15) Reflected XSS into HTML context with all tags blocked except custom ones
Previous14) Reflected XSS into HTML context with most tags and attributes blockedNext16) Reflected XSS with some SVG markup allowed
Last updated
Was this helpful?
Last updated
Was this helpful?
searching on hacktricks for custom tags we find this
The first naive attempt whether onload on a custom tag does anything on page load is not successful. Another option is the onfocus event if I can arrange that the tag gets focused on page load. The autofocus attribute unfortunately only exists for <input> tags, so does not help here.
Another possibility to focus an element is to use . It marks an element as focus able, but requires keyboard interaction.
However, using a URI fragment causes the browser to focus the indicated element if there is one with the given id or name in the document.
Therefore, my exploit page needs to one that redirects to the search URL containing <xss onfocus=alert(document.cookie) tabindex=1 id=x as search parameter and focusing the fragment #x>
if we go to the URL and paste this xss search query payload it will trigger the alert
go to the exploit server and put this in the body and then click on store click on store
This injection creates a custom tag with the ID x, which contains an onfocus event handler that triggers the alert function. The hash at the end of the URL focuses on this element as soon as the page is loaded, causing the alert payload to be called.
deliver to victim and lab solved
