javascript injection and looping

Question

I want to test a site against javascript injection. I am familier with following syntaxes which are working fine.

javascript:alert(document.cookie);
javascript:void(document.cookie="authorization=true");
javascript:void(document.cookie="authorization=true");javascript:alert(document.cookie);
javascript:void(document.forms[0].email.value="[email protected]");

I tried following to inject a loop

javascript:for(i=0;i<10;i++){document.forms[0].t1.value=i;}

It is working. But clering all the contents of browser and prints '9' (result).

Is there any way/sybtax to inject a loop so i can run/call a function/statement multiple times. Or any tool/utility/aadon which can help me.

*I can run the site only in IE.

It's nice to see someone that actively cares about javascript vulnerabilities. Cheers to you. — Jordan
– Jordan, Commented Jun 16, 2011 at 4:53

icktoofay · Accepted Answer · 2011-06-16 04:36:23Z

4

Add void(0); to the end of your code:

javascript:for(i=0;i<10;i++){document.forms[0].t1.value=i;}void(0)

However, you may want to move your code into a closure; you're modifying a global variable named i. Here we combine this with void as well:

javascript:void(function(){for(var i=0;i<10;i++){document.forms[0].t1.value=i}}())

answered Jun 16, 2011 at 4:36

icktoofay

130k23 gold badges261 silver badges239 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Amit Kumar Gupta Over a year ago

wow great. it works thanks @icktoofay for quick reply. Can you sugegst me some link where i can read more about it.

icktoofay Over a year ago

@articlestack: Perhaps this question.

Collectives™ on Stack Overflow

javascript injection and looping

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related