XSS Post #2: Event Handlers & Breaking Out - Perspective Risk

XSS Post #2: Event Handlers & Breaking Out - Perspective Risk

Following on from my first blog post, hopefully you've now grasped the basics of XSS, so we can move onto some slightly more advanced areas. As mentioned in the previous post, we'll be covering event handlers today. We're also going to take a look at breaking out of HTML tags, as this is another essential part of exploiting XSS flaws and web security!

 

Event Handlers

Event handlers are special JavaScript functions that perform an action based on certain events. An obvious example is onmouseover, when you hover your cursor over the displayed text, the code accompanying it will be executed. So what will this line of code do?

<a onmouseover=alert('Boom')>Hey there</a>

That's right, when you move your cursor over the Hey there that's displayed on the page, an alert box will pop up.

From an XSS perspective, we can loosely categorize these event handlers into two types, those that require user interaction to trigger and those that don't. We will take a look at both below.

 

Example 1: Event Handlers that Require User Interaction

 

We can demonstrate this with the DOM based XSS WebGoat example described in the previous blog post. We insert the above onmouseover event handler string and when we hover our mouse over it…

 

Boom! Pop up time! As the event handler constantly listens for the corresponding event we do not need to refresh the page, like we would if using script tags. Note, we need the HTML <a> tags as they will anchor our text. Other tags will work as well, such as <p>, the paragraph.

Read full article from XSS Post #2: Event Handlers & Breaking Out - Perspective Risk