For an education hacking challenge I need to implement javascript in my style attribute.
How can I do this?
<a id="bb" style ="javascript"> alert('test') </a>
Asked
Active
Viewed 62 times
-3
Davin Tryon
- 64,963
- 15
- 144
- 131
-
How do you mean? What have you tried? – Jacques Marais Nov 24 '15 at 12:11
-
not clear: do you need to highlight the javascript code (if so then look on google for _syntax highlighter_) or do you need to create a styled alert? – Fabrizio Calderan Nov 24 '15 at 12:12
-
Can you give more information? – roottraveller Nov 24 '15 at 12:12
-
3https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.234_-_CSS_Escape_And_Strictly_Validate_Before_Inserting_Untrusted_Data_into_HTML_Style_Property_Values provides a full list of XSS vulnerabilities and how they are implemented – CodingIntrigue Nov 24 '15 at 12:13
-
He wants to execute Javascript through the `style` attribute, apparently... – Matheus208 Nov 24 '15 at 12:14
-
1maybe something like this? http://stackoverflow.com/questions/476276/using-javascript-in-css – melli-182 Nov 24 '15 at 12:14
-
@Matheus208 Exactly. I'm almost through a hack and my lector told me I should use the 'style' tag to perform the attack – Don'tStopMeNow Nov 24 '15 at 12:15
-
As far as I know, most, if not all of the vulnerabilities your instructor is thinking of were plugged. It's not possible to execute JavaScript from a style selector anymore (as far as I know). – Madara's Ghost Nov 24 '15 at 12:18
-
Take a look at @RGraham 's answer. I could not replicate the behaviour from there, but you might have a better idea on what to look into (or it might have been fixed on modern browsers). Can you use any browser? Try older version of IE, it used to be the less secure – Matheus208 Nov 24 '15 at 12:18
-
I'm looking to bypass the regex Is there any chance I could do that ? – Don'tStopMeNow Nov 24 '15 at 13:36
1 Answers
0
I think you will have to learn how is render html code and the style attribute. And then find a way to execute your own javascript code.
http://taligarsiel.com/Projects/howbrowserswork1.htm#Rendering_engines
Gauthier
- 984
- 2
- 13
- 35