the-web-application-hackers-handbook

Chapter 12 n Attacking Users: Cross-Site Scripting 455
Example 3: An Attribute Containing a URL
Suppose that the returned page contains the following:
Click here ...
Here, the string you control is being inserted into the href attribute of an
tag. In this context, and in many others in which attributes may contain URLs,
you can use the javascript: protocol to introduce script directly within the
URL attribute:
javascript:alert(1);
Because your input is being reflected within a tag attribute, you can also inject
an event handler, as already described.
For an attack that works against all current browsers, you can use an invalid
image name together with an onclick event handler:
#”onclick=”javascript:alert(1)
TIP As with other attacks, be sure to URL-encode any special characters that
have significance within the request, including & = + ; and space.
HACK STEPS
Do the following for each reflected input identified in the previous steps:
1. Review the HTML source to identify the location(s) where your unique
string is being reflected.
2. If the string appears more than once, each occurrence needs to be treated
as a separate potential vulnerability and investigated individually.
3. Determine, from the location within the HTML of the user-controllable
string, how you need to modify it to cause execution of arbitrary script.
Typically, numerous different methods will be potential vehicles for an
attack, as described later in this chapter.
4. Test your exploit by submitting it to the application. If your crafted string
is still returned unmodified, the application is vulnerable. Double-check
that your syntax is correct by using a proof-of-concept script to display an
alert dialog, and confirm that this actually appears in your browser when
the response is rendered.
Probing Defensive Filters
Very often, you will discover that the server modifies your initial attempted
exploits in some way, so they do not succeed in executing your injected script.