button" onclick="getwords()" id="Button" value="Enter" />
        <label id="label">
        </label>
    </body>
</html>

Collectives™ on Stack Overflow

Creating HTML with intentional HTML Injection

3 Answers 3

8 Comments

2 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

8 Comments

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related