$myvar = "varname"; $x = $_GET['arg']; eval("\$myvar = \$x;");phpinfo()
Regular price
$0.00
Sale
<body onload="alert('test1')">or other attributes like: onmouseover, onerror. onmouseover <b onmouseover="alert('Wufff!')">click me!</b> onerror <img src="" onerror="alert(document.cookie);" data-mce-src="http://url.to.file.which/not.exist" /> XSS using Script Via Encoded URI Schemes If we need to hide against web application filters we may try to encode string characters, e.g.: a=A (UTF-8) and use it in IMG tag: <img src="jA:alert('test2')" /> There are many different UTF-8 encoding notations what give us even more possibilities. XSS using code encoding We may encode our script in base64 and place it in META tag. This way we get rid of alert() totally. More information about this method can be found in RFC 2397<meta http-equiv="refresh" content="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgndGVzdDMnKTwvc2NyaXB0Pg" />These and others examples can be found at the OWASP XSS Filter Evasion Cheat Sheet which is a true encyclopedia of the alternate XSS syntax attack. Examples Cross-site scripting attacks may occur anywhere that possibly malicious users are allowed to post unregulated material to a trusted website for the consumption of other valid users. The most common example can be found in bulletin-board websites which provide web based mailing list-style functionality. Example 1 The following JSP code segment reads an employee ID, eid, from an HTTP request and displays it to the user. <% String eid = request.getParameter("eid"); %> ... Employee ID: <%= eid %> The code in this example operates correctly if eid contains only standard alphanumeric text. If eid has a value that includes meta-characters or source code, then the code will be executed by the web browser as it displays the HTTP response. Initially, this might not appear to be much of a vulnerability. After all, why would someone enter a URL that causes malicious code to run on their own computer? The real danger is that an attacker will create the malicious URL, then use e-mail or social engineering tricks to lure victims into visiting a link to the URL. When victims click the link, they unwittingly reflect the malicious content through the vulnerable web application back to their own computers. This mechanism of exploiting vulnerable web applications is known as Reflected XSS. Example 2 The following JSP code segment queries a database for an employee with a given ID and prints the corresponding employee's name. <%... Statement stmt = conn.createStatement(); ResultSet rs = stmt.executeQuery("select * from emp where id="+eid); if (rs != null) { rs.next(); String name = rs.getString("name"); %> Employee Name: <%= name %></body>