Another XSS auditor bypass

This bug is similar to the last one I posted but executes in a different context. It requires an existing script after the injection because we use it to close the injected script. It’s a shame chrome doesn’t support self closing scripts in HTML or within a SVG element because I’m pretty sure I could bypass it without using an existing script. Anyway the injection uses a data url with a script. In order to bypass the filter we need to concat the string with the quote from the attribute or use html entities such as //. The HTML parser doesn’t care how much junk is between the opening and closing script since we are using a src attribute.

PoC
PoC2

Print Share Comment Cite Upload Translate

APA

() » Another XSS auditor bypass. Retrieved from https://www.truth.cx/2015/02/19/another-xss-auditor-bypass/.

MLA

" » Another XSS auditor bypass." - , https://www.truth.cx/2015/02/19/another-xss-auditor-bypass/

HARVARD

» Another XSS auditor bypass., viewed ,

VANCOUVER

- » Another XSS auditor bypass. [Internet]. [Accessed ]. Available from: https://www.truth.cx/2015/02/19/another-xss-auditor-bypass/

CHICAGO

" » Another XSS auditor bypass." - Accessed . https://www.truth.cx/2015/02/19/another-xss-auditor-bypass/

IEEE

" » Another XSS auditor bypass." [Online]. Available: https://www.truth.cx/2015/02/19/another-xss-auditor-bypass/. [Accessed: ]

Select a language: Afrikaans Albanian Arabic Armenian Basque Bengali Bulgarian Catalan Cambodian Chinese (Mandarin) Croatian Czech Danish Dutch English Estonian Fiji Finnish French Georgian German Greek Gujarati Hebrew Hindi Hungarian Icelandic Indonesian Irish Italian Japanese Javanese Korean Latin Latvian Lithuanian Macedonian Malay Malayalam Maltese Maori Marathi Mongolian Nepali Norwegian Persian Polish Portuguese Punjabi Quechua Romanian Russian Samoan Serbian Slovak Slovenian Spanish Swahili Swedish Tamil Tatar Telugu Thai Tibetan Tonga Turkish Ukrainian Urdu Uzbek Vietnamese Welsh Xhosa <p>This bug is similar to the last one I posted but executes in a different context. It requires an existing script after the injection because we use it to close the injected script. It’s a shame chrome doesn’t support self closing scripts in HTML or within a SVG element because I’m pretty sure I could bypass it without using an existing script. Anyway the injection uses a data url with a script. In order to bypass the filter we need to concat the string with the quote from the attribute or use html entities such as <code>&sol;&sol;</code>. The HTML parser doesn’t care how much junk is between the opening and closing script since we are using a src attribute. </p> <p><a href="http://challenge.hackvertor.co.uk/script3.php?x=%22%3E%3Cscript/src=data:,alert(1)%2B%22">PoC</a><br /> <a href="http://challenge.hackvertor.co.uk/script3.php?x=%22%3E%3Cscript/src=data:,alert(1)%26sol;%26sol;">PoC2</a></p> First name:

Last name: