For a testing project I want to create a XSS vulnerable site. My basic structure is a forum where people can add forum posts via input fields and a submit button. Currently I render the new post which should be displayed via innerHTML but with this method the malicious (e.g. <script>alert("123")</script>) script which I want to insert as an attacker gets not executed. I searched for other alternatives to innerHTML but none of them worked. How can I achieve JavaScript rendering in my code?
Things I tried
appendChild();
eval();
insertAdjacentElement();
Input fields for creation new post
<form>
<label for="topic"
>Topic:
<br />
<input id="topic" required
/></label>
<br />
<br />
<label for="text"
>Text:
<br />
<input id="text" type="text" required
/></label>
<br />
<button type="submit" id="submit">submit</button>
</form>
Input example text field (localStorage is the storage from the input fields)
<div id="post">
<script>
if (localStorage.length > 0) {
post.innerHTML += localStorage.key(0);
}
</script>
</div>
Solution
This function gives me actually the desired behaviour.
<div id="post">
<script>
if (localStorage.length > 0) {
post.innerHTML += localStorage.key(0);
eval(localStorage.getItem(localStorage.key(0)));
}
</script>
</div>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Document</title>
</head>
<body>
<form>
<label for="topic"
>Topic:
<br />
<input id="topic" required
/></label>
<br />
<br />
<label for="text"
>Text:
<br />
<input id="text" type="text" required
/></label>
<br />
<button id="submit" onclick="test()">submit</button>
</form>
<div id="TESTDIV">
</div>
<script>
function test(){
if(localStorage.length >0){
item+=localStorage.setItem(document.getElementById("topic").value,document.getElementById("text").value);
}
else{
var item=localStorage.setItem(document.getElementById("topic").value,document.getElementById("text").value);
}
document.getElementById("TESTDIV").innerHTML= localStorage.getItem(document.getElementById("topic").value);
}
</script>
</body>
</html>
Hi! Hope You are well i think i will works.