I have my javascript stored in a localstorage varibale as hackVariable defined below.
hackVariable
begin:
">document.querySelector('[onclick="Hackbutton()";]').click();<img src='notexist.png'
end:
Then I have this html doc with the goal to trigger the click button after the hackVariable has been put in alt attribute of the image tag. The issue I'm facing is that the browser interprets the " as " in the variable hackVariable.
<!DOCTYPE html>
<html>
<body>
<p>This example uses the HTML DOM to try to click a button</p>
<img src="winner.jpg" alt="hackVariable" width="100" height="100" >
<button type="button" id="Hackbutton" onclik="DoSomethingCrazy()"> Click Me!</button>
</body>
</html>
This is the result I get
<img src="winner.jpg" alt=" "><script>document.querySelector('[onclick=*"*Hackbutton()*"*;]').click();</script><img src='notexist.png' width="100" height="132" >
This is what I want to get
<img src="winner.jpg" alt=" "><script>document.querySelector('[onclick="Hackbutton()";]').click();</script><img src='notexist.png' width="100" height="100" >
My goal is to try to prevent the browser from encoding the double quote " coming from the variable into "
I tried few methods like replacing the " with &x22 or " but didn't work.