Creating HTML with intentional HTML Injection

Question

I am a cybersecurity student trying to understand some basic HTML injections. I have been working on this code for a few days and can't understand what I am doing wrong. The code that I have currently does allow for injection, for example if I put <h1>test</h1> into the textbox, it will display test as a header. But if I try <script>alert(1)</script> it won't actually run the script. I have tried setting the value of the text box to "" or with the thought that I could close out that line by inputting the following into the textbox: "><script>alert(1)</script>

I've also tried to cancel out the remainder of the code by adding a comment to the end like this: <script>alert(1)</script><!--

I've tried a number of combinations of each with no luck. Now I actually need to be able to inject a script since I'm playing around with CSP and how that affects injection of scripts into the webpage. I currently DO NOT have a csp specified that would restrict the JavaScript from running. Some other things I've tried include using different browsers, changing browser security, and ensuring that JavaScript is enabled in the browser. Any help would be greatly appreciated!!

<html>
    <script language='JavaScript'>
    function getwords(){
        textbox = document.getElementById('words');
        label = document.getElementById('label');
        label.innerHTML = textbox.value;
    }
    </script>

    <body>
        <input type="text" id="words">
        <input type="button" onclick="getwords()" id="Button" value="Enter" />
        <label id="label">
        </label>
    </body>
</html>

Possible duplicate of [Can scripts be inserted with innerHTML?](https://stackoverflow.com/questions/1197575/can-scripts-be-inserted-with-innerhtml) — Jorge Fuentes González, Sep 30 '19 at 14:43

FZs · Accepted Answer · 2019-09-30T14:57:05.543

3

That's because <script>s run at page load, and, when the label's content change, the scripts have ran already.

However, if you inject <script> tags to a different page (through the backend (XSS means Cross-Site Scripting)), it does work.

Alternatively, to make it work in a scenario, where the content injected after page load (like your case), you can use JS events (like onclick) to run your code:

<div onclick="alert(1)">Click me!</div>

Or, to execute it without user interaction, you could use an <iframe>'s onload event:

<iframe onload="alert(1)" style="display:none"></iframe>

edited Sep 30 '19 at 14:57

answered Sep 30 '19 at 14:41

FZs

16,581
13
41
50

Thank you for the response, that definitely helped. I have another question though, is there anyway to specify the source in which the javascript would be ran from? The current csp that I'm using restricts the src to self and *.google.com – xswarms Sep 30 '19 at 15:13
Like script `src`? Basically no; but you can try an AJAX request, if supports CORS, and then `eval` it – FZs Sep 30 '19 at 15:18
Alright so going back to the xss portion, if in my code I added a window to popup that maybe set something to the input of that textbox, the script would run since the new page loaded on click of the button? – xswarms Sep 30 '19 at 15:23
@xswarms '*if in my code I added a window to popup that maybe set something to the input of that textbox, the script would run since the new page loaded on click of the button?*' - Sorry, I don't understand what do you ask... – FZs Sep 30 '19 at 15:29
Essentially, I am wanting it to actually run when I put in . In reference to the portion that you said "if you inject – xswarms Sep 30 '19 at 15:31
@xswarms If the injected code is in the source code at the time of the page load, it will work, no matter what type of *page* do you have (normal page, iframe content, page opened by another page, etc.). Usually, XSS works by injecting code to a page that stored on a server, and when you visit that page, the script can be there at the page load. Similarly, if you programmatically open a new page, it also has a page load, if the script is there at that time, it will work. The key is the page load. – FZs Sep 30 '19 at 15:45
Okay thank you! That has answered my question so I can figure the code out from here! – xswarms Sep 30 '19 at 15:49
@xswarms I'm glad that it helped you – FZs Sep 30 '19 at 15:51

score 2 · Answer 2 · answered Sep 30 '19 at 14:40

2

to execute javascript from your form, you can try:

<iframe src=javascript:alert(1)>

or

<img src=x onerror=alert(1)>

Also worth noting:

script elements inserted using innerHTML do not execute when they are inserted.

answered Sep 30 '19 at 14:40

Rumplin

2,703
21
45

Could you add a source for that last quote? – padarom Sep 30 '19 at 14:46
1

https://developer.mozilla.org/en-US/docs/Web/API/Element/innerHTML – Rumplin Nov 27 '19 at 13:09

score 0 · Answer 3 · answered Sep 30 '19 at 15:09

To manually execute JavaScript, you may do the following

without editing your HTML file, add this to the Input field on your Browser.

<iframe onload="alert(1)" style="display:none"></iframe>

More information on why this works here

More on how you can perform actions like this here: developer.mozilla.org

<html>
    <script language='JavaScript'>
    function getwords(){
        textbox = document.getElementById('words');
        label = document.getElementById('label');
        label.innerHTML = textbox.value;
    }
    </script>

    <body>
        <input type="text" id="words">
        <input type="button" onclick="getwords()" id="Button" value="Enter" />
        <label id="label">
        </label>
    </body>
</html>

Creating HTML with intentional HTML Injection

3 Answers3

Linked