javascript - Creation of XSS vulnerable web page -
i want create xss vulnerable web page execute script entered in input box. here have written code whenever enter script nothing happens.
<html> <head> </head> <body> <script type="text/javascript"> function changethis(){ var forminput = document.getelementbyid('theinput').value; document.getelementbyid('newtext').innerhtml = forminput; localstorage.setitem("name","hello world!!!"); } </script> <p>you wrote: <span id='newtext'></span> </p> <input type='text' id='theinput' value='write here' /> <input type='button' onclick='changethis()' value='see wrote'/> </body> </html> please help. how should modify code?
update: trying reflected xss. according me if enter script in input should execute. happen when not checking user has entered valid input or not , taking actions not execute script.
here web page www.insecurelabs.org/task/rule1 xss vulnerable when ever type script like: <script> alert("hell"); </script> in input field script executes.
want know main difference between , doing?
if use innerhtml inject script tag... script won't run!
what instead inject image onload event handler:
<img src="someimage.gif" onload="alert('hacked!')" /> [update] last question: main difference using innerhtml, while insecurelabs page using jquery.html(). jquery approach run script.
live demo: http://jsfiddle.net/wqqwt/
Comments
Post a Comment