The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

412

Chapter 12 

■

Attacking Other Users

70779c12.qxd:WileyRed  9/14/07  3:14 PM  Page 412

---

the returned page, you can inject the following 46-byte script, which evaluates

the fragment string in the current URL:

By injecting this script into the parameter that is vulnerable to reflected XSS,

you can effectively induce a DOM-based XSS vulnerability in the resulting

page and thus execute a second script located within the fragment string,

which is outside the control of the application’s filters and may be arbitrarily

long. For example:

https://wahh-app.com/error.php?message=

#alert(‘long script

here ......’)