Friday, December 02, 2011

Double eval() for DOM based XSS


DOM based XSS are becoming relatively common with Web 2.0 and Ajax driven applications. DOM based applications are using eval() method to inject new stream into the existing DOM. In certain cases it is becoming tricky to pass on the values for pen-testing and to create an abuse/exploit scenario. Recently during consulting we came across different DOM based XSS and objective is to get a pop-up to confirm the vulnerability. If we get an eval call then it is possible to double eval-ing to convert text back into payload.

Here is a simple scenario; it can be complicated on case to case basis.
For example, we have following line in the code

eval('getProduct('+ koko.toString()+')');

Here “koko” is coming from URL or controlled by user. Hence, if we pass on the value in following URL it gets to the “getProduct” function.

Testing scenario is simple, it causes DOM based XSS with following condition.

We are passing payload terminating function, ending statement and commenting out rest of the script. We get a simple pop-up if we pass on following code.

But to prove a point if we want to craft any other payload where we need to send single quote, for example want to execute “document.getElementsByName('Login')” will not work since we have that single quote that will raise syntax error. For simplicity if we pass on alert(‘hi’), it will not work and we will not get popup in above scenario.

We get following error in the browser.

Error: syntax error
Source File: http://192.168.3.2/catalog.aspx?pid=3%27);elval(alert(%27hi%27));//
Line: 37, Column: 29
Source Code:
getProduct(3%27);elval(alert(%27hi%27));//)

Interestingly, we can leverage double eval() in this case, we pass on following payload and let’s see what happens…

It will avoid error and we will get a pop-up. What we did was simple, we used fromCharCode function and passed on decimal values for alert(‘hi’) here, first eval will convert it into string and second eval will execute the code. Hence, double eval can rescue while testing DOM based XSS.

Curiously I searched this trick on web if people are using it and came across this article - http://blogs.msdn.com/b/infopath/archive/2006/04/05/569338.aspx
Double eval() can be leveraged for string operations and concatenation.

86 comments:

Jeremy said...

Wouldn't escaping the single tick work too? As in:

http://192.168.3.2/catalog.aspx?pid=3);alert(\'test\');//

shreeraj said...

Nop. It will not work - going through URL browser will not process. It may work through POST params.

Error: illegal character
Source File: http://192.168.3.2/catalog.aspx?pid=2%27);alert(\%27hi\%27)//
Line: 37, Column: 23
Source Code:
getProduct(2%27);alert(\%27hi\%27)//)

Unknown said...

This is most informative and also this post most user friendly and super navigation to all posts... Thank you so much for giving this information to me.. 

automation anywhere training in chennai

automation anywhere training in bangalore

automation anywhere training in pune

automation anywhere online training

blueprism online training

rpa Training in sholinganallur

rpa Training in annanagar

iot-training-in-chennai

blueprism-training-in-pune

automation-anywhere-training-in-pune

sathyaramesh said...

I am really enjoyed a lot when reading your well-written posts. It shows like you spend more effort and time to write this blog. I have saved it for my future reference. Keep it up the good work.
RPA Training in Chennai
RPA Training Institute in Chennai
Robotic Process Automation Training
Robotics courses in bangalore
RPA classes in bangalore

jefrin said...

Really good to read this post
IOT training institute in chennai

suresh said...

Excellent Article. Thanks Admin


DevOps Training in Chennai

Cloud Computing Training in Chennai

IT Software Training in Chennai

suresh said...

Excellent Article. Thanks Admin
Data Science Training in Chennai

DevOps Training in Chennai

Hadoop Big Data Training

Python Training in Chennai

jefrin said...

Great blog very good to read
best matlab training in chennai

VRITPROFESSIONALS said...

Nice post. Thanks for sharing! I want people to know just how good this information is in your article. It’s interesting content and Great work.
Thanks & Regards,
VRIT Professionals,
No.1 Leading Web Designing Training Institute In Chennai.

And also those who are looking for
Web Designing Training Institute in Chennai
SEO Training Institute in Chennai
Photoshop Training Institute in Chennai
PHP & Mysql Training Institute in Chennai
Android Training Institute in Chennai

Sadhana Rathore said...

Your site is amazing and your blogs are informative. I have bookmarked this blog for my reference.
Automation Anywhere Training in Chennai
Automation Training Institute in Chennai
Automation Anywhere course in Chennai
RPA Training Institute in Chennai
RPA Training in Chennai
RPA Training in Velachery
Blue Prism Training Institute in Chennai
Blue Prism Training in Chennai
RPA course in Chennai

ProPlus Logics said...

Hey Nice Blog!! Thanks For Sharing!!!Wonderful blog & good post.Its really helpful for me, waiting for a more new post. Keep Blogging!
SEO company in coimbatore
SEO company
web design company in coimbatore

Vicky Ram said...

Nice post. I learned some new information. Thanks for sharing.

Guest posting sites
Education

Sivanandhana Girish said...

Thanks for your efforts in sharing this post with us. This was really awesome. kindly keep continuing the great work.
Spoken English Classes in Chennai
IELTS Coaching in Chennai
English Speaking Classes in Mumbai
IELTS Classes in Mumbai
IELTS Coaching in Mumbai
IELTS Mumbai
Best IELTS Coaching in Mumbai
IELTS Center in Mumbai

Kapil Sharma said...

I am outstandingly glad to see this post. It is interesting and edifying. Such a lovely post, I am appreciative and I like this post. Moreover, I should need to share one thing which is a foundation for learning python, which is the most mentioning now every day. For that, you can join at this association

Pythan Training in Greater Noida
Pythan coaching in Greater Noida
Pythan institute in Greater Noida
Pythan classes in Greater Noida


Vivek said...

Thangs for shareing this Blog I am very happy to see this such a valuable

information, you are doing good job keep continue on Blogging job here you can do

C++ Training in Greater Noida at Mirorsoft Technologies It can be used for low-

level programming, such as writing scripts for drivers and kernels, and also

supports high-level programming language functions, such as writing scripts for

software applications, etc.
C++ Language Training In Greater Noida
C++ Language Training Institute In Greater Noida
C++ Language Course In Greater Noida
C++ Language Classes In Greater Noida

Vivek said...

Thangs for shareing this Blog I am very happy to see this such a valuable

information, you are doing good job keep continue on Blogging job here you can do

C++ Training in Greater Noida at Mirorsoft Technologies It can be used for low-

level programming, such as writing scripts for drivers and kernels, and also

supports high-level programming language functions, such as writing scripts for

software applications, etc.
C++ Language Training In Greater Noida
C++ Language Training Institute In Greater Noida
C++ Language Course In Greater Noida
C++ Language Classes In Greater Noida

htop said...

thank you so much for sharing this useful message to us
best java training in chennai
best python training in chennai
selenium training in chennai
selenium training in omr
selenium training in sholinganallur

priyanka usha said...

This is really a great information about this technology.
IoT Training in Chennai
Internet of Things Training in Chennai
TOEFL Training in Chennai
french courses in chennai
Best Spoken English Class in Chennai
IELTS Training in Chennai
IoT Training in Velachery
German classes in anna nagar
spoken english class anna nagar

gaurav kashyap said...

This is a decent post. This post gives genuinely quality data. I'm certainly going to investigate it. Actually quite valuable tips are given here. Much obliged to you to such an extent. Keep doing awesome. To know more information about
Contact us :- https://www.login4ites.com/

gaurav kashyap said...

It is brilliant substance. I for the most part visit numerous locales however your site has something unique highlights. I for the most part visit on your site. Best Seo Tips
Contact us- https://myseokhazana.com

luckys said...

english to hindi typing   

Venkatesh CS said...

Very useful tutorials and very easy to understand. Thank you so much for sharing.
hadoop interview questions
Hadoop interview questions for experienced
Hadoop interview questions for freshers
top 100 hadoop interview questions
frequently asked hadoop interview questions
hadoop interview questions and answers for freshers
hadoop interview questions and answers pdf
hadoop interview questions and answers
hadoop interview questions and answers for experienced
hadoop interview questions and answers for testers
hadoop interview questions and answers pdf download
hadoop interview questions pdf

Aparna said...

Its such a wonderful article. The above article is very helpful to study the technology and I gain my knowledge. Thanks for that and Keep posting.
Embedded System Course Chennai
Embedded Systems Course
Unix Training in Chennai
Power BI Training in Chennai
Tableau Training in Chennai
Oracle Training in Chennai
Advanced Excel Training in Chennai
job Openings in chennai
Embedded Training in OMR
Embedded Training in Adyar

Data anlytic said...

It’s been an incredible Journey with UNIMAS for the last few years and we are proud that we are recognized as their
Data Science Training training delivery partner.
ExcelR successfully handled many batches in this university.
With our quality delivery and top notch brand reputation, UNIMAS accredited our training program and recognized ExcelR as an official partner to deliver various certification
programs through their university. Avail globally recognized certification from UNIMAS by completing Data Analytics course in ExcelR.



Data Science Training

keywords:data science training,data science course

Ramesh Gude said...

Nice blog.
Best institute for data scientist course institute in Bangalore

Venkatesh CS said...

Thanks for sharing valuable information.
Digital Marketing training Course in chennai
digital marketing training institute in chennai
digital marketing training in Chennai
digital marketing course in Chennai
digital marketing course training in omr
digital marketing certification in omr
digital marketing course training in velachery
digital marketing training center in chennai
digital marketing courses with placement in chennai
digital marketing certification in chennai
digital marketing institute in Chennai
digital marketing certification course in Chennai
digital marketing course training in Chennai
Digital Marketing course in Chennai with placement
digital marketing courses in chennai

shivam said...


Top engineering colleges in India

technical news

digital marketing course in bhopal

what is microwave engineering
how to crack filmora 9
what is pn junction

Prwatech said...

Thanks for sharing.It is good to see the greatest details presented in an easy and understandable manner.Keep posting more.
best institutes for big data training in Bangalore

Myclasstraining said...

well said about Static Access to Context outside of an Activity orAutomation Anywhere Training .Automation Anywhere Training in Bangalore

TestLeaf Software Training said...

Nice infromation
Selenium Training In Chennai
Selenium course in chennai
Selenium Training
Selenium Training institute In Chennai
Best Selenium Training in chennai
Selenium Training In Chennai

TestLeaf Software Training said...

Rpa Training in Chennai
Rpa Course in Chennai
Rpa training institute in Chennai
Best Rpa Course in Chennai
uipath Training in Chennai
Blue prism training in Chennai

Data Science Training In Chennai
Data Science Course In Chennai
Data Science Training institute In Chennai
Best Data Science Training In Chennai

TestLeaf Software Training said...

Python Training In Chennai
Python course In Chennai
Protractor Training in Chennai
jmeter training in chennai
Loadrunner training in chennai

datasciencecourse said...

data science course bangalore is the best data science course

ammu said...

excellent blogs.....!!!
chile web hosting
colombia web hosting
croatia web hosting
cyprus web hosting
bahrain web hosting
india web hosting
iran web hosting
kazakhstan web hosting
korea web hosting
moldova web hosting

kani said...

slovakia web hosting
timor lestes hosting
egypt hosting
egypt web hosting
ghana hosting
iceland hosting
italy shared web hosting
jamaica web hosting
kenya hosting
kuwait web hosting

Rashika said...

Good article! I found some useful educational information in your blog about Automation Anywhere, it was awesome to read, thanks for sharing this great content to my vision.
Java training in chennai | Java training in annanagar | Java training in omr | Java training in porur | Java training in tambaram | Java training in velachery

pratheep said...

Thanks Admin For sharing this massive info with us. it seems you have put more effort to write this blog , I gained more knowledge from your blog. Keep Doing..

Robotic Process Automation (RPA) Training in Chennai | Robotic Process Automation (RPA) Training in anna nagar | Robotic Process Automation (RPA) Training in omr | Robotic Process Automation (RPA) Training in porur | Robotic Process Automation (RPA) Training in tambaram | Robotic Process Automation (RPA) Training in velachery

Ziarulunirea.ro said...

Very interesting blog. Many blogs I see these days do not really provide anything that attracts others, but believe me the way you interact is literally awesome.You can also check my articles as well.

Data Science In Banglore With Placements
Data Science Course In Bangalore
Data Science Training In Bangalore
Best Data Science Courses In Bangalore
Data Science Institute In Bangalore

Thank you..

Saqib Mirza said...

Top 2020 Digital Marketing agency in North Carolina Are offering web design and development services in low prices our prices are 10 times lower than the other USA companies our main priority is our client

Millionmakerscare said...

Hey Nice Blog!!
Thanks For Sharing!!! Nice blog & Wonderfull post. Its really helpful for me, waiting for a more new post. Keep on posting!


web development company
software development company
app development company

IT Technology Updates said...

Nice Blog..Thanks for sharing..

dot net training in chennai
microstrategy training in chennai
ab initio training in chennai

harshni said...

wonderful article. Very interesting to read this article.I would like to thank you for the efforts you had made for writing this awesome article. This article resolved my all queries. keep it up.
Artificial Intelligence Training in Chennai | Certification | ai training in chennai | Artificial Intelligence Course in Bangalore | Certification | ai training in bangalore | Artificial Intelligence Training in Hyderabad | Certification | ai training in hyderabad | Artificial Intelligence Online Training Course | Certification | ai Online Training | Blue Prism Training in Chennai | Certification | Blue Prism Online Training Course

Damien Grant said...

http://digitalweekday.com/
【回上頁】
【回上頁】
http://digitalweekday.com/
http://digitalweekday.com/
http://digitalweekday.com/
http://digitalweekday.com/
http://digitalweekday.com/

Damien Grant said...

http://digitalweekday.com/
http://digitalweekday.com/
http://digitalweekday.com/

radhika said...

This is excellent information. It is amazing and wonderful to visit your site.Thanks for sharing this information,this is useful to me...

AWS training in Chennai

AWS Online Training in Chennai

AWS training in Bangalore

AWS training in Hyderabad

AWS training in Coimbatore

AWS training

Data Science Institute In Banglore said...

This type of very helpful article. Very interesting to see this article.
Data Science Training Institute in Bangalore

Best Data Science Courses In Bangalore said...

Very wonderful article. I liked reading your article. Very wonderful share. Thanks ! .
Best Data Science Courses In Bangalore

nirjonniyaz said...

토토사이트검증 토토 먹튀 검증 저희 먹튀커머스 는 2016년 5월 부터 지금까지 먹튀커머스 를 믿고 방문 해주시는 유저 분들을 위해 더이상 먹튀 없는 공정한 배팅 문화 를 만들기 위해서 항상 노력하고 유저분들에 소리에 귀를 기울리는 NO.1 먹튀검증 커뮤니티 입니다. 또한 먹튀커머스 에서는 무분별한 배팅사이트 들을 일방적으로 추천 하지 않고 철저한 검수 작업을 토대로 사전에 먹튀 사고가 발생 안되게끔 유저 분들 에게 추천하는 만큼 저희측에 등록 되어 있는 배팅사이트 내에서 혹여 먹튀가 발생 한다면 오로지 그책임은 저희 먹튀커머스 에 있음을 알려 드립니다. / 먹튀 검증

Pankaj Singh said...

Thank you so much for sharing your brilliant thoughts with us. Visit Ogen Infosystem for professional Web Designing and SEO Services in Delhi, India.
Website Designing Company in Delhi

Unknown said...

visit here
iso certification in delhi
iso certification in noida
iso certification in gurgaon
iso certification in faridabad

Unknown said...

visit
Freight Forwarder in Vietnam
Shipping Company In India

Unknown said...

Thanks for sharing this amazing blog.

Bis Consultant in delhi

Tableau Training in Hyderabad said...


Nice article and thanks for sharing with us. Its very informative


AI Training in Hyderabad

Srigokul said...


Useful information, Thank you for sharing...

Data science training in chennai
Data science course in chennai

Devi said...

Did you want to set your career towards Amazon Web Services? Then Infycle is with you to make this into your life. Infycle Technologies gives the combined and best Big AWS Training in Chennai, along with the 100% hands-on training guided by professional teachers in the field. In addition to this, the interviews for the placement will be guided to the candidates, so that, they can face the interviews without struggles. Apart from all, the candidates will be placed in the top MNC's with a great salary package. To get it all, call 7502633633 and make this happen for your happy life.Best AWS Training in Chennai

Deekshitha said...

Informative blog
data scientist course in Bangalore

Pallavi reddy said...

i am glad to discover this page : i have to thank you for the time i spent on this especially great reading !! i really liked each part and also bookmarked you for new information on your site.
data science courses in hyderabad

Datascience Books said...

Excellent Blog! I would like to thank for the efforts you have made in writing this post. I am hoping the same best work from you in the future as well. I wanted to thank you for this websites! Thanks for sharing. Great websites!
Data Science Training in Bangalore

data analytics books said...

I am a new user of this site, so here I saw several articles and posts published on this site, I am more interested in some of them, hope you will provide more information on these topics in your next articles.
data analytics training in bangalore

InstituteBlr said...

I just got to this amazing site not long ago. I was actually captured with the piece of resources you have got here. Big thumbs up for making such wonderful blog page!
data analytics course in bangalore

aisa337 said...

I’m still learning from you, while I’m improving myself. I certainly enjoy reading everything that is written on your website.Keep the posts coming. I loved it!
먹튀검증

Datascience Course Analyst said...

Great post i must say and thanks for the information. Education is definitely a sticky subject. However, is still among the leading topics of our time. I appreciate your post and look forward to more.
Data Science Course in Bangalore

Village Talkies said...

Thanks for sharing
Village Talkies a top-quality professional corporate video production company in Bangalore and also best explainer video company in Bangalore & animation video makers in Bangalore, Chennai, India & Maryland, Baltimore, USA provides Corporate & Brand films, Promotional, Marketing videos & Training videos, Product demo videos, Employee videos, Product video explainers, eLearning videos, 2d Animation, 3d Animation, Motion Graphics, Whiteboard Explainer videos Client Testimonial Videos, Video Presentation and more for all start-ups, industries, and corporate companies. From scripting to corporate video production services, explainer & 3d, 2d animation video production , our solutions are customized to your budget, timeline, and to meet the company goals and objectives.
As a best video production company in Bangalore, we produce quality and creative videos to our clients.

Business Analytics Course said...

It's good to visit your blog again, it's been months for me. Well, this article that I have been waiting for so long. I will need this post to complete my college homework, and it has the exact same topic with your article. Thanks, have a good game.
Business Analytics Course

Best Data Science Courses in Bangalore said...

I wanted to leave a little comment to support you and wish you the best of luck. We wish you the best of luck in all of your blogging endeavors.
Best Data Science Courses in Bangalore

Data Analytics Course in Bangalore said...

I found Habit to be a transparent site, a social hub that is a conglomerate of buyers and sellers willing to offer digital advice online at a decent cost.
Data Analytics Course in Bangalore

Digital Marketing Course in Bangalore said...

It is always so interesting to visit your site. What a great information, thanks for sharing. it will help me a lot in my learning.
Digital Marketing Course in Bangalore

Solitairian City Reviews and Complaints said...

Your Content is amazing and I am glad to read them. Thanks for sharing the Blog.this blog is very helpful information for every one.

Solitairian city Review

Solitairian city Complaints

Diyalabs said...

Thanks for sharing such a helpful, and understandable blog. I really enjoyed reading it.

Robots for kids
Robotic Online Classes
Robotics School Projects
Programming Courses Malaysia
Coding courses
Coding Academy
coding robots for kids
Coding classes for kids
Coding For Kids

Bhuvana said...

The Extraordinary blog went amazed by the content that they have developed in a very descriptive manner. This type of content surely ensures the participants explore themselves.

Data Science Training in Hyderabad

Data Science Training in Hyderabad said...

Good work, unique site and interesting too… keep it up…looking forward for more updates. Good luck to all of you and thanks so much for your hard-work…

Data Science Training in Hyderabad

Kavya said...

Much obliged for Sharing This Article. It is exceptionally such a lot of significant substance. I trust these Commenting records will serve to my site…

DevOps Training in Hyderabad

cloud computing course in bangalore said...

Extremely overall quite fascinating post. I was searching for this sort of data and delighted in perusing this one. Continue posting. A debt of gratitude is in order for sharing. data scientist course in delhi

data science said...

I was just examining through the web looking for certain information and ran over your blog.It shows how well you understand this subject. Bookmarked this page, will return for extra. data science course in vadodara

Business Analytics Course said...

I'm looking for and I like to post a comment that says "The content of your post is amazing" Great job!

Business Analytics Course

Best Data Science Courses said...

Very good message. I came across your blog and wanted to tell you that I really enjoyed reading your articles.
Best Data Science Courses in Bangalore

Data Analytics Course said...

Very good message. I came across your blog and wanted to tell you that I really enjoyed reading your articles.
Data Analytics Course in Bangalore

Digital Marketing Course said...

Very good message. I came across your blog and wanted to tell you that I really enjoyed reading your articles.
Digital Marketing Course in Bangalore

Brilliant Minds said...

Thanks For Write such a good content i am so amazed when i read this Article and also waitng for your next blog.if your are Searching For Staffing and Recruitment Agency in Qatar or Part time staffing Agency in Qatar .Our Manpower agency provides temporary and part time staff to our clients for both short and long term for Hotels, events and more.Best Manpower staffing solutions company.

Deekshitha said...

Informative blog
best digital marketing institute in hyderabad

Deekshitha said...

Informative blog
ai training in hyderabad

trainingcourses said...

Really nice and interesting post. I was looking for this kind of information and enjoyed reading this one.
data scientist course in malaysia

Educational Courses in Bangalore said...

I am a new user of this site, so here I saw several articles and posts published on this site, I am more interested in some of them, will provide more information on these topics in future articles.

Best Cyber Security Training Institute in Bangalore

TOTOcoin said...

I'm writing on this topic these days, 메이저사이트, but I have stopped writing because there is no reference material. Then I accidentally found your article. I can refer to a variety of materials, so I think the work I was preparing will work! Thank you for your efforts.


Tamil novels said...

Excellent article. Thanks for sharing.
Tamil novel writers
Ramanichandran novels PDF
srikala novels PDF
Mallika manivannan novels PDF
muthulakshmi raghavan novels PDF
Infaa Alocious Novels PDF
N Seethalakshmi Novels PDF
Sashi Murali Tamil Novels PDF Download

Professional Courses in Bangalore said...

It's like you've got the point right, but forgot to include your readers. Maybe you should think about it from different angles.

Data Analytics Bangalore