html5 xss,HTML5 new XSS vectors

最新推荐文章于 2023-12-12 14:21:36 发布

转载最新推荐文章于 2023-12-12 14:21:36 发布 · 120 阅读

文章标签：

#html5 xss

本文介绍了一种利用HTML5特性实现跨站脚本(XSS)自动执行的新方法。该方法通过autofocus和onfocus属性绕过<和>过滤，适用于多种浏览器，包括Safari、Chrome和Opera。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

So I posted some new XSS vectors on twitter and I thought I’d share them on the blog in case anyone missed them. Safari, Chrome and Opera all support these now 🙂 We have a brand new way of auto executing XSS.

Normally when you find a XSS hole within a input element that has filtered < and > you can’t exploit it automatically without using CSS expressions. The injection looks something like:-

Here you can do style=xss:expression(alert(1)) or moz-binding etc. but it only works on a limited number of browsers. HTML5 however lets us execute like expressions but without css styles. For example:-

We use the “autofocus” feature to focus our element and then the onfocus event to execute our XSS. This works with a plethora (I like that word) of tags. Any form based element it seems you can use this method:-